Is the XKeyScore Code Released in Germany Faked?

Expert analysis uncovers serious misrepresentations and possible fakery

Following up on our post about the wildly exaggerated claims made about the purported XKeyScore source code released in Germany this week by hacker Jacob Applebaum, here’s a very interesting post by cybersecurity expert Robert Graham with evidence that the code may have been at least partly faked: Errata Security: Validating XKeyScore Code.

The burning questions about the XKeyScore “source code” is whether it’s real, and whether it come from Snowden. The Grugq (@thegrugq) has some smart insight into this, and I have my own expertise with deep-packet-inspection code. I thought I’d write up our expert analysis to the questions.

TL;DR: we believe the code partly fake and that it came from the Snowden treasure trove.

A slightly longer summary is:

  1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.
  2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is "fake".
  3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.
  4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code - if fake, it's not completely so.

Here’s a point that jumped out at me immediately upon looking at the code: all over the Internet, people are claiming that the code identifies linuxjournal.com as an “exremist forum” — but that’s simply false. As I tweeted two days ago:

Graham’s post agrees with this evaluation:

Another misrepresentation in the story is that the source calls the Linux Journal an extremist forum. That’s not true.

A comment does say that TAILS is “a comsec mechanism advocated by extremists on extremist forums”. This is true, as the picture (from the Grugq) demonstrates on the right: it’s a picture from an ISIS/jihad forum advocating the use of TAILS. But nowhere does it claim that the Linux Journal is one of those extremists — that’s something willfully made up by the authors of the story.

That the story already misrepresents the meaning of this source code hints that it may already be misrepresenting the provenance.

Exactly. Something smells very fishy here. Read the whole thing. And for those interested in the highly technical details, here’s Graham’s post going through the code line by line.

Jump to top

Create a PageThis is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.
Or... you can just click this button to open the Pages posting window right away.
Last updated: 2016-01-01 10:29 am PST
LGF User's Guide RSS Feeds Tweet

Help support Little Green Footballs!

Subscribe now for ad-free access!Register and sign in to a free LGF account before subscribing, and your ad-free access will be automatically enabled.

Recent PagesClick to refresh
Cloudfare Leak: Here Are the Passwords You Should Change Immediately If you have or had accounts on Fitbit, Uber, OkCupid, Medium, or Yelp, you should probably change your passwords. In a blog post published on Thursday, the web performance and security company Cloudflare said it had fixed a critical ...
Tarkloon
1 hour, 47 minutes ago
Views: 75 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
2013 SALON: Even Nixon Knew That Birth Control Reduces Spending For more than 40 years, Title X has provided family planning and reproductive health services to millions of American women. More recently, conservative lawmakers have targeted Title X as part of their obsession with shrinking the social safety net ...
Birth Control Works
22 hours, 3 minutes ago
Views: 141 • Comments: 0 • Rating: 1
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
HISTORY: Richard Nixon: Special Message to the Congress on Problems of Population Growth. In 1917 the total number of Americans passed 100 million, after three full centuries of steady growth. In 1967--just half a century later--the 200 million mark was passed. If the present rate of growth continues, the third hundred million ...
Birth Control Works
22 hours, 5 minutes ago
Views: 127 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 1
Comments: 0
: 1
The Ears Have It The site’s editorial thrust reflects Bannon’s nationalist, immigration-restrictionist beliefs and trumpets Breitbart’s continuing grievance and outrage against those who trespass against its worldview. The homepage focuses on a handful of thematic categories: praise for President Trump; attacks on his ...
Tarkloon
22 hours, 27 minutes ago
Views: 134 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
Watch Ashton Kutcher’s Incredibly Emotional Senate Speech on Child Trafficking Kutcher continued by telling the story of a 15-year-old girl in Oklahoma who was tricked into being trafficked by a man she had met on the internet. She was returned to her family within three days thanks to the ...
Birth Control Works
23 hours, 31 minutes ago
Views: 129 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
Texas Anti-Campus Rape Laws Could Be the Strictest Nationwide On the heels of new revelations in the sexual assault scandal at Baylor University, Texas could become an unlikely leader in campus anti-rape legislation. State Senator Kirk Watson, a Democrat, filed five bills this morning that would press schools ...
Birth Control Works
23 hours, 48 minutes ago
Views: 139 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Kellyanne Conway Says Feminism Is “Anti-Male” and “Pro-Abortion” in CPAC Talk "I was raised to be a very strong and independent woman without anyone ever saying the word feminist or having a political conversation," she said. "Hillary Clinton should be applauded for her willingness to serve publicly, but I thought ...
Birth Control Works
1 day ago
Views: 310 • Comments: 0 • Rating: 0
Tweets: 11 • Share to Facebook
Shares: 3
Comments: 0
: 3
11 Kids Books About Immigration and the Refugee Crisis - How to Talk to Your About Immigration and Refugees Like so many of us, my American story is an immigrant one. My dad, came to this country eager to try his luck; my mom came as a brand new bride, unsure of a new land where she neither ...
Birth Control Works
1 day ago
Views: 289 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Why Women Aren’t Entering the Workforce Like They Were in the ’90s President Trump has said repeatedly that jobs are one of his top priorities. He's promised to add 25 million jobs over eight years (assuming he earns reelection) and his newly-minted Treasury Secretary, Steven Mnuchin, has promised our economy will ...
Birth Control Works
1 day ago
Views: 542 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Judge Blocks Medicaid Cuts to Planned Parenthood in Texas But the judge wrote in his ruling on Tuesday: “A secretly recorded video, fake names, a grand jury indictment, congressional investigations — these are the building blocks of a best-selling novel rather than a case concerning the interplay of ...
Birth Control Works
1 day ago
Views: 573 • Comments: 0 • Rating: 0
Tweets: 25 • Share to Facebook
Shares: 2
Comments: 0
: 2