Hacker News Reader

I think you're too focused on the technical side of things. If your target can be breached with an intern's hobby projects, why not breach your target with an interns hobby project?

That means you have more money to spend on analyst, translators, future operations, etc. You only start developing more capabilities if your targets need more capabilities.

Many important targets today are still being breached by a bunch of office macro's that have been around for ages. Still works, still yields desired results, no need for a passive global adversary or a l33t 0day.

You're getting concepts mixed up. These aren't exploits. You can't breach a target with them. They're post-exploit persistence tools. A persistence tool has just three jobs:

1. Enable the mission.

2. Avoid discovery.

3. Frustrate attribution.

These tools are amateurish. By modern standards, all they accomplish is (1). But rootkit.tar.Z for SunOS 4.1.3 did that too.

Presumably, if the CIA is implanting backdoors, they're doing it in high-stakes situations: the kind where it's important they not be identified, and the kind where it's important that identification of a single compromised machine not instantaneously provide a signature that can be used to identify every other compromised host in their inventory. But, nope.

One obvious possible subtextual revelation from the CIA tool kit that we've seen is that they're not doing high-stakes implantation work at all, and this stuff is all aspirational.

What is the possibility that this was a deliberate leak meant to obfuscate the true state of the art of what the CIA uses? Would that be too much of the trap of "hyper-competence" or the kind of thing you'd hope-for/expect-from an intelligence service?

very small chance. They won't go and put a bucket load of these type of tools on a server to leak. Makes no sense at all.

I take it you don't work in high assurance security. You should be more paranoid!

True, keeping your enemies in the dark about your true capabilities is a useful strategy (unless it is a doomsday device, then you should tell the world). Strategic leaks of misinformation is one way to go about it.

Also low-quality exploits could be made on purpose to be intentionally found. The victim finds it and then thinks they are in the clear, while the a more sophisticated real exploit is lurking undetected.

The only kind of people the government can attract are buffoons that can't be successful elsewhere.

If you're the CIA/NSA don't you want to use this kind of low level stuff most of the time because it blends in with the background malware? If it's discovered which it may almost certainly be at some point there's little to point at and say "this is malware created by a nation state" vs "this is malware made by a bored teenager".

Seems like a positive advantage?

Seems like the difference of assassination by hit-and-run/"robbery gone wrong" vs polonium. One screams "state actor", the other is almost entirely deniable..

FWIW its worth, a lot governments occasionally use off the shelf commerical spytech like cheap hidden camera from Ebay exactly fkr deniability purposes.

> Wikileaks is still milking a drip-drip from the original cache they obtained of CIA warez. It's cynical, and speaks to a general contempt they have of their audience.

Snowden did the same and it pisses me off. But then again, wikileaks learned from the cablegate: releasing tons of information will lead to people disregarding most of it.

What's happening with the Snowden leaks? Havent heard anything in a long time.

Did Snowden do that, or did the press do that to string it along. My recollection (could be flawed) said that he turned over all of the data he had, and then the newsies teased it out to keep it around as long as possible. Whether that was to help sales or from preventing an overload, doesn't matter. To me it wasn't Snowden that did it that way.

It was up to the journalists. According to the interview Glenn Greenwald did on "Pod Save the World", Snowden gave the journalists a giant dump of documents and they had to go through them to determine what was newsworthy. Snowden also insisted that the journalists give the NSA a chance to ask for documents to be redacted/kept secret and explain why. Again, according to the interview, Snowden explicitly did not want a wikileaks-style dump of everything, all at one or drip-drip-drip.

Calling it "contempt" is unsupported. Patronizing, condescending, sermonizing - sure.

If we weren't told by first principles in 2000 that all Internet traffic was being surveilled, then Mark Klein certainly did in 2006. And yet the masses continued blissfully adopting webcrapps and other negligently-designed communications systems... until 2013 when Snowden came along with banal "revelations", that were doled out slowly enough to survive the media's short attention span.

I'd love it if there were enough whistleblowers that we did get a new leak from the surveillance-industrial complex every week. And this news item, in the technical context, is utterly boring. But it's a bit disingenuous to condemn a news organization for behavior that every other news org does, likely because you disagree with their politics.

We've shared enough threads that I think you can predict my response to this. I find it aggravating when people suggest that our understanding of dragnet Internet surveillance is new, and that it came from leaks. The NSA's access to online communication was understood as a ground truth in the 1990s. You can read the first edition of Applied Cryptography to see it.

If anything, the last 10 years have diminished my respect for SIGINT capabilities.

A thing I think people lose sight of when trying to put this stuff in historical perspective is that in the 1990s it was not only possible but actually sort of routine for entire ISPs to be owned up. There were instances of solsniff.c getting access to backbone traffic. None of it was encrypted. Internet surveillance in the 1990s wasn't hypothetical. Clueful people's homedirs would get traded in the "underground" and they'd be tarballs full of .pgp files, because everyone knew they were going to get owned up somehow.

It depends what you mean by "our" understanding. If the "our" refers to us paranoid computer professionals, then I completely agree with your characterization. If the "our" refers to society at large, then I do think there was a sea change with Snowden.

Furthermore, there is a distinction between understanding how vulnerable everything is, and believing that the modus operandi of government institutions is actually that of an attacker (and furthermore, the societal effects when that belief becomes widespread. But I digress).

The only point I was picking on is your characterization of Wikileaks's approach to audience-impedance-mismatch as "contempt". Contempt of the lagging-understanders isn't outright wrong - I can try it on myself, but dwelling on having contempt for say everyone using gmail wouldn't be healthy or productive. But it's certainly not charitable to ascribe to others, which is why I said it comes down to pure political disagreement.

I think you're trying to sell a fish when really all you have is a horse.

Wikileaks isn't contemptuous of its audience; its contemptuous of an ignorant public who have allowed their state to be infiltrated and usurped for the purposes of allowing special interests control over the technological prowess of 5 nation states. And in my opinion, that contempt is quite well targeted - because, just as you have demonstrated, its all very easy to dismiss these incursions into our basic human rights as being 'necessary' or 'so easy even kids can do it, therefore its acceptable', or so on.

The fish is dead. The horse, not so.

I doubt that teenagers exhibit this level of operational capability. I wouldn't even call commercial red teaming software (cobalt strike) up to par.

Can you give us an example of tech at the very high end level?

>And yet, despite the extraordinarily low stakes of publishing, Wikileaks is still milking a drip-drip from the original cache they obtained of CIA warez. It's cynical, and speaks to a general contempt they have of their audience.

They're trying to do their due diligence and make sure evety thing they release is fixed already. Given the likely size of things to go through and many companies refusing to interact with Wikileaks, preparation for a release is likely a long process.

interestingly, the NSA ANT catalog from a few years ago[1] had a few things that actually were explicitly intern projects: the one i specifically recall was backdoored hard disk firmware

[1] https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_...

Comes with the territory I think. Working in an environment of complete secrecy does not help you create new or unique things. I can only imagine how unpleasant it would be to work in such an environment. You probably wouldn't be allowed to talk to your coworkers about what you are doing, much less someone outside the organization.

No, not really: NSA has the same constraints, and does much more interesting work.

I think NSA's quality problem comes from the fact that a lot of its raw technical output comes from people that are effectively working in their first real programming jobs.

Cynicism is the norm in international relations. I am certain that some of the major leaks such as cablegate were allowed to happen in order to define the foreign policy posture and reach of the US government while maintaining diplomatic niceties.

WL has been known to leave things out of leaks. It wouldn't surprise me if they only dumped the more embarrassing tools.