Vault 8 – Source code and analysis for CIA software projects | Hacker News Reader

Vault 8 – Source code and analysis for CIA software projects

wikileaks.org

118 pointsdegenerate72 comments

If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considered evidence?

Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, together.

If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/dia...

Isn't the CIA here specifically attacking this model of attribution?

Kaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here:

https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu...

It was on HN before, but it vanished quickly -

https://news.ycombinator.com/item?id=15483529

Looks like we invited nkurz to repost that one but it didn't happen to get traction either time. Hard to say why, but it wasn't flags.

Sorry, didn't mean to imply otherwise. It's pretty interesting, IMHO, but just didn't get upvotes/visibility.

Not at all.

A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as it allows your implant to blend into traffic more easily.

However, attributing an attack based on the CN of an invalid TLS certificate would be very silly, as literally anyone can generate one (Instructions for generating the self-signed certs are actually right there in the source bundle).

The FBI never even examined the server themselves, just took the word of a campaign affiliated and funded company. Not credible.

> The FBI never even examined the server themselves

You don't need to look at a physical server to make these conclusions.

> just took the word of a campaign affiliated and funded company

Literally a company PAID to provide security.

> Literally a company PAID to provide security.

The Company was PAID for remediation, to write an execute report, and to testify.

Why would you pay a private company versus the United States Government that would have much more man power and most likely free services?

You generally pay someone when you want a favorable outcome, isn't that Politics 101?

There are 2 types of people who read summaries of the crowdstrike report, those who have retained a security company to produce some type of report and those who haven't.

It definitely should not be considered evidence by anyone credible. Attribution requires more than just some snippets of traffic and metadata.

Here is a pretty interesting presentation from the Snowden leaks regarding attribution of Chinese CNE (Warning: TS/SI content): https://www.eff.org/files/2015/02/03/20150117-spiegel-byzant...

What is TS/SI content?

Top Secret/Sensitive Information

That’s not what SI means.

That's twice in the same minute that you've replied "That's not what SI means" (to two different definitions, so you have to be right at least once). But it would be more useful if you would supply what you think the correct definition is, rather than making us guess (or making us grovel before your superior knowledge, which is not really the point of HN).

Poster probably meant to say TS/SCI: Top Secret/Security Compartmentalized Information. Part of the contract involved in getting a U.S. government security clearance assigns you liability for exposure to any TS/SCI, even if you were not the publisher. Therefore if you're subject to one of those contracts, you generally (almost always?) want to avoid reading these leaks like the plague.

Thanks. Is it safe to assume the original link (to the hive8 page on wikileaks) is under a similar clearance?

Hive is SECRET//NOFORN when attributable to CIA, if I understand correctly.

Assuming it's TS/SCI: it's a highly classified and compartmentalized type of US classified material. Generally if you hold a clearance you don't want to access those links on a work computer, because DOD/DOI still consider it "contaminating" and unclassified system with classified material even if the material has been leaked to the public.

Information classified at the “Top Secret” level and in the “Special Intelligence” SCI compartment.

I was trying to be courteous to any readers with an active security clearance, as viewing such material may require them to report the incident.

That’s not what SI means.

It is, though.

> (U) Definition: Special Intelligence, or SI, Is a sensitive compartmented information (SCI) control system designed to protect technical and Intelligence Information derived from the monitoring of foreign communications signals by other than the intended recipients. The SI control system protects SI-derived Information and information relating to SI activities, capabilities, techniques, process and procedures.

Page 80 here: https://fas.org/sgp/othergov/intel/capco_reg_v6-0.pdf

If people can lie, then why are humans used as witnesses to crimes?

"Evidence" doesn't have to be irrefutable to make it into a court of law (and the standards are far lower for the court of public opinion).

Interesting that WL goes after the one nation state that is not going to completely fubar them, and has much better human rights than the other big nation states it could go after. I say that if WL's real goal is to promote human rights, the US is not the highest target on the list. On the other hand, if they want easy publicity with minimal risk to self, the US is probably their best target.

> I say that if WL's real goal is to promote human rights, the US is not the highest target on the list.

well, I say that constant hopes for transparency and the strides we take towards those goals will keep the United States high on the list of nations with decents human rights.

WL is one of those strides, and I think it's invaluable.

It's 'interesting' that given the muck that WL has raked up about the U.S. that anyone could be upset about their ( the US ) having been a target..

The question is not whether the US should be subject to oversight, the question is "does WikiLeaks intend to push a deliberate agenda with their disproportionate targeting of the US?"

You would be naive to take for granted that WikiLeaks is acting exclusively out of principle.

You are reframing the discussion.

I would disagree. This particular discussion was started by yters' post; aalleavich's point seems to me to be extremely in sync with yters'.

You can only publish what you are given.

But you also do not have to publish everything you are given.

You would rather they not publish what they are given if it's about the US.

>I say that if WL's real goal is to promote human rights,

That's where you're wrong. Wikileaks' mission is "transparency for governments and privacy for people". Perhaps they seem to have affinity for publishing things contrary to the US' interests and you're right that the US isn't uniquely bad at protecting human rights, but the US (and Western European sigint community) violates privacy on a scale that's simply unmatched, it's reasonable for them to treat the Anglosphere's sigint as their primary adversary.

You think that the US violates privacy more than, say, Russia? Or, going back to WL's stated goal, you think that the US government is less transparent than Russia's?

I think the US is much more likely to violate the privacy of a random 3rd party than Russia, absolutely. How many Kenyans have their data sitting in NSA servers? I bet it's more than Kenyans on the FSB's servers.

I don't know, but I would be surprised of Russia even captured 1% of the data that the NSA captures routinely (or was capturing at the height of its excess).

Additionally, Russia seems to keep quiet about what they do which is lying by omission at worse. A lot of US security officials have lied under oath about what the US is doing - I think it's more important to expose active and direct and popular lies than incidental lies.

Fair point. I wasn't looking at it that way, though. I was trying to say that Russia is more likely to violate a Russian's privacy than the US is to violate an American's privacy. Yes, the NSA may well have the American's communications on their servers (though they are not supposed to unless it left the country), but the FSB probably has the Russian's communications, and seems to me considerably more likely to examine them - or to more actively spy on the Russian citizen.

This is the source code (and several binary compiles) of the CIA C2 infrastructure + client implants for Solaris, Linux and various routers. I suspect that now this is in the open, past and current CIA malware will now be detectable by commercial Anti Virus.

I'm not so sure about that. WL released the documentation back in April, which contained more than enough information to create a few behavioral detection signatures for the implants. I would assume that any AV company who cared has already created and deployed signatures.

Hi chronic,

We now know that all comms implant to C2 are TLS with a unique (fake) certificate tree. They use unique, single use domains for operations. I don't believe there was enough information in vault 7 to identify IOC's that could be used for behavioural analysis. We also now know that the C2 fronting servers negotiate 'Client Cert optional', which is a fairly unique configuration item.

The git repo contains 3 binary builds of the client/server malware. I think this is more important for detection than their docs.

Regardless, its all public domain now.

AV is now far beyond just using hash-based detection, but you are correct that having the three binary builds will allow that to also be added to their (hopefully existing) detections. No argument there.

What you're saying comes from the documentation included in the source, yes. But if you dig into the Confluence dump from back in March, you'll see that the User's Guide and Developer's Guide PDFs for Hive were attached to one of the wiki pages already, explaining how this all worked. It did not get any press attention as it was quite mundane compared to the more interesting leaked wiki pages, but I would really hope AV companies and others in infosec noticed this already.

The following line from /honeycomb/crypto.c look very interesting...

   /*
    * Computing a "safe" DH-1024 prime can take a very
    * long time, so a precomputed value is provided below.
    * You may run dh_genprime to generate a new value.
    */
   char *my_dhm_P = 
       "E4004C1F94182000103D883A448B3F80" \
       "2CE4B44A83301270002C20D0321CFD00" \
       "11CCEF784C26A400F43DFB901BCA7538" \
       "F2C6B176001CF5A0FD16D2C48B1D0C1C" \
       "F6AC8E1DA6BCC3B4E1F96B0564965300" \
       "FFA1D0B601EB2800F489AA512C4B248C" \
       "01F76949A60BB7F00A40B1EAB64BDD48" \
       "E8A700D60B7F1200FA8E77B0A979DABF";

Those lines aren't very interesting. The comment explains exactly what and why they are.

You'll be able to find this same C̶I̶A̶ ̶b̶a̶c̶k̶d̶o̶o̶r̶ DH-1024 prime in tons of other projects:

https://github.com/mstorsjo/rtmpdump/blob/master/librtmp/rtm...

https://github.com/travelping/nattcp/blob/master/polarssl.c#...

You're right, I got over-enthusiastic. And it looks like the C code has been migrated to Python anyway. Also, owners of MikroTik hardware look to be thoroughly owned:

        elif str(beacon_hdr.os) == '40':
	    beacon_data['os'] = "MikroTik-MIPSBE"
	elif str(beacon_hdr.os) == '41':
	    beacon_data['os'] = "MikroTik-MIPSLE"
	elif str(beacon_hdr.os) == '42':
	    beacon_data['os'] = "MikroTik-x86"
	elif str(beacon_hdr.os) == '43':
	    beacon_data['os'] = "MikroTik-PPC"

The bad news is that soon CIA will not have to build their own infrastructure due to the rise of all kinds of public P2P technologies. The best type of covert operation is the one that is hidden in plain sight.

I see Wikileaks is still publishing "leaks" about US agencies in the week following major news on the Russian investigation, as they have more-or-less consistently since February.

I'm sure this time is just coincidence, too.

Again?

Can someone tell me if there's actual malfeasance this time or just more edgy moaning about the spy agency doing its job?

I'm happy to call out the security apparatus when it actually oversteps its bounds (Eg the Snowden leaks). But so far as I can tell wikileaks vault 7/8 isn't a leak in the public interest. Its just anti-American wankery.

Well you can't protect yourself against an hostile gov if you don't know their weapons.

These are up to 10 year old tools, they are not going to still be in use.

In the commercial sector I seem to find myself spending a significant amount of my time working on projects that were started many decades ago that have just been improved over time.

I honestly wouldn't be too surprised if a lot of these applications were used today with relatively little change.

This isn't the commercial sector, these kinds of things are incredibly sensitive to time.

Huh, why? We aren't really discussing exploits here.

Repo is from 2015. Its not that old.

Read the page, they moved to a new repos a few years ago. If you go to the actual source files some of them are dated as early as October 1st 2007.

They moved from a CVS/SVN repo to git. The history from this old repo is missing, but the (leaked) git repo is recent.

Author:User#142 Date: Fri Oct 30 09:58:22 2015 EDT User's Guide date corrections.

Given that some big exploits can fly under the radar for decades (e.g: https://www.theregister.co.uk/2017/02/23/linux_kernel_gets_p...), I think it's always interesting.

But the point is moot anyway: either their tools are still relevant today, in that case it's good to see what they can use against the people, or they are not, in which case it won't hurt them if we see them and it's not "anti american".

> Can someone tell me if there's actual malfeasance this time or just more edgy moaning about the spy agency doing its job?

Why don't you read it and decide for yourself?

>Its just anti-American wankery.

So what, that’s been wikileaks MO since day one. Assange has been very transparent about his intentions.

Read his essay from 2006 https://web.archive.org/web/20070129125831/http://iq.org/con...

Don't you realize that the institution that's being examined isn't necessarily on your side? Without oversight, how could they possibly be kept on the good side? Having gone so long without oversight, how far have they strayed?

Assuming you weren't involved in any of this, ask yourself: did I authorize it? Did the legitimate authority of my civil peers (to which I am willing to cede) authorize it? Did my representatives authorize it? (Not everyone in congress is on these top-secret commitiees, it's entirely possible that some action could be taken that the voters of an entire state had essentially zero say in.)

Finally,

What would happen if a cleared individual decided to take an action without asking anybody or telling anybody? You know, like Snowden, except not conscience-driven to make sure we all heard about it. It's not like established systems have ever suppressed secrets that would make them look bad if widely known, right? Right?

>Don't you realize that the institution that's being examined isn't necessarily on your side?

CIA or Wikileaks? CIA absolutely not, Wikileaks probably yes.

>Without oversight, how could they possibly be kept on the good side?

CIA is the foreign intelligence agency of a particularly murderous country, they can’t possibly be kept on the good side.

Wikileaks seems to have oversight built in that they need to be trustworthy enough for people to leak to them.

>Having gone so long without oversight, how far have they strayed?

CIA has a long history of doing terrible things, I doubt they’ve strayed too far from that.

>What would happen if a cleared individual decided to take an action without asking anybody or telling anybody?

What would happen if the sun came up in the morning? Things would probably be the same they were yesterday.

I'd be careful with that kind of nihilistic attitude; note that it has the same effect as wholehearted support! (Which is, advocating that nothing different be done.)

Oh, but I advocate precisely what Wikileaks is doing. In the essay I linked Assange describes a rather effective approach to disrupting these organizations. Leaks such as this one will eventually lead to these organizations having to be so careful that they'll simply be unable to act.

I certainly understand how you could come to see this kind of stuff as anti-American, but that's really a misjudgment.

I (or we?) stand in one of the many countries where this threat is developing, but one of the few countries where our predecessors have secured the liberties for us to do something about it. So in this sense, we are the custodians of ourselves: and any true American would tend to their government while discussing with their countrymen how they can do the same.

(Hopefully that addresses your point, now that I see what you're really saying.)

Don't assume everyone on HN is American. Some are actually from openly hostile countries, so what? Can't we discuss these things freely on the internet as long as we don't hurt anyone?

> Can't we discuss these things freely on the internet as long as we don't hurt anyone?

In most countries, sadly the answer is still no.

I put (we) in parenthasis - certainly, I'm aware that fact that not everyone on HN is from the US!

And no, if you're from a country that's openly hostile to free speech, you really can't speak freely online without fear of reprisal. In an abstract sense I can't speak with a complete lack of fear of reprisal either - but essentially what I'm trying to exhort people to realize is that taking on the personal risk of saying the "wrong thing" in public is a civil duty: the civil duty of maintaining our government.

I'm having a hard time telling if you're talking about the various spy agencies, Wikileaks, or both.

The amount of work that they put into throwing off attribution, while expected, is important to make it's way into public knowledge rather than just the realm of conspiracy, IMO.

See the Sony break in where the dubious attribution was used by Obama as a reason for more DPRK sanctions

It is vital to the intel community that their methods of attribution can't be publicly audited and that their authority is trusted on word alone.

Interesting drop.

I have many questions but two are very high on my list:

1. one of the commit messages mentions merge from a git remote hosted at devlan.net. Who owns that host and is it a hidden CIA server or repurposed captured host?

https://wikileaks.org/vault8/document/hive-log/page-41/#pagi... Merge branch 'master' of ssh://stash.devlan.net:7999/hive/hive

https://www.whois.com/whois/devlan.net

It kinda looks like a captured host registered originally by a French admin.

2. Why Solaris? Microtik and the other router targets make sense in combination with generic Linux machines, but Solaris sticks out and there must be an interesting explanation for targeting that. What kind of internet facing Solaris hosts are out there or which orgs use it in such a capacity to become a target for the CIA?

1. Stash seems to be an atlassian instance hosted on their intranet.

2. <conjecture> Kaspersky ? </conjecture> + ISPs, universities, etc.

1. it's very bad practice, even if only internal, to use an already registered public domain. It crossed my mind that this might just be an internal domain (devlan -> developer LAN), though it seemed unbelievable an agency would have people in IT with that much disrespect for proper network config.

It must be an interesting life for the French admin of the "real" devlan.net since the leaks.

2. I don't get the Kaspersky reference. Can you explain?

ISP and University: I suppose you mean those would be running public Solaris hosts, right? And that therefore the CIA has been hiding on those servers. I sure would hate the CIA to spy on scientists, though it's not unheard of that one of the agencies knocks on a door of a scientist who just happened to be on the verge of publishing something they deem a risk. Happened in the past and sure still does. The imbalance and abuse of power is the problem and here it's legalized/constitutionalised. An agency can spy on my private life and professional work without being questioned, but we aren't allowed to demand a transparent administration or any of the many ranches of government.

Reply on news.ycombinator.com