Wikileaks releases CIA's Marble: Malware obfuscation tools

Every one of those news outlets publishes multiple stories criticizing the current leader of the United States and the United States' foreign policy agenda. This happens nearly every hour of the day.

(Perhaps not so) Interesting that the demonstration languages are: Chinese, Russian, Arabic, Farsi and Korean.

Could be a fun one for game DRM? Or apps where an API key is hidden in the binary?

They're ~revealing~ the capability for computers to store text in foreign languages, even if the programmer doesn't speak that language natively? All the source docs say is that if a programmer wrote text in a foreign language, the code isn't going to blow up.

Wikileaks is implying -- heavily enough that every news article I've seen mentions it (some, even, without the "might" or "could") -- that the main reason the CIA would support Unicode is so that they can trick people into thinking they're Chinese.

Mentioning (the quite obvious fact) that it's possible to include foreign text in code as an effort to confuse adversaries, while discussing an actual implementation of text obfuscation, will confuse reasonable people who lack the technical understanding of what this is into thinking the software obfuscates text by somehow changing the language it's in.

Here's a more egregious example:

This doc (https://wikileaks.org/ciav7p1/cms/page_13763790.html) contains one line "Vehicle Systems (e.g. VSEP)." It doesn't elaborate what "Vehicle Systems" they mean or define "VSEP," but given the other projects worked on by the same team (all using embedded systems to spy on you), the most reasonable interpretation to me is that they'd be trying to intercept GPS and other sensor data, including voice and video from cameras and microphones.

Wikileaks wrote "As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks. The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations." In this case, they added the word "control" from nothing, making the completely unsupported claim that the CIA is investigating the possibility of assassinating people by hacking their cars (which, hey, might be true... but there's nothing supporting that idea here).

Sure enough, dozens of article were written about how the CIA is killing people by driving their cars off cliffs.

I'm Nigerian and I feel the hypocrisy of the US government is a great danger to the world. Russia and China are known "evils" and that we can deal with. The US keeps us a d American citizens blind.

I hope my comment history works for you and you will not be reporting me to any "authorities"

It's funny to see how many educated people on HN expect to see something like "Russia / FSB / etc" hacking tools or documents leaks or whatever. Probably it's due to looking at how three letter agencies operate in first world countries someone would expect that you actually need that many people to steal some emails or get hands over company database.

It's obviously that no matter how big NSA conspiracy is every dollar spent, every meeting occur, every decision made all have to be controlled and documented. And any 3rd party company working for agency must have official contract, must report taxes and sometimes can even sell all the same tools for other governments. So it's thousand people participate at every single step.

In world of paranoid and corrupt ex-KGB mafia nothing like that required. All you need is just few experts and enough of money. Russia have plenty of online criminals: carders, illegal pharmacy and drug dealers, owners of credit card processings used for fraud, money laundering payment systems, botnet owners, spyware developers and most of them are controlled by state or somewhat under special agency protection racket.

Need 0-day exploit? Rootkit? Spyware? Any unique tools? Anything can is there for money! DDoS attack or a lot of proxy servers at any location needed? Plenty of services there and agencies obviously know owners. No documentation or reporting needed since corrupt government agencies are closely tied to those criminals for years.

So the same attacks that would involve at least few hundred of people in usual US three letter agency would likely require to just few dozens in Russia. What's more important no one would ever tell the difference between this activity and usual agency behaviour that related to usual corruption schemes.

So if you seriously think there is Russian government behind some attacks then shouldn't expect any leaks about that. If there is something important for Kremlin they wouldn't mind to dump money on it, but there will be very few people aware of it and of course there will never be any documents or other traces since they would be done as any other attack against commercial company or opposition politician.