WikiLeaks Posts Mysterious 'Insurance' File

An interview with a WikiLeaks volunteer indicated that release of encrypted unreleased data is standard procedure.

The Pentagon also hopes to stop WikiLeaks from making public the contents of a mammoth encrypted file recently added to the site. Contents of that file remain a mystery and Schmitt did not want to comment specifically on the content of a file the group posted online with the label "Insurance" in recent days. He only said that "we regularly distribute backups of documents that have not been published ... This one has just been placed on a very popular site right now to make sure that it has been distributed as widely as possible."

Source

One can draw conclusions as to password strength from this, I think. This is the interview in which WL said they were misquoted (from their Twitter feed). I think this is the corrected version.

Originally posted by JBA2848
And heres a simple question for those who are determined that this program must be ran in open ssl. Wikileaks releases to the world multiplatforms. Why would that pick a limited platform only. Meaning they are useing a software program for encryption that is not platform limited.

Here's a Windows version of OpenSSL - So that covers about 90% of desktop computers... Add to that OpenSSL running on Linux/Unix and you have >90% of personal computers able to decrypt this with OpenSSL...

And what exactly do you mean by this:

Originally posted by JBA2848
Wikileaks releases to the world multiplatforms.

Earlier you suggested that a hardware encrypted USB flash drive was required to use the insurance file, and then later a hardware encrypted portable hard drive - those are both very limited with respect to world wide use. So you are contradicting yourself on how you think WL operates...



[edit on 8-8-2010 by CommandoJoe]

reply to post by mikeATSuser


Nice.
But to be on the safe side, I think I'll wait till they add a disclaimer to the page they've posted the file on. That's the most sane thing for them to do, isn't it?

ok so freedomusic I've been at work lately and such and Could you write a script that makes it make a list of the files made becasue my harddrive can't take that many 1.4 gb files being made so like make it delete the files and log which ones worked>

reply to post by ymgve


Missed your comment in all of this.
No, openssl can read the whole file if it needs to (it doesn't), the output from *it* and openssl is dropped by 'head' after the first 32 bytes is written to stdout, which is then passed to 'file'. It's just a file type tester that works really fast without decrypting the whole file. Anyway, this was tested on a several files encrypted with known keys and works. If you do find a bug, please quote how to reproduce it.

statsman, just add this to your existing script:

openssl enc -d -$name -in insurance.aes256 -out $of -pass pass:$pass;

if [ $? -ne 0 ]; then
# remove the file
rm -f $of;
else
echo GOOD: $of;
fi

The $? variable is checking the return value of the openssl call.

reply to post by CommandoJoe

And what exactly do you mean by this:

Originally posted by JBA2848
Wikileaks releases to the world multiplatforms.


Earlier you suggested that a hardware encrypted USB flash drive was required to use the insurance file, and then later a hardware encrypted portable hard drive - those are both very limited with respect to world wide use. So you are contradicting yourself on how you think WL operates...

You seem surprised?

frredommusic you're amazing!

I do wonder if anyone yet has found out that the code to unlock insurance is the same numeral code in the recent movie Inception.

Well not really but it would be worth a try.

If you've downloaded the file change the filename and the file extention.

There are ways to ferret-out a known file. It doesn't matter if you've saved it to disk or USB drive. The moment it is accessed by your PC they will spot it.

Then they will spot you.

reply to post by Slippery Jim

And do exactly what?
Specifically with every journalist and 14 year olds worldwide who thought it might be a good idea to have a dvd-r copy shelved?..

Originally posted by the.krio
reply to post by Slippery Jim

 

And do exactly what?
Specifically with every journalist and 14 year olds worldwide who thought it might be a good idea to have a dvd-r copy shelved?..

Wipe it.

Continue to use that file on a PC which is online and that is the only outcome.

They already know who has downloaded the file.

Any attempt to reveal the contents offline will be dealt with in the usual way.

Everyone is assuming that this file was encrypted by the government.

Given that the US has the person who leaked the files in custody it is fair to say they have an idea of what may have been leaked based on what his job was. If the file is under Gov encryption then they will know what it is and can make plans for countering it.

However if the file was encryted by Wikileaks then it is a far scarier threat.

The US will know roughly what might be in the file, but cannot be 100% sure. With people around the world downloading the file it is guarenteed if the key is ever released that the unencrypted info will soon follow.

That may be the insurance, release the info but give no clue as to what it maybe. Make them sweat over what he may have just released to the world based on what they think he might have.

Somebody (probably alot of somebodies) is not sleeping well right now.

I'm trying to help.

Second stupid line.

reply to post by Slippery Jim


Anyone who reads "Stainless steel rat" would be better suited to helping Assange hide or save the universe lol.
You just became an instant friend for me.
To keep it on topic i have downloaded the file and burnt it to dvd just in case.
I dont have the skills to do anything with it.

[edit on 9/8/2010 by SvenTheBerserK]

Originally posted by Slippery Jim

They already know who has downloaded the file.

For everybody who thinks this is true... its not.

Anybody who knows computer networks knows its not. There are lots of ways to stay anonymous. So no, they dont know who has downloaded the file. They may know some of them, but thats completely useless information for trying to prevent the contents from getting published. They would need to find everybody who have downloaded the file. And that is not in their power.




[edit on 9-8-2010 by Copernicus]

Originally posted by Slippery Jim
They already know who has downloaded the file.

They may have my IP address, but they don't know who I am.

If I ever want to release the decrypted file (unlikely, I am not even trying to decrypt it) I just have to buy one of those pre-paid USB stick modems and use it wherever I want.

PS: adding "second line" doesn't change a thing, the one line rule is not an automatic thing, it depends on what you write on that one line.

Originally posted by Copernicus
For everybody who thinks this is true... its not.

Anybody who knows computer networks knows its not. There are lots of ways to stay anonymous. So no, they dont know who has downloaded the file. They may know some of them, but thats completely useless information for trying to prevent the contents from getting published. They would need to find everybody who have downloaded the file. And that is not in their power.

You have no idea of their surveillance abilities.

If you have downloaded the file they know who you are.

I've downloaded it, renamed it, changed the file extention, burned it to disk and given a copy to someone I can trust.

I suggest you do the same.

Originally posted by ArMaP

Originally posted by Slippery Jim
They already know who has downloaded the file.

They may have my IP address, but they don't know who I am.

If I ever want to release the decrypted file (unlikely, I am not even trying to decrypt it) I just have to buy one of those pre-paid USB stick modems and use it wherever I want.

PS: adding "second line" doesn't change a thing, the one line rule is not an automatic thing, it depends on what you write on that one line.

If they have your IP they can backtrack you via your ISP.

If you try to release the file with its original name they can spot it and erase it. Hence why I advise renaming it and its file extention. Using the original file extention it is easy to match the file size and identify the file.

I added the "second line" because this site refused to display my original post because it was "too short." You're a Mod, thats your problem.

Originally posted by SvenTheBerserK
reply to post by Slippery Jim

 

Anyone who reads "Stainless steel rat" would be better suited to helping Assange hide or save the universe lol.
You just became an instant friend for me.
To keep it on topic i have downloaded the file and burnt it to dvd just in case.
I dont have the skills to do anything with it.

[edit on 9/8/2010 by SvenTheBerserK]

Finally! Someone gets where my Username comes from!

Seriously though, do not use the original file on any system connected to the web.