5 ms·

The most likely leaker to Wikileaks? The CIA itself. Its tools already compromised, perhaps by Russia or by someone internal, the sensible thing to do is to lea

by rrggrr 9y ago

The most likely leaker to Wikileaks? The CIA itself. Its tools already compromised, perhaps by Russia or by someone internal, the sensible thing to do is to leak the exploits in such a way that: (a) they can be patched and rendered largely harmless; (b) the oversight focus is primarily on Wikileaks and not the CIA for losing its jewels. Why would Russia (or any state actor) wikileak these compromises instead of using them against unpatched targets globally? No upside & makes no sense.

rm_-rf_slash 9y ago
They probably have plenty of the same zero-days and using them would be a waste: once someone knows you're using an exploit it'll get patched. It makes perfect sense for an adversarial nation's intelligence agency to undermine the CIA and Americans' trust in their own government. America is too far away from its rivals and enemies for a conventional war to be fought on its own shores. It makes more sense to use fear (9/11) and propaganda (your CIA is spying on you!!) to get Americans at each other's throats and distracted from the real threats to their wellbeing. After all, our political parties have been doing that for my whole life, so the groundwork laid is practically an invitation.
- ak4g 9y ago
  On one hand, yes, our political divisions no doubt make that kind of information warfare campaign tempting. On the other hand, it's already pissed us off something fierce, and I think the narrative in the mid-term future will ultimately be one where would-be adversaries decide they don't want to be the next poor soul to be made an example of.
- linkregister 9y ago
  It's been my experience that given the same binary, two researchers will probably find two different vulnerabilities. Given the complexity of these vulnerabilities, I see no reason why any other nation-state hacking service would lose their own, custom-developed exploits. I agree with your comment in general, except for its confidence in U.S. military capability. Though it would be unlikely for a battle to be waged on U.S. soil, other theaters offer plenty of opportunity for a U.S. loss, especially those that diminish traditional U.S. advantages (such as air and information superiority).
bowmessage 9y ago
Wow, this is a seriously interesting perspective. Thanks for your comment. I have often caught myself thinking that Snowden was US-sponsored, but I couldn't put my finger on why the US would do that.
AdamN 9y ago
Cool Tom Clancy premise but the CIA and NSA are looking pretty tarnished with their core data processes leaking publicly. This costs them a ton of political capital. They have channels to give the vendors the exploits in a controlled way - which they would do if they wanted to (and surely have if they think the exploit is too broadly known).
- tptacek 9y ago
  I agree. I say this somewhat regularly, so sorry to repeat it, but --- and I'm not especially well-informed here --- I think the best way to evaluate NSA and CIA motives, at least with respect to infosec, is that their #1 objective isn't geopolitical, but simply headcount. Whatever secures the most budget is going to be at the top of their stack of objectives. Massive turnover, which is what events like this create, works directly against the goal of securing more headcount: it means they're spending a big chunk of their recruiting energy just retaining the headcount numbers they already have.
  - linkregister 9y ago
    I disagree with your premise that headcount is the primary objective, but agree that career progression is the end goal of many, if not most, executives in the IC. Headcount is one of many metrics that can constitute success and eventual promotion. I posit that giving flashy results to customers is the #1 best way for a particular executive to make a name for herself and advance. FBI is a great example of this, constantly attempting to make splashy headlines; it presses its advantage of being able to go to the press. I've only seen headcount increase in response to what WH, ODNI, and Congressional intelligence committees view as crises. Headcount shuffles away for objectives that aren't considered sexy, e.g. Russian linguists and analysts in the late 1990s-2000s.
    - tptacek 9y ago
      I understand what you're saying but I don't think we have two different interpretations of the same worldview, but that instead we simply disagree. I think budget and headcount are more important objectives to NSA than flashy results. If there's a tradeoff to be made between achieving a flashy objective and securing more budget, I think NSA is likely to pursue the latter, not the former. To me and for the kind of work I do, this has important implications: it means that you shouldn't do things to make it harder for NSA to do their job (that's just feeding them, just like feeding in DOTA or LOL) --- you have to make things intractable for them.
sigmar 9y ago
>Why would Russia (or any state actor) wikileak these compromises instead of using them against unpatched targets globally? No upside & makes no sense. Huge flaw in this reasoning- the fuzzbunch stuff was patched before it was leaked. Russia leaking recently-burned tools makes a lot of sense.
repples 9y ago
It's most probable that Russia (or perhaps other adversarial state actors) would have given all the most sensationalist, newsworthy, and reputation-damaging material to Wikileaks, but kept the really juicy zero day exploits to itself. If this is true, I expect the CIA and/or other agencies will have gone into defense mode and tipped off the relevant vendors, giving details of vulnerabilities they either know to be leaked or have observed to be used in active attacks. In doing that, I can't really see the CIA revealing any more than is strictly necessary, and to a very limited set of people. Certainly not dumping a whole load of compromising material to Wikileaks.
a3n 9y ago
I can't imagine anyone in the CIA authorizing leaking their own tools. It's too outlandish, too career limiting. It would seem to be treason by definition. "Nobody got fired and jailed for leaking CIA tools." Except, probably, anyone who ever did.
- wu-ikkyu 9y ago
  https://en.wikipedia.org/wiki/Limited_hangout https://en.wikipedia.org/wiki/Limited_hangout
  - a3n 9y ago
    Huh. There's even a term for it. I would never make it in government.
wu-ikkyu 9y ago
Were there really any groundbreaking revelations out of the leak? I didn't think so. Couldn't it be to their advantage to purposefully leak a bunch of outdated and not-so-special tools (i.e. Notepad++ dll hijack) to misdirect their adversaries as to their real capabilities?

by rrggrr 9y ago

rm_-rf_slash 9y ago

They probably have plenty of the same zero-days and using them would be a waste: once someone knows you're using an exploit it'll get patched. It makes perfect sense for an adversarial nation's intelligence agency to undermine the CIA and Americans' trust in their own government. America is too far away from its rivals and enemies for a conventional war to be fought on its own shores. It makes more sense to use fear (9/11) and propaganda (your CIA is spying on you!!) to get Americans at each other's throats and distracted from the real threats to their wellbeing. After all, our political parties have been doing that for my whole life, so the groundwork laid is practically an invitation.

ak4g 9y ago
On one hand, yes, our political divisions no doubt make that kind of information warfare campaign tempting. On the other hand, it's already pissed us off something fierce, and I think the narrative in the mid-term future will ultimately be one where would-be adversaries decide they don't want to be the next poor soul to be made an example of.
linkregister 9y ago
It's been my experience that given the same binary, two researchers will probably find two different vulnerabilities. Given the complexity of these vulnerabilities, I see no reason why any other nation-state hacking service would lose their own, custom-developed exploits. I agree with your comment in general, except for its confidence in U.S. military capability. Though it would be unlikely for a battle to be waged on U.S. soil, other theaters offer plenty of opportunity for a U.S. loss, especially those that diminish traditional U.S. advantages (such as air and information superiority).

bowmessage 9y ago

Wow, this is a seriously interesting perspective. Thanks for your comment. I have often caught myself thinking that Snowden was US-sponsored, but I couldn't put my finger on why the US would do that.

AdamN 9y ago

Cool Tom Clancy premise but the CIA and NSA are looking pretty tarnished with their core data processes leaking publicly. This costs them a ton of political capital. They have channels to give the vendors the exploits in a controlled way - which they would do if they wanted to (and surely have if they think the exploit is too broadly known).

tptacek 9y ago
I agree. I say this somewhat regularly, so sorry to repeat it, but --- and I'm not especially well-informed here --- I think the best way to evaluate NSA and CIA motives, at least with respect to infosec, is that their #1 objective isn't geopolitical, but simply headcount. Whatever secures the most budget is going to be at the top of their stack of objectives. Massive turnover, which is what events like this create, works directly against the goal of securing more headcount: it means they're spending a big chunk of their recruiting energy just retaining the headcount numbers they already have.
- linkregister 9y ago
  I disagree with your premise that headcount is the primary objective, but agree that career progression is the end goal of many, if not most, executives in the IC. Headcount is one of many metrics that can constitute success and eventual promotion. I posit that giving flashy results to customers is the #1 best way for a particular executive to make a name for herself and advance. FBI is a great example of this, constantly attempting to make splashy headlines; it presses its advantage of being able to go to the press. I've only seen headcount increase in response to what WH, ODNI, and Congressional intelligence committees view as crises. Headcount shuffles away for objectives that aren't considered sexy, e.g. Russian linguists and analysts in the late 1990s-2000s.
  - tptacek 9y ago
    I understand what you're saying but I don't think we have two different interpretations of the same worldview, but that instead we simply disagree. I think budget and headcount are more important objectives to NSA than flashy results. If there's a tradeoff to be made between achieving a flashy objective and securing more budget, I think NSA is likely to pursue the latter, not the former. To me and for the kind of work I do, this has important implications: it means that you shouldn't do things to make it harder for NSA to do their job (that's just feeding them, just like feeding in DOTA or LOL) --- you have to make things intractable for them.

sigmar 9y ago

>Why would Russia (or any state actor) wikileak these compromises instead of using them against unpatched targets globally? No upside & makes no sense. Huge flaw in this reasoning- the fuzzbunch stuff was patched before it was leaked. Russia leaking recently-burned tools makes a lot of sense.

repples 9y ago

It's most probable that Russia (or perhaps other adversarial state actors) would have given all the most sensationalist, newsworthy, and reputation-damaging material to Wikileaks, but kept the really juicy zero day exploits to itself. If this is true, I expect the CIA and/or other agencies will have gone into defense mode and tipped off the relevant vendors, giving details of vulnerabilities they either know to be leaked or have observed to be used in active attacks. In doing that, I can't really see the CIA revealing any more than is strictly necessary, and to a very limited set of people. Certainly not dumping a whole load of compromising material to Wikileaks.

a3n 9y ago

I can't imagine anyone in the CIA authorizing leaking their own tools. It's too outlandish, too career limiting. It would seem to be treason by definition. "Nobody got fired and jailed for leaking CIA tools." Except, probably, anyone who ever did.

wu-ikkyu 9y ago
https://en.wikipedia.org/wiki/Limited_hangout https://en.wikipedia.org/wiki/Limited_hangout
- a3n 9y ago
  Huh. There's even a term for it. I would never make it in government.

wu-ikkyu 9y ago

Were there really any groundbreaking revelations out of the leak? I didn't think so. Couldn't it be to their advantage to purposefully leak a bunch of outdated and not-so-special tools (i.e. Notepad++ dll hijack) to misdirect their adversaries as to their real capabilities?