4 ms·

xpost from comment on the orig blog http://pastebin.com/ukBvSKyw http://pastebin.com/ukBvSKyw - Look at the timestamps. And no "Recorded Future" here, hence pu

xpost from comment on the orig blog http://pastebin.com/ukBvSKyw http://pastebin.com/ukBvSKyw - Look at the timestamps. And no "Recorded Future" here, hence published before their fetch.

themeek 11y ago
Sorry, I don't follow. Could you unpack this?
- LVB9 11y ago
  Search Google for the "secret" URL. Make sure you click the option to show the "omitted" search results. In the search results, look for the results that date from before the article was posted. You will find an URL on pastebin.com. Look at the timestamp. This page contains a partial HTTP log, containing not only the relative URL but also, in the referrers, the complete "secret" URL. So, my conclusion is: in the group conducting the "secret" chat, somebody posted the HTTP log to Pastebin.com, and then, and only then, was the "secret" URL picked up by Recorded Future.
  - themeek 11y ago
    Can a log on pastebin containing a relative path be resolved to an absolute URL?
- LVB9 11y ago
  (continued from previous comment) The "secret" string to google is "/_temp/cork.png". People should be aware that once they post an HTTP log to pastebin, their "secret" URLs are not secret anymore.
- LVB9 11y ago
  (continued) And now, somebody has deleted that pastebin page. Because they want this hoax to thrive?
  - legel 11y ago
    ...weird, indeed. Since the OP published the article implying such a grand circumstance, and commented "I assure you it was not posted publicly by any of us. Newly created URL and link c/p to fb chat.", I believe that there are still a few basic questions in order, in any case: 1. What "link generation" program was the OP using? Is it possible this program streamed its output through something like Pastebin - without the explicit knowledge of the OP - and if so, can we verify this is the case by following up with an example? 2. Can the representative from Recorded Future comment on whether or not this site, Pastebin, is being monitored? Thanks all, for what we'd surely hope to be a trivial, if unusual, case of software being stealthy...

xpost from comment on the orig blog http://pastebin.com/ukBvSKyw http://pastebin.com/ukBvSKyw - Look at the timestamps. And no "Recorded Future" here, hence published before their fetch.

themeek 11y ago

Sorry, I don't follow. Could you unpack this?

LVB9 11y ago
Search Google for the "secret" URL. Make sure you click the option to show the "omitted" search results. In the search results, look for the results that date from before the article was posted. You will find an URL on pastebin.com. Look at the timestamp. This page contains a partial HTTP log, containing not only the relative URL but also, in the referrers, the complete "secret" URL. So, my conclusion is: in the group conducting the "secret" chat, somebody posted the HTTP log to Pastebin.com, and then, and only then, was the "secret" URL picked up by Recorded Future.
- themeek 11y ago
  Can a log on pastebin containing a relative path be resolved to an absolute URL?
LVB9 11y ago
(continued from previous comment) The "secret" string to google is "/_temp/cork.png". People should be aware that once they post an HTTP log to pastebin, their "secret" URLs are not secret anymore.
LVB9 11y ago
(continued) And now, somebody has deleted that pastebin page. Because they want this hoax to thrive?
- legel 11y ago
  ...weird, indeed. Since the OP published the article implying such a grand circumstance, and commented "I assure you it was not posted publicly by any of us. Newly created URL and link c/p to fb chat.", I believe that there are still a few basic questions in order, in any case: 1. What "link generation" program was the OP using? Is it possible this program streamed its output through something like Pastebin - without the explicit knowledge of the OP - and if so, can we verify this is the case by following up with an example? 2. Can the representative from Recorded Future comment on whether or not this site, Pastebin, is being monitored? Thanks all, for what we'd surely hope to be a trivial, if unusual, case of software being stealthy...