CIA 2010 covert communication websites JAR reverse engineering by Ciro by 
Ciro Santilli 40 2026-10-23
Ciro Santilli 40 2026-10-23.
./c
./c/b
./c/b/b.class
./c/b/c.class
./c/b/d.class
./c/b/a
./c/b/a/a.class
./c/b/a/b.class
./c/b/a/c.class
./c/b/a/d.class
./c/a
./c/a/a.class
./c/a/b.class
./c/a/c.class
./b
./b/a
./b/a/a
./b/a/a/e.class
./b/a/a/f.class
./b/a/a/a.class
./b/a/a/b.class
./b/a/a/g.class
./b/a/a/c.class
./b/a/a/d.class
./META-INF
./META-INF/MANIFEST.MF
./a
./a/cre
./a/a
./a/a/b
./a/a/b/a.class
./a/a/a
./a/a/a/e.class
./a/a/a/applet.configs
./a/a/a/b
./a/a/a/b/e.class
./a/a/a/b/f.class
./a/a/a/b/b.class
./a/a/a/b/g.class
./a/a/a/b/c.class
./a/a/a/b/d.class
./a/a/a/b/a
./a/a/a/b/a/a.class
./a/a/a/b/a/b.class
./a/a/a/b/a/c.class
./a/a/a/c.class
./a/a/a/d.class
./a/a/a/a
./a/a/a/a/a.class./META-INF/MANIFEST.MFManifest-Version: 1.0
Ant-Version: Apache Ant 1.7.1
Created-By: 1.5.0_17-b04 (Sun Microsystems Inc.)web.archive.org/web/20110207204640/http://flyingtimeline.com/aircraft.jar is very similar looking.
META-INF/MANIFEST.MF is identical:Manifest-Version: 1.0
Ant-Version: Apache Ant 1.7.1
Created-By: 1.5.0_17-b04 (Sun Microsystems Inc.)web.archive.org/web/20110202185659/http://differentviewtoday.com/bwm.jar is a bit different with tree:and:
META-INF/MANIFEST.MF
a/a.class
b/a/a/a.class
b/a/a/b.class
b/a/a/c.class
b/a/b/a.class
b/a/b/b.class
b/a/b/c.class
b/a/b/d.class
b/a/b/e.class
b/a/bw.properties
b/a/c.class
c/a/a/a.class
c/a/a/b.class
c/a/a/c.class
c/a/a/d.class
c/a/b.class
c/a/c.class
c/a/d.class
c/a/e.class
c/b/a.class
c/b/b.class
c/b/c.classMETA-INF/MANIFEST.MF
Manifest-Version: 1.0
Ant-Version: Apache Ant 1.6.5
Created-By: 1.5.0_12-b04 (Sun Microsystems Inc.) CIA 2010 covert communication websites JAR reverse engineering by quat1024 by Ciro Santilli 40 2026-10-23
Ciro Santilli 40 2026-10-23The most advanced reverse engineering effort prior to Codex had been by GitHub user quat1024, an undergratuate student at Ohio State University, Minecraft modding extraordinaire and furry afficionado. Minecraft is written in Java, which may partly explains his Java skills.He managed to deobfuscate the strings present inthe JARs using Enigma, possibly github.com/FabricMC/Enigma, a Java reverse engineering tool. Cool findings on web.archive.org/web/20110208072027/http://newsupdatesite.com/update.jar include:
CIA 2010 covert communication websites JAR reverse engineering by Codex by Ciro Santilli 40 2026-10-23
Ciro Santilli 40 2026-10-23This project was originally done before Ciro Santilli knew how to use Codex and before Codex was so incredibly strong. Codex 6 Astra High can now just disassemble, deobfuscate and datamine the fuck out of such binaries, so we asked it to. Unfortunately it couldn't really find anything mind blowing, but here are the results anyways.
The analysis scripts is: jar.py and it should be pointed to a dump directory of the websites such as CIA 2010 websites dump. The analysis below was done as of commit b9eb31618c36421133e4875bc1cd7d7ac7763a32.
These scripts produce TODO directories.
The JARs are obfuscated, and Codex believes that they have a strong match to the Zelix KlassMaster commercial obfuscator, and points to this analysis from 2006: www.exploit-db.com/docs/english/13132-cracking-string-encryption-in-java-obfuscated-bytecode.pdf. Zelix appears to have the exact same string obfucation mechanism quat1024 had already previously manually discovered. It stores all string literals XOR'ed with 5 consecutive key bytes along:It then injects an encoder/decoder for this which transforms the strings as neede at runtime. The bytes are present in each class file itself.
switch (character_index % 5):
case 0: key = 47
case 1: key = 41
case 2: key = 84
case 3: key = 35
default: key = 14Zelix is made by an Australian company based in Narraweena and its website proudly sates:Shame they failed to list the CIA in their users list! I'm goign to ping them actually.
Leading Java Obfuscator since 1997
Here are the best small finds:
- some of the
resource/resources.binfiles contain the string:Codex could not find any clear public reference to what#Auto-generated Starbuck client config fileStarbuckis, which leads to the tentalizing possibility that could be an internal project codename. Though the possibility that it is just some internal of some public tool so obscure that even the web has lost track of it is also too strong to refute entirely.This string is part of a more complete key/value pair, e.g.dryterrainnews.comcontains:which would be present insie the- key:
Config.properties.old.1277148810409 - value:
#Auto-generated Starbuck client config file: Mon Jun 21 14:32:02 ACT 2010 #Mon Jun 21 14:32:02 ACT 2010 ServerURL=http\\://www.dryterrainnews.com/cgi-bin/nigeria.cgi EncSharedSecret=7A948986EF08B9DDF800E5AF229EC118D4F8AD9609C5080CBF2AB92397C2A9B8 KeyE=1F7D7 KeyN=67D8EA7BF935232E55863DCED7A279F701B7492316FE96F15D00C983CBFDB93B97D35898FA8928FA13D4F320E2B62D1B92F08FA8692F7D043EC197E2857D2A540E01A2529AEB232EB386917992B80D5CADE283D2C4E8DCBF682704F419E29D013FFCF33D9A1BC94E4AA469058BB508EEE1D654CF9FC4B89977A13FA33CDEDAED
resource/resources.binfile present inside the JAR.resource/resources.binfile is encrypted with International Data Encryption Algorithm, a public symmetric encryption standard. However the key is itself present inside the JAR as an XOR obfuscated string.The decrypted form ofresource/resources.binis a custom key value format which Codex could not identify the source of for the life in it. The JAR contains a decoder for it in its code.There are different alternative filenames for this file all with the same format, each one with a single key used across all JARs, and each JAR having at most one of them:Applet.properties: key:7A5DAEC4029C91ED, occurances: 76. Exmaple:aryannews.net/20101229122727/headlines.jarpathc/b/b/Applet.properties.Client.properties: key:60A514D96C19F93C, occurances: 33. Example:activegaminginfo.com/20110202130304/gaming.jarpatha/b/f/Client.propertiesresource/resources.bin: key:0C5C45F2EC3C2A63, occurances: 45. Example:all-sport-headlines.com/20110207144821/birdie.jarpathresource/resources.bin
The remaining JARs use other arrangements:applet.configs, XOR-obfuscated as a single string: 35. Example:aeronet-news.com/20110202122601/aeronet.jarpatha/a/b/applet.configs. Deobfuscated content might look like:#Applet Properties #Thu Aug 19 08:19:00 AMT 2010 RequestKey.UserData.1.IsQuery=set Applet.BundleSize=1 ResponseKey.UserData.0.Size=85bw.properties, ZIP-packed: 30. Example:casanewsnow.com/20110201184918/casanews.jarpathb/a/bw.properties- none of these configuration resources: 9. Example:
factorforcenews.com/20110202125321/factorspeed.jar
- key:
- there's a certain number of timestamps present in the Jars. Although these could have been faked, it feels unlikey that they were. The sources of those include:
- ZIP modification time of each file
- Certificate validity dates:
- present in 37 JARs. Example:
latinamericanewsbeat.com/20100513191045/today.jarfileMETA-INF/INLINE.DSA - timezone: yes
- format: Standard binary
PKCS#7/X.509encoding unencrypted, readable with OpenSSL - usage: these are part of a standard JAR public key signatures scheme, which if a key trusted would have given greater execution priviledges to the JAR. They are validly signed but self signed as you might expect...
- present in 37 JARs. Example:
applet.configs: comment timestamp as shown aboveStarbuckclient comment as shown above:#Auto-generated Starbuck client config file: Mon Jun 21 14:32:02 ACT 2010- config key backup Unix epoch milliseconds key, e.g. the
1277148810409inConfig.properties.old.1277148810409. So their editing tool kept backups as they were editing it, which is a small OPSEC defect.
We've dumped timestamp data to: github.com/cirosantilli/media/blob/master/cia-2010-covert-communication-websites/jar/dates.csv No dates of interest was found in the SWF.
Many of the timestamps present are much older than the earliest archive we have for each website, suggesting that they were around for much longer. E.g. 2005-06-02.
The operators worked exclusively on weekdays, and much less on Friday than other days of the week, lol they're only human:92% of timestamps fall in conventional work hours between 08:00 and 18:00, so it was not a James Bond work through the clock to save the world business.
Day Configuration timestamps Distinct configuration calendar dates ZIP timestamps¹
Monday 21 11 72
Tuesday 12 10 78
Wednesday 16 13 72
Thursday 12 11 72
Friday 5 5 60
Saturday 0 0 0
Sunday 0 0 0The timezones are:
Timezone label applet.configs Backups in resources.bin Total Possible locations / interpretations
EST 9 4 13 Eastern United States, eastern Canada, parts of the Caribbean
EDT 8 11 19 Eastern United States, eastern Canada, parts of the Caribbean
AMT 18 0 18 Western Brazil (Amazon Time), Armenia
ACT 0 16 16 Acre in Brazil (Acre Time), Northern Territory in Australia if interpreted as Java’s short timezone IDThere are a few plausible timestamp trigram documentations with slightly different possibilities among them:
- code.googlesource.com/edge/openjdk/+/refs/heads/master/jdk/src/share/classes/java/time/ZoneId.java
- docs.oracle.com/cd/E98457_01/opera_5_6_core_help/PDFs/Time_Zones.pdf
- //android.googlesource.com/platform/libcore/+/9f08ee8977750b228382eaf9a081f4847a1e0377/jdk/src/share/classes/sun/util/resources/TimeZoneNames.java
EST an EDT are obvious, Langley. ACT is understandable, Australia, a Five Eyes country and center of US espionage is East Asia. But AMT? That one is weird.
A few sites have timestamps from multiple locations e.g.:
Site Labels and counts
internationalnewsworthiness.com EDT ×2, ACT ×2
intlnewsdaily.com EDT ×2, ACT ×1
www.myhealthlibrary.net EDT ×1, ACT ×5
www.todaysnewsreports.net EDT ×1, ACT ×3Codex also spots the interesting case of myhealthlibrary on April 11, 2011 backup sequence, configuration comments go:which in UTC would jump backwards in time if ACT actually means Australia...but would work neatly if ACT is actualy Acre Standard time at UTC-4. Damn, Brazilian operators???Codex also comments:Too strong. Too strong.
09:18:19 ACT
13:59:13 EDT
13:34:14 ACT
13:43:20 ACT
14:17:18 ACT09:18:19 ACT April 10, 23:48:19
13:59:13 EDT April 11, 17:59:13
13:34:14 ACT April 11, 04:04:14
13:43:20 ACT April 11, 04:13:20
14:17:18 ACT April 11, 04:47:1814:18:19 UTC
17:59:13 UTC
18:34:14 UTC
18:43:20 UTC
19:17:18 UTCCodex did some SWF reverse engineering for us creating the analysis script: jar.py and should be pointed to a dump directory of the websites such as CIA 2010 websites dump. The analysis below was done as of commit b9eb31618c36421133e4875bc1cd7d7ac7763a32.
Unfortunately, the SWF are much less interesting than the JAR files.
According to Codex' analysis, it is just a lean client, and doesn't even contain its own UI which seems to be downloaded from the server. As such, we will never know what it actually looked like.
One thing that they do do is to load a gallery or things that it loops through, presumably images, and loop through them automatically. These are loaded one by one from the server, and it keeps doing server requests after that.
Codex mentions that the SWF could also download another SWF to execute, which could in turn contain the login UI, possibly upon click. But it is all hidden.
A particularly interesting example is worlddispatch.net/servlet/news2. This is apparently a helper page for the SWF, but perhaps because the website became broken after it was abandoned, it was archived, and contains the following 10 bytes of a URL query string:Codex' reverse engineering identified what the parameters do exactly:
c=0&f=3424GPT-6 noticed the following not so mind-blowing facts about some media present in some of the websites
33 images on stickshiftnews.com record Photoshop saves on 2010-08-24, 14:16:41–14:17:50 at UTC-4 (Langley): a 69-second batch. This supports batch asset preparation possibly from ImageReady, and also gives us the exact Photoshop version used and operating system: Adobe Photoshop CS4 (released 2008). They used Windows. That's the real reason the network went down!gives:
exiftool -r -q -if '$HistoryWhen' -p '$HistoryWhen | $HistoryAction | $HistorySoftwareAgent | $Directory/$FileName' stickshiftnews.com | sort2010:08:24 14:16:41-04:00 | created | Adobe Photoshop CS4 Windows | stickshiftnews.com/20110207233507/images/199.jpg
2010:08:24 14:16:44-04:00 | saved | Adobe Photoshop CS4 Windows | stickshiftnews.com/20110207232515/images/2.jpg
...
2010:08:24 14:17:50-04:00 | created | Adobe Photoshop CS4 Windows | stickshiftnews.com/20110207232233/images/9.jpgFour graphics across ballbatstumpsandbails.com and myhealthlibrary.net share gives:However that same UUID also appears on a few unrealted Google hits e.g.:so it cannot reliably establish a connection between their operators. TODO how did that come about. LLMs say that this UUID comes from PhotoShop and depends on the exact version, but they are not fully clear on the details of how they come about.
uuid:B48CC374F6E2DC1193D6E593F704EF94:exiftool -r -q -if '$OriginalDocumentID eq "uuid:B48CC374F6E2DC1193D6E593F704EF94"' -p '$Directory/$FileName | $OriginalDocumentID' ballbatstumpsandbails.com www.myhealthlibrary.netballbatstumpsandbails.com/20110202033048/images/bbsb-logo.jpg | uuid:B48CC374F6E2DC1193D6E593F704EF94
ballbatstumpsandbails.com/20110202033025/images/cornerimg.jpg | uuid:B48CC374F6E2DC1193D6E593F704EF94
www.myhealthlibrary.net/20111015023625/images/back.gif | uuid:B48CC374F6E2DC1193D6E593F704EF94
www.myhealthlibrary.net/20111015023519/images/top.jpg | uuid:B48CC374F6E2DC1193D6E593F704EF94We have dumped all the websites from Wayback Machine to: github.com/cirosantilli/cia-2010-websites-dump to make it easier to datamine their contents.
This section is about blockchain explorers focused on inscriptions.
- writteninbitcoin.com/en Attempts to index various different formats and show previews, including images. They've added support for AtomSea & EMBII data format which is cute. Also serves as pay for inscription inscription service: writteninbitcoin.com/en/create. Nice, we've been needing one since cryptograffiti.info: . Closed source.
www.wsj.com/tech/openai-who-is-greg-brockman-e699816c from May 29, 2026 mentions:
[...] the couple married a year later, which included a civil ceremony at OpenAI with a robotic hand ring bearer
The daughter of Korean immigrants, Anna worked in tech, including at Stripe, although not at the same time as Brockman, he said. She is intensely private: almost no information, including her maiden name, is available online. In one political contribution last year, her profession was listed as “retired.” She declined to comment.
The best approch to find her maiden name might be to look into dumps of Stripe employee emails. According to his LinkedIn, Gret was at Stripe from 2010 to 2015, so it must be outside of that ti
There are unlisted articles, also show them or only show them.