Talk:1247: The Mother of All Suspicious Files

2013-08-05T14:01:27Z

Sonofaresiii:

LNK and ZDA...Link and Zelda? [[Special:Contributions/76.64.65.200|76.64.65.200]] 13:43, 5 August 2013 (UTC)

http://www.ip-tracker.org/locator/ip-lookup.php?ip=65.222.202.53, some place in the USA. Looks random, but still...

Someone mentioned you see the word Hackers as well as a pirated movie... In fact the pirated movie is the 1995 movie named Hackers. Edited it to make the reference clear.

1247: The Mother of All Suspicious Files

2013-08-05T13:59:27Z

Sonofaresiii: /* Explanation */

{{comic
| number = 1247
| date = August 5, 2013
| title = The Mother of All Suspicious Files
| image = the_mother_of_all_suspicious_files.png
| titletext = Better change the URL to 'https' before downloading.
}}

==Explanation==
The save dialogues shows a download from [65.222.202.53 http://www.utrace.de/?query=65.222.202.53] with a very long file title. Many of the extensions used inside there indicate executable code. You also see common download syntax for a pirated movie, Hackers, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious.

The title text suggests changing from http to https, as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. http (Hyper Text Transfer Protocol) and https (Hyper Text Transfer Protocol - Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. The end recipient will still get whatever nasties were in the original, however -- encrypting it doesn't change the content at all.

The IP address referenced in the comic, 65.222.202.53, is currently being used by the shellcode of a Javascript 0-day exploit for the Tor Browser Bundle being run by the FBI to phone home over the clearnet and de-anonymize visitors to websites on Freedom Hosting that are serving child pornography. http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/

==Transcript==
<pre style="white-space: pre-wrap;">
[A save dialogue popup with an alert sign]
Warning!
This type of file can harm your computer! Are your sure you want to download: http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=--AUTOEXEX.BAT.MY%20OSX%20DOCUMENTS-INSTANLL.EXE.RAR.INI.TAR.DOCX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS-(1995)-BLURAY-CAM_XVID.EXE.TAR.[SCR].LISTP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.SWF.DPKG.APP.ZIP.TAR.CO.GZ.OUT.EXE

[Two buttons] Cancel Save
</pre>

{{comic discussion}}

explain xkcd - User contributions [en]

Talk:1247: The Mother of All Suspicious Files

1247: The Mother of All Suspicious Files