Is the XKeyScore Code Released in Germany Faked?

Expert analysis uncovers serious misrepresentations and possible fakery

Following up on our post about the wildly exaggerated claims made about the purported XKeyScore source code released in Germany this week by hacker Jacob Applebaum, here’s a very interesting post by cybersecurity expert Robert Graham with evidence that the code may have been at least partly faked: Errata Security: Validating XKeyScore Code.

The burning questions about the XKeyScore “source code” is whether it’s real, and whether it come from Snowden. The Grugq (@thegrugq) has some smart insight into this, and I have my own expertise with deep-packet-inspection code. I thought I’d write up our expert analysis to the questions.

TL;DR: we believe the code partly fake and that it came from the Snowden treasure trove.

A slightly longer summary is:

  1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.
  2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is "fake".
  3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.
  4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code - if fake, it's not completely so.

Here’s a point that jumped out at me immediately upon looking at the code: all over the Internet, people are claiming that the code identifies linuxjournal.com as an “exremist forum” — but that’s simply false. As I tweeted two days ago:

Graham’s post agrees with this evaluation:

Another misrepresentation in the story is that the source calls the Linux Journal an extremist forum. That’s not true.

A comment does say that TAILS is “a comsec mechanism advocated by extremists on extremist forums”. This is true, as the picture (from the Grugq) demonstrates on the right: it’s a picture from an ISIS/jihad forum advocating the use of TAILS. But nowhere does it claim that the Linux Journal is one of those extremists — that’s something willfully made up by the authors of the story.

That the story already misrepresents the meaning of this source code hints that it may already be misrepresenting the provenance.

Exactly. Something smells very fishy here. Read the whole thing. And for those interested in the highly technical details, here’s Graham’s post going through the code line by line.

Jump to top

Create a Page

This is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.

Or... you can just click this button to open the Pages posting window right away.

Last updated: 2016-01-01 10:29 am PST

LGF User's Guide RSS Feeds

Help support Little Green Footballs!

Subscribe now for ad-free access!

Recent Pages
Thanos
‘Bay Boys’ Surfer Gang Cannot Block Access to Upscale Beach, Coastal Commission Says
The letter says: "Precluding full public use of the coastline at Palos Verdes Estates, including the waters of Lunada Bay, whether through physical devices ... or impediments, such as threatening behavior intended to discourage public use of the coastline, ...

3 hours, 6 minutes ago
Views: 218 • Comments: 0 • Rating: 1
Tweets: 50 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
Thanos
Viola Beach - Swings and Waterslides R. I. P.
The Hyve - new indie & alternative music.✜ Like: bit.ly✜ Subscribe: bit.ly✜ Spotify: bit.ly Viola Beach - 'Swings and Waterslides'Single released 28th August 2015 on Fuller Beans Records. Available to buy now: smarturl.it℗ 2015 Fuller Beans Records ✗ Like ...

3 hours, 24 minutes ago
Views: 65 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
Thanos
Kids, Forget Console Gaming—play the FBI’s Browser-Based Game Instead
Sad but Trump: Right wing populist speak and ISIS speak are sometimes indistinguishable at a basic level. That "distorted logic text," however, appears to be taken right out of the playbook of any US politician inciting violence or war. There ...

7 hours, 34 minutes ago
Views: 108 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
Thanos
Fallout 4: Is the Transistor a Symbol of Peace?
It's a retro-future future... Today's episode has been sponsored by Squarespace. For more information, visit squarespace.com Tweet us! bit.lyIdea Channel Facebook! bit.lyTalk about this episode on reddit! bit.lyIdea Channel IRC! bit.lyEmail us! pbsideachannel [at] gmail [dot] com Fallout’s unique brand ...

1 day, 16 hours ago
Views: 208 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
HappyWarrior
A Photo Depository For Lizards Interested in Family History
So some of us were talking and decided it would be a neat idea to have a thread filled with old photos of family history. I'll post a photo as well an accompanying article about my great grandfather's blacksmtih shop. ...

2 days, 2 hours ago
Views: 268 • Comments: 34 • Rating: 7
Tweets: 0 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
I Stand With Planned Parenthood
Laws Written by Men to Protect Women Deserve Scrutiny, Supreme Court Told
History holds a lesson for the Supreme Court, the brief warns: Be skeptical of laws protecting women that are written by men. The nation’s past is littered with such statutes, say the historians who filed the friend-of-the-court brief, and ...

2 days, 4 hours ago
Views: 268 • Comments: 1 • Rating: 3
Tweets: 1 • Share to Facebook

Shares: 1
Likes: 0
Comments: 0
: 1
Great White Snark
Canadians Learn Arabic to Give Syrian Refugees a Warm Welcome
A timely reminder some real angels walk among us. Simple human angels of mercy for the distressed. Canadian David Foster developed a passion for Arabic ten years ago, while he was working for an international company in Sudan. Now, he ...

2 days, 16 hours ago
Views: 392 • Comments: 0 • Rating: 1
Tweets: 21 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
mishuga
Ted Nugent: Jew(ish Politician)s = Nazis
Ted Nugent singled out 12 Jewish-American politicians, complete with a graphic depicting each of the politicians alongside an Israeli flag, for supporting gun control and other crimes. The post, which has been shared more than 4,000 times and liked more ...

3 days, 21 hours ago
Views: 456 • Comments: 1 • Rating: 1
Tweets: 0 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
I Stand With Planned Parenthood
Why We Need to Think Beyond Roe v. Wade - Pacific Standard
For the immigrant mothers—Dolores Madrigal, the lead plaintiff, and the nine others named in the suit, and countless others whose names we will not know—the story was more complex, the culpable more numerous. First, there were the doctors and ...

4 days, 3 hours ago
Views: 393 • Comments: 0 • Rating: 2
Tweets: 1 • Share to Facebook

Shares: 0
Likes: 0
Comments: 0
: 0
I Stand With Planned Parenthood
Are Pets Really Good for Us? - Pacific Standard
We just adopted a dog, meaning I'm now a pet owner, meaning I'm now responsible for another living creature. It's weird. Her name is Bella. She's a pit bull mixed with something that is not a pit bull, and ...

4 days, 3 hours ago
Views: 400 • Comments: 2 • Rating: 3
Tweets: 1 • Share to Facebook

Shares: 1
Likes: 0
Comments: 0
: 1