Hacker News Reader

Comment by moyix | Hacker News Reader

More confirmation that it's actually from NSA:

https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowd...

There's a string ("ace02468bdf13579") that is mentioned in a previously-unreleased document from the Snowden cache and also found in some of the binaries contained in the dump.

View on HN

Is it not possible to replace an existing string in the binary with that one?

The (yet unpublished) documents obtained by Snowden had the same string as found in the sample files. The documents were not available to the publisher of the files to use.

To what end?

Pecking order hash: http://www.ijirst.org/articles/IJIRSTV1I9059.pdf I_10 = ACE02468 I_11 = BDF13579 https://github.com/sivagtr/POH He works at Cisco :P

To connect it with the same speculation that's being made right now?

It's the timing that makes the connection. The sequence of events is:

1. Snowden leaves NSA with documents. Some of these (but, crucially, not all) are published.

2. Shadow Brokers release something claiming to be NSA hacking tools containing ace02468bdf13579 string.

3. The Intercept looks in the unreleased parts of the Snowden documents and finds the same string.

Thus, the fact that the leaked tools contain non-public NSA-specific information is what makes it clear the tools originate from NSA. The only other possibility is that the Shadow Brokers also had access to the full set of Snowden documents and decided to use them to fake the dump, which is much, much less likely.

You could start dropping ace02468bdf13579 into binaries willy nilly now, but it wouldn't do much, because that's now public information.

Or am I missing something?

Birthday paradox.

While that 64-bit value would be just as likely to occur as any other if randomly chosen, any competent programmer is going to recognize a very strong pattern in that value's binary representation that makes it much more likely to have been chosen with intent. In fact, the pattern is so strong, there's a chance that the appearances of the value in two places is simply a coincidence.

Specifically, in C, it's

  (0x01234567uLL + 0x55555555 & 0x77777777) * 0x200000002 + 0x11111111

Yes, googling for the 32-bit parts of that 64-bit hex value gets me two distinct hits:

2015:

http://www.ijirst.org/articles/IJIRSTV1I9059.pdf

and 2013:

https://www.halowaypoint.com/en-us/forums/d76f090378914a9bb8...

Still, the string (instead of the binary values) is somewhat less probable than this to be an accidental match.

Suppose the ace02468bdf13579 is a random hex string. That's 8 bytes of data, or 1/2^64 to get that specific value. With the birthday paradox, that only gets you down to 1/2^32 or one in 4 billion chance. Not happening.

Well, if the string was a widely occuring one (say, because it's useful in some coding task, etc.) you might expect it to turn up a few times in a google search for occurrences prior to Aug 1 2016.

But, apparently not: https://www.google.com/search?q=ace02468bdf13579&client=fire...

Lol the chances of a collision are still too low.

Reply on news.ycombinator.com