9 ms·

The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states

by imron 10y ago

The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation. With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the "fingerprints" of the groups that the attack techniques were stolen from. This has interesting implications for the claim that "Russians" hacked the election (although I can't imagine the CIA wanting to hack the election in Trump's favour).

jug5 10y ago
Well you need to make it seem as if "the bad guys" are a threat regardless of the attack vector, digital or otherwise.
at-fates-hands 10y ago
I'm wondering if these documents are going to match the same ones that were taken by Harold Martin III and if the CIA will out him as the Wikileaks source.
- dmix 10y ago
  These documents were being passed around by former CIA hackers. It says this right on the page. Harold has already been disproven to have any connection to leaks. He was just a hoarder with a mental illness. This hasn't stopped people from connecting every leak since his arrest to him.
  - ttctciyf 10y ago
    Actually, WikiLeaks press release says: > The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive. and later specifically mentions Martin: > Over the last three years the United States intelligence sector, which consists of government agencies such as the CIA and NSA and their contractors, such as Booze Allan Hamilton, has been subject to unprecedented series of data exfiltrations by its own workers. > A number of intelligence community members not yet publicly named have been arrested or subject to federal criminal investigations in separate incidents. > Most visibly, on February 8, 2017 a U.S. federal grand jury indicted Harold T. Martin III with 20 counts of mishandling classified information. The Department of Justice alleged that it seized some 50,000 gigabytes of information from Harold T. Martin III that he had obtained from classified programs at NSA and CIA, including the source code for numerous hacking tools. EDIT: I would infer from this that WL mention Martin to shore up their claim that the CIA hacking archive is circulating among contractors, not to hint that he's a source.
artursapek 10y ago
That video of Hillary touting that "17 different intelligence agencies yada yada Russia is who hacked my emails" is going to be even more amusing now.
sandworm101 10y ago
The term "hacked the election" goes beyond the literal computer hacking of the dnc. It also covers the well-targeted "fake news" propoganda program ... something not touched by the release of these tools. The "hack" of the election was trickery to twist a system to a desired end. Like all good hacks it ignored definitions to employ whatever techiques were availible regardless. That some were not traditionally called "hacking" means nothing given the overall effectiveness of the program.
tdb7893 10y ago
The Russians really seem like to most likely there still. It would’ve taken quite a bit of knowhow and resources so the Russians would be one of the few organization with motive and opportunity so at this point it seems highly likely that it was the Russians. It could also be some nation state that wants us to think that they are Russian (which I don’t know who would have motive for this). The only other option would be a corporation or hacker group that is really good and knows enough to be able to (and also have a motive to) implicate the Russians convincingly, but that seems unlikely. That’s the analysis I heard so it doesn’t really change the overall analysis but I’m no expert and I’m open to other views.
dmix 10y ago
There also still hasn't been any public evidence that Wikileaks got their Podesta email data from Russians yet. So far we only know the DNC leaks were very likely Russian. That means until today only about ~50% of the 'election hacks' have been attributed to Russia with public evidence. Now this leak calls into question some of the evidence about the DNC hack [1]. This evidence being the malware was Russian. But there were many other pieces of evidence that pointed to Russia so I'm personally not anymore persuaded it wasn't Russia for the DNC stuff. The Podesta stuff is still up in the air AFAIK. [edit: see pvg reply] Either way this leak will just add to the deniability angle for the partisan hawks. Although this is probably way over the head of CNN/Fox News crowd so it's also possible it will have zero effect. [1] Previous leaks mentioned NSA/Five Eyes collected foreign malware. This leaks adds CIA to that group and further solidifies the "misdirected attribution" angle.
- camperman 10y ago
  > So far we only know the DNC leaks were very likely Russian. We don't know that at all. There isn't a single piece of evidence for it anywhere.
  - res0nat0r 10y ago
    Unfortunately for this we aren't going to get some 1080p video of someone in a mask sneaking into the DNC server room, just the fact that the 17 agencies all agree based on what they've seen believe that to be the case. Unfortunately everyone these days think everything is a conspiracy or has to have HD recordings of something they think happened as public evidence or it is false, but that's not how the world really works...
    - NoGravitas 10y ago
      The thing is, "17 agencies agree" doesn't really mean anything, if the evidence that all 17 agencies are relying on is a single report from a private security company hired by the DNC, and not independent investigation. If all of those agencies had looked at the original evidence themselves, the story would be different.
vinhboy 10y ago
> that "Russians" hacked the election That's not the claim. In fact, multiple people have said that is not the claim. The claim is that the Russians influenced the election in favor of Trump by promoting propaganda against Clinton.
- roc 10y ago
  Through leaks like this one. Leaks that can be partially validated or corroborated, but which (by their nature) cannot be entirely proven true. And those leaks were very transparently beneficial to a person/group who are also going to benefit from this one. I don't trust the CIA at all. But I don't trust Wikileaks either. I see way too many self-described "skeptical" types who aren't approaching any of this with any shred of skepticism.
  - deleted 10y ago
    [deleted]
- troyvit 10y ago
  Yeah it's irritating how our media is ignoring the propaganda machine and looking at "hacks" instead.
- ctdonath 10y ago
  Objective proof is usually not considered "propaganda". We used to call it "investigative journalism".
- fareesh 10y ago
  There's also an argument to be made that Hillary would not have been the nominee had the DNC played fair. The leaked emails show that they actively worked to suppress Bernie, who had huge rallies, similar to Trump.
  - danans 10y ago
    A US political party playing favorites with it's own candidates (however upsetting that is), is very different from a foreign state engaging in a successful propaganda campaign to influence the US election. The DNC problems are part of a long term reshaping of US political identities. The Russia issues are a serious near-term national security concern.
steamer25 10y ago
> although I can't imagine the CIA wanting to hack the election in Trump's favour Doesn't preclude planting 'evidence' of Russian hacking to stir up a red scare (towards renewed cold war -level funding of the intelligence community) irrespective of the election's outcome. I.e., the fact that anyone actually uncovered secret data through some other means could have just been unrelated/incidental. E.g., if Wikileaks got their material from an inside whistle-blower as they've insinuated. I wouldn't either be surprised if the 'evidence' of Russian interference was just circumstantial rather than planted... E.g., "Woah, we found evidence of probing originating from Russia (in the pile of probing evidence from script-kiddies all over the world, mostly Nigerian princes but those don't bolster our narrative)!" https://www.youtube.com/watch?v=7j_ZfKmcnSk https://www.youtube.com/watch?v=7j_ZfKmcnSk https://en.wikipedia.org/wiki/Operation_Northwoods https://en.wikipedia.org/wiki/Operation_Northwoods http://www.mintpressnews.com/migrant-crisis-syria-war-fueled-by-competing-gas-pipelines/209294/ http://www.mintpressnews.com/migrant-crisis-syria-war-fueled...
anthonybsd 10y ago
>although I can't imagine the CIA wanting to hack the election in Trump's favour CIA is overwhelmingly republican, just like the FBI. So yes they would.
- remarkEon 10y ago
  Source? I've always understood the FBI v. CIA conflict as a classic Red vs Blue security alignment. FBI aligned with Defense and CIA aligned with State.
- hackuser 10y ago
  Trump has been aggressively critical of the CIA and has, to some extent at least, ignored their intelligence briefings. He openly opposes much of what they advocate. I don't think they like him.
- troisx 10y ago
  Actually, if you look at donations in the last election government employees in all branches donated over 85% to Clinton. So I'm not sure I'd say overwhelmingly Rebublican by any means.
vxNsr 10y ago
I think it's vitally important, at least in this forum where tech knowledge is fairly high to avoid saying that "Russia hacked the election" without any sort of qualifier. Because the implication is that they hacked voter booths or somehow changed votes. In reality they allegedly hacked computers of people related to a single party and brought to light the illicit activities that party was doing. tl;dr Saying Russia hacked the election is the same as saying that some kid hacked the FBI when all he did was deface their website. It implies a level of sophistication that did not happen.
- xherberta 10y ago
  Agreed. All this fuss gives Russia more prestige/soft power.
- bertil 10y ago
  > In reality they allegedly hacked computers of people related to a single party and brought to light the illicit activities that party was doing. My understanding was the Security professionals expected that the most likely scenario was that both parties were hacked: one side was revealed and the other one used for leverage.
JohnStrange 10y ago
Well, you've nailed it in your parenthetical comment. Lack of a credible motive is one of the telltale signs of conspiracy theories, but has never kept conspiracy nuts from presuming all kinds of nefarious motives if they fit into their preconceived world-view. Of course the CIA could have constructed a complicated false flag operation to get Trump elected, but they lack a reasonable motive. Similar things can be said about many conspiracy theories, only few of them attribute credible motives to the state actors and/or individuals involved.
nothis 10y ago
IMO it just doesn't make much sense, though, as soon as you picture actual groups of people running these schemes. It's super secret and all, but behind the iris-scanner doors and extreme vetting, people are sitting in offices, drink coffee, have meetings, etc. There's oversight, reports to file and activity logs. Now how should a group of employees, in this environment, sit together and decide to manipulate an election in their own country? That just doesn't seem feasible. I honestly imagine the day-to-day activity there to be way more mundane than we imagine. It's probably just sifting through thousands of pages worth of intelligence (transcribed phone calls from terrorism suspects, reports from people at foreign embassies, etc) for things that are usable. Probably often with few results. I don't even think the amount of information is the real limitation. It's probably the quality.

by imron 10y ago

jug5 10y ago

Well you need to make it seem as if "the bad guys" are a threat regardless of the attack vector, digital or otherwise.

at-fates-hands 10y ago

I'm wondering if these documents are going to match the same ones that were taken by Harold Martin III and if the CIA will out him as the Wikileaks source.

dmix 10y ago
These documents were being passed around by former CIA hackers. It says this right on the page. Harold has already been disproven to have any connection to leaks. He was just a hoarder with a mental illness. This hasn't stopped people from connecting every leak since his arrest to him.
- ttctciyf 10y ago
  Actually, WikiLeaks press release says: > The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive. and later specifically mentions Martin: > Over the last three years the United States intelligence sector, which consists of government agencies such as the CIA and NSA and their contractors, such as Booze Allan Hamilton, has been subject to unprecedented series of data exfiltrations by its own workers. > A number of intelligence community members not yet publicly named have been arrested or subject to federal criminal investigations in separate incidents. > Most visibly, on February 8, 2017 a U.S. federal grand jury indicted Harold T. Martin III with 20 counts of mishandling classified information. The Department of Justice alleged that it seized some 50,000 gigabytes of information from Harold T. Martin III that he had obtained from classified programs at NSA and CIA, including the source code for numerous hacking tools. EDIT: I would infer from this that WL mention Martin to shore up their claim that the CIA hacking archive is circulating among contractors, not to hint that he's a source.

artursapek 10y ago

That video of Hillary touting that "17 different intelligence agencies yada yada Russia is who hacked my emails" is going to be even more amusing now.

sandworm101 10y ago

The term "hacked the election" goes beyond the literal computer hacking of the dnc. It also covers the well-targeted "fake news" propoganda program ... something not touched by the release of these tools. The "hack" of the election was trickery to twist a system to a desired end. Like all good hacks it ignored definitions to employ whatever techiques were availible regardless. That some were not traditionally called "hacking" means nothing given the overall effectiveness of the program.

tdb7893 10y ago

The Russians really seem like to most likely there still. It would’ve taken quite a bit of knowhow and resources so the Russians would be one of the few organization with motive and opportunity so at this point it seems highly likely that it was the Russians. It could also be some nation state that wants us to think that they are Russian (which I don’t know who would have motive for this). The only other option would be a corporation or hacker group that is really good and knows enough to be able to (and also have a motive to) implicate the Russians convincingly, but that seems unlikely. That’s the analysis I heard so it doesn’t really change the overall analysis but I’m no expert and I’m open to other views.

dmix 10y ago

There also still hasn't been any public evidence that Wikileaks got their Podesta email data from Russians yet. So far we only know the DNC leaks were very likely Russian. That means until today only about ~50% of the 'election hacks' have been attributed to Russia with public evidence. Now this leak calls into question some of the evidence about the DNC hack [1]. This evidence being the malware was Russian. But there were many other pieces of evidence that pointed to Russia so I'm personally not anymore persuaded it wasn't Russia for the DNC stuff. The Podesta stuff is still up in the air AFAIK. [edit: see pvg reply] Either way this leak will just add to the deniability angle for the partisan hawks. Although this is probably way over the head of CNN/Fox News crowd so it's also possible it will have zero effect. [1] Previous leaks mentioned NSA/Five Eyes collected foreign malware. This leaks adds CIA to that group and further solidifies the "misdirected attribution" angle.

camperman 10y ago
> So far we only know the DNC leaks were very likely Russian. We don't know that at all. There isn't a single piece of evidence for it anywhere.
- res0nat0r 10y ago
  Unfortunately for this we aren't going to get some 1080p video of someone in a mask sneaking into the DNC server room, just the fact that the 17 agencies all agree based on what they've seen believe that to be the case. Unfortunately everyone these days think everything is a conspiracy or has to have HD recordings of something they think happened as public evidence or it is false, but that's not how the world really works...
  - NoGravitas 10y ago
    The thing is, "17 agencies agree" doesn't really mean anything, if the evidence that all 17 agencies are relying on is a single report from a private security company hired by the DNC, and not independent investigation. If all of those agencies had looked at the original evidence themselves, the story would be different.

vinhboy 10y ago

> that "Russians" hacked the election That's not the claim. In fact, multiple people have said that is not the claim. The claim is that the Russians influenced the election in favor of Trump by promoting propaganda against Clinton.

roc 10y ago
Through leaks like this one. Leaks that can be partially validated or corroborated, but which (by their nature) cannot be entirely proven true. And those leaks were very transparently beneficial to a person/group who are also going to benefit from this one. I don't trust the CIA at all. But I don't trust Wikileaks either. I see way too many self-described "skeptical" types who aren't approaching any of this with any shred of skepticism.
- deleted 10y ago
  [deleted]
troyvit 10y ago
Yeah it's irritating how our media is ignoring the propaganda machine and looking at "hacks" instead.
ctdonath 10y ago
Objective proof is usually not considered "propaganda". We used to call it "investigative journalism".
fareesh 10y ago
There's also an argument to be made that Hillary would not have been the nominee had the DNC played fair. The leaked emails show that they actively worked to suppress Bernie, who had huge rallies, similar to Trump.
- danans 10y ago
  A US political party playing favorites with it's own candidates (however upsetting that is), is very different from a foreign state engaging in a successful propaganda campaign to influence the US election. The DNC problems are part of a long term reshaping of US political identities. The Russia issues are a serious near-term national security concern.

steamer25 10y ago

> although I can't imagine the CIA wanting to hack the election in Trump's favour Doesn't preclude planting 'evidence' of Russian hacking to stir up a red scare (towards renewed cold war -level funding of the intelligence community) irrespective of the election's outcome. I.e., the fact that anyone actually uncovered secret data through some other means could have just been unrelated/incidental. E.g., if Wikileaks got their material from an inside whistle-blower as they've insinuated. I wouldn't either be surprised if the 'evidence' of Russian interference was just circumstantial rather than planted... E.g., "Woah, we found evidence of probing originating from Russia (in the pile of probing evidence from script-kiddies all over the world, mostly Nigerian princes but those don't bolster our narrative)!" https://www.youtube.com/watch?v=7j_ZfKmcnSk https://www.youtube.com/watch?v=7j_ZfKmcnSk https://en.wikipedia.org/wiki/Operation_Northwoods https://en.wikipedia.org/wiki/Operation_Northwoods http://www.mintpressnews.com/migrant-crisis-syria-war-fueled-by-competing-gas-pipelines/209294/ http://www.mintpressnews.com/migrant-crisis-syria-war-fueled...

anthonybsd 10y ago

>although I can't imagine the CIA wanting to hack the election in Trump's favour CIA is overwhelmingly republican, just like the FBI. So yes they would.

remarkEon 10y ago
Source? I've always understood the FBI v. CIA conflict as a classic Red vs Blue security alignment. FBI aligned with Defense and CIA aligned with State.
hackuser 10y ago
Trump has been aggressively critical of the CIA and has, to some extent at least, ignored their intelligence briefings. He openly opposes much of what they advocate. I don't think they like him.
troisx 10y ago
Actually, if you look at donations in the last election government employees in all branches donated over 85% to Clinton. So I'm not sure I'd say overwhelmingly Rebublican by any means.

vxNsr 10y ago

I think it's vitally important, at least in this forum where tech knowledge is fairly high to avoid saying that "Russia hacked the election" without any sort of qualifier. Because the implication is that they hacked voter booths or somehow changed votes. In reality they allegedly hacked computers of people related to a single party and brought to light the illicit activities that party was doing. tl;dr Saying Russia hacked the election is the same as saying that some kid hacked the FBI when all he did was deface their website. It implies a level of sophistication that did not happen.

xherberta 10y ago
Agreed. All this fuss gives Russia more prestige/soft power.
bertil 10y ago
> In reality they allegedly hacked computers of people related to a single party and brought to light the illicit activities that party was doing. My understanding was the Security professionals expected that the most likely scenario was that both parties were hacked: one side was revealed and the other one used for leverage.

JohnStrange 10y ago

Well, you've nailed it in your parenthetical comment. Lack of a credible motive is one of the telltale signs of conspiracy theories, but has never kept conspiracy nuts from presuming all kinds of nefarious motives if they fit into their preconceived world-view. Of course the CIA could have constructed a complicated false flag operation to get Trump elected, but they lack a reasonable motive. Similar things can be said about many conspiracy theories, only few of them attribute credible motives to the state actors and/or individuals involved.

nothis 10y ago

IMO it just doesn't make much sense, though, as soon as you picture actual groups of people running these schemes. It's super secret and all, but behind the iris-scanner doors and extreme vetting, people are sitting in offices, drink coffee, have meetings, etc. There's oversight, reports to file and activity logs. Now how should a group of employees, in this environment, sit together and decide to manipulate an election in their own country? That just doesn't seem feasible. I honestly imagine the day-to-day activity there to be way more mundane than we imagine. It's probably just sifting through thousands of pages worth of intelligence (transcribed phone calls from terrorism suspects, reports from people at foreign embassies, etc) for things that are usable. Probably often with few results. I don't even think the amount of information is the real limitation. It's probably the quality.