Is the XKeyScore Code Released in Germany Faked?

Expert analysis uncovers serious misrepresentations and possible fakery

Following up on our post about the wildly exaggerated claims made about the purported XKeyScore source code released in Germany this week by hacker Jacob Applebaum, here’s a very interesting post by cybersecurity expert Robert Graham with evidence that the code may have been at least partly faked: Errata Security: Validating XKeyScore Code.

The burning questions about the XKeyScore “source code” is whether it’s real, and whether it come from Snowden. The Grugq (@thegrugq) has some smart insight into this, and I have my own expertise with deep-packet-inspection code. I thought I’d write up our expert analysis to the questions.

TL;DR: we believe the code partly fake and that it came from the Snowden treasure trove.

A slightly longer summary is:

  1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.
  2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is "fake".
  3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.
  4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code - if fake, it's not completely so.

Here’s a point that jumped out at me immediately upon looking at the code: all over the Internet, people are claiming that the code identifies linuxjournal.com as an “exremist forum” — but that’s simply false. As I tweeted two days ago:

Graham’s post agrees with this evaluation:

Another misrepresentation in the story is that the source calls the Linux Journal an extremist forum. That’s not true.

A comment does say that TAILS is “a comsec mechanism advocated by extremists on extremist forums”. This is true, as the picture (from the Grugq) demonstrates on the right: it’s a picture from an ISIS/jihad forum advocating the use of TAILS. But nowhere does it claim that the Linux Journal is one of those extremists — that’s something willfully made up by the authors of the story.

That the story already misrepresents the meaning of this source code hints that it may already be misrepresenting the provenance.

Exactly. Something smells very fishy here. Read the whole thing. And for those interested in the highly technical details, here’s Graham’s post going through the code line by line.

Jump to top

Create a PageThis is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.
Or... you can just click this button to open the Pages posting window right away.
Last updated: 2016-01-01 10:29 am PST
LGF User's Guide RSS Feeds Tweet

Help support Little Green Footballs!

Subscribe now for ad-free access!Register and sign in to a free LGF account before subscribing, and your ad-free access will be automatically enabled.

Donate with
PayPal
Square Cash Shop at amazon
as an LGF Associate!
Recent PagesClick to refresh
Orville Peck - ‘Turn to Hate’ (Live at WFUV)wfuv.org • Follow @wfuv: ow.ly Orville Peck performs "Turn To Hate" live in Studio A. Recorded 4/26/19. Host: Russ BorrisAudio: Jim O'HaraCameras: Nora Doyle, Dan Tuozzoli, Brian Gallagher and Michael L'AbbbateEditor: Nora Doyle and Dan Tuozzoli
Thanos
2 days, 5 hours ago
Views: 269 • Comments: 0 • Rating: 0
Tweets: 4 • Share to Facebook
Shares: 0
Comments: 0
: 0
Vampire Weekend - This Life (Official Video)Father of the Bride available now: smarturl.it #VampireWeekend #FatherOfTheBride
Thanos
2 days, 5 hours ago
Views: 274 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
Molly Tuttle at Paste Studio NYC Live From the Manhattan Center1. Take the Journey 0:232. Messed With My Mind 6:393. Sleepwalking 12:214. Light Came In (Power Went Out) 18:11 Watch Molly Tuttle live at Paste Studio NYC! More sessions and interviews here: pastemagazine.com Audio: Bob MalloryVideo: Brad Wagner
Thanos
2 days, 5 hours ago
Views: 257 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
The Raconteurs - ‘Help Me Stranger’ (Official Music Video) Music video for The Raconteurs new single “Help Me Stranger” from their forthcoming album HELP US STRANGER – out June 21st. Pre-order & pre-save HELP US STRANGER here: theraconteurs.lnk.to Director: Yasuhiko ShimizuDirector of Photography: Shunya AraiProducer: Takashi SugaiStylist: Tomohiko ...
Thanos
3 days, 17 hours ago
Views: 334 • Comments: 0 • Rating: 0
Tweets: 2 • Share to Facebook
Shares: 0
Comments: 0
: 0
‘The Maldives Mystery’ Resolved This is a response to the Academic Agent's "Climate Change -- The Maldives Mystery." I am currently on assignment and won't be able to list sources for at least another week. My apologies for the delay. This is also ...
Thanos
4 days ago
Views: 316 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Lil Nas X - Old Town Road (Official Movie) Ft. Billy Ray Cyrus Official video for Lil Nas X’s Billboard #1 hit, “Old Town Road (Remix)” featuring Billy Ray Cyrus. Special guest appearances from Chris Rock, Haha Davis, Rico Nasty, Diplo, Jozzy, Young Kio, and Vince Staples. Listen & Download “Old Town ...
Thanos
4 days ago
Views: 357 • Comments: 0 • Rating: 0
Tweets: 3 • Share to Facebook
Shares: 0
Comments: 0
: 0
Down on the PromenadeProvided to YouTube by CDBaby Down On the Promenade · Marc Monroe Copasetic ℗ 2013 Mark Kelton Released on: 2013-04-23 Auto-generated by YouTube.
Thanos
1 week ago
Views: 555 • Comments: 1 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
Dido - Take You Home (Official Video) The official video for Take You Home, taken from Dido's new album, Still On My Mind. Buy now: dido.lnk.to Follow DidoOfficial site - didomusic.comFacebook - facebook.com Instagram - instagram.comTwitter - @didoofficial Jordan Rossi (Video Producer), John RankinWaddell (Video Director) ...
Thanos
1 week ago
Views: 545 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
Norah Jones - Begin Again (Live on the Today Show)‘Begin Again’ comes from Norah Jones’s latest compilation of the same name.Listen to the full compilation here: norahjones.lnk.to See Norah live: norahjones.lnk.to Connect with Norah:norahjones.comfacebook.com@norahjonesinstagram.com #NorahJones #BeginAgain vevo.ly
Thanos
1 week ago
Views: 593 • Comments: 0 • Rating: 0
Tweets: 2 • Share to Facebook
Shares: 0
Comments: 0
: 0
Bill Evans ‘Peace Piece’ Virtual Museum Exhibit: Pasos Peace Museum (visit: www. pasospeacemuseum.org)—Bill Evans's "Peace Piece" is an unrehearsed modal composition that he recorded for his "Everybody Digs Bill Evans" LP in 1958. It is hailed as one of the most beautiful and ...
Thanos
1 week, 1 day ago
Views: 450 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0