Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikileaks releases CIA's Marble: Malware obfuscation tools

wikileaks.org

Post reply on HN
Print view View original

181–190 of 284 posts

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#181

Post by dredmorbius »

k-mcgrady wrote: post #174
dredmorbius wrote: post #170

Earlier quoted context omitted.

One action that's been at least partially effective for combatting clear bias in the past and other contexts has to make clear that you are openly inviting contributions (or applications, involvement, etc.) from previously under-served or unaddressed quarters. A current example would be STEM outreach to underrepresented groups: disadvantaged minorities and women in particular. Housing, employment, and educational opp…

I understand your point. Mine is bias does not matter when it comes to this stuff. As long as the leak is factually accurate (and it seems like Wikileaks mostly jump dump the data they get) I want to know if a government is doing something shady and I don't care whether information is also getting leaked at the same rate about another government. Maybe they're not doing anything shady, or maybe they're just doing a b…

If Wikileaks tells me the sky is blue, I'd be inclined to believe them.

But I'd wonder who wants me to know that, and why.

Wikileaks is a spotlight. It shines brightly, and exposes much, but only where it shines.

And if I notice that it's shining only in specific places ... well, that's a curious fact in itself.

And I absolutely disagree with you that bias doesn't matter. Ultimately it's the only thing that matters. Much as, say, US print and broadcast news was conspicuously silent on matters concerning advertiser interests, or government interests in contexts in which the government had leverage over the press.

Wikileaks themselves are no different in that regard, though the business model and relationships are slighly rearranged.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#182

Post by tehlike »

cavanasm wrote: post #34
tehlike wrote: post #24

Earlier quoted context omitted.

honest question: does wikileaks not have necessary connections in China to collect the intel and stuff?

Wikileaks doesn't collect intel whatsoever. They pretty much put up anything sent to them that they think is real (and that admittedly fits whatever editorial narrative is driving Assange at the moment). No one at Wikileaks is doing the hacks, or infiltrating government organizations.

Sorry, i meant gather cables, leaks etc. That is what i meant by intel.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#183

Post by jwtadvice »

salesguy222 wrote: post #15

I wonder if Sony really was "hacked by the North Koreans" then.

SONY had partnered with the US government to create a film that they thought and hoped could galvinize a revolutionary mood in North Korea (by making a comedy about the CIA assassinating the leadership and showing that mock assassination on screen). The DPRK considered this an attack (similar to the US considering the disclosure of hacked DNC emails an attack) and responded with a cyber attack on the contracting firm.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#185

Post by openasocket »

asimpletune wrote: post #161

How about instead of talking about whether Wikileaks is good or bad or whether you support them or not, let's talk about the content of the post. From what I've read so far, this is pretty freaking cool. It's super interesting to read these docs and see their thought process involved, especially since the product their building is so different from what people are making on a day to day business. It actually looks pr…

Self-modifying the underlying machine code isn't what it used to be. Besides the difficulty in writing it, there's lot's of caveats about how it interacts with the cache and the instruction pipeline. It also requires setup, because with modern memory protection all the machine code is read-only. Changing the memory protection for some machine code to be executable and writable at once will set off some alarms (And isn't even possible on systems with W^X). So you need to change it to just writable, make your modifications, then change it back to just executable, which is less suspicious, it just looks like what JIT compilers do. But all in all self-modifying code doesn't really give you anything.

The exception to that is packers and other obfuscation techniques, which are related to self-modifying code. The general idea with these is that you take your real program and compress/encrypt/mangle/etc it and store that data in an executable. The code in that executable de-compresses/decrypts/demangles that data, sets it as executable, and then runs it. Unlike traditional self-modifying code, packing is orders of magnitude easier to write for the malware developer. The advantage here is that an antivirus tool can't determine what your real program does statically unless it understands how you mangled it, which is hard to do in general. To "unpack" an executable you've got three general techniques:

1. Packers tend to get reused a lot, so just have a person write an unpacker for popular packers by hand, and do some pattern matching to figure out which packer an executable is using. This doesn't work for everything, but it's fairly simple.

2. Dynamic Analysis. Run the executable and watch the contents of memory as the program unpacks itself, the real program should pop right out. Of course you have to run the executable in some sort of sandbox environment, and there's ways for the malware to detect that and alter it's behavior. This also isn't the most efficient process, so you can't really do this to executables during, say, an antivirus scan.

3. Symbolic Analysis. Basically static analysis on steroids to figure out what the executable will do without actually running it. The malware can't stop this with sandbox detection. But it's super slow and is still an active area of research.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#186

Post by jwtadvice »

kushti wrote: post #133
SXX wrote: post #129

It's funny to see how many educated people on HN expect to see something like "Russia / FSB / etc" hacking tools or documents leaks or whatever. Probably it's due to looking at how three letter agencies operate in first world countries someone would expect that you actually need that many people to steal some emails or get hands over company database. It's obviously that no matter how big NSA conspiracy is every doll…

This is the perfect example of "whataboutism".

Could you explain the difference between whataboutism and context, particularly if a comment tries specifically to say that "two wrongs don't make a right"?

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#187

Post by belorn »

ajross wrote: post #66
elif wrote: post #55

Earlier quoted context omitted.

please provide something to educate me. Who has more spy bases around the world? Who has disseminated their spy tools so widely that they have become available to 3rd parties? Who else is tapping undersea fiber? Who else is behind the SSL layer at google? I like primary documents obviously, but publications are fine too.

So "egregious" behavior extends only to digital surveillance? OK, fine. Surely the US is the worst at that, I think that's a fair assessment. I thought you were talking about seemingly-Wikileak relevant things like secret police stuff, control over national media, poisoning of political enemies, assassinations... Y'know. Boring stuff. Not "egregious" I guess.

Which leakers would go to wikileaks and not one of the multiple international news papers that are happy to report on "secret police stuff, control over national media, poisoning of political enemies, assassinations" located in say Syria, Russia or China? Just looking at news paper in my own language, I think I will have a hard time to find one that do not publish articles about things in Syria.

What service do Wikileaks provide to leakers in those cases?

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#188

Post by rdtsc »

1_2__3 wrote: post #92
rdtsc wrote: post #11

Earlier quoted context omitted.

Oh I get it, because Assange is a Russian FSB agent. Yap, makes total sense.

Because that's the craziest fucking thing you've heard this year?

Not much fucking but pretty crazy yeah.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#189

Post by matt4077 »

salesguy222 wrote: post #25
azinman2 wrote: post #21

I've really turned on Wikileaks. Itd be one thing if all the major powers had equivalent leaks publishing, but focusing on the US basically serves Chinese and Russian interests far more than it does the citizens of the US. String obfuscation isn't stemming from some corrupt deal that needs sunlight... this is just doing a disservice to their original mission.

you either die a hero or you live long enough to see yourself become the villian...

True.

Or, you know, you spend a decade hiding in some embassy indulging your prosecution complex and thinking up elaborate revenge scenarios for everyone who ever dared to question your genius.

Post reply on HN