Wikileaks is offering tech firms CIA files first
bbc.co.uk
bbc.co.uk
> He claimed that an anti-virus expert, who was not named, had come forward to say that he believed sophisticated malware that he had previously attributed to Iran, Russia and China, now looked like something that the CIA had developed.
That sounds very like something I read on Robert Graham's Mar 7 comments[1] on the leak:
> Already, one AV researcher has told me that a virus they once suspected came from the Russians or Chinese can now be attributed to the CIA, as it matches the description perfectly to something in the leak.
1: http://blog.erratasec.com/2017/03/some-comments-on-wikileaks...
> There's no false flags. In several places, the CIA talks about making sure that what they do isn't so unique, so it can't be attributed to them. However, Wikileaks's press release hints that the "UMBRAGE" program is deliberately stealing techniques from Russia to use as a false-flag operation. This is nonsense. For example, the DNC hack attribution was live command-and-control servers simultaneously used against different Russian targets -- not a few snippets of code.
They aren't signing them with Russian government certificates or running them from Russian government IPs.
They're buying servers or VPN connections on public providers. The notion of "strong attribution" in and of itself is basically impossible in the field of malware unless someone steps up and shows you the source. Those are things anyone can do. They're only doing a probabilistic analysis assuming no one else knows them, which makes many very large assumptions - like no one else wanting to fake Russian malware.
He comes off quite partisan in my opinion - his Twitter pretty much confirms it as he compares Wired to Brietbart. I wouldn't listen to a word this guy says on the topic.
Strong Attribution is definitely a difficult task and unless someone admits guilt, you'll have to rely on probabilities but the combined CrowdStrike, SecureWorks, and ThreatConnect reports give a fairly strong basis of where to place blame for the DNC servers. I'd imagine our intelligence agencies have their own methods of attribution that we won't learn of for a long time.
As for Rob, this feels like a pretty balanced opinion:
> The DNC hacks have strong evidence pointing to Russia. Not only does all the malware check out, but also other, harder to "false flag" bits, like active command-and-control servers. A serious operator could still false-flag this in theory, if only by bribing people in Russia, but nothing in the CIA dump hints at this.
> The Sony hacks have weak evidence pointing to North Korea. One of the items was the use of the RawDisk driver, used both in malware attributed to North Korea and the Sony attacks. This was described as "flimsy" at the time []. The CIA dump [] demonstrates that indeed it's flimsy -- as apparently CIA malware also uses the RawDisk code.
> In the coming days, biased partisans are going to seize on the CIA leaks as proof of "false flag" operations, calling into question Russian hacks. No, this isn't valid. We experts in the industry criticized "malware techniques" as flimsy attribution, long before the Sony attack, and long before the DNC hacks. All the CIA leaks do is prove we were right. On the other hand, the DNC hack attribution is based on more than just this, so nothing in the CIA leaks calls into question that attribution.
https://www.threatconnect.com/blog/tapping-into-democratic-n...
https://www.secureworks.com/research/threat-group-4127-targe...
https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
That's the thing though - you can place that blame whereever you want simply by making it look that way - buying servers from the right providers, modifying existing malware to suit your purposes via reverse engineering, etc. It's fairly straightforward stuff for someone in the know to do.
The probabilistic analysis does not and cannot account for fakery of this sort - the posts you linked do not attempt to account for this at all, instead assuming blindly that "hey, this looks vaguely like this russian attack group". I read his posting there - it seemed sketchy to me - then I read his Twitter account and it explained why it seemed sketchy. He's a blatant partisan, looking only to prove his side.
I'm not saying it's not possible it's Russia. It's quite possibly Russia. Probable even. Just that I don't trust the only possible analysis methods at a deep level such that I don't feel blame can be reliably laid in such a case.
Uh huh. After the US Election debacle, I'm not so sure of that.
And funnily enough, those who called for death warrants against Assange have literally apologized (Palin) and done a complete 180 (Trump, Hannity) and praise him.
But yes, now that Trump is a politician, I imagine it's only a matter of time.
>> I'm just saying he's not impartial
Assange != Wikileaks
Having documents on both sides and releasing one and not the other would be a break with impartiality. Having personal political opinions has nothing to do with Wikileaks impartiality.
No, but it is real suspicious.
1 - http://www.cbsnews.com/news/key-trump-surrogates-once-led-fi...
I can think of at least one instance where they targeted individuals: publishing the names and addresses of members of the extreme-right British National Party. Of course that is OTOH hard to square with the narrative that they're right-wing Trumpists.
Assange probably has no love for Trump, but certainly hates Hillary and was willing to get in bed with whoever was necessary to hurt her.
While there was no similar mass disclosure (most likely because of the political goals of those conducting the operation), Republican groups, not just Democrats, were compromised by the same actors behind the DNC attack.
Source - http://www.cnn.com/2017/01/10/politics/comey-republicans-hac...
I think you are being naive if you believe that everything that has been hacked has been leaked or that the leaks are motivated be an ideology of transparency rather than political objectives.
It's entirely possible that either they failed to break in or that they failed to get any significant information.
Comey disputes that in the linked article.
>or that they failed to get any significant information.
Or maybe it is possible that they got more significant information and it was never leaked because it is more valuable as blackmail material. Neither of us know which one of those theories is right.
What we do know is that both sides were hacked, probably by the Russians, and data from only one side was released. By wide consensus those releases were timed in order to maximize the damage they did to Clinton. That is exactly the type of action you would expect from someone motivated by politics.
>> "We did not develop any evidence that the Trump campaign or the current RNC was successfully hacked." - Linked Article
Seems pretty contradictory to me. Maybe a previous admin's RNC or something, but not the current one...
Honestly, these intelligence agencies are pretty clueless. They use the same tactics to identify malware sources that they use to thwart their own identification as a malware source. I wouldn't believe anything they say about the source of malware - or anything anyone says. It's far too easy to make it look like someone else did it - use their or nearby providers, use their malware or slightly modified versions of it, copy their strings, etc. It's pretty easy stuff to do if you've got a bit of assembly skill too.
> By wide consensus those releases were timed in order to maximize the damage they did to Clinton. That is exactly the type of action you would expect from someone motivated by politics.
Or you know, just someone motivated to make impactful leaks. Despite these emails not being in my political favor, I wouldn't have done anything differently in their shoes. Would you have? and if you would have, would you honestly say that your actions weren't politically motivated?
I think _not_ releasing in this case or avoiding impact would have been more clearly politically motivated.
I mentioned this in my other post. The RNC was hacked, but we don't know the timeline due to Comey's vague terminology.
>Honestly, these intelligence agencies are pretty clueless.
This is incredibly patronizing. They have a much greater expertise on these things than two doofuses like us debating on the Internet.
>Or you know, just someone motivated to make impactful leaks. Despite these emails not being in my political favor, I wouldn't have done anything differently in their shoes. Would you have?
It isn't just the timing of the leaks, go back and read what they were saying about them. They stoked the flames of Pizzagate. Assange was quoted as saying the leaks would guarantee Clinton's arrest. Those aren't the actions of someone who is politically neutral.
I probably am naive, but at least I'm not so naive as to hear anything from Comey other than CYA over his own "election-affecting" but now-forgotten Clintonian email releases.
As I said above, however, we're really in the dark when we're reading tea leaves of nuance in testimony about an open investigation, by an effectively independent civil servant who has given directly-misleading testimony within the last year.
Not so much that — we have ample evidence to the contrary — but more conventional media outlets like the NYT, WaPo, CNN and so on are more than happy to publish unredacted leaks themselves, if they embarrass Trump. Wikileaks is whom you bring your story to when nobody else will publish it.
You don't see leaks from 3-letter agencies because someone phished them - while it's definitely possible to contact them.
You can do a lot with training - simply frequently attempting phishing on your own employees can do a lot.
http://www.independent.co.uk/news/world/middle-east/wikileak...
Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking... http://bgr.com/2017/03/09/google-says-many-android-exploits-...
1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.
2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS
2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.
2. Makes no difference.
How do you know the CIA found these vulns, and that they weren't shared from IC partners?
You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.
Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html
Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.
My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.
There were social security #'s in those releases.
They try and play both sides of the fence: -we dont "editorialize", redact or make decisions on what is and isn't released -release specific info with sensational headlines timed for optimal impact
If they were to dump all the releases months before the election no one would have remembered them, no matter how significant.
They've done partial releases and released over time with many other leaks too. I don't see how that conflicts with transparency or impartiality.
Put yourself in their shoes - how would you have solved it differently?
> There were social security #'s in those releases.
When you're working with data in the volumes that they are and you have limited review staff, sometimes mistakes happen. If you'd like to help prevent it, I believe they do accept reviewers if you've got appropriate credentials.
If you'd like to volunteer that skill, they may be open to accepting it. It's entirely possible they just don't have developers with such abilities in their arsenal. You might try their IRC channels and such if you'd consider it.
It's not "mistake" if PII is revealed in every single release. It is incompetence or they are acting in bad faith. There are dozens of other organizations that have strong records on this. wikileaks is not one of them.
They've stated that's exactly what they're doing in several pieces.
> It's not "mistake" if PII is revealed in every single release. There are dozens of other organizations that have strong records on this. wikileaks is not one of them.
Likely because those "dozens of other organizations" don't publish many leaks and especially not in anything approaching raw form - every single leak I've seen in a major paper has been heavily filtered down and distilled into a specific narrative. WikiLeaks just publishes with minimal editing - any narrative from them is completely separated from the leaks. That rawness is what makes them better than other approaches for getting real information out, but it's also what makes them worse at censoring that information.
>WikiLeaks just publishes with minimal editing - any narrative from them is completely separated from the leaks
Wikileaks in king of clickbait and creating false impressions of what data they are and aren't releasing. Just look at their twitter account. There are even reports of withholding entire data sets when it doesn't fit their narrative.
I am on board for the premise of WikiLeaks is trying to do, but they have flatly failed in the execution.
What do you think of Umbrage?
I've already seen a few people on the right saying it means the DNC hack was 100% fake.
And I've already seen a security researcher on the left saying it has nothing to do with the results because "they found running C&C servers in that case", like you can't buy C&C servers anywhere in the world that you want.
Neither claim makes any verifiable sense. Hacking attribution is somewhere between hard and impossible if your opponent doesn't want to be found or wants you to find someone else instead.
It's a legitimately interesting program and something to consider when these claims get made. But don't listen the politics of it. It'll be a nightmare.
> It would be possible to leave such fingerprints if the CIA were re-using unique source code written by other actors to intentionally implicate them in CIA hacks, but the published CIA documents don’t say this. Instead they indicate the UMBRAGE group is doing something much less nefarious.
> They say UMBRAGE is borrowing hacking “techniques” developed or used by other actors to use in CIA hacking projects. This is intended to save the CIA time and energy by copying methods already proven successful. If the CIA were actually re-using source code unique to a specific hacking group this could lead forensic investigators to mis-attribute CIA attacks to the original creators of the code. But the documents appear to say the UMBRAGE group is writing snippets of code that mimic the functionality of other hacking tools and placing it in a library for CIA developers to draw on when designing custom CIA tools.
https://theintercept.com/2017/03/08/wikileaks-files-show-the...
Back to pen and paper we go, until that can be compromised too.
It's probably just a coincidence.
Some possible reasons: * They comparmentalise information better? * They don't use private contractors ? * It's more dangerous to leak material in those countries ? * ... * ... * ...
We all know there's no chance this is smearing US intel agencies during an investigation.
That said, given how often "trustworthiness" is used as a mental shortcut for "believing anything they publish", it's still a knee-jerk worth fighting against. None of Wikileaks' released documents in their history have proven to be false, and so they are still reliable as a source.
I find it troubling that people conclude they're "beyond reproach" just because the facts are true.
That doesn't make them non-biased, mean they're not intending to distract or mislead, say anything about their framing, analysis, or editorial content, etc.
Like here: a suspiciously timed leak of sensitive US documents which largely seem to be intended to scare and distract, not show legitimate wrong-doing.
Negligence counts as wrong-doing to me. The leaks prove that the CIA has lost control of their malware cache. And on the positive side, it gives the affected parties the means to patch their code.
I say this because it would make sense to vote a comment like this down if it was just a random opinion. I agree: "don't trust Assange" is kind of a banal sentiment (I share it, but I wouldn't claim it was interesting enough to showcase). But that's not all Dan is saying.
(I haven't heard anything either but, I mean, I've only known about this for about 3 minutes now).
"WikiLeaks was originally established with a "wiki" communal publication method..."
https://en.wikipedia.org/wiki/WikiLeaks#Staff.2C_name_and_fo...