5 ms·

Looks like they are actively distributing child pornography. They should be charged.

• chris_wot 11y ago
  How do you figure that?
  • doki_pen 11y ago
    I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.
    • DCoder 11y ago
      It seems like that code just builds random-ish data that conforms to the wanted file format and then gives it incriminating names. For example: [1] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence.rb#L110 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c... [2] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence/position.rb#L51 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...
      • ocschwar 11y ago
        I would guess that's part of a codebase for generating sales demos before LEOs.
      • ryan-c 11y ago
        That could plausibly be a tool for generating test data for forensics tools. The hardcoded paths don't make a lot of sense for actually trying to plant evidence.
• verteu 11y ago
  It's probably a dummy value. I doubt there's a sinister scheme to plant "John Doe <test@me.com>" in a victim's address book. [1] [1] https://github.com/hackedteam/rcs-common/blob/master/lib/rcs-common/evidence/addressbook.rb#L8 https://github.com/hackedteam/rcs-common/blob/master/lib/rcs...