5 ms·
Okay, there's now some credibility to what Shadow Brokers are saying. Watch those bids rise for the rest of the dump! A far fetched tin-foil hat idea - Shadow
by bArray 10y ago
Okay, there's now some credibility to what Shadow Brokers are saying. Watch those bids rise for the rest of the dump!
A far fetched tin-foil hat idea - Shadow Brokers made a few exploits themselves and are looking to bring maximum profit from a smaller amount of work.
The second tin-foil idea is that the NSA themselves are pretending to leak their old tricks in order to find out who the big players are.
- moyix 10y agoMore confirmation that it's actually from NSA: https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowden-documents-confirm/ https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowd... There's a string ("ace02468bdf13579") that is mentioned in a previously-unreleased document from the Snowden cache and also found in some of the binaries contained in the dump.
- 88e282102ae2e5b 10y agoIs it not possible to replace an existing string in the binary with that one?
- moyix 10y agoTo what end?
- 0x6c6f6c 10y agoTo connect it with the same speculation that's being made right now?
- moyix 10y agoIt's the timing that makes the connection. The sequence of events is: 1. Snowden leaves NSA with documents. Some of these (but, crucially, not all) are published. 2. Shadow Brokers release something claiming to be NSA hacking tools containing ace02468bdf13579 string. 3. The Intercept looks in the unreleased parts of the Snowden documents and finds the same string. Thus, the fact that the leaked tools contain non-public NSA-specific information is what makes it clear the tools originate from NSA. The only other possibility is that the Shadow Brokers also had access to the full set of Snowden documents and decided to use them to fake the dump, which is much, much less likely. You could start dropping ace02468bdf13579 into binaries willy nilly now, but it wouldn't do much, because that's now public information. Or am I missing something?
- blumentopf 10y agoBirthday paradox.
- Ar-Curunir 10y agoLol the chances of a collision are still too low.
- moyix 10y agoSuppose the ace02468bdf13579 is a random hex string. That's 8 bytes of data, or 1/2^64 to get that specific value. With the birthday paradox, that only gets you down to 1/2^32 or one in 4 billion chance. Not happening.
- pklausler 10y agoWhile that 64-bit value would be just as likely to occur as any other if randomly chosen, any competent programmer is going to recognize a very strong pattern in that value's binary representation that makes it much more likely to have been chosen with intent. In fact, the pattern is so strong, there's a chance that the appearances of the value in two places is simply a coincidence.
- pklausler 10y agoSpecifically, in C, it's (0x01234567uLL + 0x55555555 & 0x77777777) * 0x200000002 + 0x11111111
- acqq 10y agoYes, googling for the 32-bit parts of that 64-bit hex value gets me two distinct hits: 2015: http://www.ijirst.org/articles/IJIRSTV1I9059.pdf http://www.ijirst.org/articles/IJIRSTV1I9059.pdf and 2013: https://www.halowaypoint.com/en-us/forums/d76f090378914a9bb85312f87cf09b99/topics/classified-section-3-decoding-center/ac50b7bf-5abc-4043-bc7f-772fd764047b/posts?page=11 https://www.halowaypoint.com/en-us/forums/d76f090378914a9bb8... Still, the string (instead of the binary values) is somewhat less probable than this to be an accidental match.
- 10y ago
- deleted 10y ago[deleted]
- ngrim 10y agoPecking order hash: http://www.ijirst.org/articles/IJIRSTV1I9059.pdf http://www.ijirst.org/articles/IJIRSTV1I9059.pdf I_10 = ACE02468 I_11 = BDF13579 https://github.com/sivagtr/POH https://github.com/sivagtr/POH He works at Cisco :P
- toufka 10y agoThe (yet unpublished) documents obtained by Snowden had the same string as found in the sample files. The documents were not available to the publisher of the files to use.