3 ms·

A comment in the source code seems to describe what you need to do: MasterSegment is the length of the string at the end of the encrypted data that contains

A comment in the source code seems to describe what you need to do: MasterSegment is the length of the string at the end of the encrypted data that contains the secret key To decrypt - we do the following 1. Take masterSegment (88) length - from the right of the data - this has the private key 2. Everything from 0 to the end - master segment is the raw data - that needs to be decrypted 3. Decrypt the 88 characters using the public key - that will give you a pipe separated string of the private key (random guid from MDS) and a time stamp (to scramble it) 4. Now use the private key and decrypt the data stored from step 2. 5. Parse the decrypted data - and rejoice 6. KSUE -means key issue 7. __$$_jmd - the public key that we obtain __$_s1 : variable name for the Security object in the Helper.js file - that file has the calls to actually decrypt the data.

iancarroll 8y ago
This is insane. How much time did they put in to this pointless obfuscation, and then why would they go and document it all?
- jonknee 8y ago
  I would guess "management", probably under the name of Homeland Security. It seems to be some spaghetti code of loops/callbacks written by a frustrated jQuery developer. Here are some more fun tidbits: > /MasterZoom is the sum of the zoom levels from the routes_list.json file. That is the index in the routesList.v.json -> arr array where we have the public key stored. IF THE ROUTES_LIST CHANGES, REMEMBER TO CHANGE THE INDEX TO BE CORRECT / > /Salt Value - the element is at the 8th position. So we can essentially pick any number from 0-100 (length of the s array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 8. Salt has a length of 8 / > /Initialization Vector Value - the element is at the 32th position. So we can essentially pick any number from 0-100 (length of the IV array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 32 - IV has a length of 32 / And my favorite: > masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha
  - AdamJacobMuller 8y ago
    "Homeland Security"... and i'm on another list. Great.
- kingbirdy 8y ago
  I'd imagine it's something like company policy says it has to obfuscated, but the guy actually programming the site realizes it's pointless and fellow hackers could make good use of the data.
- gsnedders 8y ago
  Alternatively, all the comments were meant to be stripped out in some build stage.
- chris0x00 8y ago
  IANAL and things may have changed, but it was my understanding that having a copy protection mechanism, even a simple one, gives them better claim to DMCA protection of their content should someone do something they'd like to discourage. "Your honor they read our source code and stole our private key to break the encryption of our protected data" sounds better than "they downloaded the data we gave them"
  - jonknee 8y ago
    It's all pretty ridiculous considering it's a government owned corporation. They should not be obfuscating anything.
- kirykl 8y ago
  Maybe it’s another layer of misdirection
- reustle 8y ago
  While everyone here is thinking Amtrak implemented the copy protection, this map was actually built using CartoDB. I honestly just think it's something it includes by default. https://carto.com/ https://carto.com/
  - gregsadetsky 8y ago
    The mapping engine is CartoDB, but I (seriously) doubt that this copy protection was implemented by them. They're much more serious & better at writing good code. You can also see that the encrypted data stream is coming from https://maps.amtrak.com/services/MapDataService/trains/getTrainsData https://maps.amtrak.com/services/MapDataService/trains/getTr... which is an Amtrak-hosted backend service. If you look at the top comment in https://www.amtrak.com/services/maps.trainlocation.html https://www.amtrak.com/services/maps.trainlocation.html you'll see the name of the consultant that probably worked on this.
AdamJacobMuller 8y ago
// cw: FORCE the bloody stations to show at the initial zoom level. If this is not done, there is // a possibility that stations will not show in the initial map load. // I crib this shamelessly from SO...because it is so useful!! // http://stackoverflow.com/questions/3125065/how-do-i-limit-panning-in-google-maps-api-v3 /* __$$_jmd - public key masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha __$_s - salt value __$_v - iv vale */ This code is hilarious.

iancarroll 8y ago

This is insane. How much time did they put in to this pointless obfuscation, and then why would they go and document it all?

jonknee 8y ago
I would guess "management", probably under the name of Homeland Security. It seems to be some spaghetti code of loops/callbacks written by a frustrated jQuery developer. Here are some more fun tidbits: > /MasterZoom is the sum of the zoom levels from the routes_list.json file. That is the index in the routesList.v.json -> arr array where we have the public key stored. IF THE ROUTES_LIST CHANGES, REMEMBER TO CHANGE THE INDEX TO BE CORRECT / > /Salt Value - the element is at the 8th position. So we can essentially pick any number from 0-100 (length of the s array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 8. Salt has a length of 8 / > /Initialization Vector Value - the element is at the 32th position. So we can essentially pick any number from 0-100 (length of the IV array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 32 - IV has a length of 32 / And my favorite: > masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha
- AdamJacobMuller 8y ago
  "Homeland Security"... and i'm on another list. Great.
kingbirdy 8y ago
I'd imagine it's something like company policy says it has to obfuscated, but the guy actually programming the site realizes it's pointless and fellow hackers could make good use of the data.
gsnedders 8y ago
Alternatively, all the comments were meant to be stripped out in some build stage.
chris0x00 8y ago
IANAL and things may have changed, but it was my understanding that having a copy protection mechanism, even a simple one, gives them better claim to DMCA protection of their content should someone do something they'd like to discourage. "Your honor they read our source code and stole our private key to break the encryption of our protected data" sounds better than "they downloaded the data we gave them"
- jonknee 8y ago
  It's all pretty ridiculous considering it's a government owned corporation. They should not be obfuscating anything.
kirykl 8y ago
Maybe it’s another layer of misdirection
reustle 8y ago
While everyone here is thinking Amtrak implemented the copy protection, this map was actually built using CartoDB. I honestly just think it's something it includes by default. https://carto.com/ https://carto.com/
- gregsadetsky 8y ago
  The mapping engine is CartoDB, but I (seriously) doubt that this copy protection was implemented by them. They're much more serious & better at writing good code. You can also see that the encrypted data stream is coming from https://maps.amtrak.com/services/MapDataService/trains/getTrainsData https://maps.amtrak.com/services/MapDataService/trains/getTr... which is an Amtrak-hosted backend service. If you look at the top comment in https://www.amtrak.com/services/maps.trainlocation.html https://www.amtrak.com/services/maps.trainlocation.html you'll see the name of the consultant that probably worked on this.

AdamJacobMuller 8y ago

// cw: FORCE the bloody stations to show at the initial zoom level. If this is not done, there is // a possibility that stations will not show in the initial map load. // I crib this shamelessly from SO...because it is so useful!! // http://stackoverflow.com/questions/3125065/how-do-i-limit-panning-in-google-maps-api-v3 /* __$$_jmd - public key masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha __$_s - salt value __$_v - iv vale */ This code is hilarious.