The CIA probably isn't stupid. Why would they waste attacks like the ones you listed if the silly stuff simply works for most targets. Also those "silly stuff" things are perfect because anybody could have developed them and not necessarily a nation state actor.

Also just because some information got leaked, doesn't mean that there aren't more units / projects at the CIA where maybe the more skilled people are working and where the "good" attacks don't get leaked.

This looks to be the kind of stuff for the day in, day out operations.

Not only is there the difficulty to think about, there's also risk management for discovery of your exploits.

Creating antibiotic-resistant bacteria is a bad idea. Don't use linezolid when you could use vancomycin.

Don't use your fancy rootkit if the boring DLL injector you give the contractors works just as well.

Why not just use an off-the-shelf rootkit with off-the-shelf obfuscator + whatever exploits they discovered? None of the code has to be extremely valuable.

If I were CIA in the current political climate, I would simply slightly modify a Russian exploit toolchain and exfiltrate data to CIA controlled C&C. One dev can do the work and with a couple of days of effort it would get past all major AVs.

Might not want to do that in case the Russian's backdoored theeir exploit toolchain somehow and you didn't notice.

Creating this sort of malware isn't expensive, so why not do it.

I think this crowd tends to vastly underestimate the ease of deploying and testing this stuff in a targeted and useful way.

There's a big difference between broadband spray and pray malware, and malware you actually want to hit a target with.

If you know average tools won't detect it, then why get fancy when you have something that's proven reliable and if discovered is unlikely to have your victim substantially improve their processes?

If it's public the vulnerability might be patched. The whole point of these is that they were secret (though the concepts may or may not be novel).

love the medical analogy

The lower level / juniors / new hires probably cut their teeth on the simple exploits, and as they gain experience move on to the more advanced.

Also, the hextuple-agent in me wants to think the simple exploits were leaked intentionally to distract from the whatever-else-it-is-they-don't-want-you-to-know.

I doubt it, I think they hired out of some no name information security firm. These people probably are not the group developing the exploits either. I know if I was in their shoes I wouldn't waste my time using anything fancy, but this whole thing reads like some mid level member trying to create documentation to move up the corporate ladder.

I don't want to rush to judge them because not everyone can be at the top and if it works it works. If I can pop a box using powershell, it's way easier than having to develop some kernel level hack. Additionally when anyones 'private' conversations get leaked they always look like a fool because it shows us being vulnerable and asking dumb questions, but a lot of the posts really do remind me more of the sysadmin who learned some python instead of the cutting edge of private industry.

This might be true for things like exploits, where every time you use them you stand a chance of burning them, so you're incentivized to keep using whatever's working. But it's not true of rootkit and implant techniques; in fact, the opposite is true: the dumber your implants, the more likely it is that your target will discover you compromised them.

The more likely it is that your target will discover someone compromised them, yes. But finding a DLL injection exploit only says "hacked by someone", whereas finding a microcode-level rootkit in the CPU pretty much says "hacked by a state actor". Which, sometimes is what you want to say (see e.g. Stuxnet), but often not. If you know the first has a 99% chance of going undetected, and the second a 99.9% chance, do you always want to risk the one that pretty much acts like a calling card?

> microcode-level rootkit

There's two ways microcode goes on Intel CPUs. The first is when it gets flashed in at the factory onto an OTP ROM. The second is when it gets uploaded to a block of internal RAM by your computer, every time it boots. That's why packages like this one (https://www.archlinux.org/packages/extra/any/intel-ucode/) exist.

One is set at the factory, one is set by your computer every time, once at boot, before the completion of boot. Also, it's very carefully signed, so even if you managed to put a bootkit before the OS boot, you would need to steal Intel's microcode key.

Microcode is not targetable. Few things at that level are. (A decent example of something that might be more targetable at that level is a hard drive controller. Less difficult but still not easy.) The amount of engineering needed to pull off an exploit that is "99.9% chance" unnoticeable, but still persistent, is much more than that of a "99% chance".

(I know nothing of AMD's CPUs and their microcode, but I'm guessing it's much of the same.)

First of all, thanks for writing this, since I did find the technical details quite interesting. But I don't think this puts microcode rootkits beyond the reach of a state actor. It puts them beyond the reach of a normal criminal attacker, which is actually my point.

Scenario 1: Supply chain interdiction. You don't need to target the CPU only after it has been manufactured and put into whatever you want to hack, you can start way earlier, including at the factory.

Scenario 2: Getting the signing keys from hardware manufacturers, including Intel, seems quite feasible for state actors. You don't even need hacking (I assume Intel's keys are kept air-gapped) or relying on secret court orders, plain old spycraft would probably do the trick.

That said, my argument can be rephrased to consider the hard-drive controller or other peripheral firmware rootkits instead, if you prefer and care only about scenarios where the rootkit must be delivered over the network to a clean system without attacking the CPU manufacturer.

Knowing the NSA got to the SIM cards manufacturer master keys, I wouldn't be surprised if they had Intel's key to forge microcode updates...

The CIA took control of the SIM card manufacturer company through in-q-tel years before and willingly sold their shares just before the keys got stolen by NSA/GHCQ.

It was a big deal at the time known as "l'affaire gemplus" and it prompted the french government to set up the "Fonds stratégique d'investissement" or strategic investment fund, sort of a french in-q-tel.

Intel being a US company it is probable the US agencies have their ways with them.

I wouldn't be surprised if the NSA worked with Intel to design their microcode update mechanism (selecting algorithms with advisements against classified breaches; generating key material and sharing between themselves; etc.) That would serve the NSA's interests in both their SIGINT and COMSEC roles at once.

As an attacker, you have a decent shot at doing UEFI/BIOS level exploits or even going after the Intel Management Engine.

This is why I run libreboot and I neutralized the IME by flashing my BIOS using SOIC-8 chip clips and a Bus Pirate.

I guess I'm paranoid.

Did you really "neutralize" the IME?

I guess you refer to a procedure as described in

https://hardenedlinux.github.io/firmware/2016/11/17/neutrali...

I would say what you did is to "neutralize" the ME firmware part in the flash BIOS. But this is only firmware that the ME loads additionally to load applications like e.g. AMT. The ME has it's own internal ROM containing it's very own firmware which is inaccessible and can not be modified.

So what you have is libreboot running on top of a still functional IME. All you gained is, that you got your BIOS of choice installed, and to remove some ME apps from the flash image. Correct me if I am wrong.

In Ptacek's defense (heh), I'm willing to wager those hypothetical detection rates are far off the mark by orders of magnitude.

I'd expect a microcode-level rootkit to run a five-nines success rate evading detection unless used against someone who's paranoid enough to have _something_ in place to detect it, and I'd venture further that the 3LAs of the world are smart enough not to target the infosec-paranoids of the world.

I am sure the numbers are way off, but not sure only the microcode one is. My suspicion is that against most non-intelligence targets, the DLL injection approach is quite unlikely to be found out either, at least once the initial intrusion has been accomplished. In both cases, the implants will likely only be detected if the machine in question is used to stage another attack or exfiltrate data over the network, in which case the level of the rootkit running on the host will matter very little for detection.

Admittedly, the best rootkits probably target the network equipment as well as the host.

At the host level, most organizations wouldn't be able to detect an unmasked trojan running as its own separate user process unless its signature was already known or its behavior caught by a blacklist-based IDS.

The problem doing DLL injections is you are dropping things directly to the disk which is a great way to get AVs attention. Heuristics based detection can be a pain in the ass here and you want your rootkit to be able to be 'unique' for every installation if possible.

Also rootkits are way overrated. What you do when you compromise an organization is you open a connection to your C&C on a few machines to keep your foothold if any reboot. If you need to get in you just connect to one of those boxes and just continue on. You never have to drop anything on the hard disk which makes it much stealthier.

I don't doubt your expertise, but I think you're making a lot of declarative and slightly inflammatory statements without supporting them with concrete evidence. Is there publicly available evidence that you could refer to?

> the more likely it is that your target will discover you compromised them

fair enough, but the like the person above said, it can be very important to hide/obfuscate the identity of the snooper. Stuxnet would have been more effective if experts could not immediately point to US/Israel.

According to a recent Wikileaks tweet, this leak is only 1% of the files that they have on the CIA. So most likely, they have many more exploits that are more significant.

So yet another thing Wikileaks (Assange) wants us to take their (his) word for.

Well, they also published those papers you see now.

On the other side, there's an organization that by definition asks you to take them on their word that everything they good is for your own good...

They published the papers with a heavy dose of spin. Remember how the headline contained FUD about Signal and WhatsApp? The released documents have nothing about sidestepping Signal and WhatsApp. That was pure conjecture and editorializing.

Of course WikiLeaks wants ordinary people to be vaguely afraid of using Signal and WhatsApp. End-to-end encryption is very much counter to their goals.

Wasn't whatsapp all over the news for its "replace the encryption key transparently without notifying the user" feature ? Also facebook.

I don't trust signal, a centralized that requires a phone number while pretending to be secure and providing some anonymity is flawed by design and begging to be exploited.

The reporting you're talking about has been widely denounced by actual security experts, with 70 of them signing a letter asking the Guardian to retract its inaccurate story. Your position is about as responsible as saying "I don't trust vaccines, they kill people".

http://technosociology.org/?page_id=1687

Get off the FUD brigade.

It's not FUD: it's just a threat model WhatsApp and those experts do not care for, or alternatively think is a worthy the UI/UX trade-off.

FWIW, I strongly disagree with this stance: if the recipient's key changes while the message is in-flight, that message should never be resent/delivered without the sender's explicit approval. Imagine that Bob is a political activist planning a protest. Bob is wondering why his IMs to a co-conspirator Alice aren't being delivered; Bob's wonder turns to fear when he hears on the news that Alice has been detained. Fear turns into terror when Bob sees his messages subsequently get two blue ticks as WhatsApp happily delivers his IMs to a new phone belonging to the secret police. Only afterwards does WhatsApp notify Bob that Alice's key has changed

OWS never claim that Signal provides anonymity. The word they use is privacy which sometimes involves being anonymous, but not necessarily so.

> Wasn't whatsapp all over the news for its "replace the encryption key transparently without notifying the user" feature ? Also facebook.

Which was a conscious design decision. Not doing that (even for people that had turned on "notify on key changes"), would let whatsapp know which users could be securely MITM'd. Neither is a very good choice, but an understandable trade-off when it comes to security vs usability.

I haven't read overly deep into the documents, but if they have rootkits for the main devices (iPhone, android, linux, OSX, windows) that you are using E2E encryption on they can easily sit between the decryption layer and the user.

Yes, and they can also hypothetically send nude pictures of you to all your friends and family, but that wasn't the headline for some reason.

You can do lots of things when you've owned someone's phone. The big news is that they're targeting phones instead of services.

Given that, it's very peculiar to focus on the services WikiLeaks wants you to be afraid of anyway, when they're mentioned nowhere in the documents.

> End-to-end encryption is very much counter to their goals.

What would those goals be?

Yeah, Assange can go get stuffed. He has lost all credibility with this drips and drabs bullshit in an attempt to keep himself some kind of "celebrity".

Release it and let people figure it out or shut the fuck up.

Snowden is a hero. Assange is an asshat.

Snowden coordinated with Greenwald et al. for years on their "drips and drabs" strategy. Rightly so! The point of leaking is to have a political effect. Those effects are multiplied when leaks are well-timed. I'm glad, because had the leaks that have many people most upset not been so effective, USA would probably be at war in Syria right now.

https://theintercept.com/2016/05/16/the-intercept-is-broaden...

Funny that the snowden leaked document have been released drips and drabs to the point that only a portion has been made public yet but for some reason you fail to take it into account.

Also Assange would be Poitras/Greenwald here not Snowden.

Are you implying that he did something dishonest? I can't recall one example even. Although, I do recall a handful of politicians and news stories claiming the DKIM verified emails were likely fake. For example, I remember when Donna Brazile said that it wasn't her who sent the email leaking debate questions. Russians probably broke DKIM, and Brazile was probably coerced into admitting she's a liar.

What exactly are you suggesting? That they defeated modern cryptography or compromised Google to unprecedented degree?

The last sentence was sarcastic.

Sorry! You’ve run into Poe’s law.[1]

[1] https://en.wikipedia.org/wiki/Poe%27s_law

How much of that "99% unreleased" is represented by the stub files:

    ::: THIS ARCHIVE FILE IS STILL BEING EXAMINED BY WIKILEAKS. :::
    ::: IT MAY BE RELEASED IN THE NEAR FUTURE. WHAT FOLLOWS IS :::
    ::: AN AUTOMATICALLY GENERATED LIST OF ITS CONTENTS: :::

You're extrapolating from Wikileaks hyping itself in a tweet and calling the result "most likely".

Find a better justification for your beliefs.

Add to the fact that many systems around the world are woefully unpatched, so the "silly stuff" still works against them. I've done a lot of work outside the U.S., especially in 3rd world countries, and it's astounding how outdated much of the IT infrastructure is. We're talking entire networks still running pirated Windows XP and Vista.

Definitely correct, they are not stupid. These tools are more of a "keep it around in case we need it" type of thing.

The CIA works abroad, not on American soil, so none of these tools are being used against the American people anyway (thats the NSA's job). I imagine this is part of a network or "library" of exploits they have, in case they encounter say a North Korean laptop with Windows 98 and they need something in a pinch.

>doesn't mean that there aren't more units

Exactly, thats why they call it a "leak" and not a "turn the hose on full blast."

"The CIA probably isn't stupid."

I don't think you can underestimate how stupid these big bureaucracies can be.

Perhaps, probably, etc.

But never underestimate your opponent, and all that...

> Also just because some information got leaked, doesn't mean that there aren't more units / projects at the CIA where maybe the more skilled people are working and where the "good" attacks don't get leaked.

Actually the vault7 leak is the first in a series and it is clearly stated that this is only a portion of the CIA tools:

> Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized "zero day" exploits, malware remote control systems and associated documentation. (..) The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.

Can anyone confirm if 'the CIA lost control' refers to the August 2016 Shadow Brokers / Equation Group auction? At the time I recall the tools being attributed to the NSA however it seems to fit the timeline ...

May be the simple DLL can be installed without privilege elevation. Simple to use.

Technically, there is absolutely nothing impressive whatsoever, in the archive released yesterday; I went through the entire thing. Relative to the Snowden leaks, the CIA tools look benign. The biggest difference between the two sets of leaks(and subsequent NSA revelations) however, is scale & automation. NSA's tools are built almost entirely by contractors. The 'hacking' tools are integrated with deployment tools, as well as data collection. For example, say I work for the NSA and I want to see Bob's desktop wallpaper. I already have some generic social network information, as well as ISP info on bob, and he has already been assigned a 'selector,' which I use to query Bob's information, which was gathered from all sorts of sources. Assuming I don't already have a RAT or similar installed on Bob's computer, a further step is required. The NSA has many redundant attacks entirely automated, and most of the massively successful attacks, require some sort of MITM attack. Schneier released a video(on October 26th 2016, I think - if not real close to that date,) of some sort of intelligence meeting he spoke at, with just a handful of people, where he claimed he was going to bring something to light that had not previously been revealed anywhere in public. He revealed that the majority of home routers in the U.S.(commonly believed to be the ones provided by ISP, which run a custom Linux distro, with half a dozen internal subnets, mine runs on Arris hardware, has full busy-box, and used to contain a root pivot script that was previously accessible via ssh, on an accidentally unsecured network interface, within an obscure IP range, whos shell login turned out to be the commonly available Arris rolling code('arris pw of the day?'). The embedded Linux running on the device is based on the "RDK project" as is the DVR's and modem/router combos from a variety of other ISP's. Supposedly this is patched(for arris) but I haven't attempted any further investigation since August 2016. I believe the backdoor was simply a poorly designed interface between the router and the technician GUI software.) Sorry for the unnecessary details, but I've already typed it out now. Schneier revealed that these routers(HE never specified which, but said they are everywhere), referred to by the NSA internally as 'diodes'. The diodes are used(automatically) to provide better proximity to other users, not necessarily the target, where the plethora of attacks are then executed from. The initial development costs are immensely greater than those of the CIA's, much easier and cheaper to use, by the lay person, and are more carefully controlled/depend on the system hosted by the NSA. While proximity attacks are not the only method of intrusion/full control, the next best, or perhaps better alternative is Acidfox, which is often delivered via email/browser, and requires user intervention. Clearly the NSA is leaps and bounds ahead of CIA in terms of sophistication, as well as control/oversight, as you can't just walk out the door with an archive containing 75% of their tools(they depend on infrastructure.) The CIA attacks depicted in the Wikileaks archive, almost all require manual intervention, are less reliable, and 'janky' as hell. The CIA has a record of using their tools for less than honorable/legal purposes(which may be further elaborated on, depending on what goes down with the Trump wiretaps,) either way, the CIA hacks seem like a waste of time and money (5000 employees at the consulate in Germany) and redundant. The CIA must be able to utilize the NSA's vastly superior technology/information after receiving a warrant, which makes the motives and means all the more suspicious. Who knows what will come out, but one thing is for certain, there will be a lot more information revealed pertaining to the illegal, unwarranted, for personal gain, sharing of their tools with ex employees and contractors, in the coming weeks. I could go on for ages on this stuff, but I usually just get instantly downvoted, and I'm not providing sources(as it's all from memory[pro memory,] but it's all easily duckduckgo-able [or google.]) There are certainly more sophisticated employees and programs at the CIA(obviously), but I have a feeling that the shindig over in Germany consists mostly of this sort of thing, cheaper, younger, less experienced kids, copy & pasting junk together, customized and deployed on a case by case basis. I also have a feeling that the reasons Obama set that up, is going to be an interesting narrative which we will soon watch unfold. (hint: 7th floor group; aka 'shadow government') P.S. I refuse to go back and grammar check this monstrosity.

Edit: Maybe someone can answer this question for me.. So from the Snowden leaks, we know the extent of the NSA toolkits and the requirements which need to be met to utilize them. Now we know some of the CIA's capabilities, and after Apple refused to unlock the San Bernardino Shooter's iPhone, we found out the FBI was playing some sort of politics, by claiming that justice might not be served without Apple's intervention, and proceeded to publicly shame the ethical position Apple took. So why on earth was Obama trying to force Apple's hand in that matter? Soon as Apple said no, the FBI somehow found the single magical person willing and able to defeat the privately enhanced security of the shooter's 5S? Makes no sense to me.

Thanks for sharing. Consider breaking it up into a few paragraphs to make it easier to parse.

The most interesting tool I found in the leaks was the bug that jumps airgap to make Nero burn trojaned binaries. If we see more tools like this come out of the woodwork, it shows that the CIA is at least in some ways keeping their teeth sharp.

I believe that the FBI and Obama both played politics for a few reasons, namely:

- Obama and the FBI probably withheld a reasonable amount of information from each other regarding the case

- This was all a charade to bring the topic into the public sphere. It backfired, but the aim was to allow future high-profile cases on which concurrent evidence trails are harder to establish. Once it backfired, Comey came out with a public letter admonishing the American people, comparing us to children. He stated that with Rule 41 coming into effect, the FBI would use its expanded powers to collect information for the following year. They would then use that information in an upcoming "adult conversation" the FBI wishes to have with the public about the future of open, libre encryption.

We should be expecting that "conversation" to take place this year. And I don't expect it to be much of a dialogue so much as a monologue. I expect the FBI to either directly or indirectly (thru Wikileaks, etc) release information that "proves" that backdoored encryption and its inherent reduced security is necessary for public safety. There is a saying we all know and love about the merits of this particular trade-off

I'm certain the FBI always had that contact on standby. They probably received multiple unprompted bids from various hacking companies during the public run of the case. They wanted to flex how much pull they had over a giant like Apple. Even though they seemingly failed, they came out with a huge data point: The American people need further brainwashing and ideological shifting before attempting a full coup over libre encryption in America.

I hope that things make a little more sense now.

I don't think they wanted to flex muscle over Apple, I think they were trying to build case law for situations like this. Also breaking into a phone with an exploit like this is expensive and if they have an exploit, they might not want to publish that they have it in the future so having the backdoor provides deniability even if it's fundamentally dumb.

/puts on tinfoil hat

There is also the other option which is that trust in American tech companies has been sketchy at best following the NSA leaks and this was a chance for the Obama administration to allow companies to reestablish some legitimacy when it came to security by making the US government look evil but having the corporations 'prove' that they are not backdoored by the NSA. They can still break in the covert way, but it makes it look tech companies are not as compromised as the NSA leaks would suggest.

/puts tinfoil hat

they might also used the whole stunt as a way to inform the public that they have the capability so that next time around at the interview goes "look kid, we do have the capability to unlock the phone, but it's costly, nasty, annoying for everyone involved and will put your refusal in a very very bad light in front of the judge and jury, why you don't just give the code and we tell the judge you cooperated?"

To be frank, the whole concept of "plea bargaining" in US law is a vulnerability, broadening the attack surface for many otherwise less harmful vulnerabilities.

Yeah! If only we could make the courts and the wider legal system cheaper.

Interesting, hadn't thought of this, nor the previous comment's theory.

Hadn't thought about it like that. Interesting. Was too late to edit when I saw your comment. Unrelated: Most interesting thing to me, of this nature(was from the snowden leaks) is known as 'RAGEMASTER;' an RF retro-reflector built into a vga cable(deployed by intercepted packages between computer supplier and target I believe) which allows NSA to observe the contents of a vga signal remotely, using radar, and subsequent re-modulation and sync of the signal.. Totally bizarre.

Edit: https://leaksource.files.wordpress.com/2013/12/nsa-ant-ragem...

This comment with paragraphs:

http://pastebin.com/raw/EgaH3WSh

Thank-you. That wall of text was impossible to read.

This is just the exploits that contractors were given. There's probably another set of more carefully guarded and important 0 days. Given how easily these were passed around this was most likely a cache of common exploits used every day on regular operations. Huge deal if compromised, but not all the keys in the kingdom.

I'm 1000% sure that's the case (though I'm not sure CIA is the group that has them).

The FBI --- our domestic intelligence agency --- has been doing kernel keyloggers since at least 2003.

Name the groups?

I won't name them, but you can filter their names by regex: /^[A-Z]{3}$/

I suspect the CIA is doing these primitive basic attacks for one reason: they work a lot of the time. CIA likely doesn't use ONLY these attacks (and the more intricate ones are probably run by a different group), but I mean, c'mon, buffer overflows and SQL injection are STILL effective venues of attack. Why give up on something that works just because there are other, stronger, tools? This lets you reduce risk of your involved attacks being caught - use them less often. Meanwhile, you can get 80% (made up number) of your targets with "silly" stuff, and only bring out the big guns on the 20%.

All speculation, of course.

If it's stupid and it works, it's not stupid.

Simple attacks are often (sadly;still) the most effective.

This is literally exactly what they want you to think. The CIA is smarter than you, and they have a lot to gain by misleading you otherwise.

Some of the most talented software engineers in the world work intelligence, and they can write better than you, exploit faster than you, debug more thoroughly than you, etc.

State intelligence is especially dangerous and devious. The average security researcher doesn't stand a chance, much less the average basement hacker.

Understanding what the CIA does and why they do it is designed to be more or less impossible from the outside. It's the nature of intelligence really, to be incomprehensible from outside the sphere.

Lol. I'm sure that there are people at the CIA / NSA that are much better at software than me, but I highly doubt it's pervasive.

I read the Snowden leaks. I know what type of tools they're using. I know the type of holes that their public facing infrastructure has. I know the type of holes that their government officials that they're supposed to be protecting have. I know how fucked the security environment is right now. The CIA doesn't even use HSTS or CSP headers for fucks sakes (lol, they get an F on observatory.mozilla.org) so we are not dealing with an organization of godlike power.

These people work in a bureaucracy. Some of them are geniuses that write stuxnet or break HTTPS ciphers, most are not. Most are dll or SQL injection kiddies. Or they use grep to filter emails.

Do you think they let contractors like snowden just cat whatever they want? I'm not saying he didn't go digging, but I'm sure it's just the top of their iceberg.

I didn't mean to insult your prowess or whatever, but people gotta understand the level that they operate at. It's insane

The CIA is just a collection of people. People that make mistakes. People that have emotions and whims. People that have families and children. People that want to go home at night, take sick days, and go on vacation. There is a natural limit to what the CIA can do simply because they need humans to do it.

I don't think there's much more to the CIA than what's in these leaks. To do anything more, you'd need tens of thousands of people and huge server farms. You can't hide that stuff.

>Some of the most talented software engineers in the world work intelligence

I truly doubt this for a multitude of reasons, but pay alone suggests otherwise.

Some of the most talented work intelligence but not necessarily for intelligence agency. AFAIK those guys come up with 0 days and put them for sale on the open market where all kind of bad guys buy them, not only the intelligence agencies (who are bad guys themselves).

Somebody needs to go to the library and rent Legacy of Ashes.

http://www.nytimes.com/2007/07/22/books/review/Thomas-t.html

> 2017

> new cuck times

Hell no.

I'm very familiar with business intelligence, and I'm somewhat familiar with govt intelligence though I've never actually filled a contract or anything, I've spoken with plenty who have, and have worked with a few as well.

The intelligence universe is completely parallel to the rest of the world. People just don't get it.

The CIA may just not need that much for 80% of their targets. We aren't talking about top-level security experts. The CIA might use these tools on very low-tech focused threats. The mere fact that they focus on Samsung smart tvs tell us something about their targets. What person serious about security would have a TV that even had a chance of recording their conversations if it was hacked?

For the other 20% of targets who are serious about security (High-level government actors in countries that can invest a lot of money into serious computer security.) The CIA probably has a bunch of high-level tools that were not leaked.

Why would they use more sophisticated tools than required? There are no style points to be had.

It's not about style, it's about ease of detection and circumvention. The marginal cost of using tools that don't have the flaws of a userland DLL injector is zero.

It's not. Every time you use a tool its an opportunity for it to be detected and if you are going to lose one it would be better for it to be one that you don't care about that much.

One must not cast a bigger bet but a better one.

Maybe the higher quality work just hasn't been leaked (yet)?

It's government work. It's probably a lot more fun to work in the private sector, which surely results in some skill discrepancy. It takes a lot of effort to get secret clearances, too. So I'm not sure there is higher quality work, at least in the CIA. All the talented hackers with inclinations to become a blackhat probably want to work for the NSA.

There are aspects of information security that I think the government is behind the private sector on, but there are others where they are way ahead. There are whole classes of technology that are fun to work on for which there is basically no private sector market, because very few companies need those sorts of things, but for which there is a thriving government market.

Certainly. I just meant that the CIA seems less likely to have that than the NSA or the FBI. But admittedly it's an uneducated guess.

Could you expand on why you feel the CIA in particular would have high-quality remote exploitation capabilities? Assume a talented hacker wants to join the government. Why would they choose to work for the CIA and not the NSA or the FBI?

I'm not saying the CIA does second-rate work in general, but perhaps their remote access work is second-rate in comparison to the NSA/FBI and to the very talented echelons of the private sector.

Or the CIA is intentionally leaking obsolete techniques to deflect attention from the good stuff...

Or maybe they really are incompetent. The whole dump reads like a group of sysadmins trying to wrap their head around the basics. Their targets probably don't need anything on the cutting edge either so anything good they can just hold onto until they need to blow it on an Iranian nuclear reactor.

> The whole dump reads like a group of sysadmins trying to wrap their head around the basics.

That was exactly the vibe I got from the leak as well. I don't know why people are going crazy over this, thinking Notepad++ or all Samsung SmartTVs are backdoored.

Who knows, maybe LD_PRELOAD is also an amazing method to hack programs?

There is a case to be made that you only need to be good enough to get in. I myself am not nearly at the level where I could write a hypervisor exploit even though I have been in the industry for a while. However I feel pretty confident in my ability to break into almost any company if I set my mind to it. Fancy exploits are just things that take time to create and if your super great payload gets flagged by fireeye down the line you might have just wasted a ton of time for no other reason than showing off if powershell would suffice. So I guess I am torn on this because I don't want to flame the sysadmin's turned security people for not being a top speaker at blackhat or CCC because I myself come from that background, but on the other hand I think I should expect more quality work out of the CIA than what comes out of infosecinstitute. If this is the average of the CIA I really think NCC group might have more capability than the intelligence agency of the US government which is kind of crazy to think about. I am sure they have some really great zero days that they save for very important projects, but I doubt we will get to see the same level of capability that we saw out of the NSA leaks.

This is a very real possibility. The CIA has admitted to Congress that they have operatives in US magazines, and refused to answer if they have operatives in TV:

https://youtu.be/U1Qt6a-vaNM?t=2h30m35s

Or leaking the ones they know other nations are using.

Exactly, they could be doing some kind of hacking tools rotation by burning all the ones which are most likely to get patch shortly because they have been reported and thrown in with a mix of obsolete tools which have been already been replaced by more efficient attack vectors and at the same time burning a big bag of tricks for all the other nations already using these vectors or in the process of developping such techniques/tools.

That's my point.

apparently, the first leak represents less then one percent of what they have... so they probably didn't leak the most damaging stuff in the first leak.

>I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses.

Got to have something to spend the budget on to ask for more next year?

Maybe they are just trawling and they have more skilled people pick out the wheat from the chaff or combine exploits. It would make sense if there are some bigger picture people directing the contractors. A library of low-level shit might be useful if you're building entire frameworks.

Strong currents push to classify work. Structures like jetties and piers oppose declassification.

Silt builds up at classification boundaries. You should expect to see a bunch of S crap that can't get to the TS tools, TS crap that can't get the compartments needed for the great tools---all in service of not devaluing the tech.

This was the U silt pile.

This leak does contain classified content, it seems.

Doesn't that suggest that there are other attacks and exploits that the CIA potentially has that weren't leaked?

WikiLeaks claims to have leaked less than 1% of their material.

Yes. That's my point.

And you seem like the last person who should make the all or nothing security fallacy. Just because fancy rootkits exist doesn't mean we shouldn't protect ourselves against the easy stuff. Isn't your argument basically either turn your threat mitigation up to 11 (nation state bad assery) or give up.

Those topics you list make for cool presentations, but at the end of the day some poor schmuck does have to write that "capture the phone calls from Skype" and "exfiltrate the IM messages" code. That super-meta rootkit certainly isn't doing it on its own. It's boring, there is probably XML involved, but so is that CRUD web app that is rewritten thousand times over on every continent of this planet.

DLL injection seems like a perfectly fine hammer in the toolbox for that purpose. Nobody is claiming that they are using it for anything more than targeting specific applications once they have already gained system access. How they got that access might make for more interesting documents.

The CIA is in the business of obtaining information, not malware research.

Would you say that Black Hat talks are representative of the state-of-the-art of malware? Or is it likely that commercial spyware/malware/rootkit authors know "more" than what's presented at Black Hat (or a similar conference)?

Isn't the main difference complexity and sophistication? You mostly see POC type work at conferences. What organizations can do better is integrate multiple exploits and relevant intelligence to architecture a targeted cyber weapon.

What's impressive about things like Stuxnet is the amount of work and coordination it must have took to make it. The actual techniques were rather unremarkable.

In my opinion, typical PoC academic work tends to underestimate the actual effort required to execute an exploit, and sometimes even describes exploits that can only ever occur under very stringent conditions.

Didn't Stuxnet involve backdooring Siemens PLCs? I find that pretty remarkable. In general, extremely sophisticated exploits that target critical infrastructure require attacks that haven't already been considered, be it for delivery or execution.

Good point - just because people aren't talking about it doesn't mean it's not happening

It could be disinformation.

That's my bet also.

> I know it's annoying to hear this, but I'm going to keep saying it: this stuff is silly. The DLL injection stuff in the CIA leaks should embarrass the CIA.

Are you calling Notepad++ or the CIA silly, here?

If the first case (which I assume) you're comically missing the point yourself, which is a big middle finger to a hostile government agency. This is an international Open Source software, used worldwide, that has taken a stance against US politics before (export restrictions).

So yeah maybe it is to embarrass the CIA, but not quite in the way you describe.

By publicly releasing this "fix", they're making a noise calling out LOOK WHAT THE CIA IS DOING PEOPLE, instead of shrugging "eh, is that all, I sure hope they got better exploits from my tax money" and "gosh I wonder why whoever released all this is angry with the US or something, I bet it's cause they're biased".

Now there's a public post on their site, on record, being shared everywhere that says BUGFIX BECAUSE THE CIA ACTIVELY TARGETED OUR SOFTWARE, so that people know this is no longer some "'They' could potentially do X and Y" but that it's actually happening and in this particular case "They" are the CIA.

I think you understand perfectly well how this sends a very different message to a very different (broader) audience than the (admittedly much more serious) revelations at Blackhat conferences. You remember that all these serious capabilities have been around for a long time, but the public didn't really take it seriously because many people believe "they wouldn't really" or the attacks were surely theoretical or otherwise we'd hear more about it, right? Or even when the capabilities have been right there, clear as day, for a decade, to actually assume "They" are really listening on your Samsung Smart TV's microphones (or you name it), has been flat out conspiracy nut territory or at best you could say "surely they only deploy these capabilities on a very small, targeted scale, responsibly".

And now they're not. We know it's happening. New proof of new scandalous breaches of privacy of individual indiscriminate members of the public comes out every other month or so. The whole world knows that the US/UK surveillance apparatus has spiralled out of control and is surveilling, spying and collecting data on everyone, everywhere. To say now, let's not make a big deal out of this because it just confirms what everybody could have known all along, is an idea that should have its motives questioned (by which I mean, you should maybe ask yourself, not that you're doing it deliberately).

Does Notepad++ really believe that with this fix they've successfully defended their software against CIA (or other gov.actor) exploits? Of course not. But they do get to make a big fuss out of it. And that's important too. If the police beat you up, is that something to make a big fuss out of and try to fix and make sure they don't get away with, even if it doesn't help with them still getting away with actually shooting people dead elsewhere? You can argue about that, but I wouldn't call it "silly".

Are there now people who will think "phew at least now Notepad++ is protected against CIA hacks"--well, probably, quite a few. But you're not addressing or helping those people by talking about Blackhat and hypervisor rootkits.

(... and if it's the second case, "silly" is a bit of an understatement given what these people have been up to the past half century or so--it's not actually quite as funny as in the film Burn after reading)

It may be silly, but people need to keep hearing that that CIA is doing an end-around the Bill of Rights.

AFAIK, Wikileaks hasn't asserted that the CIA is using these exploits against American citizens, as surveillance of American citizens is not the CIA's mission. Moreover, it is not illegal for the U.S. government to use exploits for surveillance of citizens. The FBI has been tapping phones for a very long time now.

Are they? If so, we may have finally reached the point where the Bill of Rights (as fantastic as it is) no longer can adequately address modern abuses and communication patterns. Remember that the American agencies aren't the only intelligence agencies in the world.

Sticking with the CIA, though, let's say we apply the bill of rights in its most stringent interpretation; then the CIA can't hack into anything that any American might use to communicate to, without an American warrant. That would be totally unrealistic, and the result would be no tech toys for the CIA. They would be at a significant disadvantage compared to other intelligence and manipulation agencies around the world.

Or perhaps another spin on it... does the Bill of Rights apply in the case where an ISIS combatant is firing on a US Marine, where the combatant happens to be an American? The Marine won't know that, and will treat them as a combatant. The Bill of Rights doesn't seem to apply in this case. Given that to be the case, then should the Bill of Rights apply where the CIA is hacking into equipment that a non-American is using and might use to communicate with an American?

Perhaps this really shows the inherent problems in the assumption that human rights are contingent on citizenship.

> Remember that the American agencies aren't the only intelligence agencies in the world.

But they (US+UK) are, agencies that have been allowed natural access to the infrastructure and resources required to implement surveillance on such a global scale. So much so that other intelligence agencies are making deals to get access via them. So, say, the Dutch AIVD, they don't have the majority of Internet data flowing through their territory (with nearly all large tech companies being US, clouds, browsers, software etc) so they can't directly abuse this access, because their scope is limited, unfortunately they can still trade for it because we have two nice big ports with transatlantic Internet cable connections (unless we already traded US access to those for something else, I don't know). So sure, they're being bad, but they're also limited, and they're not the root of the problem.

The US and the UK are in a very unique position for global Internet surveillance.

But that's a social problem, and there are no (purely) technical solutions to social problems. The tree of liberty does not need to be refreshed from time to time with stricter DLL search paths.

If Notepad++ wants to push an update that fixes DLL search paths purely for symbolic reasons, so that all their users are aware of what the CIA is doing by seeing the changelog, that's another thing entirely, and yes, I agree that's useful.

> If Notepad++ wants to push an update that fixes DLL search paths purely for symbolic reasons, so that all their users are aware of what the CIA is doing by seeing the changelog, that's another thing entirely, and yes, I agree that's useful.

Of course it is. Notepad++ is an international project and these reasons are exactly why I upvoted this story.

(I'm honestly a bit confused as to what other reason one could come up with that is not an insult to Notepad++ developers' intelligence--"There, we fixed the DLL inject-y thing, finally now our users will be safe from CIA hacks"??)

Nah, the simple reason is a straightforward, almost-apolitical "Someone found a bug. We were doing something wrong. So we fixed it."

But that's not what happened (the release note's text was boldly political), I'm not sure what your point is any more :) I think we're in agreement anyway.

The cynic in me would assume this is a well played game. Look at us, we can't even use Vi properly, and we use these unsophisticated attacks to break your defenses. Nothing to fear from us, don't worry...

We have ot agreed on many a topic... but I just want to say; I love you and keep doing what you're doing (PROVIDED youre not perpetuating the Deep State) - but yeah, youre sound and I will still keep calling you 'Patrick'

>Here's the rootkits track from Black Hat 2008 --- keep in mind that this is almost a decade old and that it's public work

So, yeah, we're fucked, yes?