4 ms·

Maybe the higher quality work just hasn't been leaked (yet)?

by dan1234 10y ago

TYPE_FASTER 10y ago
Or the CIA is intentionally leaking obsolete techniques to deflect attention from the good stuff...
- the_cyber_pass 10y ago
  Or maybe they really are incompetent. The whole dump reads like a group of sysadmins trying to wrap their head around the basics. Their targets probably don't need anything on the cutting edge either so anything good they can just hold onto until they need to blow it on an Iranian nuclear reactor.
  - therein 10y ago
    > The whole dump reads like a group of sysadmins trying to wrap their head around the basics. That was exactly the vibe I got from the leak as well. I don't know why people are going crazy over this, thinking Notepad++ or all Samsung SmartTVs are backdoored. Who knows, maybe LD_PRELOAD is also an amazing method to hack programs?
    - the_cyber_pass 10y ago
      There is a case to be made that you only need to be good enough to get in. I myself am not nearly at the level where I could write a hypervisor exploit even though I have been in the industry for a while. However I feel pretty confident in my ability to break into almost any company if I set my mind to it. Fancy exploits are just things that take time to create and if your super great payload gets flagged by fireeye down the line you might have just wasted a ton of time for no other reason than showing off if powershell would suffice. So I guess I am torn on this because I don't want to flame the sysadmin's turned security people for not being a top speaker at blackhat or CCC because I myself come from that background, but on the other hand I think I should expect more quality work out of the CIA than what comes out of infosecinstitute. If this is the average of the CIA I really think NCC group might have more capability than the intelligence agency of the US government which is kind of crazy to think about. I am sure they have some really great zero days that they save for very important projects, but I doubt we will get to see the same level of capability that we saw out of the NSA leaks.
- flukus 10y ago
  Or leaking the ones they know other nations are using.
  - Globz 10y ago
    Exactly, they could be doing some kind of hacking tools rotation by burning all the ones which are most likely to get patch shortly because they have been reported and thrown in with a mix of obsolete tools which have been already been replaced by more efficient attack vectors and at the same time burning a big bag of tricks for all the other nations already using these vectors or in the process of developping such techniques/tools.
- djsumdog 10y ago
  This is a very real possibility. The CIA has admitted to Congress that they have operatives in US magazines, and refused to answer if they have operatives in TV: https://youtu.be/U1Qt6a-vaNM?t=2h30m35s https://youtu.be/U1Qt6a-vaNM?t=2h30m35s
sillysaurus3 10y ago
It's government work. It's probably a lot more fun to work in the private sector, which surely results in some skill discrepancy. It takes a lot of effort to get secret clearances, too. So I'm not sure there is higher quality work, at least in the CIA. All the talented hackers with inclinations to become a blackhat probably want to work for the NSA.
- tptacek 10y ago
  There are aspects of information security that I think the government is behind the private sector on, but there are others where they are way ahead. There are whole classes of technology that are fun to work on for which there is basically no private sector market, because very few companies need those sorts of things, but for which there is a thriving government market.
  - sillysaurus3 10y ago
    Certainly. I just meant that the CIA seems less likely to have that than the NSA or the FBI. But admittedly it's an uneducated guess. Could you expand on why you feel the CIA in particular would have high-quality remote exploitation capabilities? Assume a talented hacker wants to join the government. Why would they choose to work for the CIA and not the NSA or the FBI? I'm not saying the CIA does second-rate work in general, but perhaps their remote access work is second-rate in comparison to the NSA/FBI and to the very talented echelons of the private sector.
    - anon101001 10y ago
      From what I have seen, the CIA is full of technical illiterates, and if that extends to this division then most of them are mediocre at best. There are probably a few decent hackers among them, but the majority probably don't have a clue. It is another government agency. The CIA is not about tech, they are more about OPS.
tptacek 10y ago
That's my point.
- pramodxyle 10y ago
  No, its not. You say "1000% sure" which implies you are an authentic turd just trolling around.
awqrre 10y ago
apparently, the first leak represents less then one percent of what they have... so they probably didn't leak the most damaging stuff in the first leak.

Maybe the higher quality work just hasn't been leaked (yet)?

by dan1234 10y ago

Maybe the higher quality work just hasn't been leaked (yet)?

TYPE_FASTER 10y ago

Or the CIA is intentionally leaking obsolete techniques to deflect attention from the good stuff...

the_cyber_pass 10y ago
Or maybe they really are incompetent. The whole dump reads like a group of sysadmins trying to wrap their head around the basics. Their targets probably don't need anything on the cutting edge either so anything good they can just hold onto until they need to blow it on an Iranian nuclear reactor.
- therein 10y ago
  > The whole dump reads like a group of sysadmins trying to wrap their head around the basics. That was exactly the vibe I got from the leak as well. I don't know why people are going crazy over this, thinking Notepad++ or all Samsung SmartTVs are backdoored. Who knows, maybe LD_PRELOAD is also an amazing method to hack programs?
  - the_cyber_pass 10y ago
    There is a case to be made that you only need to be good enough to get in. I myself am not nearly at the level where I could write a hypervisor exploit even though I have been in the industry for a while. However I feel pretty confident in my ability to break into almost any company if I set my mind to it. Fancy exploits are just things that take time to create and if your super great payload gets flagged by fireeye down the line you might have just wasted a ton of time for no other reason than showing off if powershell would suffice. So I guess I am torn on this because I don't want to flame the sysadmin's turned security people for not being a top speaker at blackhat or CCC because I myself come from that background, but on the other hand I think I should expect more quality work out of the CIA than what comes out of infosecinstitute. If this is the average of the CIA I really think NCC group might have more capability than the intelligence agency of the US government which is kind of crazy to think about. I am sure they have some really great zero days that they save for very important projects, but I doubt we will get to see the same level of capability that we saw out of the NSA leaks.
flukus 10y ago
Or leaking the ones they know other nations are using.
- Globz 10y ago
  Exactly, they could be doing some kind of hacking tools rotation by burning all the ones which are most likely to get patch shortly because they have been reported and thrown in with a mix of obsolete tools which have been already been replaced by more efficient attack vectors and at the same time burning a big bag of tricks for all the other nations already using these vectors or in the process of developping such techniques/tools.
djsumdog 10y ago
This is a very real possibility. The CIA has admitted to Congress that they have operatives in US magazines, and refused to answer if they have operatives in TV: https://youtu.be/U1Qt6a-vaNM?t=2h30m35s https://youtu.be/U1Qt6a-vaNM?t=2h30m35s

sillysaurus3 10y ago

It's government work. It's probably a lot more fun to work in the private sector, which surely results in some skill discrepancy. It takes a lot of effort to get secret clearances, too. So I'm not sure there is higher quality work, at least in the CIA. All the talented hackers with inclinations to become a blackhat probably want to work for the NSA.

tptacek 10y ago
There are aspects of information security that I think the government is behind the private sector on, but there are others where they are way ahead. There are whole classes of technology that are fun to work on for which there is basically no private sector market, because very few companies need those sorts of things, but for which there is a thriving government market.
- sillysaurus3 10y ago
  Certainly. I just meant that the CIA seems less likely to have that than the NSA or the FBI. But admittedly it's an uneducated guess. Could you expand on why you feel the CIA in particular would have high-quality remote exploitation capabilities? Assume a talented hacker wants to join the government. Why would they choose to work for the CIA and not the NSA or the FBI? I'm not saying the CIA does second-rate work in general, but perhaps their remote access work is second-rate in comparison to the NSA/FBI and to the very talented echelons of the private sector.
  - anon101001 10y ago
    From what I have seen, the CIA is full of technical illiterates, and if that extends to this division then most of them are mediocre at best. There are probably a few decent hackers among them, but the majority probably don't have a clue. It is another government agency. The CIA is not about tech, they are more about OPS.

tptacek 10y ago

That's my point.

pramodxyle 10y ago
No, its not. You say "1000% sure" which implies you are an authentic turd just trolling around.

awqrre 10y ago

apparently, the first leak represents less then one percent of what they have... so they probably didn't leak the most damaging stuff in the first leak.