3 ms·
Daily reminder that the identity of the victim or allegations of "state-actor" are not reliable pieces of evidence when it comes to determining culpability of a
by pphysch 5y ago
Daily reminder that the identity of the victim or allegations of "state-actor" are not reliable pieces of evidence when it comes to determining culpability of a cybercrime.
From the article:
> Wardle found that the software contained code strings in Chinese, such as 安装成功 (Successful installation), and that the command and control server it connected to was located in Hong Kong.
From the CIA:
> In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation. The source code revealed that Marble had examples in Chinese, Russian, Korean, Arabic and Persian. These were the languages of the US's main cyber-adversaries – China, Russia, North Korea, and Iran.
https://en.wikipedia.org/wiki/Vault_7#Marble_framework https://en.wikipedia.org/wiki/Vault_7#Marble_framework
- paulryanrogers 5y agoStill, would the CIA burn such valuable exploits for HK activists? HK activists don't appear to be of much strategic interest to the USA. And where they are I imagine they would just reach out to them directly.
- pphysch 5y ago> HK activists don't appear to be of much strategic interest to the USA. And where they are I imagine they would just reach out to them directly. What? The USG has put a ton of resources into backing HK protestors, through the NED, BRL, and satellite orgs like Amnesty (look at the saga of Kong Tsung-gan/Brian Kern). As for why the CIA might burn a 0day only to generate articles like this: NatSec threat inflation is a trillion-dollar industry in Washington. But it just as well might have been a local crime syndicate trying to scrape personal information for financial fraud. Point is, the article provides virtually zero evidence to determine who is at fault.
- deleted 5y ago[deleted]
- azinman2 5y agoIn fact, it’s the opposite. Their success is strategic interest.
- paulryanrogers 5y agoThen why covertly hack them? Why not supply anti-hacking tools and expertise?
- yabones 5y agoWhat makes you think the CIA is the only one developing such tools? I would see it as any group's goal to avoid attribution.
- emodendroket 5y agoYeah, I remember with DNC hacking stuff as well, the evidence was very uncompelling... like a state actor doesn't have the resources to figure out such basic stuff if they want to cover their tracks. Or the Sony one too.
- cronix 5y agoThe more compelling case for me was William Binney's point (former Technical Director of NSA) that the timestamps in the Gucifer leak showed that the data was transferred at about the same rate as a usb stick, which was quite a bit faster than the physical connection the email server had (at that time). Basically concluding it was locally copied rather than hacked due to physically being impossible to transfer over the internet connection the server was physically connected to at that time at that speed shown in the timestamps.
- emodendroket 5y agoYes, I agree. But the question has become too political for dispassionate consideration, I guess.
- jonas21 5y agoJust to make sure I understand correctly... the most compelling piece of evidence for you is the timestamps on the files? Something that's not only trivial to fake, but also would have been overwritten if the files were copied between systems between being stolen and being leaked.
- cronix 5y agomore compelling != most compelling
- jasonlotito 5y agoContext matters. If there are two cases, and one is more compelling than the other, then that one is also most compelling.
- calibas 5y agoGlad you reminded me that allegations of "state-actor" are not reliable, or I might think you're implying that the CIA is responsible. Also, framing someone else is an ancient part of espionage, not something the CIA recently invented. They're far from the only people who use that tactic. I'm not going to hold my breath about any party coming clean about who's actually responsible. Until then we can just make guesses about it based on the evidence we have, the targets, the code itself, and the location of the server. It certainly points to a state-actor.
- iforgotpassword 5y ago>> In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses This reminds me of Sasser (iirc), which was initially attributed to Russia, as it contained Cyrillic. Turned out it was a German teen and he and his friends put it in there for shits ans giggles and laughed their asses off when "security experts" actually took the bait.