CIA malware and hacking tools

Also, while I doubt they've ever released fake documents as part of a leak, they do often push incorrect and/or unverified theories and ideas on Twitter.

First, it's quite restricted in terms of deep system access towards devs and users. Apps are sandboxed and extremely isolated from each other. Then, its market share is so low that probably no one makes an effort to build targeted attacks towards it.

which are "do's and don't's" for malware writers. I like this:

S//NF) DO NOT perform operations that will cause the target computer to be unresponsive to the user (e.g. CPU spikes, screen flashes, screen "freezing", etc).

But the rationale is only:

(S//NF) Avoids unwanted attention from the user or system administrator to tool's existence and behavior.

It should go farther. When a user's impact is affected, this is a firm and definite step toward living in a police state.

I like the idea of a state where the director of the CIA can tell the President "We do not have private files on anyone, nor anything not directly related to imminent terror action and the like. We live in a free world, and if we didn't have people abducting others for ransom, planning terrorist activities, or the like, nobody country would need such capabilities.

Generally I am against a surveillance state and for one of these reasons I do not read these documents.

I also like this part:

(S//NF) DO make all reasonable efforts to minimize binary file size for all binaries that will be uploaded to a remote target (without the use of packers or compression). Ideal binary file sizes should be under 150KB for a fully featured tool.

To put this in perspective, if you were to load the front page of the wall street journal right now, your browser would download something like 900 KB.

I think getting 100 kb slipped in here or there that makes sure I'm not running a huge terrorist network is worse than the total inability for the government to do this if someone is.

it shouldn't impact my experience and it should be denied.

It's problematic that some of this is extralegal, but I'd rather not know about it than to have to have someone acknowledge its existence. Sorry.

if bitcoin assholes weren't ransoming people's pc's and life's work, or if people weren't being abducted for ransom, or if people weren't radicalized in a matter of weeks and then transmitted secret payments and chose to plough into a group of people celebrating independent democracy (the French 14 July thing with the truck), I might have a little more sympathy toward the idea that there doesn't need to be anything except might makes right on the Internet, letting users and terrorists do whatever they want and fend for themselves.

-

Edit: the cleanup/uninstall section explicitly mentions in the rational, not collecting private (unwanted) data. This might not be great but certainly sounds like the kind of hidden machinery you would want, in the kind of world we live in.