Or maybe they really are incompetent. The whole dump reads like a group of sysadmins trying to wrap their head around the basics. Their targets probably don't need anything on the cutting edge either so anything good they can just hold onto until they need to blow it on an Iranian nuclear reactor.

> The whole dump reads like a group of sysadmins trying to wrap their head around the basics.

That was exactly the vibe I got from the leak as well. I don't know why people are going crazy over this, thinking Notepad++ or all Samsung SmartTVs are backdoored.

Who knows, maybe LD_PRELOAD is also an amazing method to hack programs?

There is a case to be made that you only need to be good enough to get in. I myself am not nearly at the level where I could write a hypervisor exploit even though I have been in the industry for a while. However I feel pretty confident in my ability to break into almost any company if I set my mind to it. Fancy exploits are just things that take time to create and if your super great payload gets flagged by fireeye down the line you might have just wasted a ton of time for no other reason than showing off if powershell would suffice. So I guess I am torn on this because I don't want to flame the sysadmin's turned security people for not being a top speaker at blackhat or CCC because I myself come from that background, but on the other hand I think I should expect more quality work out of the CIA than what comes out of infosecinstitute. If this is the average of the CIA I really think NCC group might have more capability than the intelligence agency of the US government which is kind of crazy to think about. I am sure they have some really great zero days that they save for very important projects, but I doubt we will get to see the same level of capability that we saw out of the NSA leaks.

This is a very real possibility. The CIA has admitted to Congress that they have operatives in US magazines, and refused to answer if they have operatives in TV:

https://youtu.be/U1Qt6a-vaNM?t=2h30m35s

Or leaking the ones they know other nations are using.

Exactly, they could be doing some kind of hacking tools rotation by burning all the ones which are most likely to get patch shortly because they have been reported and thrown in with a mix of obsolete tools which have been already been replaced by more efficient attack vectors and at the same time burning a big bag of tricks for all the other nations already using these vectors or in the process of developping such techniques/tools.