TwitterFacebook

Is the XKeyScore Code Released in Germany Faked?

Expert analysis uncovers serious misrepresentations and possible fakery
Technology • Views: 26,724

Following up on our post about the wildly exaggerated claims made about the purported XKeyScore source code released in Germany this week by hacker Jacob Applebaum, here’s a very interesting post by cybersecurity expert Robert Graham with evidence that the code may have been at least partly faked: Errata Security: Validating XKeyScore Code.

The burning questions about the XKeyScore “source code” is whether it’s real, and whether it come from Snowden. The Grugq (@thegrugq) has some smart insight into this, and I have my own expertise with deep-packet-inspection code. I thought I’d write up our expert analysis to the questions.

TL;DR: we believe the code partly fake and that it came from the Snowden treasure trove.

A slightly longer summary is:

  1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.
  2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is "fake".
  3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.
  4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code - if fake, it's not completely so.

Here’s a point that jumped out at me immediately upon looking at the code: all over the Internet, people are claiming that the code identifies linuxjournal.com as an “exremist forum” — but that’s simply false. As I tweeted two days ago:

Graham’s post agrees with this evaluation:

Another misrepresentation in the story is that the source calls the Linux Journal an extremist forum. That’s not true.

A comment does say that TAILS is “a comsec mechanism advocated by extremists on extremist forums”. This is true, as the picture (from the Grugq) demonstrates on the right: it’s a picture from an ISIS/jihad forum advocating the use of TAILS. But nowhere does it claim that the Linux Journal is one of those extremists — that’s something willfully made up by the authors of the story.

That the story already misrepresents the meaning of this source code hints that it may already be misrepresenting the provenance.

Exactly. Something smells very fishy here. Read the whole thing. And for those interested in the highly technical details, here’s Graham’s post going through the code line by line.

^ back to top ^

TwitterFacebook

Turn off all ads for a full year by subscribing!
Take advantage of our yearly subscription, and save 50% off the normal subscription price! One-year ad-free subscriptions are just $59.95. Turn off all ads for a full year by subscribing now and save!
Read more...

► LGF Headlines

  • Loading...

► Tweeted Articles

  • Loading...

► Tweeted Pages

  • Loading...

► Top 10 Comments

  • Loading...

► Bottom Comments

  • Loading...

► Recent Comments

  • Loading...

► Tools/Info

► Tag Cloud

► Contact

You must have Javascript enabled to use the contact form.
Your email:

Subject:

Message:


Messages may be published unless you request otherwise.
Tech Note:
Using the Contact Form
LGF Pages

This button leads to the main index of LGF Pages, our user-submitted articles. You can post your own LGF Pages simply by registering a free account with us.

Create a Page

This is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.

Or... you can just click this button to open the Pages posting window right away.

Last updated: 2015-04-18 5:26 pm PDT

LGF User's Guide
Recent Pages
Thanos
More Than 1,400 Dead as Magnitude-7.8 Quake Rocks Nepal
A powerful earthquake -- the country's worst in 80 years -- rocked mountainous Nepal on Saturday, killing more than 1,400 people and leveling buildings and centuries-old temples. Dozens if not hundreds remained trapped under mounds of rubble. Hospitals in ...

5 hours, 33 minutes ago
Views: 71 • Comments: 1
Tweets: 1 • Rating: 2
TheTruthHurts
Israeli settlements profit from Palestinian children
Muhammad is one of hundreds of Palestinian children who has dropped out of school and started working for low wages in exploitive conditions to ensure some Israeli agricultural settlements prosper...

3 days, 10 hours ago
Views: 412 • Comments: 4
Tweets: 0 • Rating: 0
Higgs Boson's Mate
Sleeping Bear Dunes shipwrecks spotted by helicopter patrol
LEELANAU COUNTY, MI -- A Northern Michigan Coast Guard helicopter crew on routine patrol captured some excellent images of the shipwrecks that dot the waters off Sleeping Bear Dunes National Lakeshore. The Traverse City-based crew posted six photos on ...

4 days, 7 hours ago
Views: 421 • Comments: 1
Tweets: 2 • Rating: 6
CriticalDragon1177
Skepchick - Ad Hominem Fallacy: A Lesson for Sea World ( Video )
Rebecca Watson takes on Sea World, and their attacks on John Hargrove. She takes them to task for attacking him, rather than even trying to refute his allegations, and in the process gives us a lesson in critical thinking. Read ...

5 days, 4 hours ago
Views: 682 • Comments: 0
Tweets: 37 • Rating: 3
lostlakehiker
Solar will soon be as cheap as coal
Better wafer fabrication techniques Inside a sprawling single-story office building in Bedford, Massachusetts, in a secret room known as the Growth Hall, the future of solar power is cooking at more than 2,500 °F. Behind closed doors and downturned blinds, ...

1 week ago
Views: 614 • Comments: 16
Tweets: 0 • Rating: 9
FemNaziBitch
IRS Should Crack Down on Private Equity’s Abusive Tax Alchemy
As Warren Buffett famously observed, "...while most Americans struggle to make ends meet, we mega-rich continue to get our extraordinary tax breaks." He was referring to the fact that capital gains earned by wealthy investors are taxed at a ...

1 week ago
Views: 409 • Comments: 1
Tweets: 0 • Rating: 1
philosophus invidius
Bioethicist Live-Tweets Her Son’s Sex-Ed Class
The tweets were simultaneously disturbing and hilarious. "We are going to roll this dice 8 times. Every time your number comes up, in pretend your condom failed and you get a paper baby." JESUS!!! — Alice Dreger (@AliceDreger) April ...

1 week, 2 days ago
Views: 583 • Comments: 7
Tweets: 2 • Rating: 9
Great White Snark
Pope Francis Uses ‘Genocide’ for Killings of Armenians
Grateful Armenia This consternation over the use of the word 'genocide' occurs regularly. And Armenians are equally upset, when Turkey protests it. Armenian Foreign Minister Edward Nalbandian rebuked Turkey. "We are in a situation in which Turkey speaks a ...

1 week, 5 days ago
Views: 548 • Comments: 0
Tweets: 0 • Rating: 4
 Frank says:

Winos don't march.