10 ms·
CIA 'Angelfire' covert Windows malware system
- appleflaxen 9y agojesus christ. the damage our own government has done to microsoft is just insane. if i was a shareholder I would be so pissed. big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less.
- binarray2000 9y agoYou must see it in a broader context. I'll paraphrase you: "jesus christ. the damage our own government has done to [Iraq, Syria, Libya, North Korea, Vietnam, Serbia, Afghanistan...] is just insane. if i was a [citizen of these countries] I would be so pissed." At least, the shareholder has his life and his property (sans the missed opportunity due to "the damage our own government has done to microsoft").
- alexandercrohde 9y agoIs it really that simple? Didn't a cache of hacking tools recently end up in hackers' hands?
- MaymayMaster 9y agoWhat the hell does this have to do with anything?
- appleflaxen 9y agoi agree with you completely, but it seems irrelevant to this particular conversation.
- SomeStupidPoint 9y agoIt seems strange to blame the government -- couldn't you see this as self-inflicted damage from creating an insecure OS that runs a vast number of important computers? I actually blame both, but it's not like MS is an innocent victim here -- there's a lot more they could have done on security, and didn't because it was expensive. If that choice being exploited costs them money, how is that anything but an effect of their own choices?
- nxc18 9y agoMicrosoft has been investing a lot of effort into security. If they had it their way, you wouldn't even be able to install unverified software. I'm not sure Microsoft has been making the bad "security is expensive" decisions since XP sp2. Note also that they've been ahead of the curve on security since Vista, which was much maligned (partially) as a result. Nowadays both macOS and windows effectively have UAC, but Vista took the heat for it. Same thing with blocking unknown software; Windows took the heat, but just you try to run non-Apple-signed packages on OS x.
- yoz-y 9y agoDoes UAC and signing belong to the same bucket though? UAC has always been on macOS 10 because of the bsd root/user separation. For me the main problem is that on windows (Vista at least) the UAC seemed to fire on benign operations while letting you do quite dangerous ones without flinching.
- nxc18 9y agoIts true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's the same for OS x and they have some even worse patterns; e.g. I'm pretty sure half the installers I end up using take your password themselves and pass it on to some waiting sudo under the hood. They at the very least don't use the proper system way of doing things; i can tell because some things trigger touch id and some don't. Similarly, there have been many stories about dropbox circumventing system security. I have no doubt that if dropbox can figure it out, malware writers can, too.
- riskable 9y agoBased on the plethora of methods Microsoft has (intentionally) provided to bypass UAC I'd argue that it's the very definition of "security theater". UAC is nothing but a minor annoyance to attackers at this point. An extra step or two they have to add to their payload. Nothing more. It's also trivial to escalate from a regular user to NT AUTHORITY\SYSTEM (which is a higher privilege than Administrator!). There's so many privilege escalation vulnerabilities in Windows it's hard to keep track of them all! A big reason for that is that Microsoft considers privilege escalation vulnerabilities, "medium risk".
- rdtsc 9y agoThey never see it that way. The ones doing it always have a solid propaganda / brainwashing framework to support these kind of actions. Heck they justify running a drone assassination program rationalizing exploiting some windows vulnerabilities is child's play for them. "We are fighting the evils of terrorism" / "It's their fault for releasing software full of these holes" / "It's the target's fault for installing this OS" pretty easy to rationalize this stuff. And I think you are implicitly asking them to think "one day this will leak and will damage the reputation of a major US company" and they probably are not allowed to think that way it's more down the line "we'll just keep it hidden and nobody will ever find out, we are the best at this and not like those other agencies whose stuff has been leaked"
- roywiggins 9y agoI don't think developing a malware kit for Windows damages Microsoft's reputation materially. I mean, it's just a fancier RAT, isn't it? The CIA's job is to spy on people. Planting bugs is part of their job. If they didn't plant bugs in computer systems too, what are they being paid for? I mean, you can argue that their entire charter should be rearranged or abolished, but it's hard to blame them when "sneaking into places they're not wanted and exfiltrating data" is kind of their entire reason for existing. (the drone program is a whole other kettle of fish)
- chisleu 9y agoNSA -> Microsoft is a revolving door of employment. EDIT: Apple, Google, etc as well.
- sleepybrett 9y agoIs this the governments fault for finding the exploits or microsoft's for inadequate testing?
- lawnchair_larry 9y agoThese aren't even exploits. This is just normal OS functionality. There is no security flaw here. It's meant for post-compromise use. You need admin rights before you can use it.
- CaptSpify 9y agoWhy not both?
- burkaman 9y agoThe issue is not finding the exploits, but exploiting the exploits.
- riazrizvi 9y agoI seriously doubt it is anything but a quid pro quo arrangement.
- burkaman 9y agoWhy? What would the CIA/NSA gain by telling Microsoft what they're doing? It's not like it's impossible to find serious security flaws without colluding, independent researchers do it all the time. It seems like asking for a quid pro quo would open up a huge risk of discovery without very much gain.
- riazrizvi 9y agoWhy would it be a quid pro quo? A government-hackable system allows intelligence services to 'keep the country safe' by helping data gathering (remember the arguments put forth during the iPhone/FBI kerfuffle). So governments support them through the means at their disposal, funding, govt contracts, State dept deals etc. The company gains because they shift product. Win-win. I'm not sure what the CIA/NSA would gain by explaining their tactics, I don't understand why they would ever do that. IMO it is a non-sequitor to my comment.
- eighthnate 9y ago> if i was a shareholder I would be so pissed. I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends. > big companies go along with this behavior and collude with the government Isn't that called mercantilism? > big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less. It hasn't affected their bottom line yet. It is concerning how intertwined large corporations are with government.
- appleflaxen 9y ago> I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends. > It hasn't affected their bottom line yet. it's unknowable what the bottom line or stock price would be with different circumstances, but there is no question that security disclosures like this are a downward pressure on it. who knows; maybe they did get an even bigger lift from the collusion. the only way it will change is if consumers start pricing in this kind of behavior (paying less for compromised products). it's too bad that's such an unlikely goal.
- ethbro 9y agoIs the WikiLeaks site not responding to requests?
- josteink 9y agoI'm getting dns lookup failure. Did they piss someone off too much this time?
- mattmanser 9y agoFallout from this perhaps? Their DNS got hacked today or yesterday, report's a bit vague. https://www.theguardian.com/technology/2017/aug/31/wikileaks-hacked-ourmine-group-julian-assange-dns-attack https://www.theguardian.com/technology/2017/aug/31/wikileaks...
- nfriedly 9y agoIt loaded for me. Here's the text of the post: ------ Angelfire 31 August, 2017 Today, August 31st 2017, WikiLeaks publishes documents from the Angelfire project of the CIA. Angelfire is an implant comprised of five components: Solartime, Wolfcreek, Keystone (previously MagicWand), BadMFS, and the Windows Transitory File system. Like previously published CIA projects (Grasshopper[1] and AfterMidnight[2]) in the Vault7[3] series[4], it is a persistent framework that can load and execute custom implants on target computers running the Microsoft Windows operating system (XP or Win7). Solartime modifies the partition boot sector so that when Windows loads boot time device drivers, it also loads and executes the Wolfcreek implant, that once executed, can load and run other Angelfire implants. According to the documents, the loading of additional implants creates memory leaks that can be possibly detected on infected machines. Keystone is part of the Wolfcreek implant and responsible for starting malicious user applications. Loaded implants never touch the file system, so there is very little forensic evidence that the process was ever ran. It always disguises as "C:\Windows\system32\svchost.exe" and can thus be detected in the Windows task manager, if the operating system is installed on another partition or in a different path. BadMFS is a library that implements a covert file system that is created at the end of the active partition (or in a file on disk in later versions). It is used to store all drivers and implants that Wolfcreek will start. All files are both encrypted and obfuscated to avoid string or PE header scanning. Some versions of BadMFS can be detected because the reference to the covert file system is stored in a file named "zf". The Windows Transitory File system is the new method of installing AngelFire. Rather than lay independent components on disk, the system allows an operator to create transitory files for specific actions including installation, adding files to AngelFire, removing files from AngelFire, etc. Transitory files are added to the 'UserInstallApp'. [1]: https://wikileaks.org/vault7/grasshopper/ https://wikileaks.org/vault7/grasshopper/ [2]: https://wikileaks.org/vault7/#AfterMidnight https://wikileaks.org/vault7/#AfterMidnight [3]: https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/ [4]: https://wikileaks.org/vault7/# https://wikileaks.org/vault7/# ------ And here are the documents linked beside the post: Angelfire 2.0 -- User Guide: https://wikileaks.org/vault7/document/Angelfire-2_0-UserGuide/ https://wikileaks.org/vault7/document/Angelfire-2_0-UserGuid... BadMFS -- Developer Guide: https://wikileaks.org/vault7/document/BadMFS_Developer_Guide/ https://wikileaks.org/vault7/document/BadMFS_Developer_Guide... Wolfcreek Docs -- Angelfire User Guide: https://wikileaks.org/vault7/document/Wolfcreek-Docs-Angelfire_UserGuide/ https://wikileaks.org/vault7/document/Wolfcreek-Docs-Angelfi... Wolfcreek Docs -- Angelfire Test Matrix: https://wikileaks.org/vault7/document/Wolfcreek-Docs-Angelfire_test_matrix/ https://wikileaks.org/vault7/document/Wolfcreek-Docs-Angelfi... Wolfcreek Docs -- NotesSee more: https://wikileaks.org/vault7/document/Wolfcreek-Docs-Notes/ https://wikileaks.org/vault7/document/Wolfcreek-Docs-Notes/
- rbanffy 9y agoHad to update https://www.npmjs.com/package/nsaname https://www.npmjs.com/package/nsaname again. It never stops...
- equalunique 9y agoWhy? Was one of the Angelfire names used on the NPM usage examples?
- rbanffy 9y agoNo. I added the new names.
- hammock 9y agoWikiLeaks was taken down by hackers last night
- beepboopbeep 9y agoGonna guess Sovereign U.S. forces on this one.
- sschueller 9y agoDNS was hijacked, that's it.
- alexandercrohde 9y agoExcept I believe people were still showing a successful HTTPS connection, were they not?
- e12e 9y agoUp again/resolves fine for me now (Norway).
- gressquel 9y agoI am usually for openess, freedom of speech no matter what. But I would make an exception for Wikileaks. Started off fine by leaking things journalists wouldn't get their hands on thus doing their job in a way. Which was great. Now they just turned out to be ill-intended malicious Russia-sponsored mouthpiece. Only thing they do is harm, harm peoples computer by releasing malwares and hacks. PS. I am not from US at all.
- convery 9y ago> Now they just turned out to be ill-intended malicious Russia-sponsored mouthpiece. Only thing they do is harm, harm peoples computer by releasing malwares and hacks. They have never released any malware or hacks, ever. Tell your supervisor that they fucked up the narrative memo.
- 9y ago
- ArchReaper 9y agoI wonder what political news story this is trying to take attention away from...
- dagenleg 9y agoI don't understand what you are implying here. Would you kindly tell us which political news story are those pesky russian hackers at wikileaks trying to cover up?
- ArchReaper 9y agoDiscussion from last: https://news.ycombinator.com/item?id=14920664 https://news.ycombinator.com/item?id=14920664
- dagenleg 9y agoWhat's the point of saying 'Wikileaks is trying to distract us from happenings in Russia' when you are not even specifying the things we are supposedly being distracted from? If you are trying to proliferate the 'Wikileaks are Russian agents' mantra at least back this up with some facts and observations. Don't simply link to the circlejerk from previous thread - that's kind of lazy.
- ArchReaper 9y ago>What's the point of saying 'Wikileaks is trying to distract us from happenings in Russia' when you are not even specifying the things we are supposedly being distracted from? Am I required to have omniscient knowledge of the subject prior to commenting? You asked me what I was referring to, and I answered your question. It has been painfully clear, with almost every release in recent history, that wikileaks uses releases as distractions to take the spotlight away from other stories. That's why it's worth bringing this up on every post. Just because wikileaks wants the story to be about the release, doesn't mean that's where the real story is. I'm curious as to what the real story is. I do not know the answer to that question, hence my initial comment.
- tptacek 9y agoThere are multiple companies in the industry where you could get interns to build a project like this. Implantation (what we used to call "rootkit") tech is more interesting than banking trojans from a technical perspective, and at the very high end can reach the level of generating new research results --- but this isn't that level. People continue to be enthralled by low-on-the-food-chain software security work. There are teenagers that have written stuff like this. It's sort of embarrassing that the CIA commissioned this at all (if that's how it happened), rather than pooling with NSA and getting a proper, reconfigurable, deniable tool built. (But then: leaks of NSA tooling in the last 2 years have demonstrated that we've all been a bit generous regarding NSA's technical reputation, too). Virtually everything that Wikileaks has published about the CIA has been like this. To the extent that it damages national security, it does so by making CIA look clownish. And yet, despite the extraordinarily low stakes of publishing, Wikileaks is still milking a drip-drip from the original cache they obtained of CIA warez. It's cynical, and speaks to a general contempt they have of their audience.
- SCHiM 9y agoI think you're too focused on the technical side of things. If your target can be breached with an intern's hobby projects, why not breach your target with an interns hobby project? That means you have more money to spend on analyst, translators, future operations, etc. You only start developing more capabilities if your targets need more capabilities. Many important targets today are still being breached by a bunch of office macro's that have been around for ages. Still works, still yields desired results, no need for a passive global adversary or a l33t 0day.
- tptacek 9y agoYou're getting concepts mixed up. These aren't exploits. You can't breach a target with them. They're post-exploit persistence tools. A persistence tool has just three jobs: 1. Enable the mission. 2. Avoid discovery. 3. Frustrate attribution. These tools are amateurish. By modern standards, all they accomplish is (1). But rootkit.tar.Z for SunOS 4.1.3 did that too. Presumably, if the CIA is implanting backdoors, they're doing it in high-stakes situations: the kind where it's important they not be identified, and the kind where it's important that identification of a single compromised machine not instantaneously provide a signature that can be used to identify every other compromised host in their inventory. But, nope. One obvious possible subtextual revelation from the CIA tool kit that we've seen is that they're not doing high-stakes implantation work at all, and this stuff is all aspirational.
- etplayer 9y agoCan someonebody please help me understand what this is? Is it software which Microsoft has included in Windows maliciously for such exploitation, or is it the fact that the CIA has identified a Windows exploit and taken advantage of it? Did Microsoft know that this problem existed, and continued to let it exist at the CIA's request?
- wepple 9y agoNeither. This was not written by Microsoft. This is not an exploit. Further, you never "identify an exploit" - you identify a vulnerability, and the exploit is what you build to take advantage of that vulnerability. This is software that has been written by presumably US govt to be installed on a windows machine to maintain control if it once they've compromised it. Think "really advanced malware". It is supposed to be hard to detect and/or remove, and allows long term access to that machine. Edit: hopefully that helps clear up. Also your line of questioning seems to suspect Microsoft colluding with the govt. zero evidence of that.
- wu-ikkyu 9y ago>Also your line of questioning seems to suspect Microsoft colluding with the govt. zero evidence of that Snowden leaks indicated otherwise
- wepple 9y agoEverything I wrote is referring to this Wikileaks release. There is zero evidence Microsoft colluded to help the CIA write this malware.