Cryptome admits they leaked their logs (WAS: [cryptome] Cryptome has been leaking its user logs for over a year)

[Michael Best]

Most up to date version:
http://that1archive.neocities.org/subfolder1/cryptome-admits-leak.html


Before reading this, I recommend reading my first post raising concerns
that the alleged GCHQ Cryptome slide from could be a mockup
<http://that1archive.neocities.org/subfolder1/gchq-cryptome-slide.html>,
followed by my disclosure of Cryptome's leaked user logs
<http://that1archive.neocities.org/subfolder1/cryptome-leaked-logs.html>.

After refusing to comment
<http://web.archive.org/web/20151009170831/https:/twitter.com/Cryptomeorg/status/651652489704554497>,
denying it, accusing it of being disinfo
<http://web.archive.org/web/20151009170829/https:/twitter.com/Cryptomeorg/status/651838022909054978>,
accusing me of stealing data
<http://web.archive.org/web/20151007134316/https:/twitter.com/Cryptomeorg/status/651751155962396674>,
accusing me of being a newbie advertising for a spy job
<http://web.archive.org/web/20151009170826/https:/twitter.com/Cryptomeorg/status/651890295072755712>,
declaring that it was "a campaign" against them
<https://cpunks.org/pipermail/cypherpunks/2015-October/009681.html>,
accusing me of faking data
<http://web.archive.org/web/20151008125804/https:/twitter.com/Cryptomeorg/status/651777707873837056>,
declaring that all logs leak and they pay for the internet
<http://web.archive.org/web/20151009170824/https:/twitter.com/Cryptomeorg/status/652067337621929984>,
and deleting my post
<https://twitter.com/NatSecGeek/status/651907692081115137> to the
Cryptome mailing
list <https://cpunks.org/pipermail/cypherpunks/2015-October/009684.html>
alerting
them to the leak, Cryptome has acknowledged that the leaked logs I found
were legitimate. John Young/Cryptome then thanked me, which is apology
enough for all the accusations.

Date: Fri, 09 Oct 2015 11:54:05 -0400
To: Michael Best
From: John Young
Subject: Cartome AWStats











*You were right about AWStats data. Not the stats for Cryptome itself but
for the Cartome sub-directory, for four months, November 2009-February
2010. Included in a full site restoration by ISP NetSol after a full
shutdown in June 2013.The stats have been deleted from the Cryptome
archive. Probably best to not expose visitors' data further but then
nothing can be fully deleted or hidden.Thanks for discovering and reporting
in this.Publish this message if you like.Regards,John*

Immediately after receiving his email, I deleted the stat files from my
website. They were only published to force verification and public
disclosure about the leak. Now that it has been acknowledged, there's no
point in continuing to distribute them. If John provides a new
cryptographically signed Cryptome archive file without those logs, I will
replace the one hosted on Archive.org with the new, sanitized version. Note
that .7z may be best to prevent the archive's deriving process (it makes
individual files within the zip viewable) from making changes to the .zip
file which can cause it to no longer match the hash/cryptographic signature.
What does this mean for the slide that seems to show GCHQ spying on
Cryptome.org?

According to John Young's email, the leak is limited to the Cartome
sub-directory which would not include the Eyeball directory. However, the
time frame matches up perfectly and does include the time period the slide
appears to show. Determining whether or not the leak ever included the
Eyeball directory, and why NetSol's glitch only restored those four months
of the Cartome's stats to the Cryptome archive while trying to view a
random selection of the leaked files on the online server failed, requires
more information from NetSol, Cryptome's ISP. Inquiring about those details
from NetSol and disclosing them falls entirely to John Young and Deborah
Natsios. Presumably, John Young would have disclosed if a similar leak had
been found relating to the Eyeball directory, but it remains possible that
the information might have been deleted from the Cryptome archive prior to
2014-06-02
<https://thepiratebay.se/torrent/11113511/Cryptome_archive_2014-06-02> without
John realizing it had already leaked. More information will be required
before those possibilities can be excluded.

As of the time of this posting (13:45 Eastern October 9, 2015), John Young
has not added anything to his website, twitter account, or mailing lists
disclosing the now confirmed leak to his users. He did remove the graphic
advising his users that the GCHQ was/is allegedly monitoring them.
<http://web.archive.org/web/20151007140432/https:/twitter.com/Cryptomeorg/status/644123971051474944>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 5970 bytes
Desc: not available
URL: <http://lists.cpunks.org/pipermail/cypherpunks/attachments/20151009/bcd49255/attachment-0002.txt>