That program appears to creates evidence on the target machine. I hope there will be a way to link this to the parallel construction group. Don't like the guy, plant evidence!/s

Is it just to have laws against child pornography? Looks like they are actively being used to frame the innocent.

Looks like they are actively distributing child pornography. They should be charged.

It's probably a dummy value. I doubt there's a sinister scheme to plant "John Doe <test@me.com>" in a victim's address book. [1]

[1] https://github.com/hackedteam/rcs-common/blob/master/lib/rcs...

How do you figure that?

I was under the impression that they were planting files on the user's computer to incriminate them. I don't really understand where this code is getting it's payload from though.

It seems like that code just builds random-ish data that conforms to the wanted file format and then gives it incriminating names. For example:

[1] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...

[2] https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...

That could plausibly be a tool for generating test data for forensics tools. The hardcoded paths don't make a lot of sense for actually trying to plant evidence.

I would guess that's part of a codebase for generating sales demos before LEOs.

What's so interesting? They have a default value, most likely for testing.

I find it very hard to believe anyone thinks "child_porn.avi" is a compelling filename for child pornography. I'd imagine they'd be more like "<age> <gender> <explicit act>.mp4".

It's software sold to law enforcement/intelligence agencies, and it is designed explicitly to plant false evidence. Even post-Snowden I think that qualifies as interesting.

Can you elaborate on "design explicitly to plant false evidence"? I don't know what the program does, but those path names are zero evidence, come on.

The file explicitly said "evidence" in the first line. It's deleted now.

yes, I thought the same exact thing, but then I've read this:

> better evidence generation

https://github.com/hackedteam/rcs-common/commit/7059fb04a189...

probably those are just placeholders but the intent seems at least a bit shady

Look at the change. They went from a unix-like file system path name to a Windows one. Considering they call to_utf16le_binary_null I'm going to guess they just wanted it to look reasonable (and perhaps not crash?) on Windows.