8 ms·
Copies of malware used by intelligence agencies to spy on journalists
- aetherspawn 12y ago"Handle with care." Hey guys, let's unzip this so the next guy can run it and spread the worlds most advanced malware on our home network.
- cyphunk 12y agoI didn't see any zips. Though zip is not the only vector one should be concerned with. For downloadable files, handle with extreme care. Exploration of the database content however is static and i'm sure the Internet will thank you if you parse and compile a list of interesting patterns you find from it.
- rubbingalcohol 12y agoIt would be fun to install in a VM though! Or maybe not.
- gasull 12y agoIt will phone home. Don't do it unless it's disconnected from the network. It might also try to spread the infection through other attack vectors, like bluetooth, or trying to break out of the VM.
- kordless 12y ago> break out of the VM I wonder if this has happened yet?
- sp0rk 12y agoMost definitely. Here is an example: http://1337day.com/exploit/22519 http://1337day.com/exploit/22519
- Dylan16807 12y agoGot anything that doesn't involve the 2d/3d video acceleration? Those are a rather obvious and off-by-default attack surface.
- justincormack 12y agoSee here http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_...
- gasull 12y agoDown for me. Here's a cached version: https://web.archive.org/web/20140703130707/www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php https://web.archive.org/web/20140703130707/www.vupen.com/blo...
- wcummings 12y agoMore likely it would self-destruct to avoid analysis or detection, this is well documented behavior of a number of more sophisticated pieces of malware.
- toomuchtodo 12y agoThe equivalent of handling Ebola in your home kitchen.
- frozenport 12y agoI doubt its advanced, their customer list doesn't include well established players like China, Russia and the USA. In fact, this might be the cheapest militarized malware you can get. The only way to go cheaper is to use a TeamViewer RAT.
- kissickas 12y agoIt might not be the most advanced out there, but I wouldn't belittle the surveillance ability of countries like Pakistan, Qatar, Bahrain, and South Africa. Surprised to see Italy on there, though. https://wikileaks.org/spyfiles4/customers.html https://wikileaks.org/spyfiles4/customers.html
- cyphunk 12y agoshared pad for compiling patterns: https://pad.riseup.net/p/gO8Ng806lNnl https://pad.riseup.net/p/gO8Ng806lNnl
- deleted 12y ago[deleted]
- kissickas 12y agoInteresting note on Mongolia on the bottom. Also good to see that, at least for a time, Gmail was able to detect infected files (see the Mongolian feedback numbers 10-12) https://wikileaks.org/spyfiles4/database.html#feedback https://wikileaks.org/spyfiles4/database.html#feedback
- cbhl 12y agoHmm, I'm not sure if that's Gmail detecting an infected file. I'm pretty sure Gmail just blocks .exe and .bat files altogether (even in .zip archives). https://support.google.com/mail/answer/6590?hl=en https://support.google.com/mail/answer/6590?hl=en
- kissickas 12y agoThe file in question was a PDF - can it detect that?
- xkiwi 12y agoI don't usually click EXE, But when I do, I do it on my production computer with 200 VM running. ====== and none of my firewalls pop a warning.
- philtar 12y agoMy AV deleted it as soon as it was extracted.
- philangist 12y agoHa. What AV do you use?
- doreo 12y agoYou can just run it through https://www.virustotal.com/ https://www.virustotal.com/ to see which AV's will get it
- BorisMelnik 12y agoIf I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.
- atmosx 12y agoJust don't forget to wear gloves.
- higherpurpose 12y agoAnd a ski mask.
- ivanca 12y agoThey may have cameras in the coffee shop or near there, so you'd better use TOR.
- deleted 12y ago[deleted]
- sam_bwut 12y agoWhy Kali? Surely you means TAILS?
- iancarroll 12y agoKali comes with some forensic tools.
- icpmacdo 12y agoWould you do that on a laptop hard drive partition or on a clean drive? Would you use that drive after formatting it? I think that physically breaking the connection between the camera and microphone and the laptop would be a good idea.
- tux3 12y agoThat's pretty much what I did, it's now sitting in my Random-Noise-10GB file waiting to be opened in IDA.
- girvo 12y agoSo, it seems the NSW police here in Australia are a customer and use this. Ignore for a moment whether it's a good or bad thing that police use tools like these. What I want to know is, what happens once they "get their guy", so to speak. Does the malware stay on that computer forever, violating the privacy of family members, or other users of the computer should it be sold on and not wiped correctly? What happens if it's not the correct person? Basically, why are the police spying? To me, that raises some ethical questions and makes me feel that the police will handle things like this in a very ham-fisted way, like they usually do with technology. Worrying.
- jamesk_au 12y ago(I'm also in NSW)-- The list of "support requests" on the customers page suggests that the tools are used only in accordance with duly-issued warrants. Access would need to be removed once the purpose of the warrant had been fulfilled, but we may never know whether they get that right in practice. Ben Grubb has collated some background information on the operation of those laws.[1] [1] http://www.smh.com.au/it-pro/government-it/nsw-police-use-hacking-software-to-spy-on-computers-and-smartphones-wikileaks-data-20140915-10h530.html http://www.smh.com.au/it-pro/government-it/nsw-police-use-ha...
- meowface 12y agoI have not looked at the materials but I suspect most or all Western countries using this toolkit are using it for specific investigations where warrants have been issued. I personally have no qualms with the FBI planting malware as just another form of surveillance (if they have a warrant to search your home and tap your phone, why shouldn't they be able to get a warrant to monitor your computer?). The problem with Gamma Group, and what I suspect is one of the core reasons for this leak, is that they happily sell their product to extremely oppressive regimes and give them personal support, knowing full well that the tools are being used to spy on and find dissidents, protesters, and political opponents.
- __P 12y agoThere is a weird "Us and Them" vibe from your comment. Is the US/Australia/Uk's treatment of Julian Assange (as an example) not count as "oppressive regimes" and "...dissidents, protesters, and political opponents."? How is that different to <insert country you were thinking of when you wrote "oppressive regimes"> ? (I ask honestly, not rhetorically)
- ogijaoijfawje 12y agoI know many love to consider Snowden and Assange "heroes", but I think these two are people we should think outside the box on. Are they acting in the interest of everyone, themselves, or another party? The releases, interviews, and otherwise that get released seem very scripted and controlled. The propaganda machine is skilled and there may be unseen benefits to these leaks.
- vasco 12y agoYou realize that you sound like propaganda yourself?
- XorNot 12y agoLike Julian Assange repurposing wikileaks donations into the Julian Assange sexual assault defense fund? Whatever you may think of the allegations, it has become extremely blurry as what the money donated to wikileaks' operation is actually used for, seeing as how Julian Assange wasn't supposed to be wikileaks.
- throwaway876876 12y agoSince his "sexual assault" allegations were, in essence, an orchestrated smear campaign to discredit him and by extension Wikileaks, and the health of the former depends on the latter, I see absolutely no problem here. Why do you?
- ikt 12y ago> Since his "sexual assault" allegations were, in essence, an orchestrated smear campaign to discredit him and by extension Wikileaks Is what he wants you to believe. http://www.theguardian.com/media/2010/dec/17/julian-assange-sweden http://www.theguardian.com/media/2010/dec/17/julian-assange-... By Saturday morning, 21 August, journalists were asking Assange for a reaction. At 9.15am, he tweeted: "We were warned to expect 'dirty tricks'. Now we have the first one." The following day, he tweeted: "Reminder: US intelligence planned to destroy WikiLeaks as far back as 2008."
- 12y ago
- orblivion 12y agoI hope Norton is updating their database accordingly.
- rplnt 12y agoYou can try and submit the files here: https://www.virustotal.com/ https://www.virustotal.com/
- nysv 12y agoPretty depressing. Only 2 out of 54 scanners currently detect something in the zips of the spyware. https://www.virustotal.com/en-gb/file/6ee40b8e7d49f4ea70b7ce5ca55a445897395323cd298a40baca76432a3a13bc/analysis/ https://www.virustotal.com/en-gb/file/6ee40b8e7d49f4ea70b7ce... https://www.virustotal.com/en-gb/file/688f1e15390faf8d977351572a9a5c84d5bb228135ebd6c4c306708a9420f359/analysis/ https://www.virustotal.com/en-gb/file/688f1e15390faf8d977351...
- Zigurd 12y agoWAY too many security companies play both sides of the fence.
- Kalium 12y agoMore like anti-virus companies are just bad at what they do.
- Strom 12y agoThose zips are encrypted, that's why. I have included links to the unencrypted results [1,2], with ~80% detection rate. Notable green checkmark by Microsoft, perhaps FinFisher made extra sure to not get caught by Microsoft's heuristics? [1] https://www.virustotal.com/en-gb/file/f827c92fbe832db3f09f47fe0dcaafd89b40c7064ab90833a1f418f2d1e75e8e/analysis/ https://www.virustotal.com/en-gb/file/f827c92fbe832db3f09f47... [2] https://www.virustotal.com/en-gb/file/0b465877a998a993a64a146c80beaea2adf8e854644709706c6173a853ec8dba/analysis/ https://www.virustotal.com/en-gb/file/0b465877a998a993a64a14...
- wldlyinaccurate 12y agoThis company makes millions upon millions of dollars from selling surveillance malware to (by the looks of the customer list) anyone who will pay. If I were to set up a company which sold similar products at similar prices, I would expect the FBI to come knocking at my door very quickly.
- sarciszewski 12y agoAnd they'd probably want to seize all your 0dayz to use to spy on activists too. :P
- aliquis 12y agoThese periodic reminders that Internet isn't a safe place and that anyone might be spying on us probably makes a lot of people learn about security, come up with better passwords, hesitate before downloading unknown software and so on. When people get their identities stolen, or lose all the money from their bank accounts, this might be regarded as "random" events, in the same way that most people won't get mugged and when it happens it's because of "randomly" being in the wrong place at the wrong time. But more people have experience dealing with the government, and though they believe that criminals aren't interested in them they know that the government might be, and thus the government is seen as a more tangible threat. Is it possible that governmental surveillance is on average a good thing, since it raises people's awareness and makes them protect themselves more? Having enough money in your bank account to buy food is, after all, a more basic need in Maslow's hierarchy than not having copies of your e-mail conversations in a government database.