4 ms·
Is it not possible to replace an existing string in the binary with that one?
by 88e282102ae2e5b 10y ago
Is it not possible to replace an existing string in the binary with that one?
- moyix 10y agoTo what end?
- 0x6c6f6c 10y agoTo connect it with the same speculation that's being made right now?
- moyix 10y agoIt's the timing that makes the connection. The sequence of events is: 1. Snowden leaves NSA with documents. Some of these (but, crucially, not all) are published. 2. Shadow Brokers release something claiming to be NSA hacking tools containing ace02468bdf13579 string. 3. The Intercept looks in the unreleased parts of the Snowden documents and finds the same string. Thus, the fact that the leaked tools contain non-public NSA-specific information is what makes it clear the tools originate from NSA. The only other possibility is that the Shadow Brokers also had access to the full set of Snowden documents and decided to use them to fake the dump, which is much, much less likely. You could start dropping ace02468bdf13579 into binaries willy nilly now, but it wouldn't do much, because that's now public information. Or am I missing something?
- blumentopf 10y agoBirthday paradox.
- Ar-Curunir 10y agoLol the chances of a collision are still too low.
- moyix 10y agoSuppose the ace02468bdf13579 is a random hex string. That's 8 bytes of data, or 1/2^64 to get that specific value. With the birthday paradox, that only gets you down to 1/2^32 or one in 4 billion chance. Not happening.
- pklausler 10y agoWhile that 64-bit value would be just as likely to occur as any other if randomly chosen, any competent programmer is going to recognize a very strong pattern in that value's binary representation that makes it much more likely to have been chosen with intent. In fact, the pattern is so strong, there's a chance that the appearances of the value in two places is simply a coincidence.
- pklausler 10y agoSpecifically, in C, it's (0x01234567uLL + 0x55555555 & 0x77777777) * 0x200000002 + 0x11111111
- acqq 10y agoYes, googling for the 32-bit parts of that 64-bit hex value gets me two distinct hits: 2015: http://www.ijirst.org/articles/IJIRSTV1I9059.pdf http://www.ijirst.org/articles/IJIRSTV1I9059.pdf and 2013: https://www.halowaypoint.com/en-us/forums/d76f090378914a9bb85312f87cf09b99/topics/classified-section-3-decoding-center/ac50b7bf-5abc-4043-bc7f-772fd764047b/posts?page=11 https://www.halowaypoint.com/en-us/forums/d76f090378914a9bb8... Still, the string (instead of the binary values) is somewhat less probable than this to be an accidental match.
- ttctciyf 10y agoWell, if the string was a widely occuring one (say, because it's useful in some coding task, etc.) you might expect it to turn up a few times in a google search for occurrences prior to Aug 1 2016. But, apparently not: https://www.google.com/search?q=ace02468bdf13579&client=firefox-b&source=lnt&tbs=cdr%3A1%2Ccd_min%3A%2Ccd_max%3A8%2F1%2F2016&tbm= https://www.google.com/search?q=ace02468bdf13579&client=fire...
- deleted 10y ago[deleted]
- ngrim 10y agoPecking order hash: http://www.ijirst.org/articles/IJIRSTV1I9059.pdf http://www.ijirst.org/articles/IJIRSTV1I9059.pdf I_10 = ACE02468 I_11 = BDF13579 https://github.com/sivagtr/POH https://github.com/sivagtr/POH He works at Cisco :P
- toufka 10y agoThe (yet unpublished) documents obtained by Snowden had the same string as found in the sample files. The documents were not available to the publisher of the files to use.