Hacker News Reader

Comment by sand500 | Hacker News Reader

Pretty standard practice when a exploit is found right? Alert companies and publicize after they patch it.

In general but I believe this is the first time wikileaks has had specific exploit information so it's the first time they are doing it.

The article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR move without much substance.

Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking... http://bgr.com/2017/03/09/google-says-many-android-exploits-...

https://wikileaks.org/ciav7p1/

Of course the NSA looks for software vulnerabilities, and it's a vital part of both their core missions. And of course they don't neutralize their offensive capabilities by immediately revealing all of them to software makers. There's a balance that is struck between offensive and defensive missions with respect to each vulnerability.

https://www.wired.com/2014/04/obama-zero-day/

Two things:

1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.

1. It's the CIA and the NSA, as well as a host of friendly non-US intelligence agencies. They develop vulnerabilities, share them, and release them when the improvement to the defensive advantage the release provides outweighs the hindrance to the offensive advantage they provide over adversarial intelligence agencies.

2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS

1. The recent leaks were concerning CIA and not NSA.

2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.

1. Makes no difference.

2. Makes no difference.

How do you know the CIA found these vulns, and that they weren't shared from IC partners?

You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.

They do have exploits - they had lists of vulnerabilities in iOS and Android they were planning to report and release after patching has occurred.

There is zero evidence of this.

iOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html

Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html

Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.

I definitely do not dispute the lists. One of them (Corona) is from the jailbreak group I started. They are certainly legit.

My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.

Yeah, it'll be interesting here though - they potentially have some pretty major remote exploits and tech firms might be resistant to even patch as those who are unpatched will be left vulnerable to attack. The standard route then is to threaten to publish anyways... This will involve very careful treading on the parts of both wikileaks and the firms involved.

The standard practice for Wikileaks was once to publish everything no matter what. I'm happy they have changed.

Not really... the biggest example of this was probably the leak that happened from Manning - but it in large part wasn't really WikiLeaks fault, they gave an AES 'insurance' key to a journalist who released it without really understanding the consequences. WikiLeaks generally tries their best to release responsibly, but it's a challenge when you get governments unwilling to accept leakers and journalists who don't know how to handle leaks.

Wikileaks has a terrible record on vetting releases and be "truly transparent". See the timing of the dnc and podesta emails...

There were social security #'s in those releases.

They try and play both sides of the fence: -we dont "editorialize", redact or make decisions on what is and isn't released -release specific info with sensational headlines timed for optimal impact

What's wrong with that? They simply optimized for impact.

If they were to dump all the releases months before the election no one would have remembered them, no matter how significant.

They've done partial releases and released over time with many other leaks too. I don't see how that conflicts with transparency or impartiality.

Put yourself in their shoes - how would you have solved it differently?

> There were social security #'s in those releases.

When you're working with data in the volumes that they are and you have limited review staff, sometimes mistakes happen. If you'd like to help prevent it, I believe they do accept reviewers if you've got appropriate credentials.

Software already exists to indentify common PII like credit card numbers and social security numbers (need it for HIPAA requirements) and besides probably any freshman programmer could build a simple regex to find simple PII. So the most likely excuses are either complete incompetence or utter apathy to protect that info, not lack of manpower.

We're not talking credit card numbers, SIN numbers are just a series of a few numbers which may match many, many unrelated things. I'd have to see the specific case to really say yes or no to that one. Many of the leaks they get are not in text format at all, they're in PDF images, OCR can sometimes do the job, but not always with high accuracy.

If you'd like to volunteer that skill, they may be open to accepting it. It's entirely possible they just don't have developers with such abilities in their arsenal. You might try their IRC channels and such if you'd consider it.

I have no problem with them optimizing for impact. But they refuse to admit that is what they are doing. It disingenuous at the very least.

It's not "mistake" if PII is revealed in every single release. It is incompetence or they are acting in bad faith. There are dozens of other organizations that have strong records on this. wikileaks is not one of them.

> I have no problem with them optimizing for impact. But they refuse to admit that is what they are doing. It disingenuous at the very least.

They've stated that's exactly what they're doing in several pieces.

> It's not "mistake" if PII is revealed in every single release. There are dozens of other organizations that have strong records on this. wikileaks is not one of them.

Likely because those "dozens of other organizations" don't publish many leaks and especially not in anything approaching raw form - every single leak I've seen in a major paper has been heavily filtered down and distilled into a specific narrative. WikiLeaks just publishes with minimal editing - any narrative from them is completely separated from the leaks. That rawness is what makes them better than other approaches for getting real information out, but it's also what makes them worse at censoring that information.

I'm not sure how we can square, "we are neutral", "we are optimizing for impact", "our goal is to create conflict within the government".

>WikiLeaks just publishes with minimal editing - any narrative from them is completely separated from the leaks

Wikileaks in king of clickbait and creating false impressions of what data they are and aren't releasing. Just look at their twitter account. There are even reports of withholding entire data sets when it doesn't fit their narrative.

I am on board for the premise of WikiLeaks is trying to do, but they have flatly failed in the execution.

I see many people here who accept this as generic wisdom but I don't remember them releasing non-redacted documents (outside the cablegate shitstorm). Are there precedents? Are there sources where they say this is their philosophy?

Reply on news.ycombinator.com