Title: XKEYSCORE Appids & Fingerprints

Release Date: 2015-07-01

Description: This undated NSA presentation gives a technical introduction to the treatment of AppIDs within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

Document: xks-application-ids-p1-normal.gif:
XKEYSCORE
Appids & Fingerprints

xkeyscore@nsaxks-application-ids-p2-normal.gif:
• Syntax is similar to C:

functionCname', level, coptional info ) = 'search terms and
patterns';

• Two main functions - appid and fingerprint:

appid('chat/icq', 8.5, wireshark='icq', chatproc='ICQ‘) =
/[''o]icq/c and $icq;

fingerprint('fingerprint/phone/nokia/generic') =

'user-agent: nokia' or

'profile: http://nds.nokia.eom/uaprof/n';

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p3-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

Namina Conventions

Appids are named using a pseudo directory
convention:

/application_type/sub_type/name

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p4-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

OIOOI

0 to 01

1 101 01000 "
* 01 IOIOIO

ICOMWI

Levels

sera

Levels are 1.0 - 9.9 with lower numbers meaning higher priority.

This allows multiple signatures to match a piece of traffic, but
only the most specific appid will be applied. For example:

appidCchat', 9.9) = ...
appIdCchat/yahoo', 9.8) = ...
appidCchat/yahoo/incomlng', 9.7 = ...

If a session matches all three signatures, the appid will be
'chat/yahoo/incoming' since that has the best priority.

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p5-normal.gif:
Third parameter is the application type; if missing, we use
the appid name up to the first slash as the type

appid('http/response', 9.2, 'web') = ...
appid('chat/yahoo/incoming', 9.1) = ...

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p6-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

Basic Search Patterns

XKEYSCORE supports Boolean operations and regular
expressions

Raw text must be encapsulated between single quotes

• 'search term'

Terms can be combined with Boolean logic

• 'search term' and 'another term' and not 'defeat term'

• 'search term' or 'another term'

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p7-normal.gif:
appicH’voip/sip/IMS', 6.0, wireshark='sip') =

('via: sip' or 'v: sip') and 'cseq:' and (
'p-access-network-info:' or
'p-called-party-id:' or
'p-charging-vector:' or
'p-charging-vector-addresses:' or
'p-media-authorization:' or
'security-verify:' or
'proxy-authorization:' and 'scscf or
'path:' and 'pcscf' or
'path:' and 'scscf'

);

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p8-normal.gif:
Binary patterns can be represented by putting a \x in front of
each value:

'\xff\xff\x00\x02'

Or use the hex function:

hex('ff:ff:00:02l)

Use slashes to enclose regular expressions:
/[~a-zA-Z0-9]BTE/

TOP SECRET//COMINT//REL TO USA. FVEY







xks-application-ids-p9-normal.gif:
Keywords and regular expressions are NOT case sensitive
by default.

Append a 'c' to request case-sensitive evaluation:

'keyword'c

/regex/c

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p10-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

omm 1

Keyword Lenath

Keywords must be at least 3 characters or they will never
hit. This minimum is increased to 4 at some sites for
performance reasons.

Regular expressions must include a fixed "anchor" meeting
the minimum keyword length.

Bad: /[A-Z]{3}-[0-9]{3,5}/

OK: /ABC-[0-9]{3,5}/

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p11-normal.gif:
Each session gets one appid -- lowest level wins. It gets
databased in the 'application' field.

All matching fingerprints are stored in the 'fingerprint'
field. Level is ignored and can be omitted from
fingerprint definitions.

Application Type*: | v . Winning appid
Application Info*': ^ Winning appid +
Application: .y' all fingerprints
AppID (+Rngerpnnts)* [fu'lteyfl: v [Plaid Buildarl

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p12-normal.gif:
appid('mail/yahoo', 9.0) = 'Host: mail.yahoo';

appid('mail/yahoo/login, 8.0) = 'Host: mail.yahoo' and '/login';

fingerprint('mail/arabic') = 'mail' and /language[:=] ?ar/;
fingerprint('mail/yahoo/ymbm') = 'Host: mail.yahoo' and 'YMBM='c;

GET /login.html HTTP/1.1

Referer: http://us.f359.mail.yahoo.com/ym/ShowLetter
Accept-Language: ar
Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: mail.yahoo.com
Connection: Keep-Alive

Cookie: B=fn50ehd2612o2&b=3&s=rp; YMBM=d=&v=l;

Application: mail/yahoo/login

Fingerprint: mail/yahoo/login mail/arabic mail/yahoo/ymbm

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p13-normal.gif:
tool 'O'
loot I oot

TOP SECRET//COMINT//REL TO USA. FVEY

Real world example

M» XO- :

O'

1.10)

-j-aj,

M C6'C4,2»:ce.l€u)2

H tawab

w^V

s

riRgTzT/ATRhN2E12jg1 OWQyN'tVRjl/VnE2ZTdlNzZm2DhlODLx2WZhMDG1 Mj YwMjVtZGUO
ZGYwMjdk WmJmNTA42DY2Yjk0MGU2NGNiYJg6MzHjZTc6MThjY2 Y1 ZinYBMTgxZDUYjhjMTE
x0GYzYje1ZDdiWDAxNTQzZmVlHDVfY2vyMGJjYjU20DkyYjdmYjFjYiAzMWM$ZDQ20WFIMzg
J|srrhhM2l1Mjc5ODkzZGNh0GRmNWJnNj\l2iC0MjV1xNDM4MCV0Tg1MmRJMGJiNGNkYTM
kYTQ4MzMxZJRIN2FIN)l3MJE1NGI3MTA3ZDQ4NWRmYzMyOTUzZ.2)Mg3NJQ10GQ4MTA3M
TU2N2ZkN3^|YzUzYzYyMjFIODAwft2VkM2U5NfTZINDY2MmM22TVIYjQ2Yz>OOCQ20DUxNW
VkMjl2MWViNOAyOGICMThkMTdhNTY1 Yz xMDgyOC2»A2lUxZTc40De 1 MTY2M2KW4jU5ZjBh2jVhNikOOTIhNGExCThmYVVVI NmFI2jlyNtnM«ZC A3MDM0
NjJk2DhhMrr*4ZriRhYjc3NmZIN0Fk0DkyYjBhYjY3MDO1OGVIMj dhYmUvvZTtyNGIxYmQyZDIz
ZJU,.12B5ZGO5NmNhZDQx0TM4km0Mjc3MzBI0WEwZWE1Njk3Yj gxY2V!NTQ10WULr*>WVD
UUJTEuDJqn«OGMRHe»lBPTnZ|02y
/

GiiBjijYT*rtF^xGx?<>iSfNSSkfRXXHin»Tnb7r)yiif«Sr«inMIQfi
•RFOSRlJIcUiiYVupTOhhgddnof
SEbFR30/g03*pJxDYgmFOrlRA*fYi47tijHGUhedyn7qQspNdmRlJmkjEoFqF03sPH3f10injqo
e1G»fB*jn52XE2qWdnU*4X|WnlfisVNAjv2n*L**2TG1IMbgoempOoxyOBOSXPc«vi*2JikV37
k 1 XyONZk9vHe DV3aWYPXt*y?r* wGOXNTqPHIUI JWAZql2NK/eSXt9DVtCteb8e ZRJ6G9IX vJ9
Eny7t06xPd9BGIo3M»3QuUkZHLEmJiAvovB6R«Ov»hBqk6zMHQLfoeVJcX9umW6mRtoCjzS
PW6lzzFCGt©4SK4PxTi2ZC0B2kWO8VMyNffrlsTG4XUesflx47Nd6xML3w5pirfZyrt~Z1ow29A9N3uUXBX62lhOyjMiqfJ2FNR7AIONSEjwKoagVrmxC>uGaQi+TurpxBgat1g

M* End ASRAR El Moiahedeen v2.C Encrypted Message tl$



TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p14-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

Distribution

• Appids and fingerprints are distributed across the
XKEYSCORE network every hour

• Changes will take effect within 2 hours of check-in

• Current definitions are available on the website:

http://xkeyscore.rl. r.nsa/documents/appid.html

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p15-normal.gif:
Intermediate Syntaxxks-application-ids-p16-normal.gif:
You can append derived metadata fields onto the end of an
appid:

appid(lp2p/kazaa', 7.7, append='mime_type') =
Ipos('x-kazaa') and not $http;

This will result in an appid like 'p2p/kazaa/image/jpeg'.

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p17-normal.gif:
 TOP SECRET//COMINT//REL TO USA, FVEY

ip( expr) Matches against an IP Address looks in to address and from address in the session headere • ip( ’10.10.10.1');
toport( expr) Matches against the Destination/To port. Note this must be a numeric representation of a port. • toport( 1920 );
fromport( expr) Matches against the Source/From port. Note this must be a numeric representation of a port. • fromport( 80 );
port( expr) Matches against the either port. Note this must be a numeric representation of a port. •port( 6667 );
next_protocol( expr) Matches against the integer version of the next protocol. • next_protocol( 250 );
protocol ('text') Will only work for IP next protocol names as defined in the IANA next protocol numbers document • protocoK’tcp’);

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p18-normal.gif:
email_address(sel) permutes just like strong selector (just like DECODEORDAIN
mac_address(addr) smac(addr) dmac(addr) Tasks a mac address
ip(addr) tasks this IP address (either to or from)
fromjp(addr) tasks this IP address only when it is the originator
tojp(addr) tasks this IP address only when it is the destination

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p19-normal.gif:
 TOP SECRET//COMINT//REL TO USA, FVEY

first(expr) Matches against a pattern at the beginning of the session
Ipos(expr) Matches against a pattern at the beginning of each line (\n)
pos( expr) expression occurs at offset X in the session • pos('Hello') == 5, • pos(/Good.*Grief/) <=10
between( expr) • between('Hello’, 'World’. 10,100) Separation between 'Hello' and 'World' is greater than or equal to 10 bytes and less than or equal to 100 bytes This is the same as using the following regular expression: • /Hello. {10,100 } World/
'term'c Does a case sensitive match of the term
'term'u Treats the term as UTF-16

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p20-normal.gif:
appid('voip/skinny(port2000)', 9.9, wireshark='skinny') =
port(2000);

appidCvoip/skinny/keep-alive1, 3.0, wireshark='skinny') =
toport(2000) and

first('\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00');

appid('voip/skinny/keep-alive-ack', 3.0, wireshark='skinny') =
fromport(2000) and

first('\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00');

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p21-normal.gif:
no oi 101 :
1Q0I 1 001 1

TOP SECRET//COMINT//REL TO USA, FVEY

F

Wt "OOT IDU

Exam

appid(,mail/smtp/to_server', 8.5, direction=$from_server,
wireshark='smtp') =
toport(25) and
( first('helo') or
first('ehlo') or
first('data') or

(IposCTo: ’c) and lpos('From:'c)) or
IposCQUIT'c) or
lpos('mail from:') or
lpos('rcpt to:') );

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p22-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

10 10 01
) 101 01000)
0 01 IOIOIO

CHAINWORDs

You can assign a pattern to a variable (CHAINWORD) and reuse the
variable in many patterns.

$sip = 'via: sip' and 'cseq:' and 'SIP/2'c;

Now we can use this variable in future definitions:

appid('voip/sip', 7.2) = $sip:

appid('voip/sip/invite', 6.9) = $sip and 'INVITE';

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p23-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

10 10 01
) 101 01000'

Predefined Chainwords

There are a number of chainwords predefined for convenience:

$tcp • $http_delete
$udp • $http_trace
$icmp • $http_head
$sctp • $http_options
$rpc • $http_partial
$arp • $vbulletin
$ssl • $mime_type
$http_cmd • $user_agent
$http
$http_get
$http_put
$http_post

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p24-normal.gif:
appidCchat/icq', 8.5, wireshark='icq', chatproc='ICQ') =
/[~o]icq/c and $icq;

appidCchat/icq', 9.0, wireshark='icq', chatproc='ICQ') =
first('icq') and not port(25);

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p25-normal.gif:
Expressions are evaluated only with a certain context
instead of across the session as a whole.

html_title('Yahoo! Mail1 or 'Yahoo! Address Book1)

... only hits if those keywords are seen within the
title of a web page

http_host('maps. google.com')

... only hits within the "Host:" HTTP header

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p26-normal.gif:
TOP SECRET//COMINT//REL TO USA. FVEY

Context sensitivity

Why use context-sensitive scanning?

• More intuitive - you can say what you mean

• More accurate - if 'maps.google.com' is mentioned in a
blog post, you don't want to try processing it as a
Google Maps session

• Better performance for XKEYSCORE

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p27-normal.gif:
Sample contexts:

html_title

url

http_host

http_referer

http_cookie

http_server

user_agent

web_search

to_cc

from_cc

filename

file_ext

doc_title

doc_subject

doc_author

doc_org

doc_hash

doc_body

email_body

chat_body

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p28-normal.gif:
appid('finance/currency_conversion/generic', 8.0) =

html_title('currency' and ('exchange' or 'conver')) or
http_server('currency' or 'x-rates.com');

appid('finance/currency_conversion/xe', 8.0) =
http_hostCxe.com') or
html_title(/~XE -/c or 'XE.com'c);

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p29-normal.gif:
appid options:
--help
-list-all

-list-appids

-list-fingerprints

-list-types

-list-levels

-unit-test

this help message

list all the application/fingerprint names and
levels

list all the application names (no fingerprints)
list all the application names (no appids)
list all the application types
list all the application levels
perform unit tests with data in the heirachy
'datadir', with files matching 'filespec'

-quiet don't print any load messages

-appid fname arg location of appid.cfg
-input-file arg input file to test

-datadir arg The test data directory. Defaults to

$ (XSCORETESTDATADIR )/appids

-filespec arg (=.*\.ul24) A regular expression to match against files to
check

-noexit arg (=0) do not stop on the first error

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p30-normal.gif:
, ,0 o, 101 coi IJO
TOP SECRET//COMINT//REL TO USA, FVEY

t ifi'.i lOfll I «Jl ’ ri

otnm !() «nr 'Tifr iw i ^

ADDid Validation

) loi

appid sample.ul24
Loading appids

->Loading : /home/oper/xkeyscore/config/dictionarles/appid/appid_definitions.cfg
->Loading : /home/oper/xkeyscore/config/dictionaries/appid/anonymizer.appid
->Loading : /home/oper/xkeyscore/config/dictionarles/appid/bulletin_board.appid
•>Loading : /home/oper/xkeyscore/config/dictionaries/appid/taovpn.appid
->Loading : /home/oper/xkeyscore/config/dictionaries/appid/tdmoip.appid
->Loading : /home/oper/xkeyscore/config/dictionaries/appid/terminal.appid
->Loading : /home/oper/xkeyscore/config/dictionaries/appid/voip.appid
->Loading : /home/oper/xkeyscore/config/dictionaries/appid/appid_definitions.cfg
Finished loading appids
Filename: sample.ul24

Appid: encryption/https

Total Size: 19.36Kbits
Total Time: O.Olsecs
Rate: 1.936Mbits/s
Overall performance:

Total Time: O.Olsecs
Total Bits: 0.01936Mbits
Overall Rate: 1.936Mbits/s

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p31-normal.gif:
Advanced Syntaxxks-application-ids-p32-normal.gif:
TOP SECRET//COMINT//REL TO USA. FVEY

Code-based aooids

Keywords and regular expressions don't work for
everything

• Looking down columns in packet data

• Checksums

• Decoding (urlencoding, base64, gzip, etc.)

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p33-normal.gif:
1. Preliminary "trigger" using standard keywords
and regular expressions

2. Secondary test using a snippet of C++ code

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p34-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

OIOOI I01
10 10 01 '
) 101 01000) "
a 01 IOIOIO

Code-based aooids

Example -- verifying a length field:

appid('netmanagement/ospf', 2, wireshark='ospf')
protocol(1ospf')

: C++ {{

if (size() < 4)
return false;

const uint8_t *data = begin();
return (data[3]==size());

}};

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p35-normal.gif:
no oi 101
10011 001 1

I IOOI IOOI II

TOP SECRET//COMINT//REL TO USA, FVEY

r

•'rr \rv .

Code-based aooids

Example -- packet data:

fingerprint('vpn/xxp example’) =

'Next Protocol 250'

: C++ {{

packet_t pkt;
int count = 0;

while ((pkt = get_packet()) && count < 20) {
++count;

if (pkt.size < 16)
return false;

if (pkt.data[4j != OxCC ||
pkt.data[5] != 0x45 | \
pkt.data[15] != 0x72)
return false;

}

return (count > 0);

}};

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p36-normal.gif:
Example -- code-based check on certain extracted
files:

fingerprint('crazy/office') =

extracted_file('doc' or 'xls' or 'ppt' : c++ {{

return xks::filename().find("crazy") != std::string::npos;

}});

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p37-normal.gif:
I 10 01 101
10011 ex
1 1001 100
01001
10 to 01

r

TOP SECRET//COMINT//REL TO USA, FVEY

Extractors

Simplified regex-based metadata extraction

fingerprint('maps/google/example’) =
http host('.google.1) and url('/maps?')

: C++

extractors : {{

ka = /Keep-Alive: (\d+)/;

accept[] = /Accept-([A:]+): ([\w-]+)/;

}}

main : {{

if(ka && ka[B] == "380") {

for(size_t i = 0; i < accept.size(); ++i)

if(accept[i][O] == "Encoding" && accept[i][l] == "gzip")
return true;

}

return false;

}};

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p38-normal.gif:
Support for flex-based pattern matching

fingerprint('maps/google/firefox') =
http_host('.google.') and url('/maps?')

: C++

flex : {{

USER_AGENT_CHAR [A\n\r]

%%

"User-Agent: "{USER_AGENT_CHAR}+ {
std:¡string agent(yytext);

if(agent.find("Firefox") != std::string::npos)
return true;

}

}};

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p39-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY

Microoluains

The next step: giving code-based appids (limited)
access to the XKS core

• Accessing top-level session metadata

• Throwing common events

• Contributing metadata for databasing

The goal: higher level of agility with lower
learning curve

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p40-normal.gif:
TOP SECRET//COMINT//REL TO USA, FVEY



OIOOI I®*
10 10 01
MOI 01000' "
oi loioio

lOOf W TOI

Microoluains

Example: accessing session metadata

fingerprintf'maps/google/serverl') =
http_host('.google.') and url('/maps?')

: c++
main : {{

return (SESSION["to_ip"] == "123.45.67.1");

}};

TOP SECRET//COMINT//REL TO USA, FVEYxks-application-ids-p41-normal.gif:
TOP SECRET//COMINT//REL TO USA. FVEY

Microoluains

Example: throwing a document_metadata event

fingerprint(1maps/google/contrived1) =
http_host('.google.1) and url(1/maps?')

: C++

main : {{

xks::doc meta_t dm;
dm.filename = "google.txt";
dm.author = "Google, Inc.";
xks::document_metadata(dm);

}};

TOP SECRET//COMINT//REL TO USA. FVEYxks-application-ids-p42-normal.gif:
no oí 101
10011 001

i 1001 1001 I

TOP SECRET//COMINT//REL TO USA, FVEY

Micropluains

-*■ . _ * ^

Example: contributing metadata to HTTP Activity

fingerprint('maps/google/search') =

http host('.google.') and url('/maps?')

: C++

extractors : {{

q = /[&?]q=([A&]+)/;

}}

main : {{

if(q) {

DB["http_parser"]["search_terms"] = xks::urldecode(q[0]);
DB.apply();
return true;

}

}};

TOP SECRET//COMINT//REL TO USA, FVEY


Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p1-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p2-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p3-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p4-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p5-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p6-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p7-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p8-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p9-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p10-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p11-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p12-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p13-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p14-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p15-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p16-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p17-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p18-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p19-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p20-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p21-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p22-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p23-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p24-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p25-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p26-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p27-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p28-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p29-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p30-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p31-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p32-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p33-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p34-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p35-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p36-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p37-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p38-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p39-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p40-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p41-normal.gif)

Download Document

XKEYSCORE Appids & Fingerprints (xks-application-ids-p42-normal.gif)

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh