6 ms·

Pretty standard practice when a exploit is found right? Alert companies and publicize after they patch it.

by sand500 10y ago

cracell 10y ago
In general but I believe this is the first time wikileaks has had specific exploit information so it's the first time they are doing it.
- andreyf 10y ago
  The article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR move without much substance. Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking-patch/ http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking... http://bgr.com/2017/03/09/google-says-many-android-exploits-detailed-in-wikileaks-cia-files-are-already-fixed/ http://bgr.com/2017/03/09/google-says-many-android-exploits-...
  - saycheese 10y ago
    https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/
    - andreyf 10y ago
      Of course the NSA looks for software vulnerabilities, and it's a vital part of both their core missions. And of course they don't neutralize their offensive capabilities by immediately revealing all of them to software makers. There's a balance that is struck between offensive and defensive missions with respect to each vulnerability. https://www.wired.com/2014/04/obama-zero-day/ https://www.wired.com/2014/04/obama-zero-day/
      - filoleg 10y ago
        Two things: 1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.
        andreyf 10y ago
        1. It's the CIA and the NSA, as well as a host of friendly non-US intelligence agencies. They develop vulnerabilities, share them, and release them when the improvement to the defensive advantage the release provides outweighs the hindrance to the offensive advantage they provide over adversarial intelligence agencies. 2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
        filoleg 10y ago
        1. The recent leaks were concerning CIA and not NSA. 2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.
        deleted 10y ago
        [deleted]
        andreyf 10y ago
        1. Makes no difference. 2. Makes no difference. How do you know the CIA found these vulns, and that they weren't shared from IC partners? You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.
      - deleted 10y ago
  - problems 10y ago
    They do have exploits - they had lists of vulnerabilities in iOS and Android they were planning to report and release after patching has occurred.
    - willstrafach 10y ago
      There is zero evidence of this.
      - problems 10y ago
        iOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html https://wikileaks.org/ciav7p1/cms/page_13205587.html Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html https://wikileaks.org/ciav7p1/cms/page_11629096.html Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.
        willstrafach 10y ago
        I definitely do not dispute the lists. One of them (Corona) is from the jailbreak group I started. They are certainly legit. My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.
problems 10y ago
Yeah, it'll be interesting here though - they potentially have some pretty major remote exploits and tech firms might be resistant to even patch as those who are unpatched will be left vulnerable to attack. The standard route then is to threaten to publish anyways... This will involve very careful treading on the parts of both wikileaks and the firms involved.
therealmarv 10y ago
The standard practice for Wikileaks was once to publish everything no matter what. I'm happy they have changed.
- problems 10y ago
  Not really... the biggest example of this was probably the leak that happened from Manning - but it in large part wasn't really WikiLeaks fault, they gave an AES 'insurance' key to a journalist who released it without really understanding the consequences. WikiLeaks generally tries their best to release responsibly, but it's a challenge when you get governments unwilling to accept leakers and journalists who don't know how to handle leaks.
  - cmac2992 10y ago
    Wikileaks has a terrible record on vetting releases and be "truly transparent". See the timing of the dnc and podesta emails... There were social security #'s in those releases. They try and play both sides of the fence: -we dont "editorialize", redact or make decisions on what is and isn't released -release specific info with sensational headlines timed for optimal impact
    - problems 10y ago
      What's wrong with that? They simply optimized for impact. If they were to dump all the releases months before the election no one would have remembered them, no matter how significant. They've done partial releases and released over time with many other leaks too. I don't see how that conflicts with transparency or impartiality. Put yourself in their shoes - how would you have solved it differently? > There were social security #'s in those releases. When you're working with data in the volumes that they are and you have limited review staff, sometimes mistakes happen. If you'd like to help prevent it, I believe they do accept reviewers if you've got appropriate credentials.
      - sarmstr5 10y ago
        Software already exists to indentify common PII like credit card numbers and social security numbers (need it for HIPAA requirements) and besides probably any freshman programmer could build a simple regex to find simple PII. So the most likely excuses are either complete incompetence or utter apathy to protect that info, not lack of manpower.

Pretty standard practice when a exploit is found right? Alert companies and publicize after they patch it.

by sand500 10y ago

Pretty standard practice when a exploit is found right? Alert companies and publicize after they patch it.

In general but I believe this is the first time wikileaks has had specific exploit information so it's the first time they are doing it.

andreyf 10y ago
The article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR move without much substance. Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking-patch/ http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking... http://bgr.com/2017/03/09/google-says-many-android-exploits-detailed-in-wikileaks-cia-files-are-already-fixed/ http://bgr.com/2017/03/09/google-says-many-android-exploits-...
- saycheese 10y ago
  https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/
  - andreyf 10y ago
    Of course the NSA looks for software vulnerabilities, and it's a vital part of both their core missions. And of course they don't neutralize their offensive capabilities by immediately revealing all of them to software makers. There's a balance that is struck between offensive and defensive missions with respect to each vulnerability. https://www.wired.com/2014/04/obama-zero-day/ https://www.wired.com/2014/04/obama-zero-day/
    - filoleg 10y ago
      Two things: 1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.
      - andreyf 10y ago
        1. It's the CIA and the NSA, as well as a host of friendly non-US intelligence agencies. They develop vulnerabilities, share them, and release them when the improvement to the defensive advantage the release provides outweighs the hindrance to the offensive advantage they provide over adversarial intelligence agencies. 2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
        filoleg 10y ago
        1. The recent leaks were concerning CIA and not NSA. 2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.
        deleted 10y ago
        [deleted]
        andreyf 10y ago
        1. Makes no difference. 2. Makes no difference. How do you know the CIA found these vulns, and that they weren't shared from IC partners? You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.
    - deleted 10y ago
- problems 10y ago
  They do have exploits - they had lists of vulnerabilities in iOS and Android they were planning to report and release after patching has occurred.
  - willstrafach 10y ago
    There is zero evidence of this.
    - problems 10y ago
      iOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html https://wikileaks.org/ciav7p1/cms/page_13205587.html Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html https://wikileaks.org/ciav7p1/cms/page_11629096.html Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.
      - willstrafach 10y ago
        I definitely do not dispute the lists. One of them (Corona) is from the jailbreak group I started. They are certainly legit. My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.

problems 10y ago

Yeah, it'll be interesting here though - they potentially have some pretty major remote exploits and tech firms might be resistant to even patch as those who are unpatched will be left vulnerable to attack. The standard route then is to threaten to publish anyways... This will involve very careful treading on the parts of both wikileaks and the firms involved.

therealmarv 10y ago

The standard practice for Wikileaks was once to publish everything no matter what. I'm happy they have changed.

problems 10y ago
Not really... the biggest example of this was probably the leak that happened from Manning - but it in large part wasn't really WikiLeaks fault, they gave an AES 'insurance' key to a journalist who released it without really understanding the consequences. WikiLeaks generally tries their best to release responsibly, but it's a challenge when you get governments unwilling to accept leakers and journalists who don't know how to handle leaks.
- cmac2992 10y ago
  Wikileaks has a terrible record on vetting releases and be "truly transparent". See the timing of the dnc and podesta emails... There were social security #'s in those releases. They try and play both sides of the fence: -we dont "editorialize", redact or make decisions on what is and isn't released -release specific info with sensational headlines timed for optimal impact
  - problems 10y ago
    What's wrong with that? They simply optimized for impact. If they were to dump all the releases months before the election no one would have remembered them, no matter how significant. They've done partial releases and released over time with many other leaks too. I don't see how that conflicts with transparency or impartiality. Put yourself in their shoes - how would you have solved it differently? > There were social security #'s in those releases. When you're working with data in the volumes that they are and you have limited review staff, sometimes mistakes happen. If you'd like to help prevent it, I believe they do accept reviewers if you've got appropriate credentials.
    - sarmstr5 10y ago
      Software already exists to indentify common PII like credit card numbers and social security numbers (need it for HIPAA requirements) and besides probably any freshman programmer could build a simple regex to find simple PII. So the most likely excuses are either complete incompetence or utter apathy to protect that info, not lack of manpower.