3 ms·

Are they... referring to a... Splunk logging agent? I doubt it, but maybe the JPEG packed a binary appended to the end of the image file? Either way, if such w

Are they... referring to a... Splunk logging agent? I doubt it, but maybe the JPEG packed a binary appended to the end of the image file? Either way, if such were the case, this payload would need to rely on the presence of, and thus exploit, some sort of vulnerability in whichever host cached it. Not impossible, but not exactly a trivial maneuver. If they had suspects in mind, and had an awareness of OS version and patch level, it might be within the realm of possibility to land a working payload. Furthermore, if they were targeting Navy personel, there might even be a level of control to selectively enable a backdoor that permits a more advanced outcome than would ordinarily be possible in the wild against random individuals around the world. Maybe the plan was to hit internal personnel with a specialized payload that only affects Navy assets...

plonker 7y ago
I'm reading this as a fantastically stupid misinterpretation of the technologies in play. We're reading what some clerk wrote, in a game of telephone, as the defense tries to escalate this into utter confusion over what the fuck is going on. Somewhere along the line, they name dropped a log analysis tool (splunk) to explain how, after the pixel/logo/image is requested and loaded, the request is logged (to apache http request logs on the server) and that those SERVER logs can be pulled and inspected... THEN, an admin, with total control over THE SERVER can scrape those logs via querying for the pixel requests with Splunk, which enables highly granular queries against a log stream across load balanced clisters, or what have you. A clerk would have near zero comprehension of the system architecture or the basics of http traffic and server monitoring, so, you know... You can expect some kind of authentic expression of breathless shock at the tale a defense attourney might weave, while they loudly complain... about... a fucking email signature. This is a nothingburger, through and through.

plonker 7y ago

I'm reading this as a fantastically stupid misinterpretation of the technologies in play. We're reading what some clerk wrote, in a game of telephone, as the defense tries to escalate this into utter confusion over what the fuck is going on. Somewhere along the line, they name dropped a log analysis tool (splunk) to explain how, after the pixel/logo/image is requested and loaded, the request is logged (to apache http request logs on the server) and that those SERVER logs can be pulled and inspected... THEN, an admin, with total control over THE SERVER can scrape those logs via querying for the pixel requests with Splunk, which enables highly granular queries against a log stream across load balanced clisters, or what have you. A clerk would have near zero comprehension of the system architecture or the basics of http traffic and server monitoring, so, you know... You can expect some kind of authentic expression of breathless shock at the tale a defense attourney might weave, while they loudly complain... about... a fucking email signature. This is a nothingburger, through and through.