12 ms·
Wikileaks is offering tech firms CIA files first
- sand500 10y agoPretty standard practice when a exploit is found right? Alert companies and publicize after they patch it.
- cracell 10y agoIn general but I believe this is the first time wikileaks has had specific exploit information so it's the first time they are doing it.
- andreyf 10y agoThe article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR move without much substance. Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking-patch/ http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking... http://bgr.com/2017/03/09/google-says-many-android-exploits-detailed-in-wikileaks-cia-files-are-already-fixed/ http://bgr.com/2017/03/09/google-says-many-android-exploits-...
- saycheese 10y agohttps://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/
- andreyf 10y agoOf course the NSA looks for software vulnerabilities, and it's a vital part of both their core missions. And of course they don't neutralize their offensive capabilities by immediately revealing all of them to software makers. There's a balance that is struck between offensive and defensive missions with respect to each vulnerability. https://www.wired.com/2014/04/obama-zero-day/ https://www.wired.com/2014/04/obama-zero-day/
- filoleg 10y agoTwo things: 1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.
- andreyf 10y ago1. It's the CIA and the NSA, as well as a host of friendly non-US intelligence agencies. They develop vulnerabilities, share them, and release them when the improvement to the defensive advantage the release provides outweighs the hindrance to the offensive advantage they provide over adversarial intelligence agencies. 2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
- filoleg 10y ago1. The recent leaks were concerning CIA and not NSA. 2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.
- deleted 10y ago[deleted]
- andreyf 10y ago1. Makes no difference. 2. Makes no difference. How do you know the CIA found these vulns, and that they weren't shared from IC partners? You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.
- deleted 10y ago
- problems 10y agoThey do have exploits - they had lists of vulnerabilities in iOS and Android they were planning to report and release after patching has occurred.
- willstrafach 10y agoThere is zero evidence of this.
- problems 10y agoiOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html https://wikileaks.org/ciav7p1/cms/page_13205587.html Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html https://wikileaks.org/ciav7p1/cms/page_11629096.html Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.
- willstrafach 10y agoI definitely do not dispute the lists. One of them (Corona) is from the jailbreak group I started. They are certainly legit. My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.
- problems 10y agoYeah, it'll be interesting here though - they potentially have some pretty major remote exploits and tech firms might be resistant to even patch as those who are unpatched will be left vulnerable to attack. The standard route then is to threaten to publish anyways... This will involve very careful treading on the parts of both wikileaks and the firms involved.
- therealmarv 10y agoThe standard practice for Wikileaks was once to publish everything no matter what. I'm happy they have changed.
- problems 10y agoNot really... the biggest example of this was probably the leak that happened from Manning - but it in large part wasn't really WikiLeaks fault, they gave an AES 'insurance' key to a journalist who released it without really understanding the consequences. WikiLeaks generally tries their best to release responsibly, but it's a challenge when you get governments unwilling to accept leakers and journalists who don't know how to handle leaks.
- cmac2992 10y agoWikileaks has a terrible record on vetting releases and be "truly transparent". See the timing of the dnc and podesta emails... There were social security #'s in those releases. They try and play both sides of the fence: -we dont "editorialize", redact or make decisions on what is and isn't released -release specific info with sensational headlines timed for optimal impact
- problems 10y agoWhat's wrong with that? They simply optimized for impact. If they were to dump all the releases months before the election no one would have remembered them, no matter how significant. They've done partial releases and released over time with many other leaks too. I don't see how that conflicts with transparency or impartiality. Put yourself in their shoes - how would you have solved it differently? > There were social security #'s in those releases. When you're working with data in the volumes that they are and you have limited review staff, sometimes mistakes happen. If you'd like to help prevent it, I believe they do accept reviewers if you've got appropriate credentials.
- sarmstr5 10y agoSoftware already exists to indentify common PII like credit card numbers and social security numbers (need it for HIPAA requirements) and besides probably any freshman programmer could build a simple regex to find simple PII. So the most likely excuses are either complete incompetence or utter apathy to protect that info, not lack of manpower.
- swalsh 10y agoI wonder if firms are going to start using these fixes to search for people who have touched the files in order to find... patriots...
- rfrank 10y agoAlmost certainly.
- celticninja 10y agoThe CIA pretending to be China, or China pretending to be the CIA, or someone else entirely pretending to be China pretending to be the CIA, or vice versa.
- ikeyany 10y agoIf I had money/power, I would assume every device and account I have is compromised in some way. Back to pen and paper we go, until that can be compromised too.
- deleted 10y ago[deleted]
- Aqueous 10y agoOnce you admit that keeping secret and controlling the release of sensitive information has some 'harm minimization effect' - and therefore that releasing information in the wrong way or to the wrong people is potentially harmful - exactly where does that take the philosophy of 'radical transparency?'
- iaw 10y agoWikileaks stopped being about 'radical transparency' when Julian Assange felt personally threatened by Hillary Clinton and Google. Since then the Wikileaks agenda appears to be more about attacking and undermining US policy and standing wherever it can.
- deleted 10y ago[deleted]
- M_Grey 10y agoIt tells you that the person advocating that philosophy has given themselves license to wield all of that enormous power you're describing, without check or balance.
- deleted 10y ago[deleted]
- 0xfeba 10y ago> He added that while Wikileaks maintained a neutral position on most of its leaks, in this case it did take a strong stance. Uh huh. After the US Election debacle, I'm not so sure of that.
- snowpanda 10y agoRight because they should never publish anything that might harm the left, that automatically means they must be supporting the right.
- 10y ago
- dguido 10y agoDon't believe anything from Assange until it's confirmed by the tech companies themselves. Ask the security teams at each of these companies if they received any information from Wikileaks. From the people I know at the affected companies, no one has heard anything yet. Assange should not get the benefit of our trust.
- Ninn 10y agoPlease make a list of firms which have provided these comments denying that Wikileaks has provided them with information while claiming to have done so. This way others are able to confirm your comment. Otherwise it's really hard to take your comment seriously.
- dguido 10y agoI would ask the same in the opposite direction. Please make a list of companies that have positively confirmed they're receiving help from Assange. So far, there is no public evidence beyond a tweet from Wikileaks.
- jpalomaki 10y agoCan there be legal consequences if US based company publicly acknowledges it is working with this assumable secret and sensitive material?
- deleted 10y ago[deleted]
- filoleg 10y ago"Companies to get" implies future tense, not past. Thus it makes sense the companies have not received them yet. But I agree that confirmation from the companies once they receive would be very nice.
- saranagati 10y agoVery few people at these companies would have any idea about the vulnerabilities and even less would know where the reports came from. Big tech companies realize that they employee a lot of people and heavily restrict who can know about the reported vulnerabilities,me specially before they're patched. To think that those "privileged" people would tell you about it is asinine, especially regarding this very high profile event.
- deleted 10y ago[deleted]
- ttctciyf 10y agoFrom the BBC: > He claimed that an anti-virus expert, who was not named, had come forward to say that he believed sophisticated malware that he had previously attributed to Iran, Russia and China, now looked like something that the CIA had developed. That sounds very like something I read on Robert Graham's Mar 7 comments[1] on the leak: > Already, one AV researcher has told me that a virus they once suspected came from the Russians or Chinese can now be attributed to the CIA, as it matches the description perfectly to something in the leak. 1: http://blog.erratasec.com/2017/03/some-comments-on-wikileaks-ciavault7.html http://blog.erratasec.com/2017/03/some-comments-on-wikileaks...
- mikeyouse 10y agoThe post you link directly contradicts this: > There's no false flags. In several places, the CIA talks about making sure that what they do isn't so unique, so it can't be attributed to them. However, Wikileaks's press release hints that the "UMBRAGE" program is deliberately stealing techniques from Russia to use as a false-flag operation. This is nonsense. For example, the DNC hack attribution was live command-and-control servers simultaneously used against different Russian targets -- not a few snippets of code.
- problems 10y agoNothing about "active command and control servers" is strongly attributable. They aren't signing them with Russian government certificates or running them from Russian government IPs. They're buying servers or VPN connections on public providers. The notion of "strong attribution" in and of itself is basically impossible in the field of malware unless someone steps up and shows you the source. Those are things anyone can do. They're only doing a probabilistic analysis assuming no one else knows them, which makes many very large assumptions - like no one else wanting to fake Russian malware. He comes off quite partisan in my opinion - his Twitter pretty much confirms it as he compares Wired to Brietbart. I wouldn't listen to a word this guy says on the topic.
- mikeyouse 10y ago
- devy 10y ago> "a whole section of the CIA is working on Umbrage, a system that attempts to trick people into thinking that they had been hacked by other groups or countries by collecting malware from other nation states, such as Russia." What do you think of Umbrage?
- 086421357909764 10y agoThat it's a logical program for a Covert / Clandestine intelligence agency.
- problems 10y agoI think it's going to be severely abused politically. I've already seen a few people on the right saying it means the DNC hack was 100% fake. And I've already seen a security researcher on the left saying it has nothing to do with the results because "they found running C&C servers in that case", like you can't buy C&C servers anywhere in the world that you want. Neither claim makes any verifiable sense. Hacking attribution is somewhere between hard and impossible if your opponent doesn't want to be found or wants you to find someone else instead. It's a legitimately interesting program and something to consider when these claims get made. But don't listen the politics of it. It'll be a nightmare.
- mikeyouse 10y agoWikileaks is dramatically misrepresenting what Umbrage is. There are descriptive documents that explain exactly what it is and how it's meant to be used that were also leaked. Even the Intercept, who aren't exactly friendly to intelligence sources took umbrage (ha) with WL's characterization: > It would be possible to leave such fingerprints if the CIA were re-using unique source code written by other actors to intentionally implicate them in CIA hacks, but the published CIA documents don’t say this. Instead they indicate the UMBRAGE group is doing something much less nefarious. > They say UMBRAGE is borrowing hacking “techniques” developed or used by other actors to use in CIA hacking projects. This is intended to save the CIA time and energy by copying methods already proven successful. If the CIA were actually re-using source code unique to a specific hacking group this could lead forensic investigators to mis-attribute CIA attacks to the original creators of the code. But the documents appear to say the UMBRAGE group is writing snippets of code that mimic the functionality of other hacking tools and placing it in a library for CIA developers to draw on when designing custom CIA tools. https://theintercept.com/2017/03/08/wikileaks-files-show-the-cia-repurposing-foreign-hacking-code-to-save-time-not-to-frame-russia/ https://theintercept.com/2017/03/08/wikileaks-files-show-the...
- pinaceae 10y agoStill waiting for a leak from China or Russia. A bit weird that Wikileaks only targets the US.
- dglass 10y agoThey can only leak what is given to them. There are plenty of leaks that are not US related. https://wikileaks.org/-Leaks-.html https://wikileaks.org/-Leaks-.html
- plandis 10y agoI must be the only person to think it's weird that intelligence leaks are never from China or Russia. It's probably just a coincidence.
- Florin_Andrei 10y agoIt's almost like it's painting a pattern now. Almost.
- mickronome 10y agoSo what are you implying with that ambigous and opaque statement ? Some possible reasons: * They comparmentalise information better? * They don't use private contractors ? * It's more dangerous to leak material in those countries ? * ... * ... * ...
- problems 10y agoLikely has a lot to do with the countries themselves. Russia and China have much stricter governments and the values on freedom and privacy aren't as widely respected - so not as many leakers pop up.
- SomeStupidPoint 10y agoDefinitely a coincidence that it was within a week of Sessions being taken to task over his involvement with Russia and a Trump adviser being told by the SSCI to retain information about contact with Russia. We all know there's no chance this is smearing US intel agencies during an investigation.
- WillyOnWheels 10y agoMy biggest gripe is the word 'wiki' in the name of the Wikileaks organization.
- greenyoda 10y agoTheir site did apparently start out as a wiki. Wikipedia (another site whose name derives from their use of a wiki) says: "WikiLeaks was originally established with a "wiki" communal publication method..." https://en.wikipedia.org/wiki/WikiLeaks#Staff.2C_name_and_founding https://en.wikipedia.org/wiki/WikiLeaks#Staff.2C_name_and_fo...