15 ms·
CIA trying to inject into Little Snitch
- josefdlange 10y agoStranger is that they feel like they need to open a "hidden" browser instance to connect to the internet. A browser isn't really a necessary part of establishing a connection -- unless there's some missing context here. Is my grandmother running the CIA data ops division? Edit: it's been made clear to me that of course this is one of few viable vectors when approaching outbound network with a really restrictive firewall (like Little Snitch). If a browser is already approved on making a given connection, then using a headless instance to do network talking is a smart way to do it. If you roll your own net code, a tool like LS will notify user and/or block. Dumb me!
- 65827 10y agoI mean they could just write some net code that sends packets to whatever port, but launching IE and doing everything over HTTPS or whatever is much more stealthy when it comes to network monitoring and system logs.
- josefdlange 10y agoBut why not spend ten minutes and make their net code use SSL and then avoid it altogether? I guess one could argue that the footprint of adding SSL client behavior to a sneaky hidden tracker might be shitty to do and make it more identifiable. But also SSL libraries are typically linkable on the host system anyway, no compilation past the headers needed. It's just a weird "workaround" on their part if that's the intention.
- foota 10y agoConsider perhaps Windows firewall. I believe it can be configured to block connection by opening program.
- Alupis 10y agoPerhaps bots are more easily discernible from a human user who's using a real browser. If the goal is to be stealthy, then they'd want to appear as human-like as possible.
- josteink 10y agoWindows has very sophisticated firewalling and network access can be filtered on a per-process, per-network basis. Restrictive companies will only allow pre-approved applications, for specific ports, like I.E. doing HTTP/S over ports 80 and 443, and only on approved/trusted networks.
- josefdlange 10y agoYeah, realized the folly in my logic -- see my edit on my top-level comment. This strategy is pretty much how LS works on macOS as well.
- rasz_pl 10y agoand DNSCache at 53, same DNSCache that listens on localhost and will relay any request from anybody, _non filterable_ localhost
- Someone 10y agoI would guess that the hidden browser could have access to data (login cookies, browser history, combined with another vulnerability maybe even anything the user enters in other browser windows) that a separate program would not have accesss to.
- anilr 10y agoLittle Snitch will warn you (ask permission) if a new process wants to connect to the internet. If the beacon can pass information through an browser process though, I expect most people have Little Snitch rules to allow their browser to send any traffic without warnings.
- ryanlol 10y agoIntent is to evade firewalls that allow per-application rules, such as Little Snitch (I think?) and Windows firewall.
- josefdlange 10y agoOh, duh. Wow, dumb me. One of those "can't see the forest for the trees" mistakes on my part. Thanks for the reality check!
- tetrep 10y ago> such as Little Snitch (I think?) Correct. It is likely users allow their primary browser full access to all hosts on ports 80 and 443, if not all ports. Additionally, launching the browser gives you easy access to all the tastey session cookies and access to their keychain (I assume a lot of people give their default browser on OSX keychain access).
- sly010 10y agoExactly. Firewalls like Little Snitch primarily filter traffic primarily based on the binary initiating the connection, and only secondarily based on the target port or address. When little snitch pops up the 10th time in 30 seconds, you will just approve all traffic from your browser, so using the browser to send all traffic is great way to avoid being caught. As for what "injecting into little snitch" means, it could either mean injecting code into little snitch, because little snitch probably doesn't filter itself OR injecting a rule into little snitch.
- kordless 10y agoCasually browsing the archive, I saw something related to injecting payloads into OSX applications. The application that did this required the latest version of XCode to compile, according to the installation and build docs.
- lostlogin 10y agoAre you suggesting that this indicates recent activity on the project?
- nathancahill 10y agoLittle Snitch does filter itself, but the Allow rules are there by default. I remember on a previous version, one of the steps to pirate LS was adding a rule to block it from connecting to it's servers.
- 15155 10y agoThey've added internal protection against this in recent versions.
- HashThis 10y agoHackers are going to hack (a solution).
- rasz_pl 10y agofun Microsoft fact - windows firewall is preconfigured with a build-in outbound traffic backdoor. You cant filter localhost, DNSCache listens on localhost and will happily relay everything. You have to manually disable dnscache service and give up caching to plug this hole. You want to be able to ping? cant do that, ICMP traffic originates in System process, so you either let everything send ICMP packets, or filter it all out, there is no middle ground.
- diryawish 10y agoWhat if they use it to establish an unsavory browsing history on a target's computer without their knowledge?
- subroutine 10y agoCould you imagine. deletes browsing history If there is a page stating the CIA can create an unsavory browsing history, let me know, just for future reference.
- diryawish 10y agoLol good point. I meant to imply the history that the ISP would see, not the local one. Although a hidden browser wouldn't be necessary for that anyway. Never mind :)
- wavefunction 10y agoHidden browser would be good for establishing a "history that the ISP would see" as well.
- jcoffland 10y agoAlso it helps get you through proxies.
- Exuma 10y agoHmm... lame
- Kalium 10y agoIt's possible I've misunderstood, but I don't think they're trying to inject Little Snitch. I think they're trying to inject into Little Snitch, in order to evade its restrictions.
- neoncontrails 10y ago"Inject into" is their wording. The meaning is unclear. Is the goal to disable a working installation of Little Snitch?
- tptacek 10y agoThis is clownish: 1. Only a tiny minority of macOS users use Little Snitch, and they're not necessarily the most sensitive/interesting targets. 2. If you're competent and you have enough privileges to inject a DLL into anything, the odds are overwhelming that you also own the kernel. Why would you waste time with a goofy firewall add-on package? I joked on Twitter but I'm "ha ha only serious" about this: if you had this entire portfolio of tools and exploits 2 years ago, I'm not sure you could have gotten a job at Immunity. The leak is fascinating. The technical details: not so much. I thought the Shadow Brokers/Equation Group dump demonstrated a not-especially-skillful group of inexperienced-seeming pentesters who happened to have acquired some interesting bugs on the black market. Today's dump shows a team that's way less impressive even than that.
- javajosh 10y agoLittle Snitch users are the kind of people who can and would expose CIA beacon signals. It's not so much that LS users are juicy targets, but rather that they are substantial exposure risks. You might say, well, just piggy-back the signal on something else. Indeed, that is better. But that solution is far more complicated because you have to control (cooperatively, or coercively) a legitimate end-point. Ergo, I don't think it's clownish at all for the CIA to target LS, it addresses a real threat (to them).
- tptacek 10y agoUsing kernel implants to hide signals from these kinds of network security tools is literally 1990s-grade hacker opsec. It's the actual, precise use case for which "amodload" was written, in 1996, by a 20-year-old, for a closed-source OS. I stand by my assessment.
- ghshephard 10y ago...But what if you can implant into the kernel? Also, what if you don't want to use a full-featured zero-day kernel exploit if you can get your target with a somewhat lower tech exploit? Clever to just recover all your data using a browser process which has (likely) already been fully authorized to exfiltrate data.
- burntwater 10y agoI'm just a little weirded out how this list is, in style, identical to many of the lists I've created and have open right now. I need this to be a bit more "henchmanny" and a bit less "average Joe/Jane sitting at their desk under the florescent lights drinking coffee and idly thinking about the workweek ahead."
- urs2102 10y agoThis actually made me burst out laughing and conveyed my thoughts exactly. It's like when you become old enough to realize your parents are fallible and have been winging it the whole time.
- golergka 10y agoSo, apart from not demonstrating very high skill level (already discussed in other comments written by people that seem knowledgeable), how is this even remotely morally shady? They clearly discuss penetrating particular target systems — isn't that exactly what you would expect your intelligence/counter-intelligence service to do?
- deleted 10y ago[deleted]
- karmakaze 10y agoWhy LS and not one of many other programs? Is it for the humour value of its name to specifically alter it?
- DaiPlusPlus 10y agoI'd wager LS users are more tech-savvy and less likely to be using more mainstream tools like Norton or McAfee - they want one tool that gives them control over what programs have network access, not a bloated adware platform.
- aaron695 10y agoLittle Snitch is a host-based application firewall for Mac OS X. It can be used to monitor applications, preventing or permitting them to connect to attached networks through advanced rules. https://en.wikipedia.org/wiki/Little_Snitch https://en.wikipedia.org/wiki/Little_Snitch
- fulcanelli 10y agoYou are giving Thomas Ptacek too much credit by asking these questions. His only? engineering product was a gimmick that did "firewall rule management" and I doubt he had much to do with the engineering part. Yet he feels obligated to comment on the quality of CIA/NSA cyberespionage toolkits.
- tptacek 10y ago95-96: EnterAct, OpenBSD 97-99: Secure Networks, Ballista scanner lead, vulnerability research lab 99-01: Doomed multicast startup 01-05: Lead dev, Arbor Networks 05-15: Cofounder, Matasano 15-16: Doomed recruiting startup 17-: Startup dooming startup Hope that helps. I like the idea that we squeezed 10 years out of that firewall rule thingy at Matasano. Sick burn!
- zero_intp 10y agoThis is a pretty interesting fly-by attack. Insinuation, not evidence based. Asking questions and having a conversation is why the rest of us are here. What is your goal by attacking the credibility of other people in the conversation? EDIT: 128 days old, no prior comments or submissions.
- dang 10y agoPersonal attacks are not allowed on Hacker News. We ban accounts that do that. Please post civilly and substantively, or not at all. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html We detached this subthread from https://news.ycombinator.com/item?id=13814135 https://news.ycombinator.com/item?id=13814135 and marked it off-topic.
- shabble 10y agovisions of https://www.youtube.com/watch?v=sRcHt-sxcPI https://www.youtube.com/watch?v=sRcHt-sxcPI (Defcon 24: various bypasses of Little Snitch)
- Darthy 10y agoIf you only need to send data once per week, and that data is less than 2K, simply encrypt it, make it part of a URL that you control, then tell the default browser to open that URL. Nearly everybody has configured Little Snitch so that the browser can connect to anything (because the popups quickly annoy). Then do a redirect on your server to something innocuous, and the user will quickly forget.
- _nalply 10y agoOr even better use window.close() then the user will only see the browser window open briefly. Of course if the user has JavaScript disabled, use HTTP 302 Found or HTML meta refresh to redirect, blah blah.