9 ms·

Vault 8 – Source code and analysis for CIA software projects

118 points by degenerate 9y ago

IIAOPSW 9y ago
Again? Can someone tell me if there's actual malfeasance this time or just more edgy moaning about the spy agency doing its job? I'm happy to call out the security apparatus when it actually oversteps its bounds (Eg the Snowden leaks). But so far as I can tell wikileaks vault 7/8 isn't a leak in the public interest. Its just anti-American wankery.
- monocasa 9y ago
  The amount of work that they put into throwing off attribution, while expected, is important to make it's way into public knowledge rather than just the realm of conspiracy, IMO.
  - PeachPlum 9y ago
    See the Sony break in where the dubious attribution was used by Obama as a reason for more DPRK sanctions
  - jhiska 9y ago
    It is vital to the intel community that their methods of attribution can't be publicly audited and that their authority is trusted on word alone.
- sametmax 9y ago
  Well you can't protect yourself against an hostile gov if you don't know their weapons.
  - lightbyte 9y ago
    These are up to 10 year old tools, they are not going to still be in use.
    - codefined 9y ago
      In the commercial sector I seem to find myself spending a significant amount of my time working on projects that were started many decades ago that have just been improved over time. I honestly wouldn't be too surprised if a lot of these applications were used today with relatively little change.
      - lightbyte 9y ago
        This isn't the commercial sector, these kinds of things are incredibly sensitive to time.
        ryanlol 9y ago
        Huh, why? We aren't really discussing exploits here.
    - 45h34jh53k4j 9y ago
      Repo is from 2015. Its not that old.
      - lightbyte 9y ago
        Read the page, they moved to a new repos a few years ago. If you go to the actual source files some of them are dated as early as October 1st 2007.
        45h34jh53k4j 9y ago
        They moved from a CVS/SVN repo to git. The history from this old repo is missing, but the (leaked) git repo is recent. Author:User#142 Date: Fri Oct 30 09:58:22 2015 EDT User's Guide date corrections.
    - sametmax 9y ago
      Given that some big exploits can fly under the radar for decades (e.g: https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_patch_against_12yearold_bug/ https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...), I think it's always interesting. But the point is moot anyway: either their tools are still relevant today, in that case it's good to see what they can use against the people, or they are not, in which case it won't hurt them if we see them and it's not "anti american".
- craftyguy 9y ago
  > Can someone tell me if there's actual malfeasance this time or just more edgy moaning about the spy agency doing its job? Why don't you read it and decide for yourself?
- ryanlol 9y ago
  >Its just anti-American wankery. So what, that’s been wikileaks MO since day one. Assange has been very transparent about his intentions. Read his essay from 2006 https://web.archive.org/web/20070129125831/http://iq.org/conspiracies.pdf https://web.archive.org/web/20070129125831/http://iq.org/con...
  - whatshisface 9y ago
    Don't you realize that the institution that's being examined isn't necessarily on your side? Without oversight, how could they possibly be kept on the good side? Having gone so long without oversight, how far have they strayed? Assuming you weren't involved in any of this, ask yourself: did I authorize it? Did the legitimate authority of my civil peers (to which I am willing to cede) authorize it? Did my representatives authorize it? (Not everyone in congress is on these top-secret commitiees, it's entirely possible that some action could be taken that the voters of an entire state had essentially zero say in.) Finally, What would happen if a cleared individual decided to take an action without asking anybody or telling anybody? You know, like Snowden, except not conscience-driven to make sure we all heard about it. It's not like established systems have ever suppressed secrets that would make them look bad if widely known, right? Right?
    - ryanlol 9y ago
      >Don't you realize that the institution that's being examined isn't necessarily on your side? CIA or Wikileaks? CIA absolutely not, Wikileaks probably yes. >Without oversight, how could they possibly be kept on the good side? CIA is the foreign intelligence agency of a particularly murderous country, they can’t possibly be kept on the good side. Wikileaks seems to have oversight built in that they need to be trustworthy enough for people to leak to them. >Having gone so long without oversight, how far have they strayed? CIA has a long history of doing terrible things, I doubt they’ve strayed too far from that. >What would happen if a cleared individual decided to take an action without asking anybody or telling anybody? What would happen if the sun came up in the morning? Things would probably be the same they were yesterday.
      - 9y ago
drak0n1c 9y ago
If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considered evidence?
- dguido 9y ago
  Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, together. If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf http://www.activeresponse.org/wp-content/uploads/2013/07/dia...
  - monocasa 9y ago
    Isn't the CIA here specifically attacking this model of attribution?
    - Natsu 9y ago
      Kaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here: https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... It was on HN before, but it vanished quickly - https://news.ycombinator.com/item?id=15483529 https://news.ycombinator.com/item?id=15483529
      - dang 9y ago
        Looks like we invited nkurz to repost that one but it didn't happen to get traction either time. Hard to say why, but it wasn't flags.
        Natsu 9y ago
        Sorry, didn't mean to imply otherwise. It's pretty interesting, IMHO, but just didn't get upvotes/visibility.
45h34jh53k4j 9y ago
This is the source code (and several binary compiles) of the CIA C2 infrastructure + client implants for Solaris, Linux and various routers. I suspect that now this is in the open, past and current CIA malware will now be detectable by commercial Anti Virus.
- willstrafach 9y ago
  I'm not so sure about that. WL released the documentation back in April, which contained more than enough information to create a few behavioral detection signatures for the implants. I would assume that any AV company who cared has already created and deployed signatures.
  - 45h34jh53k4j 9y ago
    Hi chronic, We now know that all comms implant to C2 are TLS with a unique (fake) certificate tree. They use unique, single use domains for operations. I don't believe there was enough information in vault 7 to identify IOC's that could be used for behavioural analysis. We also now know that the C2 fronting servers negotiate 'Client Cert optional', which is a fairly unique configuration item. The git repo contains 3 binary builds of the client/server malware. I think this is more important for detection than their docs. Regardless, its all public domain now.
    - willstrafach 9y ago
      AV is now far beyond just using hash-based detection, but you are correct that having the three binary builds will allow that to also be added to their (hopefully existing) detections. No argument there. What you're saying comes from the documentation included in the source, yes. But if you dig into the Confluence dump from back in March, you'll see that the User's Guide and Developer's Guide PDFs for Hive were attached to one of the wiki pages already, explaining how this all worked. It did not get any press attention as it was quite mundane compared to the more interesting leaked wiki pages, but I would really hope AV companies and others in infosec noticed this already.
bob9 9y ago
Interesting drop. I have many questions but two are very high on my list: 1. one of the commit messages mentions merge from a git remote hosted at devlan.net. Who owns that host and is it a hidden CIA server or repurposed captured host? https://wikileaks.org/vault8/document/hive-log/page-41/#pagination https://wikileaks.org/vault8/document/hive-log/page-41/#pagi... Merge branch 'master' of ssh://stash.devlan.net:7999/hive/hive https://www.whois.com/whois/devlan.net https://www.whois.com/whois/devlan.net It kinda looks like a captured host registered originally by a French admin. 2. Why Solaris? Microtik and the other router targets make sense in combination with generic Linux machines, but Solaris sticks out and there must be an interesting explanation for targeting that. What kind of internet facing Solaris hosts are out there or which orgs use it in such a capacity to become a target for the CIA?
- tgragnato 9y ago
  1. Stash seems to be an atlassian instance hosted on their intranet. 2. <conjecture> Kaspersky ? </conjecture> + ISPs, universities, etc.
  - bob9 9y ago
    1. it's very bad practice, even if only internal, to use an already registered public domain. It crossed my mind that this might just be an internal domain (devlan -> developer LAN), though it seemed unbelievable an agency would have people in IT with that much disrespect for proper network config. It must be an interesting life for the French admin of the "real" devlan.net since the leaks. 2. I don't get the Kaspersky reference. Can you explain? ISP and University: I suppose you mean those would be running public Solaris hosts, right? And that therefore the CIA has been hiding on those servers. I sure would hate the CIA to spy on scientists, though it's not unheard of that one of the agencies knocks on a door of a scientist who just happened to be on the verge of publishing something they deem a risk. Happened in the past and sure still does. The imbalance and abuse of power is the problem and here it's legalized/constitutionalised. An agency can spy on my private life and professional work without being questioned, but we aren't allowed to demand a transparent administration or any of the many ranches of government.
yters 9y ago
Interesting that WL goes after the one nation state that is not going to completely fubar them, and has much better human rights than the other big nation states it could go after. I say that if WL's real goal is to promote human rights, the US is not the highest target on the list. On the other hand, if they want easy publicity with minimal risk to self, the US is probably their best target.
- serf 9y ago
  > I say that if WL's real goal is to promote human rights, the US is not the highest target on the list. well, I say that constant hopes for transparency and the strides we take towards those goals will keep the United States high on the list of nations with decents human rights. WL is one of those strides, and I think it's invaluable. It's 'interesting' that given the muck that WL has raked up about the U.S. that anyone could be upset about their ( the US ) having been a target..
  - aalleavitch 9y ago
    The question is not whether the US should be subject to oversight, the question is "does WikiLeaks intend to push a deliberate agenda with their disproportionate targeting of the US?" You would be naive to take for granted that WikiLeaks is acting exclusively out of principle.
    - jhiska 9y ago
      You are reframing the discussion.
      - AnimalMuppet 9y ago
        I would disagree. This particular discussion was started by yters' post; aalleavich's point seems to me to be extremely in sync with yters'.
- PeachPlum 9y ago
  You can only publish what you are given.
SomeStupidPoint 9y ago
I see Wikileaks is still publishing "leaks" about US agencies in the week following major news on the Russian investigation, as they have more-or-less consistently since February. I'm sure this time is just coincidence, too.
_pdp_ 9y ago
The bad news is that soon CIA will not have to build their own infrastructure due to the rise of all kinds of public P2P technologies. The best type of covert operation is the one that is hidden in plain sight.
stefantalpalaru 9y ago
https://www.itwire.com/government-tech-policy/80740-cia-created-code-to-impersonate-kaspersky-lab-wikileaks.html https://www.itwire.com/government-tech-policy/80740-cia-crea... : > Three examples included in the source code release built a fake certificate for Kaspersky Lab, a company whose products have been banned from use by US public sector bodies over the claim that it aids spying by Russia. > The fake certificates appeared to be signed by Thawte premium Server CA, Cape Town. > “In this way, if the target organisation looks at the network traffic coming out of its network, it is likely to misattribute the CIA exfiltration of data to uninvolved entities whose identities have been impersonated,” WikiLeaks said.
throwaway292929 9y ago
The following line from /honeycomb/crypto.c look very interesting... /* * Computing a "safe" DH-1024 prime can take a very * long time, so a precomputed value is provided below. * You may run dh_genprime to generate a new value. */ char *my_dhm_P = "E4004C1F94182000103D883A448B3F80" \ "2CE4B44A83301270002C20D0321CFD00" \ "11CCEF784C26A400F43DFB901BCA7538" \ "F2C6B176001CF5A0FD16D2C48B1D0C1C" \ "F6AC8E1DA6BCC3B4E1F96B0564965300" \ "FFA1D0B601EB2800F489AA512C4B248C" \ "01F76949A60BB7F00A40B1EAB64BDD48" \ "E8A700D60B7F1200FA8E77B0A979DABF";
- ryanlol 9y ago
  Those lines aren't very interesting. The comment explains exactly what and why they are. You'll be able to find this same C̶I̶A̶ ̶b̶a̶c̶k̶d̶o̶o̶r̶ DH-1024 prime in tons of other projects: https://github.com/mstorsjo/rtmpdump/blob/master/librtmp/rtmp.c#L42 https://github.com/mstorsjo/rtmpdump/blob/master/librtmp/rtm... https://github.com/travelping/nattcp/blob/master/polarssl.c#L24 https://github.com/travelping/nattcp/blob/master/polarssl.c#...
  - throwaway292929 9y ago
    You're right, I got over-enthusiastic. And it looks like the C code has been migrated to Python anyway. Also, owners of MikroTik hardware look to be thoroughly owned: elif str(beacon_hdr.os) == '40': beacon_data['os'] = "MikroTik-MIPSBE" elif str(beacon_hdr.os) == '41': beacon_data['os'] = "MikroTik-MIPSLE" elif str(beacon_hdr.os) == '42': beacon_data['os'] = "MikroTik-x86" elif str(beacon_hdr.os) == '43': beacon_data['os'] = "MikroTik-PPC"

118 points by degenerate 9y ago

Again? Can someone tell me if there's actual malfeasance this time or just more edgy moaning about the spy agency doing its job? I'm happy to call out the security apparatus when it actually oversteps its bounds (Eg the Snowden leaks). But so far as I can tell wikileaks vault 7/8 isn't a leak in the public interest. Its just anti-American wankery.

monocasa 9y ago
The amount of work that they put into throwing off attribution, while expected, is important to make it's way into public knowledge rather than just the realm of conspiracy, IMO.
- PeachPlum 9y ago
  See the Sony break in where the dubious attribution was used by Obama as a reason for more DPRK sanctions
- jhiska 9y ago
  It is vital to the intel community that their methods of attribution can't be publicly audited and that their authority is trusted on word alone.
sametmax 9y ago
Well you can't protect yourself against an hostile gov if you don't know their weapons.
- lightbyte 9y ago
  These are up to 10 year old tools, they are not going to still be in use.
  - codefined 9y ago
    In the commercial sector I seem to find myself spending a significant amount of my time working on projects that were started many decades ago that have just been improved over time. I honestly wouldn't be too surprised if a lot of these applications were used today with relatively little change.
    - lightbyte 9y ago
      This isn't the commercial sector, these kinds of things are incredibly sensitive to time.
      - ryanlol 9y ago
        Huh, why? We aren't really discussing exploits here.
  - 45h34jh53k4j 9y ago
    Repo is from 2015. Its not that old.
    - lightbyte 9y ago
      Read the page, they moved to a new repos a few years ago. If you go to the actual source files some of them are dated as early as October 1st 2007.
      - 45h34jh53k4j 9y ago
        They moved from a CVS/SVN repo to git. The history from this old repo is missing, but the (leaked) git repo is recent. Author:User#142 Date: Fri Oct 30 09:58:22 2015 EDT User's Guide date corrections.
  - sametmax 9y ago
    Given that some big exploits can fly under the radar for decades (e.g: https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_patch_against_12yearold_bug/ https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...), I think it's always interesting. But the point is moot anyway: either their tools are still relevant today, in that case it's good to see what they can use against the people, or they are not, in which case it won't hurt them if we see them and it's not "anti american".
craftyguy 9y ago
> Can someone tell me if there's actual malfeasance this time or just more edgy moaning about the spy agency doing its job? Why don't you read it and decide for yourself?
ryanlol 9y ago
>Its just anti-American wankery. So what, that’s been wikileaks MO since day one. Assange has been very transparent about his intentions. Read his essay from 2006 https://web.archive.org/web/20070129125831/http://iq.org/conspiracies.pdf https://web.archive.org/web/20070129125831/http://iq.org/con...
- whatshisface 9y ago
  Don't you realize that the institution that's being examined isn't necessarily on your side? Without oversight, how could they possibly be kept on the good side? Having gone so long without oversight, how far have they strayed? Assuming you weren't involved in any of this, ask yourself: did I authorize it? Did the legitimate authority of my civil peers (to which I am willing to cede) authorize it? Did my representatives authorize it? (Not everyone in congress is on these top-secret commitiees, it's entirely possible that some action could be taken that the voters of an entire state had essentially zero say in.) Finally, What would happen if a cleared individual decided to take an action without asking anybody or telling anybody? You know, like Snowden, except not conscience-driven to make sure we all heard about it. It's not like established systems have ever suppressed secrets that would make them look bad if widely known, right? Right?
  - ryanlol 9y ago
    >Don't you realize that the institution that's being examined isn't necessarily on your side? CIA or Wikileaks? CIA absolutely not, Wikileaks probably yes. >Without oversight, how could they possibly be kept on the good side? CIA is the foreign intelligence agency of a particularly murderous country, they can’t possibly be kept on the good side. Wikileaks seems to have oversight built in that they need to be trustworthy enough for people to leak to them. >Having gone so long without oversight, how far have they strayed? CIA has a long history of doing terrible things, I doubt they’ve strayed too far from that. >What would happen if a cleared individual decided to take an action without asking anybody or telling anybody? What would happen if the sun came up in the morning? Things would probably be the same they were yesterday.
    - 9y ago

drak0n1c 9y ago

If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considered evidence?

dguido 9y ago
Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, together. If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf http://www.activeresponse.org/wp-content/uploads/2013/07/dia...
- monocasa 9y ago
  Isn't the CIA here specifically attacking this model of attribution?
  - Natsu 9y ago
    Kaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here: https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... It was on HN before, but it vanished quickly - https://news.ycombinator.com/item?id=15483529 https://news.ycombinator.com/item?id=15483529
    - dang 9y ago
      Looks like we invited nkurz to repost that one but it didn't happen to get traction either time. Hard to say why, but it wasn't flags.
      - Natsu 9y ago
        Sorry, didn't mean to imply otherwise. It's pretty interesting, IMHO, but just didn't get upvotes/visibility.

45h34jh53k4j 9y ago

This is the source code (and several binary compiles) of the CIA C2 infrastructure + client implants for Solaris, Linux and various routers. I suspect that now this is in the open, past and current CIA malware will now be detectable by commercial Anti Virus.

willstrafach 9y ago
I'm not so sure about that. WL released the documentation back in April, which contained more than enough information to create a few behavioral detection signatures for the implants. I would assume that any AV company who cared has already created and deployed signatures.
- 45h34jh53k4j 9y ago
  Hi chronic, We now know that all comms implant to C2 are TLS with a unique (fake) certificate tree. They use unique, single use domains for operations. I don't believe there was enough information in vault 7 to identify IOC's that could be used for behavioural analysis. We also now know that the C2 fronting servers negotiate 'Client Cert optional', which is a fairly unique configuration item. The git repo contains 3 binary builds of the client/server malware. I think this is more important for detection than their docs. Regardless, its all public domain now.
  - willstrafach 9y ago
    AV is now far beyond just using hash-based detection, but you are correct that having the three binary builds will allow that to also be added to their (hopefully existing) detections. No argument there. What you're saying comes from the documentation included in the source, yes. But if you dig into the Confluence dump from back in March, you'll see that the User's Guide and Developer's Guide PDFs for Hive were attached to one of the wiki pages already, explaining how this all worked. It did not get any press attention as it was quite mundane compared to the more interesting leaked wiki pages, but I would really hope AV companies and others in infosec noticed this already.

bob9 9y ago

Interesting drop. I have many questions but two are very high on my list: 1. one of the commit messages mentions merge from a git remote hosted at devlan.net. Who owns that host and is it a hidden CIA server or repurposed captured host? https://wikileaks.org/vault8/document/hive-log/page-41/#pagination https://wikileaks.org/vault8/document/hive-log/page-41/#pagi... Merge branch 'master' of ssh://stash.devlan.net:7999/hive/hive https://www.whois.com/whois/devlan.net https://www.whois.com/whois/devlan.net It kinda looks like a captured host registered originally by a French admin. 2. Why Solaris? Microtik and the other router targets make sense in combination with generic Linux machines, but Solaris sticks out and there must be an interesting explanation for targeting that. What kind of internet facing Solaris hosts are out there or which orgs use it in such a capacity to become a target for the CIA?

tgragnato 9y ago
1. Stash seems to be an atlassian instance hosted on their intranet. 2. <conjecture> Kaspersky ? </conjecture> + ISPs, universities, etc.
- bob9 9y ago
  1. it's very bad practice, even if only internal, to use an already registered public domain. It crossed my mind that this might just be an internal domain (devlan -> developer LAN), though it seemed unbelievable an agency would have people in IT with that much disrespect for proper network config. It must be an interesting life for the French admin of the "real" devlan.net since the leaks. 2. I don't get the Kaspersky reference. Can you explain? ISP and University: I suppose you mean those would be running public Solaris hosts, right? And that therefore the CIA has been hiding on those servers. I sure would hate the CIA to spy on scientists, though it's not unheard of that one of the agencies knocks on a door of a scientist who just happened to be on the verge of publishing something they deem a risk. Happened in the past and sure still does. The imbalance and abuse of power is the problem and here it's legalized/constitutionalised. An agency can spy on my private life and professional work without being questioned, but we aren't allowed to demand a transparent administration or any of the many ranches of government.

yters 9y ago

Interesting that WL goes after the one nation state that is not going to completely fubar them, and has much better human rights than the other big nation states it could go after. I say that if WL's real goal is to promote human rights, the US is not the highest target on the list. On the other hand, if they want easy publicity with minimal risk to self, the US is probably their best target.

serf 9y ago
> I say that if WL's real goal is to promote human rights, the US is not the highest target on the list. well, I say that constant hopes for transparency and the strides we take towards those goals will keep the United States high on the list of nations with decents human rights. WL is one of those strides, and I think it's invaluable. It's 'interesting' that given the muck that WL has raked up about the U.S. that anyone could be upset about their ( the US ) having been a target..
- aalleavitch 9y ago
  The question is not whether the US should be subject to oversight, the question is "does WikiLeaks intend to push a deliberate agenda with their disproportionate targeting of the US?" You would be naive to take for granted that WikiLeaks is acting exclusively out of principle.
  - jhiska 9y ago
    You are reframing the discussion.
    - AnimalMuppet 9y ago
      I would disagree. This particular discussion was started by yters' post; aalleavich's point seems to me to be extremely in sync with yters'.
PeachPlum 9y ago
You can only publish what you are given.

SomeStupidPoint 9y ago

I see Wikileaks is still publishing "leaks" about US agencies in the week following major news on the Russian investigation, as they have more-or-less consistently since February. I'm sure this time is just coincidence, too.

_pdp_ 9y ago

The bad news is that soon CIA will not have to build their own infrastructure due to the rise of all kinds of public P2P technologies. The best type of covert operation is the one that is hidden in plain sight.

stefantalpalaru 9y ago

https://www.itwire.com/government-tech-policy/80740-cia-created-code-to-impersonate-kaspersky-lab-wikileaks.html https://www.itwire.com/government-tech-policy/80740-cia-crea... : > Three examples included in the source code release built a fake certificate for Kaspersky Lab, a company whose products have been banned from use by US public sector bodies over the claim that it aids spying by Russia. > The fake certificates appeared to be signed by Thawte premium Server CA, Cape Town. > “In this way, if the target organisation looks at the network traffic coming out of its network, it is likely to misattribute the CIA exfiltration of data to uninvolved entities whose identities have been impersonated,” WikiLeaks said.

throwaway292929 9y ago

The following line from /honeycomb/crypto.c look very interesting... /* * Computing a "safe" DH-1024 prime can take a very * long time, so a precomputed value is provided below. * You may run dh_genprime to generate a new value. */ char *my_dhm_P = "E4004C1F94182000103D883A448B3F80" \ "2CE4B44A83301270002C20D0321CFD00" \ "11CCEF784C26A400F43DFB901BCA7538" \ "F2C6B176001CF5A0FD16D2C48B1D0C1C" \ "F6AC8E1DA6BCC3B4E1F96B0564965300" \ "FFA1D0B601EB2800F489AA512C4B248C" \ "01F76949A60BB7F00A40B1EAB64BDD48" \ "E8A700D60B7F1200FA8E77B0A979DABF";

ryanlol 9y ago
Those lines aren't very interesting. The comment explains exactly what and why they are. You'll be able to find this same C̶I̶A̶ ̶b̶a̶c̶k̶d̶o̶o̶r̶ DH-1024 prime in tons of other projects: https://github.com/mstorsjo/rtmpdump/blob/master/librtmp/rtmp.c#L42 https://github.com/mstorsjo/rtmpdump/blob/master/librtmp/rtm... https://github.com/travelping/nattcp/blob/master/polarssl.c#L24 https://github.com/travelping/nattcp/blob/master/polarssl.c#...
- throwaway292929 9y ago
  You're right, I got over-enthusiastic. And it looks like the C code has been migrated to Python anyway. Also, owners of MikroTik hardware look to be thoroughly owned: elif str(beacon_hdr.os) == '40': beacon_data['os'] = "MikroTik-MIPSBE" elif str(beacon_hdr.os) == '41': beacon_data['os'] = "MikroTik-MIPSLE" elif str(beacon_hdr.os) == '42': beacon_data['os'] = "MikroTik-x86" elif str(beacon_hdr.os) == '43': beacon_data['os'] = "MikroTik-PPC"