4 ms·

Someone is uploading things to github: https://github.com/hackedteam/ https://github.com/hackedteam/ Take a look at the GeoTrust repo... This is a very intere

Someone is uploading things to github: https://github.com/hackedteam/ https://github.com/hackedteam/ Take a look at the GeoTrust repo... This is a very interesting file, too: https://github.com/hackedteam/rcs-common/blob/master/lib/rcs-common/evidence/file.rb#L17 https://github.com/hackedteam/rcs-common/blob/master/lib/rcs...

HoochTHX 11y ago
That program appears to creates evidence on the target machine. I hope there will be a way to link this to the parallel construction group. Don't like the guy, plant evidence!/s
doki_pen 11y ago
Looks like they are actively distributing child pornography. They should be charged.
- chris_wot 11y ago
  How do you figure that?
  - doki_pen 11y ago
    I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.
    - DCoder 11y ago
      It seems like that code just builds random-ish data that conforms to the wanted file format and then gives it incriminating names. For example: [1] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence.rb#L110 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c... [2] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence/position.rb#L51 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...
      - ocschwar 11y ago
        I would guess that's part of a codebase for generating sales demos before LEOs.
      - ryan-c 11y ago
        That could plausibly be a tool for generating test data for forensics tools. The hardcoded paths don't make a lot of sense for actually trying to plant evidence.
- verteu 11y ago
  It's probably a dummy value. I doubt there's a sinister scheme to plant "John Doe <test@me.com>" in a victim's address book. [1] [1] https://github.com/hackedteam/rcs-common/blob/master/lib/rcs-common/evidence/addressbook.rb#L8 https://github.com/hackedteam/rcs-common/blob/master/lib/rcs...
deleted 11y ago
[deleted]
woah 11y ago
Is it just to have laws against child pornography? Looks like they are actively being used to frame the innocent.
MichaelGG 11y ago
What's so interesting? They have a default value, most likely for testing. I find it very hard to believe anyone thinks "child_porn.avi" is a compelling filename for child pornography. I'd imagine they'd be more like "<age> <gender> <explicit act>.mp4".
- bobcostas55 11y ago
  It's software sold to law enforcement/intelligence agencies, and it is designed explicitly to plant false evidence. Even post-Snowden I think that qualifies as interesting.
  - MichaelGG 11y ago
    Can you elaborate on "design explicitly to plant false evidence"? I don't know what the program does, but those path names are zero evidence, come on.
    - yAnonymous 11y ago
      The file explicitly said "evidence" in the first line. It's deleted now.
- sathio 11y ago
  yes, I thought the same exact thing, but then I've read this: > better evidence generation https://github.com/hackedteam/rcs-common/commit/7059fb04a189b40eed125493973f7ea6752544cc https://github.com/hackedteam/rcs-common/commit/7059fb04a189... probably those are just placeholders but the intent seems at least a bit shady
  - MichaelGG 11y ago
    Look at the change. They went from a unix-like file system path name to a Windows one. Considering they call to_utf16le_binary_null I'm going to guess they just wanted it to look reasonable (and perhaps not crash?) on Windows.

HoochTHX 11y ago

That program appears to creates evidence on the target machine. I hope there will be a way to link this to the parallel construction group. Don't like the guy, plant evidence!/s

doki_pen 11y ago

Looks like they are actively distributing child pornography. They should be charged.

chris_wot 11y ago
How do you figure that?
- doki_pen 11y ago
  I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.
  - DCoder 11y ago
    It seems like that code just builds random-ish data that conforms to the wanted file format and then gives it incriminating names. For example: [1] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence.rb#L110 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c... [2] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence/position.rb#L51 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...
    - ocschwar 11y ago
      I would guess that's part of a codebase for generating sales demos before LEOs.
    - ryan-c 11y ago
      That could plausibly be a tool for generating test data for forensics tools. The hardcoded paths don't make a lot of sense for actually trying to plant evidence.
verteu 11y ago
It's probably a dummy value. I doubt there's a sinister scheme to plant "John Doe <test@me.com>" in a victim's address book. [1] [1] https://github.com/hackedteam/rcs-common/blob/master/lib/rcs-common/evidence/addressbook.rb#L8 https://github.com/hackedteam/rcs-common/blob/master/lib/rcs...

deleted 11y ago

[deleted]

woah 11y ago

Is it just to have laws against child pornography? Looks like they are actively being used to frame the innocent.

MichaelGG 11y ago

What's so interesting? They have a default value, most likely for testing. I find it very hard to believe anyone thinks "child_porn.avi" is a compelling filename for child pornography. I'd imagine they'd be more like "<age> <gender> <explicit act>.mp4".

bobcostas55 11y ago
It's software sold to law enforcement/intelligence agencies, and it is designed explicitly to plant false evidence. Even post-Snowden I think that qualifies as interesting.
- MichaelGG 11y ago
  Can you elaborate on "design explicitly to plant false evidence"? I don't know what the program does, but those path names are zero evidence, come on.
  - yAnonymous 11y ago
    The file explicitly said "evidence" in the first line. It's deleted now.
sathio 11y ago
yes, I thought the same exact thing, but then I've read this: > better evidence generation https://github.com/hackedteam/rcs-common/commit/7059fb04a189b40eed125493973f7ea6752544cc https://github.com/hackedteam/rcs-common/commit/7059fb04a189... probably those are just placeholders but the intent seems at least a bit shady
- MichaelGG 11y ago
  Look at the change. They went from a unix-like file system path name to a Windows one. Considering they call to_utf16le_binary_null I'm going to guess they just wanted it to look reasonable (and perhaps not crash?) on Windows.