Live data from Hacker News

Wikileaks releases CIA's Marble: Malware obfuscation tools

wikileaks.org

171–180 of 284 posts

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#171

I've really turned on Wikileaks. Itd be one thing if all the major powers had equivalent leaks publishing, but focusing on the US basically serves Chinese and Russian interests far more than it does the citizens of the US. String obfuscation isn't stemming from some corrupt deal that needs sunlight... this is just doing a disservice to their original mission.

[deleted]

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#172
post #58

I've really turned on Wikileaks. Itd be one thing if all the major powers had equivalent leaks publishing, but focusing on the US basically serves Chinese and Russian interests far more than it does the citizens of the US. String obfuscation isn't stemming from some corrupt deal that needs sunlight... this is just doing a disservice to their original mission.

Isn't the name supposed to reflect the general wiki concept of "anyone can contribute content"? If more people submit US leaks then that's what their coverage will consist of. It's just like how wikipedia covers obscure comic book characters much more thoroughly than it covers the history of Uzbek domination under the Persians.

It's largely a historical accident now, somewhat like "National Biscuit Co." (Nabisco) or "American Telephone and Telegraph".

"WikiLeaks was originally established with a "wiki" communal publication method, which was terminated by May 2010.[34] Original volunteers and founders were once described as a mixture of Asian dissidents, journalists, mathematicians, and start-up company technologists from the United States, Taiwan, Europe, Australia, and South Africa.[35] As of June 2009, the website had more than 1,200 registered volunteers.[35][36][37]"

https://en.m.wikipedia.org/wiki/WikiLeaks

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#173

I've really turned on Wikileaks. Itd be one thing if all the major powers had equivalent leaks publishing, but focusing on the US basically serves Chinese and Russian interests far more than it does the citizens of the US. String obfuscation isn't stemming from some corrupt deal that needs sunlight... this is just doing a disservice to their original mission.

Does any evidence exist that suggests Wikileaks is withholding information on China or Russia? If not, I don't see how you could conclude they're 'focusing on the US'. They publish what they receive.

To what extent are Wikileaks actively soliciting inputs from Russia or China?

Why, for example, was the Panama Papers leak (or other major financial disclosure leaks) not handled through Wikileaks?

(Edward Snowden's disclosures would be another example, though that did target the US.)

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#174

Earlier quoted context omitted.

So what's the solution? Stop publishing until they've caught up on Russian and Chinese leaks? Why just Russia and China? Should each country get a leak until we get back to the start of the cycle again? Why should Wikileaks care who's interests any leaks serve? They should leak interesting material they are given - that's their purpose.

One action that's been at least partially effective for combatting clear bias in the past and other contexts has to make clear that you are openly inviting contributions (or applications, involvement, etc.) from previously under-served or unaddressed quarters. A current example would be STEM outreach to underrepresented groups: disadvantaged minorities and women in particular. Housing, employment, and educational opp…

I understand your point. Mine is bias does not matter when it comes to this stuff. As long as the leak is factually accurate (and it seems like Wikileaks mostly jump dump the data they get) I want to know if a government is doing something shady and I don't care whether information is also getting leaked at the same rate about another government. Maybe they're not doing anything shady, or maybe they're just doing a better job with information security. Either way it doesn't take away from the fact I should know the information I can as long as it's factual.

As an analogy when the US/UK/other western gov criticises Assad or Kim Jong Un over human rights abuses we don't generally complain that it's unfair because the US/UK also have plenty of human rights abuses under their belt. Yes that's a problem but it doesn't take away from the original complaint which is still valid.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#175

Earlier quoted context omitted.

>Telling Chinese people that their government is systematically harvesting organs of Tibetian people has no new information or benefit. This is hilarious. Whatever you have been smoking, it needs to stop.

You are the one apparently smoking something. It is common knowledge that China uses prisoners as a way to mass harvest organs. http://www.cnn.com/2016/06/23/asia/china-organ-harvesting/

That's not right either. I just imagine the innocent people jailed for nothing. I can't even stomach hitting the link. Hopefully, I'm missing something? China shocks me. I don't understand a lot about that country, and the more I learn; the less I like it.

Oh yea, I understand you need to eat animals. You don't need to mistreat them? That dog thing still hants me, and I didn't even click on the link a few weeks ago. I know I'm suspose to love everyone? I'm basically talking about the political system, but there's some things that are just not right in the culture, or certain sectors?

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#176

Look at all the people complaining that wikileaks is anti-western and/or foriegn supported/agents with no proof of this whatsoever. If anything wikileaks has shown a superior journalistic record in publishing whatever comes across their desk, so I don't see people criticising wikileaks on this the weakest of points as anything but intellectually dishonest at best.

As a foreigner this witchunt for Assange is pathetic, suddenly when you support bad boys he's no good.

Who said advertising doesn't work? Especially political.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#177

(noob question) Do you need THE best software-development talent to be able to build comprehensive surveillance like the big agencies? Like THE Christiano Ronaldo or THE Michael Jordan of programming. Or is this more about funds and the power to set such a system in motion?

That's an interesting question.

My thought is that much of the problem is tactical, logistical, organisational, and capabilities-oriented.

Consider the problem domain:

1. There's a vast amount of information flowing around the world. Much of it remains at best poorly protected, and until recently, that was even more the case.

2. Much of surveillance revolves around access to the channels themselves. Which means places such as satellite uplink/downlink centres, transoceanic cable landfalls, major switching hubs, telecoms hubs (AT&T's notorious San Francisco closet), etc.

3. Then you've got the problem of simply ingesting the information. For that, you need fat pipe of your own, and massive storage.

4. Then the problem of classifying and prioritising the information, or identifying and tracing specific targets. Again, in both cases, scale matters more than capability, where scale is both a matter of data (transmission, storage, processing) and above all access.

If you want to tap a specific landline, or cellphone, or cloud / online storage provider, do you have the tactical assets in place to be able to do so? E.g., official or unofficial liasons with the organisation in question. If official, how do you maintain that relationship (what balance of carrots and sticks). If unofficial, do you risk burning through such assets by utilising them. Google, to take an example, apparently looks poorly on employees directly accessing user data, and could well discipline or terminate any staff or contractors who do so. This doesn't mean that the NSA doesn't have and cannot use such assets, but they can likely only use each one a small number of times, possibly only once. That raises the costs for any such access, though again, scale offers a potential counterweight. (Rinse, wash, and repeat for all non-Google organisations, I'm actually raising them as an example here on account of their apparently stringent internal controls.)

5. Technical capabilities. For any given channel, there are the fundamental information-theoretical problems of establishing a link, transferring, and comprehending data. Depending on the complexities involved, this may be easy or hard, but there's almost certainly a fixed setup cost for any given service. This also means that the surveillance entity will likely target technical sources by some balance of total size (likelihood that any given target will be on it) and specific interest (that a particular target is there).

Such resources are again finite, and suggest yet another possible defeat: by embracing rapid change, workfactor for achieving technical penetration increases.

I'm arguing my own way through this, but in general, I'd think that size matters more than skill, though the two complement, and there are almost certainly instances in which brute intelligence and capability in conceiving of exploits is an essential factor.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#178

Earlier quoted context omitted.

Do you hold WaPo, NYT, CNN to those same standards? Because that is mainly what American "MSM" does, selectively publish information which bebefits the agenda of American foreign policy interests. It's fair if you align yourself with American foreign policy interests, I do too, but to single out other publications that don't follow that agenda is just a case of having self interested double standards. All of the crit…

I disagree: I think there is a reasonable case to hold WikiLeaks and the NYT to different standards. I think WikiLeaks holds itself out as a much more anarchic news organisation than traditional outlets like the NYT. WikiLeaks isn't connected or have allegiance to any particular country, and will publish, let the facts speak for themselves and damn the establishment and any particular national interests that are harm…

Wikileaks did that in the past and got hell for it, for the very reason that they were then a anarchic organisation that didn't curate and pick what they published. It is what got us the Afghan War documents and cable gate. In both cases Wikileaks was accused of putting "people lives at risk", through not that any case of death-caused-by-leak has ever been claimed by any US official. Only "at risk".

Going back further in time, there was actually a stated goal of Wikileaks. It wanted to make sure that leaking is so ubiquitous, common and supported that states can't afford to have deep secrets. Looking at the recent support of government leaking after the US election Wikileaks did gain large step towards that on both side of the political spectrum, be that intentional or not.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#179

How about instead of talking about whether Wikileaks is good or bad or whether you support them or not, let's talk about the content of the post. From what I've read so far, this is pretty freaking cool. It's super interesting to read these docs and see their thought process involved, especially since the product their building is so different from what people are making on a day to day business. It actually looks pr…

This framework seems comparable to many open source obfuscation solutions. I would hope to see more advanced techniques, then again, maybe their requirements called for ensuring things did not look too obfuscated (the more tricks used, the more likely a signature could be detected for their tradecraft).

Personally I do not believe self-modifying code would make much sense in their use case. In fact, this would not be possible on iOS due to kernel-based security protections.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#180

How about instead of talking about whether Wikileaks is good or bad or whether you support them or not, let's talk about the content of the post. From what I've read so far, this is pretty freaking cool. It's super interesting to read these docs and see their thought process involved, especially since the product their building is so different from what people are making on a day to day business. It actually looks pr…

Self modifying code isn't really new or secret stuff.

https://en.wikipedia.org/wiki/Metamorphic_code

https://web.archive.org/web/20070602060312/http://vx.netlux....

Post reply on HN