News for hackers. Stuff that matters.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by elorm on Wednesday November 01, 2017 @06:55PM (#15606228)
Prior to accessing this file collection, please understand that this material was seized from a terrorist organization. While the files underwent interagency review, there is no absolute guarantee that all malware has been removed.

The CIA cannot guarantee that files they have spent 6 years poring through are free off malware? Wonder why anyone will download these documents after this.

Re:CIA Releases Additional Files Recovered in Raid on Usama ... by bousaid on Wednesday November 01, 2017 @08:53PM (#15606938)
Have you ever read the terms and service of any piece of software or service? They’re full of similar protective clauses.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by jorblumesea on Wednesday November 01, 2017 @07:21PM (#15606401)
Probably just legalese in case anything happened. I bet CIA lawyers are the most paranoid people on the planet.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by TinyRick on Wednesday November 01, 2017 @07:50PM (#15606591)
Or in case someone finds the malware they injected into it.

</tinfoil hat>

Re:CIA Releases Additional Files Recovered in Raid on Usama ... by gozur88 on Wednesday November 01, 2017 @10:09PM (#15607263)
That seems like a pretty obvious play, IMO. I'd be surprised if they didn't.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by wallace_f on Thursday November 02, 2017 @12:24AM (#15607819)
Don't be ridiculous. Any reasonable and representative democracy like ours would not be a government interested in subverting the privacy and rights of its own people. /s
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by moxious on Wednesday November 01, 2017 @09:18PM (#15607083)
Would the CIA really do tha...oh.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by mynewtb on Thursday November 02, 2017 @03:16AM (#15608448)
You cannot ever guarantee that, see N=NP.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by jmite on Thursday November 02, 2017 @03:19AM (#15608460)
Rice's theorem, actually
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by mbrock on Thursday November 02, 2017 @04:59AM (#15608833)
This is not a true implication.

If all the executables in the archive were, say, loop-free trivial programs, then of course you could instantly confirm an absence of malware.

If there are some loops and complications in there, you would do some more logical work, and then depending on the power of your logical system, either conclude safety or unsafety, or time out.

Rice's theorem does not mean that static analysis is impossible, even of machine code!

Re:CIA Releases Additional Files Recovered in Raid on Usama ... by jmite on Thursday November 02, 2017 @11:43AM (#15611407)
Right, but Rice's theorem means that you either have false positives, false negatives, or "Unknown" answers in any static analysis. Which means that the CIA could never guarantee the absence of malware, for example, if any of the programs timed out in the static analysis.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by mbrock on Thursday November 02, 2017 @12:25PM (#15611833)
It seems likely that they wouldn't be able to guarantee that, but we need to be more clear.

The fundamental limitations of computer science, as expressed by Rice's theorem, says that the CIA cannot make a program that given any archive says in finite time whether there is malware there.

It doesn't say that for some specific archive the CIA cannot guarantee the absence of malware.

There are infinitely many EXE files that you can prove malware-free, and this set expands with the progress of static analysis.

But of course, if one EXE file says "if (unsolved_math_problem()) { malware(); } else { harmless(); }" then the CIA would have to spend a lot of effort proving its status.

Re:CIA Releases Additional Files Recovered in Raid on Usama ... by isfield on Thursday November 02, 2017 @04:38AM (#15608739)
Maybe download and copy to isolated vm view and nuke the vm. Or I'll just read what everyone else says is in there :D
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by Bromskloss on Wednesday November 01, 2017 @09:46PM (#15607178)
What would be the problem with downloading and reading them? You don't have to _run_ them, to the extent that they are programs.
Re:CIA Releases Additional Files Recovered in Raid on Usama ... by jlgaddis on Wednesday November 01, 2017 @11:01PM (#15607502)
Yeah, it's not like there's ever been vulnerabilities in Microsoft Word, PDF readers, image viewers, or media players. /s