22 ms·
Wikileaks releases CIA's Marble: Malware obfuscation tools
- ComodoHacker 10y ago>Alternatively you can email User #72806
- albertTJames 10y agowonder when wikileaks will publish fsb hacking tools LOL
- vxxzy 10y agoThey would probably be CIA tools disguised as FSB.
- equalunique 10y agoSeems FSB has better security than CIA. 90% of intelligence community cyber security spending is on offensive projects, so this revelation should not be too surprising. (http://www.reuters.com/article/us-usa-cyber-defense-idUSKBN17013U http://www.reuters.com/article/us-usa-cyber-defense-idUSKBN1...)
- sandworm101 10y agoAnd FSB's attack surface is less than 1% of CIA's. Much fsb work is farmed out to contractors, the offensive stuff that CIA keeps in house. CIA people chat via email, messaging and by voice. FSB people chat in person. That's why russian hackers are always traveling while CIA hackers keep having thier stuff leaked.
- equalunique 10y agoGreat points. I don't know many details of how they operate. Someone told me they still rely on paper-based methods in order to avoid some types of electronic surveillance. In theory, 50% offense and 50% defense should be the only budget for a sane operation.
- dredmorbius 10y agohttps://news.ycombinator.com/item?id=14007213 https://news.ycombinator.com/item?id=14007213
- takeda 10y agoThere's suspicion that Assange no longer has control over Wiki Leaks.
- dredmorbius 10y agoCitation requested.
- cyphunk 10y agohttps://twitter.com/embassycat/status/729596974903767040 https://twitter.com/embassycat/status/729596974903767040
- dredmorbius 10y agoHow, specifically, is that proof of anything?
- Crito 10y agoCitation for suspicion? Is this a joke?
- dredmorbius 10y agoA reference to who is suspicious and why is deadly serious.
- 1_2__3 10y agoYes, surely that's the reason.
- quakeguy 10y agoRussia remains a black spot, due to the language/kyrilic alphabet? And they do most secret stuff with typewriters and photocopies these days, so i've heard. Snowdens revelations had a big impact there.
- Chaebixi 10y ago> And they do most secret stuff with typewriters and photocopies these days, so i've heard. Snowdens revelations had a big impact there. I think I heard the first heard the "Russia switches back to typewriters" story pre-Snowden. Electronic typewriter bugs are also not unheard of: http://www.cryptomuseum.com/covert/bugs/selectric/ http://www.cryptomuseum.com/covert/bugs/selectric/.
- __jal 10y ago1) I kinda doubt Russian hackers code on typewriters. 2) Cyrillic is an alphabet, not magic incomprehensibility dust. There are plenty of Russian speakers who are not beholden to their spooks. 3) Assange has an agenda in addition and orthogonal to fighting secrecy. I'm not saying he's insincere; I'm saying that some leaks are clearly more equal than others. It would not surprise me in the least if he were to sit on some leaks in order to not piss off a source providing others, especially around hard deadlines.
- quakeguy 10y agoThis comment has some more info: https://news.ycombinator.com/item?id=14007213 https://news.ycombinator.com/item?id=14007213
- mihular 10y agoSend them documents and they will publish them if legit.
- math0ne 10y agoThere is simply no evidence of that.
- mihular 10y agoYou are saying that Wikileaks has a ton of other documents but won't publish them? Based on what exactly?
- r3bl 10y agoI've seen this tweet a lot https://twitter.com/AaronBlake/status/769194327830585344 https://twitter.com/AaronBlake/status/769194327830585344 by the Washington Post reporter. Apparently, he claimed on Fox News that he had something on Trump, but that it wasn't interesting enough to release it. Not saying that this is a regular trend or something, but it seems like there is some evidence from Assange himself that they don't publish everything they have verified.
- math0ne 10y agoI'm not saying that, I'm saying there is no evidence either way.
- mihular 10y agoLet's says someone sent them important documents and they wouldn't publish them for no obvious reason. Don't you think the source wouldn't try other channels and/or go public with Wikileaks behavior?
- knz 10y agoOr more bad news for the Trump administration with evidence of communication etc coming from Russian servers? ;) Further down someone asked: "What would be the advantage to making your exploits appear to come from other countries?". If you want to sow doubt about the validity of evidence presented this seems like a good way to do so (not that we shouldn't be skeptical given the tools available).
- Jerry2 10y agoIt's much harder to leak Russian stuff because a lot of it is in paper form. After Snowden revelations, Russians returned to typewriters for all their top secret stuff [0]: >A source at Russia's Federal Guard Service (FSO), which is in charge of safeguarding Kremlin communications and protecting President Vladimir Putin, claimed that the return to typewriters has been prompted by the publication of secret documents by WikiLeaks, the whistle-blowing website, as well as Edward Snowden, the fugitive US intelligence contractor. >The FSO is looking to spend 486,000 roubles – around £10,000 – on a number of electric typewriters, according to the site of state procurement agency, zakupki.gov.ru. The notice included ribbons for German-made Triumph Adlew TWEN 180 typewriters, although it was not clear if the typewriters themselves were this kind. >“After scandals with the distribution of secret documents by WikiLeaks, the exposes by Edward Snowden, reports about Dmitry Medvedev being listened in on during his visit to the G20 summit in London, it has been decided to expand the practice of creating paper documents.” >Unlike printers, every typewriter has its own individual pattern of type so it is possible to link every document to a machine used to type it. Now, their hacking tools are obviously not in paper form but I bet they're much more tightly controlled than the CIA/NSA tools. They probably have a much smaller team of people who have access to such tools so it's much harder for them to leak. It's also easier to do counterintelligence on people who do have access and you can bet every one of those people is monitored to some degree. US has thousands of contractors who work for CIA/NSA/DIA and other intelligence agencies and many, supposedly, can easily walk out with some of the most sensitive documents that the USG possesses. [1] One of these contractors, supposedly, leaked out these files to WikiLeaks [2]. FBI is now on a hunt to figure out who it was. Russians don't have a huge network of contractors. I couldn't find the exact figure but by a quick estimation, Russians have 100x less people doing the intelligence work. They also have much, much smaller budgets because of their economy. So it's easier for them to keep secrets from leaking. CIA probably (most definitely?) has moles inside of FSB so FSB secrets do leak. Just not to WikiLeaks. [0] http://www.telegraph.co.uk/news/worldnews/europe/russia/10173645/Kremlin-returns-to-typewriters-to-avoid-computer-leaks.html http://www.telegraph.co.uk/news/worldnews/europe/russia/1017... [1] http://www.federaltimes.com/articles/fbi-arrests-contractor-in-possible-nsa-theft http://www.federaltimes.com/articles/fbi-arrests-contractor-... [2] https://www.wsj.com/articles/authorities-questioning-cia-contractors-in-connection-with-wikileaks-dump-1489283964 https://www.wsj.com/articles/authorities-questioning-cia-con...
- k-mcgrady 10y ago...when somebody sends them to Wikileaks.
- jwtadvice 10y agoThey would love to if someone gets them copies of the FSB hacking tools.
- lightbyte 10y agoWhy would they release their own tools?
- rdtsc 10y agoOh I get it, because Assange is a Russian FSB agent. Yap, makes total sense.
- JabavuAdams 10y agoMore like Assange knows that the FSB will just straight up poison him with Polonium instead of slapping him around a bit and shipping him to GITMO.
- antocv 10y agoPolonium in tea, or "slaps" while in Guantanamo or solitary confinement like Manning?
- JabavuAdams 10y agoEmpirically, one is more deadly than the other.
- superioritycplx 10y agoHe could also be Seth Rich'd https://en.wikipedia.org/wiki/Murder_of_Seth_Rich https://en.wikipedia.org/wiki/Murder_of_Seth_Rich
- sanswork 10y agoThat interview was the final straw in causing my total loss of respect for Wikileaks. Trying to profit politically off the death of an innocent man is vile. Forcing his parents and family to endure the weight of the conspiracy community in an attempt to attack your political opponents is an awful thing to do.
- 10y ago
- vxxzy 10y agoWhat would be the advantage to making your exploits appear to come from other countries? What do we gain from this? It feels like an instigation.
- jwtadvice 10y agoWell this is the CIA. It can confuse the attribution so that trust is spoiled, so that energy is spend uselessly, so that another country takes the blame, for false flag attacks to justify other strategic moves.
- empath75 10y agoDoesn't necessarily have to be instigation -- could just be misdirection. If you're targeting Russians, then making malware that looks like Russian hackers seems like a no brainer, if you don't want to attract attention from intelligence services.
- freeflight 10y agoEspecially when you, or a partner service of yours, has access to compromised servers from that region to spread said malware from a server that can be attributed to "the bad guys™". Like it's the case with the NSA: http://www.networkworld.com/article/3137065/security/shadow-brokers-leak-list-of-nsa-targets-and-compromised-servers.html http://www.networkworld.com/article/3137065/security/shadow-...
- rdtsc 10y agoThere is a huge advantage to do that. False flag attacks are one of the tried and true methods of intelligence agencies since ancient times. For example the official pretext for WWII was started as a false flag: https://en.wikipedia.org/wiki/Gleiwitz_incident https://en.wikipedia.org/wiki/Gleiwitz_incident US did it at the start of Vietnam War: https://en.wikipedia.org/wiki/Gulf_of_Tonkin_incident https://en.wikipedia.org/wiki/Gulf_of_Tonkin_incident We gain a lot from this. We can for example manufacture "Russian hysteria" - "Look we found a Russian rootkit on a DNC server". We can attack our allies and then make it look like the Chinese did it, and so on. It is immensely useful.
- salesguy222 10y agoI wonder if Sony really was "hacked by the North Koreans" then.
- mjg59 10y agoThis describes a string obfuscation technology. It doesn't do anything to disguise the origin of malware.
- salesguy222 10y agoThey've also found that kids who kill bugs and squirrels go on to become serial killers at slightly higher rates than "normal people" :) I doubt the CIA is only involved in one technical attack and not others.
- eli 10y agoYou think the CIA did it instead? Other than it maybe being technically possible, what evidence or motivation would they have for doing that?
- salesguy222 10y agoBefore I answer, I'd like to state that I am an American citizen living abroad and I have no particular allignment to or against any country :) I don't know if the CIA did or would want to do this specific attack. But, I could grasp at straws to fit the Sony attack in line with the narrative of what I would call "1950s American Imperialism". In my view, the Americans took covert or overt actions for many decades now to undermine economically competitive countries. We've bombed Germany, Italy, Japan, Serbia, Korea, China, Vietnam... we've invaded Iraq... we've taken actions against many Latin American governments and Iran... Over the years, the powers at be have been pretty good at framing other nations for attacks or dangers, in order to drum up public support to attack them. Gulf of Tonkin, WMDs, USS Vincennes... So, in short, if you had definitive proof that Russian and NK hacking were in fact orchestrated by the CIA... ... then the economic imperialism narrative would hold as pretty plausible motives! The most blatant endgame here for the US is "NK hacked us. They have nukes! It's time to invade!". And then NK becomes a new market for the West to take over for cheap as they did in Communist Yugoslavia and so on
- azinman2 10y agoI've really turned on Wikileaks. Itd be one thing if all the major powers had equivalent leaks publishing, but focusing on the US basically serves Chinese and Russian interests far more than it does the citizens of the US. String obfuscation isn't stemming from some corrupt deal that needs sunlight... this is just doing a disservice to their original mission.
- tehlike 10y agohonest question: does wikileaks not have necessary connections in China to collect the intel and stuff?
- cavanasm 10y agoWikileaks doesn't collect intel whatsoever. They pretty much put up anything sent to them that they think is real (and that admittedly fits whatever editorial narrative is driving Assange at the moment). No one at Wikileaks is doing the hacks, or infiltrating government organizations.
- ceejayoz 10y ago> They pretty much put up anything sent to them that they think is real. Maybe, maybe not. How would we know they do that?
- jlft 10y agoIf someone sends real leaks to Wikileaks and they don't publish, then the leakers can use alternative channels to distribute the leaks (for example, sending directly to journalists), and then accuse Wikileaks of not publishing. Has anyone already accused Wikileaks of not publishing real leaks?
- ceejayoz 10y agoYes, they've been accused of that. https://www.nytimes.com/2016/09/01/world/europe/wikileaks-julian-assange-russia.html https://www.nytimes.com/2016/09/01/world/europe/wikileaks-ju... > WikiLeaks, he told a Moscow newspaper, had obtained compromising materials “about Russia, about your government and your businessmen.” > Mr. Assange, asked soon after by Time magazine whether he still planned to expose the secret dealings of the Kremlin, reiterated his earlier vow. “Yes indeed,” he said. > But that promised assault would not materialize. Instead, with Mr. Assange’s legal troubles mounting, Mr. Putin would come to his defense. There's also the fun time they came out against leaks that hurt Trump on the baffling assertion that Trump deserved to get to read them before release: https://twitter.com/wikileaks/status/817322050297745408 https://twitter.com/wikileaks/status/817322050297745408 > The Obama admin/CIA is illegally funneling TOP SECRET//COMINT information to NBC for political reasons before PEOTUS even gets to read it. Odd stance for the organization to take.
- deleted 10y ago[deleted]
- brooklynmarket 10y agoWow C is back. Figured they were using php and Wordpress. :-)
- oliv__ 10y agoThe WARBLE languages are pretty telling of which actors this software is intended to target: * Arabic * Chinese * Russian * Korean * Farsi Interesting...
- DigitalJack 10y agoWhy is that interesting? Seems obvious so I am wondering if I missed something.
- deleted 10y ago[deleted]
- sigmar 10y agoYou realize that is a list of most non-latin character sets? Seems it is just to test the framework with unicode. http://searchsecurity.techtarget.com/news/450416071/WikiLeaks-false-flag-attack-allegations-against-CIA-unfounded http://searchsecurity.techtarget.com/news/450416071/WikiLeak...
- 27182818284 10y agoIt would only be interesting to see something like French show up. The CIA openly asks for primarily Chinese and Arabic speakers on their website to apply for jobs...
- Mikushi 10y agoOnly caring about Americans is the exact reason non-American keep supporting Wikileaks and the like, we're tired of your american view of the world, you're not the center of it, piss off.
- dang 10y agoAttacking another user like that is a bannable offense on HN. Please don't do this again. We detached this comment from https://news.ycombinator.com/item?id=14007208 https://news.ycombinator.com/item?id=14007208 and marked it off-topic.
- jorblumesea 10y agoThe more I look at Wikileaks the more I can see them being funded by US/Chinese interests. They are turning from a leaks organization to vehemently anti-Western.
- deleted 10y ago[deleted]
- MaxLeiter 10y agoYou can't. LOLZ. Yet. https://wikileaks.org/ciav7p1/cms/page_16384857.html https://wikileaks.org/ciav7p1/cms/page_16384857.html
- rbanffy 10y agoI think I'll just open an issue and let someone else update the name lists... Wikileaks is publishing these things faster than I can update my code. https://github.com/rbanffy/nsaname https://github.com/rbanffy/nsaname
- bsamuels 10y agothis comment is a great example of foreign astroturfing try posting from an account with a comment history next time
- cmdrfred 10y agoI feel the same way. Is my history sufficient?
- OoTheNigerian 10y agoI'm Nigerian and I feel the hypocrisy of the US government is a great danger to the world. Russia and China are known "evils" and that we can deal with. The US keeps us a d American citizens blind. I hope my comment history works for you and you will not be reporting me to any "authorities"
- travmatt 10y agoIt's hilarious that you can non ironically can say America keeps its citizens blind and use China as a comparison. Then Russia as an example of the lesser danger as it is in the middle of several wars, and literally trying to export a governing style based on a close relationship between its intelligence services and crime syndicates.
- Karunamon 10y agoI completely agree with what they posted, and find your low effort well poisoning to be odious and offensive.
- dang 10y agoThis is uncivil and the sort of thing we ban accounts for. You can't attack another user like this on HN, regardless of how wrong you consider them. Please don't do it again. There are many reasons why users post with new accounts on HN, not all such users are 'foreign' (whatever that word means on an international site). Accusing others of astroturfing or shilling without evidence is not allowed. Somebody simply having an opposing view does not count as evidence. There are plenty of opposing views. We detached this subthread from https://news.ycombinator.com/item?id=14008045 https://news.ycombinator.com/item?id=14008045 and marked it off-topic.
- defen 10y agoYou're either a really good troll, or you need more practice with your articles to pass as a native English speaker :)
- dang 10y agoYou can't conduct personal attacks like this on Hacker News. The odds that you're right in any particular case are low and not worth the considerable damage it does to the community. Please don't do this again. We detached this comment from https://news.ycombinator.com/item?id=14008045 https://news.ycombinator.com/item?id=14008045 and marked it off-topic.
- joshvm 10y ago(Perhaps not so) Interesting that the demonstration languages are: Chinese, Russian, Arabic, Farsi and Korean. Could be a fun one for game DRM? Or apps where an API key is hidden in the binary?
- SXX 10y agoIt's funny to see how many educated people on HN expect to see something like "Russia / FSB / etc" hacking tools or documents leaks or whatever. Probably it's due to looking at how three letter agencies operate in first world countries someone would expect that you actually need that many people to steal some emails or get hands over company database. It's obviously that no matter how big NSA conspiracy is every dollar spent, every meeting occur, every decision made all have to be controlled and documented. And any 3rd party company working for agency must have official contract, must report taxes and sometimes can even sell all the same tools for other governments. So it's thousand people participate at every single step. In world of paranoid and corrupt ex-KGB mafia nothing like that required. All you need is just few experts and enough of money. Russia have plenty of online criminals: carders, illegal pharmacy and drug dealers, owners of credit card processings used for fraud, money laundering payment systems, botnet owners, spyware developers and most of them are controlled by state or somewhat under special agency protection racket. Need 0-day exploit? Rootkit? Spyware? Any unique tools? Anything can is there for money! DDoS attack or a lot of proxy servers at any location needed? Plenty of services there and agencies obviously know owners. No documentation or reporting needed since corrupt government agencies are closely tied to those criminals for years. So the same attacks that would involve at least few hundred of people in usual US three letter agency would likely require to just few dozens in Russia. What's more important no one would ever tell the difference between this activity and usual agency behaviour that related to usual corruption schemes. So if you seriously think there is Russian government behind some attacks then shouldn't expect any leaks about that. If there is something important for Kremlin they wouldn't mind to dump money on it, but there will be very few people aware of it and of course there will never be any documents or other traces since they would be done as any other attack against commercial company or opposition politician.
- arca_vorago 10y agoLook at all the people complaining that wikileaks is anti-western and/or foriegn supported/agents with no proof of this whatsoever. If anything wikileaks has shown a superior journalistic record in publishing whatever comes across their desk, so I don't see people criticising wikileaks on this the weakest of points as anything but intellectually dishonest at best.
- strathmeyer 10y agoYou're going to find Hackers have a higher standard for truth.
- angry-hacker 10y agoAs a foreigner this witchunt for Assange is pathetic, suddenly when you support bad boys he's no good. Who said advertising doesn't work? Especially political.
- ndesaulniers 10y agoIt's unethical for anyone who calls themselves an engineer to do this kind of work.
- asimpletune 10y agoHow about instead of talking about whether Wikileaks is good or bad or whether you support them or not, let's talk about the content of the post. From what I've read so far, this is pretty freaking cool. It's super interesting to read these docs and see their thought process involved, especially since the product their building is so different from what people are making on a day to day business. It actually looks pretty fun to work on. Also, I think it's neat to read about their need for developing frameworks that can be used around the agency to accomplish stuff. Unfortunately, I didn't ready anything about self modifying code, which is probably the most difficult malware to detect and probably to write. Maybe it's in there though, I didn't read the whole document. I came to the comments about half way through to see dozens of people talking about whether they support Wikileaks or not which I think is fine, free country, but I'd like to actually know what some people who work with this kind of stuff think. A framework for compiling to self modifying, yet correct, code wiukd be super cool. I wonder if it always has to be written by hand? Probably not but maybe that's a separate tool Wikileaks has yet to release.
- willstrafach 10y agoThis framework seems comparable to many open source obfuscation solutions. I would hope to see more advanced techniques, then again, maybe their requirements called for ensuring things did not look too obfuscated (the more tricks used, the more likely a signature could be detected for their tradecraft). Personally I do not believe self-modifying code would make much sense in their use case. In fact, this would not be possible on iOS due to kernel-based security protections.
- kaminsod 10y agoSelf modifying code isn't really new or secret stuff. https://en.wikipedia.org/wiki/Metamorphic_code https://en.wikipedia.org/wiki/Metamorphic_code https://web.archive.org/web/20070602060312/http://vx.netlux.org/lib/vmd01.html https://web.archive.org/web/20070602060312/http://vx.netlux....
- openasocket 10y agoSelf-modifying the underlying machine code isn't what it used to be. Besides the difficulty in writing it, there's lot's of caveats about how it interacts with the cache and the instruction pipeline. It also requires setup, because with modern memory protection all the machine code is read-only. Changing the memory protection for some machine code to be executable and writable at once will set off some alarms (And isn't even possible on systems with W^X). So you need to change it to just writable, make your modifications, then change it back to just executable, which is less suspicious, it just looks like what JIT compilers do. But all in all self-modifying code doesn't really give you anything. The exception to that is packers and other obfuscation techniques, which are related to self-modifying code. The general idea with these is that you take your real program and compress/encrypt/mangle/etc it and store that data in an executable. The code in that executable de-compresses/decrypts/demangles that data, sets it as executable, and then runs it. Unlike traditional self-modifying code, packing is orders of magnitude easier to write for the malware developer. The advantage here is that an antivirus tool can't determine what your real program does statically unless it understands how you mangled it, which is hard to do in general. To "unpack" an executable you've got three general techniques: 1. Packers tend to get reused a lot, so just have a person write an unpacker for popular packers by hand, and do some pattern matching to figure out which packer an executable is using. This doesn't work for everything, but it's fairly simple. 2. Dynamic Analysis. Run the executable and watch the contents of memory as the program unpacks itself, the real program should pop right out. Of course you have to run the executable in some sort of sandbox environment, and there's ways for the malware to detect that and alter it's behavior. This also isn't the most efficient process, so you can't really do this to executables during, say, an antivirus scan. 3. Symbolic Analysis. Basically static analysis on steroids to figure out what the executable will do without actually running it. The malware can't stop this with sandbox detection. But it's super slow and is still an active area of research.
- philfrasty 10y ago(noob question) Do you need THE best software-development talent to be able to build comprehensive surveillance like the big agencies? Like THE Christiano Ronaldo or THE Michael Jordan of programming. Or is this more about funds and the power to set such a system in motion?
- dredmorbius 10y agoThat's an interesting question. My thought is that much of the problem is tactical, logistical, organisational, and capabilities-oriented. Consider the problem domain: 1. There's a vast amount of information flowing around the world. Much of it remains at best poorly protected, and until recently, that was even more the case. 2. Much of surveillance revolves around access to the channels themselves. Which means places such as satellite uplink/downlink centres, transoceanic cable landfalls, major switching hubs, telecoms hubs (AT&T's notorious San Francisco closet), etc. 3. Then you've got the problem of simply ingesting the information. For that, you need fat pipe of your own, and massive storage. 4. Then the problem of classifying and prioritising the information, or identifying and tracing specific targets. Again, in both cases, scale matters more than capability, where scale is both a matter of data (transmission, storage, processing) and above all access. If you want to tap a specific landline, or cellphone, or cloud / online storage provider, do you have the tactical assets in place to be able to do so? E.g., official or unofficial liasons with the organisation in question. If official, how do you maintain that relationship (what balance of carrots and sticks). If unofficial, do you risk burning through such assets by utilising them. Google, to take an example, apparently looks poorly on employees directly accessing user data, and could well discipline or terminate any staff or contractors who do so. This doesn't mean that the NSA doesn't have and cannot use such assets, but they can likely only use each one a small number of times, possibly only once. That raises the costs for any such access, though again, scale offers a potential counterweight. (Rinse, wash, and repeat for all non-Google organisations, I'm actually raising them as an example here on account of their apparently stringent internal controls.) 5. Technical capabilities. For any given channel, there are the fundamental information-theoretical problems of establishing a link, transferring, and comprehending data. Depending on the complexities involved, this may be easy or hard, but there's almost certainly a fixed setup cost for any given service. This also means that the surveillance entity will likely target technical sources by some balance of total size (likelihood that any given target will be on it) and specific interest (that a particular target is there). Such resources are again finite, and suggest yet another possible defeat: by embracing rapid change, workfactor for achieving technical penetration increases. I'm arguing my own way through this, but in general, I'd think that size matters more than skill, though the two complement, and there are almost certainly instances in which brute intelligence and capability in conceiving of exploits is an essential factor.
- faragon 10y agoWikileaks is an organization built to destabilize the US government. Romantic and idealist stuff aside, they are playing the role of "useful idiot" for other intelligence agencies. And that is very dangerous.