Grasshopper
wikileaks.org
wikileaks.org
---
Der Starke is a diskless, EFI-persistent version of Triton. Once active on a target system, the implant executed within diskarbitrationd and typically performs network ommunications through a browser process so that PSPs like Little Snitch cannot easily detect it's presence. This Companion User Guide is meant to supplement the Triton User Guide.
---
This is obvious to most people here but it might not be to others, if the attacker got physical access to the machine it's game over.
https://wikileaks.org/vault7/document/Grasshopper-v2_0_2-Use...
---
Grasshopper has the following system dependencies:
Python 3.4: The Grasshopper build system was developed and tested for Python 3.4
---
Nice! A lot of government projects are stuck on older versions of Python tied to ancient OS versions.
I gotta say, the rule matcher syntax and the overall design is done very well. Hat tip to the authors if they are reading this.
This misunderstanding has come up on a bunch of other threads too; it seems to be pretty widespread. You can't really "burn" most persistence techniques, publishing them in a way that makes them easy to defend against. If you could, a whole lot of platform security engineering would be much easier.
Could give an example of a persistence techniques that is using a intended feature of a computer system in order to hide the malware in unintended places in such a way that the system can't remove it (which itself is a unintended functionality).
However you want to litigate this on a message board, nobody working in platform security or even malware defense thinks that way.
The difference between a persistence vector and a vulnerability is that you can patch a vulnerability, but you can't patch "programmable page table".
At least we have this timely information again from wikileaks that provides a narrative that the US is framing Russia for hacking.
It's almost the only thing they are releasing nowadays.
Is a little like saying "the FBI is the firearms division" because FBI agents are armed.
I have to say comments like this sound like you also worry that teaching CIA agents to pick locks might result in an increase in property crime, a position that's hard to take seriously.
(I'll leave this comment here, but it responded to the original editorialized title of the story, which pointed out that this trojan had "its own language".)
This leak and the previous one are examples. The CIA is a spy organization. Their job is to spy on foreign influencers. As such, they have spy tools... Just like Russia, China, the UK, etc. etc. If the headline here mattered, it would be, "Spy Agency has Spy Tool". There is no evidence at all that this stuff has been used domestically. But wikileaks buries that headline.
Wikileaks continues to push the agenda that these leaks correlate with the legitimate PRISM leaks that we saw earlier. They push the narrative that these tools are being used on americans, should be ashamed, don't trust your intelligence agencies etc. Fueling the populist anti-intellectual bs we have going on in the world right now.
Don't get me wrong. The US government should be ashamed of PRISM and the actions of the NSA, but Wikileaks should be ashamed of these leaks and the way they're representing this information..
These current leaks are just attempts at undermining.
I read the article and they do not imply any connection to PRISM.
Anyway, why would you be fine with such tools being used on non-US targets? Would you not be outraged if an equivalent tool was used on US targets by a non-US government?
These leaks attempt to piggy back off of the snowden media frenzy
> Anyway, why would you be fine with such tools being used on non-US targets? Would you not be outraged if an equivalent tool was used on US targets by a non-US government?
It is the duty of each government to look after the well being of its people with the resources it has, up to and including spying. Spying has gone on since the dawn of civilization. My opinion extends to foreign governments attempting to spy on the US.
Does it help the human race as a whole? No, but that's a much bigger philosophical debate.
The function of the Central Intelligence Agency is to assist the Director of the Central Intelligence Agency in carrying out the responsibilities outlined above.
To accomplish its mission, the CIA engages in research, development, and deployment of high-leverage technology for intelligence purposes. As a separate agency, CIA serves as an independent source of analysis on topics of concern and also works closely with the other organizations in the Intelligence Community to ensure that the intelligence consumer—whether Washington policymaker or battlefield commander—receives the best intelligence possible.
Though I will agree with you that this is just a statement on their website, not law.
>That seems too glaring an oversight to be unintentional, so your appeal to such standards seems unfounded. I suggest that by any reasonable standard, CIA should have been shuttered decades ago. Even the tools seen here are indicted elsewhere in this thread by a knowledgeable person as "clownshoes".
Speculation and opinions are just that, speculations and opinions.
Hilarious! We're discussing CIA. The whole point is that they don't submit to the scrutiny of their employers. "You don't know what we're doing, so we could be doing the right thing!"
Also, 'the hammer' was purchased by blixtech, who's owner (Edra Blixseth) used it to hack her husband's lawyer during divorce proceedings, upon finding out, he confronted the engineer behind it, who had previously filed 18 formal whistleblower reports with the White House and was denied all 18 times. He has recorded full video testimony and a dozen affidavit's, and received full immunity, finally, two weeks ago. When the story first broke, no judge would pursue it. Eventually Joe arpaio tried to, and Fox recorded extensive reports, which have not yet aired. The engineer provided 800 million recorded phone calls, as many bank records, and emails. The system was just some sort of brute force which broke ssl. This has been mentioned in vault 7, briefly, but will be expanded on in a release very soon. Fox was provided with 10 million sample users, so they could take local callers who were willing to hear their conversations on air to prove this. There is an hour of recordings with Tim Blixseth, Joe Arpaio, and a few others, going over many more details. Definitely worth looking into, however it shouldn't be much longer until it is revealed in full. Pretty insane. Look into it, will blow your mind.
Cite your sources. If you think the sources will be discounted by the people you are presenting to, make a case why they should not be, reexamine why you think they are trustworthy, or both.
http://thehill.com/blogs/blog-briefing-room/news/324411-obam...
I won't even attempt the other stuff.
https://m.soundcloud.com/stephenlemons/fruit-of-the-poisonou... (part two from same user 20min section is part 1 url misleading) more information can be found out about this recording, but it's going to take some searching. I suggest duckduckgo or similar, nothing is great really, but since the election time, Google removes massive amounts of useful indexing based on who knows what, and ends up being useless half the time when politics and sourcing information is concerned. I don't blame them though, because noone wants anyone to know which people have been caught and which haven't, as obscurity and surprise prove to be huge assets when trying to get people to come forward to testify against superiors. There is a ton of fuckery on both sides here, but it is all unraveling and record pace. Dennis Montgomery is name of whistleblower. Got immunity two weeks ago facilitated by freedom something. Press release by some popular free speech group has more information. Freedom something. Julian Assange provides ton of insight in last couple live interviews as to source of vault 7. And there are about 50 different ex Intel guys who have offered insight into it's source, they are all over the place. Doesn't matter if you are in such heavy denial you refuse to look, but spend enough time and it really is all there, no question or speculation. Sorry, driving, terrible fragmented reply. I'll hook it up fat when I get home. Although all the queries are here to find everything. Avoid Google, use quotes, confirmation bias is fine to locate the information, but seek further context upon locating it.
If you can't find the information I'm talking about, its because big business and Obama removed it from the internet. This is a huge story and it would be all over the news if it weren't for leftists trying to hide the truth.
As a targeted investigation of an individual (which is what this would be used for)? No.
> Anyway, why would you be fine with such tools being used on non-US targets?
Because I literally cannot envision a world where the incentives mean state actors are not going to be doing this. You can legislate it away, or make moralistic announcements, but unless you actually remove the incentive, it will happen. If it's happening, I want my government to have at least the average level of proficiency.
The difference with domestic spying is that based on our laws, ethos, type of government and the fact that the people doing the spying are also citizens means that there are some powerful counter-incentives along with the incentives to spy domestically. That at least gives it a chance to be curtailed in some ways. Foreign spying really doesn't have the same counter-incentives.
This logic does not work.
Would you be okay getting shot if you broke into someone else's house? No. But other folks have a right to protect their houses.
The US has a right and constitutional duty to protect itself and it's citizens. You can argue about the best way to do that but it's a non-starter to say that we can only do the things that we would want other countries to do us.
Using that logic, we would get rid of all of our weapons.
> An internal investigation by the C.I.A. has found that its officers penetrated a computer network used by the Senate Intelligence Committee in preparing its damning report on the C.I.A.’s detention and interrogation program.
You have an issue with their actions in that particular case, which is outside the scope of this article, or the argument that I was making.
I then show public examples of the CIA not only using hacking tools against Americans, but against the very oversight framework that's supposed to keep them in check.
> outside the scope of this article
wat?
There you go. The tanks weren't removed, the organization was disbanded. Having tanks is not an indicator that an organization will attempt a coup, if having tanks is useful to the normal function of that organization.
At this point, you're making my points for me, so either it's evident to you at this point, or you aren't going to get it (as you're consistently misinterpreting the point), or you're trolling. In any case, I don't see this continuing productively past this point, since I'm just repeating myself.
But going back to the temporary disbanding, how in practice do you think that would work? You can't just jail or execute all of the military. Wouldn't it stand to reason that the very weapons used against the government would be locked up until you could figure out who those 'domestic enemies' are that the Oath to the Constitution talks about? Yes the very existence of these tools isn't a problem, these tools being in the hands of those who have proved that they are systemically incapable of legally using these tools is a problem. You therefore remove those tools from their arsenal, going so far as to disband them entirely if necessary (ie. if their use of these tools threatens the country on a whole and you can't trust them to truly give the tools up completely).
I don't have a problem with the use of these tools in general by intelligence agencies, I have a problem with the CIA's access to these tools.
Again, you're not arguing that the possession of the tools, which this article presents, is the bad thing. Your issue seems to be with the hacking of congressional computers, which I agree, is a bad thing.
The scope of this article (and the previous leak) is showcasing the tools and abilities of the CIA. I argue that we want the CIA, the espionage arm of the US government, to have the ability/tools to conduct espionage. Now how they apply those abilities/tools is up for debate and scrutany.
Good god people, this is literally the anti-encryption argument, with the tables flipped.
You are getting into hypotheticals and speculation at this point.
Why do so many people on HN reason like this? If you find a bug or design error in your code, do you fix it or delete the entire codebase and renounce such projects forever?
Would you like them more if they would publish what they get, unless it somehow hurts American institutions?
Why should WikiLeaks protect only US? They arent US organization, Assange is Australian, most staffers are European based.
Your arguments sounds like it came from somebody who would say, that leaked DNC and Podesta emails should not be read, because they can hurt DNC campaign. I advise you to start advocating for big American firewall, something like China has, so you can protect US citizens from all information that might open their eyes but hurt some officials.
It very important that these tools are published, so software companies can patch their software and people are able to protect themselves. Not everyone is US citizen. Rest of the world greets any leaks from intelligence agencies from any country. If you dont want, dont update your OS and security software, the rest of the world will.
Maybe they do, but it's also within their power to withhold information or publish selectively. It seems a little odd that they only seem to get information that hurts the US and its allies, but never information that would create problems for other superpowers.
Perhaps that's entirely coincidental but then again perhaps it's not. I support Wikileaks' existence but don't take their claims at face value and question whether they are really the disinterested actors they claim to be.