4 ms·

I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's p

I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.

DCoder 11y ago
It seems like that code just builds random-ish data that conforms to the wanted file format and then gives it incriminating names. For example: [1] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence.rb#L110 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c... [2] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c295bea021429848a3666647827/lib/rcs-common/evidence/position.rb#L51 https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...
- ocschwar 11y ago
  I would guess that's part of a codebase for generating sales demos before LEOs.
- ryan-c 11y ago
  That could plausibly be a tool for generating test data for forensics tools. The hardcoded paths don't make a lot of sense for actually trying to plant evidence.