5 ms·

https://wikileaks.org/vault7/#Marble https://wikileaks.org/vault7/#Marble Framework > The source code shows that Marble has test examples not just in English b

• xienze 10y ago
  > They're pretty obviously trying to push the idea that attribution of hacks (such as the DNC hack) can be really easily spoofed, and you shouldn't trust them. OK, and? Is it incorrect that they can spoofed? If not, doesn't that necessarily mean that you can't take "the Russians did this" at face value?
  • 112-123 10y ago
    It's entirely irrelevant to this release. The attribution to Russia has nothing to do with the language of strings embedded in the malware. It's based on the re-use of the same exact techniques, including command-and-control server addresses and encryption keys that have been used in many, many other attacks that align extremely closely with Russian interests. Successfully hacking, over the course of about a decade, American government interests, Eastern Ukrainian militias, Russian dissidents, the Olympic anti-doping committee investigating Russia's wide-spread doping scandal, journalists investigating the downing of MH17, etc. would be a very convoluted and expensive way to spoof attribution of this one attack.
    • parineum 10y ago
      > It's based on the re-use of the same exact techniques, including command-and-control server addresses and encryption keys that have been used in many, many other attacks that align extremely closely with Russian interests. Is there an official source that actually breaks down the similarities to which attacks? I have my doubts about the attribution of the DNC hack to _state_ agents. The only specific I've read was the Gucifer 2.0 windows language being set to Russian. Every other attribution has been a "trust us, we've seen this before" but I am very skeptical of intelligence and law enforcement agencies unattributed claims and I think they've earned that distrust.
      • 112-123 10y ago
        This testimony given yesterday is an excellent overview, and has citations you can follow for more specifics: https://www.intelligence.senate.gov/sites/default/files/documents/os-trid-033017.pdf https://www.intelligence.senate.gov/sites/default/files/docu... You are correct that the publicly available evidence doesn't point directly to the GRU, but rather merely to an anonymous extremely well-resourced group whose interests align extremely well with Russian military interests. While the GRU is the most reasonable conclusion, this would leave open, for example, the possibility that some contractor to the Russian military is operating with independence, not actually under direct order from the Kremlin. The intelligence community claims to have knowledge, through conventional intelligence rather than forensics, that this was done by the GRU themselves, under order from the highest levels of leadership. This presumably means they know who the hackers actually are, whom they report to, and the general structure of the agency. They claim they have multiple, strong, independent sources confirming this, but they can't reveal their intelligence publicly without compromising those sources.
      • r721 10y ago
        https://motherboard.vice.com/en_us/article/all-signs-point-to-russia-being-behind-the-dnc-hack https://motherboard.vice.com/en_us/article/all-signs-point-t... https://medium.com/@thegrugq/evidence-guccifer-2-0-is-russian-intel-55f9f8b3f135 https://medium.com/@thegrugq/evidence-guccifer-2-0-is-russia...
• elif 10y ago
  >There's no evidence the CIA has ever done this. This is pure conjecture based on the fact that there's demo code showing that the library supports Unicode. Where is the conjecture? the exact quote is "this would permit" not "this has happened" > They're pretty obviously trying to push the idea that attribution of hacks (such as the DNC hack) can be really easily spoofed, and you shouldn't trust them. They are ~revealing~ the capability and intent of attribution obfuscation. I disagree with your assessment that they are ~pushing~ something, implying that there is something which is not self-evident which requires some kind of coercion for belief.
  • sigmar 10y ago
    >They are ~revealing~ the capability and intent of attribution obfuscation. This framework is used to obfuscate. The document itself seems to suggest they built this framework to be very generic and prevent attribution. Where in this document do you see Wikileaks is misdirecting attribution? It is possible the CIA does miss-attribution, but none of these documents suggest that (which is not in line with how Wikileaks is framing it)
  • learc83 10y ago
    Stop being obtuse. Human communication is more nuanced that formal programming language. The context in which you say something is just as important as the content. It is very easy imply something and push a specific agenda without technically lying. What if I take out an add that says: "elif regularly participates on hacker news--a forum for computer programmers and 'hackers', and he is a programmer who can create malicious programs. The libraries he uses support multiple languages, like Chinese and Russian, giving him the capability to make it look like these programs were created by foreigners." I'm just describing your capabilities. But the way I said it implies to non-experts that your actually writing malicious code, because they lack the context to understand what they're reading. They don't understand that all programmers have the capability to create malicious programs. And most importantly, just like the readers of Wikileaks commentary, they don't realize that supporting Unicode is very common, and it's necessary if you want to parse text written in it. It's not a specialized capability that you'd only want if you intended to write in Russian or Chinese.
  • 10y ago
• rndgermandude 10y ago
  [A]ttribution of hacks (such as the DNC hack) can be really easily spoofed, and you shouldn't trust them.