macOS Zero-Day Used Against Hong-Kong Activists
schneier.com
schneier.com
From the article:
> Wardle found that the software contained code strings in Chinese, such as 安装成功 (Successful installation), and that the command and control server it connected to was located in Hong Kong.
From the CIA:
> In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation. The source code revealed that Marble had examples in Chinese, Russian, Korean, Arabic and Persian. These were the languages of the US's main cyber-adversaries – China, Russia, North Korea, and Iran.
HK activists don't appear to be of much strategic interest to the USA. And where they are I imagine they would just reach out to them directly.
What? The USG has put a ton of resources into backing HK protestors, through the NED, BRL, and satellite orgs like Amnesty (look at the saga of Kong Tsung-gan/Brian Kern).
As for why the CIA might burn a 0day only to generate articles like this: NatSec threat inflation is a trillion-dollar industry in Washington.
But it just as well might have been a local crime syndicate trying to scrape personal information for financial fraud.
Point is, the article provides virtually zero evidence to determine who is at fault.
If I understood it correctly, the most compelling evidence was the real data transfer rate of those emails, deduced from the file timestamps, which ruled out their provenance from the server.
> Something that's not only trivial to fake (...)
Well, in this case that would go against the original accusation, therefore it would either be pointless or the explanation would require a conspiracy with double agents planting fake compromising evidence.
Political tendencies will allow people to make attributions they agree with and then simultaneously question attributions they disagree with politically.
USB sticks seem to be weird about transfer speeds and they look like they are size dependent. Bunch of small files take longer than one monolithic large file given a total size.
What was the connection speed? I've never seen it stated anywhere, and in case the server was hosted in a data center the argument would collapse fairly quickly.
I thought it was hilarious back in 2016-2017 how people took partisans sides on BOTH wrong answers!
"It was Russia! The President is ignoring intelligence agencies! Disagreeing with me makes you a far right extremist!"
Meanwhile kid in basement in rural Ohio: "top kek"
I'm not going to hold my breath about any party coming clean about who's actually responsible. Until then we can just make guesses about it based on the evidence we have, the targets, the code itself, and the location of the server. It certainly points to a state-actor.
This reminds me of Sasser (iirc), which was initially attributed to Russia, as it contained Cyrillic. Turned out it was a German teen and he and his friends put it in there for shits ans giggles and laughed their asses off when "security experts" actually took the bait.
So it was "identical" to an exploit previously disclosed? So it wasn't new? How was it that this exploit was made public in April, re-discovered in August, and patched in September?
I wonder when will a giant rival today's google msft apple appears whose main business is information security.