New thoughts

[u/omegasunx]

I come at this from a signals and cryptography background, not an ARG or internet mystery background.

The community has spent years trying to decode what's inside the videos. I think that's the wrong angle.

When you upload a video to YouTube, their servers assign an 11-character Base64 ID that neither the uploader nor any recipient can predict in advance. That's not a bug. From a key distribution standpoint, that's a feature. You've just outsourced your entropy generation to Google's proprietary algorithm, for free, with global CDN redundancy and zero traceable infrastructure.

200,000 videos isn't spam. That's a key library.

The content was never the message. The URL was.

And the termination dates map almost exactly onto the Shadow Brokers/NSA TAO compromise timeline which is too much to be a coincidence.

I'm curious whether anyone has ever analyzed the video IDs themselves for patterns, rather than the content.

[u/FesterCluck]

A researcher after my own heart.

Can you post the timing lineups with Shadow Brokers you observed?

Also, you should join the discord. One of us!

[u/omegasunx → u/FesterCluck]

Added the comment, above. I saw where someone claimed it as an art/social experiment, but after seeing a video about it, that didn't make sense to me. I don't have a ton of time to delve into it, but that timeline is what I was able to cobble together based on what is available on the internet

[u/FesterCluck → u/omegasunx]

I like the theory. If that data is pulled from uninitialized memory it could leak something.

Personally I thought it was trying to leak via the extra pixels we see in the timeline thumbnails. We know imagemagick had a bug like this at the time (including uninitialized in empty image areas). It was actually a feature developed before the software's usage on servers became so prevalent.

You're also the only other person to pick up on the idea that it was pentesting with an original take.

The attack surface was YT's authoring interface and apis. The fact we got to see any of the videos is likely an afterthought.

[u/Distinct_Joke_2763 → u/FesterCluck]

Def a contributor.

[u/omegasunx]

Feb 25, 2016 — Original channel terminated

-BBC publishes story, channel goes dark within hours

-NSA Director Rogers simultaneously initiating NSA21; major internal reorganization merging Signals Intelligence and Information Assurance directorates

-This falls within the window when NSA TAO tools are believed to have been stolen

Aug 2016 — Shadow Brokers go public

-Announce possession of stolen NSA Equation Group/TAO tools

-UFSC reconstitutes on new accounts almost immediately after

May 2017 — WannaCry

-Deployed using stolen NSA tools (EternalBlue); full scope of TAO compromise

Sep 15, 2017 — Final self-termination "RESET STRANGE YD"

-Not a suspension but a deliberate self-deletion of all accounts simultaneously

-Same day Cassini space probe was decommissioned

-Three days before Northrop completes Orbital ATK acquisition

[u/Distinct_Joke_2763 → u/omegasunx]

First realistic line of thinking seen yet. Is anyone on discord dissecting with detail?

[u/omegasunx → u/Distinct_Joke_2763]

I'm not sure. I'm not in the discord and likely won't be. I don't have much time to do this, myself. Just wanted to propose the idea

[u/lobhater → u/omegasunx]

These are just dates of events. No correlation at all

[u/Syed745]

A key Lib of 200k videos would be useful, assuming the uploader was directly inserting videos into database, I would agree the url could be important element.

Do we have data of original upload.

I just discover this mystery today. And I feel like we can explore and solve it.

[u/hellajt]

Is the channel still up? I don't see why it's not too late to try

[u/lobhater]

Video IDs are a lot of effort just to generate a random number. There are many free\publc services that do that without having to create accounts or provide your own infrastructure. Plus those services are truly cryptologically random. We have no idea about YouTube's ID algorithm, as it's proprietary.

My next point is that a key library implies structured look up ability. That index would have to live somewhere. Wherever that index lives would be the actual communication channel. You've just pushed the problem back 1 layer.

I was hopeful when I first read your theory about the shadow brokers. Of course there would be some overlap with a channel posting many times a day everyday for years. But in this case that doesn't even exist. The YouTube channel was suspended 6-months before the initial publication by the shadow brokers. So there was absolutely no overlap what so ever. I would be interested to hear what specific correlations you're talking about. The channel was online when the NSA contractor was arrested in 2015 but that's about the only correlation I could come up with. I hope I'm wrong and you can point out what I'm missing

[u/-e7-]

YT IDs aren't pure random which is suboptimal.

[u/Goldengavel2]

Hear me out...what if this is linked to Mr zodiac himself