I took a look at the repository. The fake certificates aren't signed by a legit CA. It's not actually clear if they're in use or just examples; the code is a m

I took a look at the repository. The fake certificates aren't signed by a legit CA. It's not actually clear if they're in use or just examples; the code is a mess. The idea is clearly if someone is using packet sniffing tools to monitor their network, they see Kaspersky's name in the cert of an outbound connection and assume either: 1) It's their own AV installs grabbing updates or something similar 2) They've been hacked by teh evil ruskies Interestingly these example certs aren't in the HEAD of the repository (WikiLeaks provide the entire git repo with history). To find the certs they were talking about I had to look at the first commit. At some point these files were removed. The start of the repo is in 2013, well before the current Red Scare. It's unclear to me that this is the CIA impersonating Russia for political reasons, as might be assumed from the headline, vs just using Kaspersky and Thawte because these happen to be companies with many customers. However, Wikileaks does say the justification is simply to hide exfiltration. We already knew that western intelligence agencies like to frame their opponents and cause confusion around attribution, like the neat trick NSA/GCHQ use where they send data they want to a server controlled by someone they don't like/some random innocent, which ignores the traffic because it's not actually compromised. They then suck the data they want off the wire as it is transferred. All that said it is depressing how well US propaganda works. Look at all the people in this thread saying, no no, it can't be true, it's from Wikileaks - even though the code and files themselves are available to download. The analysis they post isn't misleading either. It's pretty much describing what's found in the repo. edit: lol, just as I was writing this the story is flagged. What a big surprise. We can't have anything interfering with the official narrative, now, can we?