7 ms·

Grasshopper

94 points by Jerry2 10y ago

rdtsc 10y ago
https://wikileaks.org/vault7/document/DerStarke_v1_4_DOC/page-1/#pagination https://wikileaks.org/vault7/document/DerStarke_v1_4_DOC/pag... --- Der Starke is a diskless, EFI-persistent version of Triton. Once active on a target system, the implant executed within diskarbitrationd and typically performs network ommunications through a browser process so that PSPs like Little Snitch cannot easily detect it's presence. This Companion User Guide is meant to supplement the Triton User Guide. --- This is obvious to most people here but it might not be to others, if the attacker got physical access to the machine it's game over. https://wikileaks.org/vault7/document/Grasshopper-v2_0_2-UserGuide/page-16/#pagination https://wikileaks.org/vault7/document/Grasshopper-v2_0_2-Use... --- Grasshopper has the following system dependencies: Python 3.4: The Grasshopper build system was developed and tested for Python 3.4 --- Nice! A lot of government projects are stuck on older versions of Python tied to ancient OS versions. I gotta say, the rule matcher syntax and the overall design is done very well. Hat tip to the authors if they are reading this.
- robschia 10y ago
  They are reading everything.
belorn 10y ago
So the CIA is using components from the malware known as Carberp, a suspected Russian organized crime rootkit, which mean instead of helping people protection their computer from organized crime they allow the vulnerability to continue. How is this moral?
- tptacek 10y ago
  It's not an either-or; this is malware, not vulnerabilities. For the most part it doesn't make sense to think in terms of using malware components to protect systems from malware. This misunderstanding has come up on a bunch of other threads too; it seems to be pretty widespread. You can't really "burn" most persistence techniques, publishing them in a way that makes them easy to defend against. If you could, a whole lot of platform security engineering would be much easier.
  - belorn 10y ago
    What part of a "persistence method" are not using vulnerabilities? If you infect the boot loader, bios, firmware, or some other methods to create persistence then those are vulnerabilities. That a system can get infected in such way is not by any intended design. Could give an example of a persistence techniques that is using a intended feature of a computer system in order to hide the malware in unintended places in such a way that the system can't remove it (which itself is a unintended functionality).
    - tptacek 10y ago
      That's like suggesting a programmable page table is a vulnerability, because it can be used to hide a malware stub from processes looking for malware. However you want to litigate this on a message board, nobody working in platform security or even malware defense thinks that way. The difference between a persistence vector and a vulnerability is that you can patch a vulnerability, but you can't patch "programmable page table".
    - Gaelan 10y ago
      One could argue that the ability to replace OS elements is a feature.
- altcognito 10y ago
  I was unaware that the CIA is the malware division of the US federal government. They are a spy division. At least we have this timely information again from wikileaks that provides a narrative that the US is framing Russia for hacking. It's almost the only thing they are releasing nowadays.
  - shuntress 10y ago
    >I was unaware that the CIA is the malware division of the US federal government. They are a spy division. Is a little like saying "the FBI is the firearms division" because FBI agents are armed.
    - jessaustin 10y ago
      Don't worry about it. GP is "clever" sarcasm, inspired by electoral bitterness.
    - anigbrowl 10y ago
      Well intelligence-gathering is the CIA's nominal job. You could say this policy of using malware is a policy for the government as a whole, and I'm inclined to agree, but if you're going to have an agency devoted to espionage (and you'd be an idiot not to because every other country does) then it's unreasonable to expect them not to use whatever tools are available. I have to say comments like this sound like you also worry that teaching CIA agents to pick locks might result in an increase in property crime, a position that's hard to take seriously.
- deleted 10y ago
  [deleted]
tptacek 10y ago
Backdoors from the 90s included actual purpose-built compilers. Whatever the CIA is doing, a good bet is that it's clownshoes stuff. (I'll leave this comment here, but it responded to the original editorialized title of the story, which pointed out that this trojan had "its own language".)
- avenoir 10y ago
  Sub7 had an editor back in the day that would allow you to build a custom client. I don't remember the technical nature of it. I believe it was just packing configuration and the client into a single executable w/o recompiling, but this is the kind of stuff teenage script kiddies were doing back in the day with VBS and/or Delphi.
deleted 10y ago
[deleted]
John23832 10y ago
At this point I think Wikileaks is largely trash. Their agenda is blatantly anti-us motivated. This leak and the previous one are examples. The CIA is a spy organization. Their job is to spy on foreign influencers. As such, they have spy tools... Just like Russia, China, the UK, etc. etc. If the headline here mattered, it would be, "Spy Agency has Spy Tool". There is no evidence at all that this stuff has been used domestically. But wikileaks buries that headline. Wikileaks continues to push the agenda that these leaks correlate with the legitimate PRISM leaks that we saw earlier. They push the narrative that these tools are being used on americans, should be ashamed, don't trust your intelligence agencies etc. Fueling the populist anti-intellectual bs we have going on in the world right now. Don't get me wrong. The US government should be ashamed of PRISM and the actions of the NSA, but Wikileaks should be ashamed of these leaks and the way they're representing this information..
- zeveb 10y ago
  Agree with your point re. Wikileaks, but I disagree that the PRISM leaks were legitimate, or anything to be ashamed of. To my knowledge, no compelling evidence indicates that the Constitutional or legal rights of Americans have been violated.
  - John23832 10y ago
    I guess you could argue whether PRISM was lawful or not. I think we can all agree though that there was a recognizable moral gray area there that needed to be brought to the attention of the people. When brought to the light, the legitimacy could be argued. These current leaks are just attempts at undermining.
- watscheatcodes 10y ago
  Um... Need I remind you, that everything from Vault 7, was leaked on flash drives, (vault 7 shit doesn't require infrastructure to deploy or use as most nsa implementations do), and given to ex spooks, contractors, ex contractors, private contractors, even those with no intention of working for the government. Basically a deal sweetener, for those with similar status or ideals.
- 10y ago

94 points by Jerry2 10y ago

rdtsc 10y ago

https://wikileaks.org/vault7/document/DerStarke_v1_4_DOC/page-1/#pagination https://wikileaks.org/vault7/document/DerStarke_v1_4_DOC/pag... --- Der Starke is a diskless, EFI-persistent version of Triton. Once active on a target system, the implant executed within diskarbitrationd and typically performs network ommunications through a browser process so that PSPs like Little Snitch cannot easily detect it's presence. This Companion User Guide is meant to supplement the Triton User Guide. --- This is obvious to most people here but it might not be to others, if the attacker got physical access to the machine it's game over. https://wikileaks.org/vault7/document/Grasshopper-v2_0_2-UserGuide/page-16/#pagination https://wikileaks.org/vault7/document/Grasshopper-v2_0_2-Use... --- Grasshopper has the following system dependencies: Python 3.4: The Grasshopper build system was developed and tested for Python 3.4 --- Nice! A lot of government projects are stuck on older versions of Python tied to ancient OS versions. I gotta say, the rule matcher syntax and the overall design is done very well. Hat tip to the authors if they are reading this.

robschia 10y ago
They are reading everything.

belorn 10y ago

So the CIA is using components from the malware known as Carberp, a suspected Russian organized crime rootkit, which mean instead of helping people protection their computer from organized crime they allow the vulnerability to continue. How is this moral?

tptacek 10y ago
It's not an either-or; this is malware, not vulnerabilities. For the most part it doesn't make sense to think in terms of using malware components to protect systems from malware. This misunderstanding has come up on a bunch of other threads too; it seems to be pretty widespread. You can't really "burn" most persistence techniques, publishing them in a way that makes them easy to defend against. If you could, a whole lot of platform security engineering would be much easier.
- belorn 10y ago
  What part of a "persistence method" are not using vulnerabilities? If you infect the boot loader, bios, firmware, or some other methods to create persistence then those are vulnerabilities. That a system can get infected in such way is not by any intended design. Could give an example of a persistence techniques that is using a intended feature of a computer system in order to hide the malware in unintended places in such a way that the system can't remove it (which itself is a unintended functionality).
  - tptacek 10y ago
    That's like suggesting a programmable page table is a vulnerability, because it can be used to hide a malware stub from processes looking for malware. However you want to litigate this on a message board, nobody working in platform security or even malware defense thinks that way. The difference between a persistence vector and a vulnerability is that you can patch a vulnerability, but you can't patch "programmable page table".
  - Gaelan 10y ago
    One could argue that the ability to replace OS elements is a feature.
altcognito 10y ago
I was unaware that the CIA is the malware division of the US federal government. They are a spy division. At least we have this timely information again from wikileaks that provides a narrative that the US is framing Russia for hacking. It's almost the only thing they are releasing nowadays.
- shuntress 10y ago
  >I was unaware that the CIA is the malware division of the US federal government. They are a spy division. Is a little like saying "the FBI is the firearms division" because FBI agents are armed.
  - jessaustin 10y ago
    Don't worry about it. GP is "clever" sarcasm, inspired by electoral bitterness.
  - anigbrowl 10y ago
    Well intelligence-gathering is the CIA's nominal job. You could say this policy of using malware is a policy for the government as a whole, and I'm inclined to agree, but if you're going to have an agency devoted to espionage (and you'd be an idiot not to because every other country does) then it's unreasonable to expect them not to use whatever tools are available. I have to say comments like this sound like you also worry that teaching CIA agents to pick locks might result in an increase in property crime, a position that's hard to take seriously.
deleted 10y ago
[deleted]

tptacek 10y ago

Backdoors from the 90s included actual purpose-built compilers. Whatever the CIA is doing, a good bet is that it's clownshoes stuff. (I'll leave this comment here, but it responded to the original editorialized title of the story, which pointed out that this trojan had "its own language".)

avenoir 10y ago
Sub7 had an editor back in the day that would allow you to build a custom client. I don't remember the technical nature of it. I believe it was just packing configuration and the client into a single executable w/o recompiling, but this is the kind of stuff teenage script kiddies were doing back in the day with VBS and/or Delphi.

deleted 10y ago

[deleted]

John23832 10y ago

At this point I think Wikileaks is largely trash. Their agenda is blatantly anti-us motivated. This leak and the previous one are examples. The CIA is a spy organization. Their job is to spy on foreign influencers. As such, they have spy tools... Just like Russia, China, the UK, etc. etc. If the headline here mattered, it would be, "Spy Agency has Spy Tool". There is no evidence at all that this stuff has been used domestically. But wikileaks buries that headline. Wikileaks continues to push the agenda that these leaks correlate with the legitimate PRISM leaks that we saw earlier. They push the narrative that these tools are being used on americans, should be ashamed, don't trust your intelligence agencies etc. Fueling the populist anti-intellectual bs we have going on in the world right now. Don't get me wrong. The US government should be ashamed of PRISM and the actions of the NSA, but Wikileaks should be ashamed of these leaks and the way they're representing this information..

zeveb 10y ago
Agree with your point re. Wikileaks, but I disagree that the PRISM leaks were legitimate, or anything to be ashamed of. To my knowledge, no compelling evidence indicates that the Constitutional or legal rights of Americans have been violated.
- John23832 10y ago
  I guess you could argue whether PRISM was lawful or not. I think we can all agree though that there was a recognizable moral gray area there that needed to be brought to the attention of the people. When brought to the light, the legitimacy could be argued. These current leaks are just attempts at undermining.
watscheatcodes 10y ago
Um... Need I remind you, that everything from Vault 7, was leaked on flash drives, (vault 7 shit doesn't require infrastructure to deploy or use as most nsa implementations do), and given to ex spooks, contractors, ex contractors, private contractors, even those with no intention of working for the government. Basically a deal sweetener, for those with similar status or ideals.
10y ago