4 ms·
> Hi Andreas - I'm not saying it was posted publicly by you or someone in the Bosnadev team. Please contact me directly (matt at recordedfuture dot com) and I w
by smokeyj 12y ago
> Hi Andreas - I'm not saying it was posted publicly by you or someone in the Bosnadev team. Please contact me directly (matt at recordedfuture dot com) and I will share more details with you.
You left this comment on Bosnadev's blog. Mind sharing with the rest of us?
- jcfrei 12y agoMaybe they posted the URL privately on some other platform (ie. slack, some instant messenger, whatsapp, who knows)? And recorded future got it from there?
- mattkrf 12y agoThat's basically right. Our system observed the URL elsewhere on the web - not on a private messaging service. We've offered to share those details with Bosnadev. RE: whether these comments really are from the RF team, we're about to post the same info on our own blog.
- legel 12y agoIf what you're saying is true, then where was the source of the "leak"? Perhaps you won't say, exactly, without the OP's permission?
- mattkrf 12y agoHere's the link to our blog: https://www.recordedfuture.com/facebook-chat-messages/ https://www.recordedfuture.com/facebook-chat-messages/
- themeek 12y agoThank you. Your link to the blog is broken (the href is missing an '='). Unfortunately no new information for those following the threads. Are there any plans to release more details (links, logs) publicly?
- n1nja5h03s 12y agoxpost from comment on the orig blog http://pastebin.com/ukBvSKyw http://pastebin.com/ukBvSKyw - Look at the timestamps. And no "Recorded Future" here, hence published before their fetch.
- themeek 12y agoSorry, I don't follow. Could you unpack this?
- LVB9 12y agoSearch Google for the "secret" URL. Make sure you click the option to show the "omitted" search results. In the search results, look for the results that date from before the article was posted. You will find an URL on pastebin.com. Look at the timestamp. This page contains a partial HTTP log, containing not only the relative URL but also, in the referrers, the complete "secret" URL. So, my conclusion is: in the group conducting the "secret" chat, somebody posted the HTTP log to Pastebin.com, and then, and only then, was the "secret" URL picked up by Recorded Future.
- themeek 12y agoCan a log on pastebin containing a relative path be resolved to an absolute URL?
- LVB9 12y ago(continued from previous comment) The "secret" string to google is "/_temp/cork.png". People should be aware that once they post an HTTP log to pastebin, their "secret" URLs are not secret anymore.
- LVB9 12y ago(continued) And now, somebody has deleted that pastebin page. Because they want this hoax to thrive?
- 12y ago