Wikileaks releases CIA's Marble: Malware obfuscation tools • Hacker News Board

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#201

Post by yunocat » Sat, Apr 01, 2017, 2:39 AM UTC

gkoberger wrote: post #85

elif wrote: post #31

Earlier quoted context omitted.

The truth isn't responsible for serving anyone's interests, and especially not the interests of the biggest secret keeper. The truth is not political, except that it is the natural enemy of politics which rely upon secrecy. If your perspective is that more secrets are being kept by more egregious actors than the US, the truth welcomes your contribution...

The truth may not be political, however the curation is. Take the US election, for example. Wikileaks has released information about Clinton and the DNC, and claims they have stuff they never released about Trump and the GOP [1, 2]. Other sources have said the GOP was hacked in the same attack that got Podesta [3]. The only person less likely to criticize Russia than Trump is Assange. Wikileaks lost any proximity to…

I personally don't think this is so much a result of Assange having a bias as it is a result of him being in a compromised position since being imprisoned in the Equadorian embassy..

One the one hand, he has the US wanting to prosecute him and on the other hand, if the claims are to be believed, Russia is happy to use WL as a channel to air their dirty US intel bits, by context implying that he is de-facto forced to take a Russia aligned position since they are the only ones with power covering him.. And of course outing this bias essentially means he plays the one card that might keep him from say, disappearing into a river or mysteriously ingesting rare radioactive isotopes..

If the shoe were on the other foot and the US were not so interested in prosecuting him to cover themselves, and it were Russia/China/Etc forcing him to hole up somewhere I'd wager that the US would be more than happy to play the same game of using wikileaks as a channel, with Assange staying mum, and Russia/China/Etc would be crying foul..

Of course this only presumes the 'wikileaks as russian channel' info is even true, since pretty much anyone not in the gung-ho US camp is branded as a Russian shill (Assange, Snowden) or a deranged lunatic hell bent on global destruction (Assad, Hussein, Khomeni, Chavez, etc.)

By the way, ever notice you don't hear so much about Anonymous these days since about the time of the elections and Hillary's server getting discovered?

There are much much much bigger factors at play than Assange's bias or non bias in this drama..

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#202

Post by yunocat » Sat, Apr 01, 2017, 2:47 AM UTC

lettergram wrote: post #159

olegious wrote: post #151

Earlier quoted context omitted.

Yes, but they don't question or criticize our foreign policy which is very destructive to the long term interests of this country.

Pretty much every organization is criticizing our foreign policy at the moment. https://duckduckgo.com/?q=trump+foreign+policy&t=fpas&iax=1&...

Really?

Show me the set of NYT/WaPo/ETc pieces consistently outlining an editorial position for any one of the following issues:

Unaccountable global free trade deals are a bad idea, Assad is not an evil guy that should be replaced via direct or indirect US action, That Syrian rebel groups are in fact heavily islamised, that Putin is not trying to be Stalin 2.0, that the Ukraine is a mess due to problems on all sides, that a Palestinian 1 state solution is preferred to the current 2 state strategy, or equating the level of theocratic social repression in Iran and Saudi Arabia.

Does the occasional piece crop up hinting that these could concievably be valid positions if they weren't actually incorrect? Yes. Does that mean they are consistently viewed or even evaluated by pinning down biases and weighing them against objective comparitive philosophical standards, particularly applied to the topic at hand? Ha!

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#203

Post by DBNO » Sat, Apr 01, 2017, 3:09 AM UTC

openasocket wrote: post #199

DBNO wrote: post #198

Earlier quoted context omitted.

Edit: part of my comment is corrected by comment below - Thanks openasocket! Another comment about the content of this article: Three quarters down the wiki page there is code for "adding foreign language" to the code. The options are are to add code comments in Arabic/Chinese/Russian/Korean/Farsi. My gut reaction is the purpose of this added language is to obfuscate the true source of the code - i.e. the code has Ch…

This is for obfuscating string constants, the foreign languages included is a red herring. The reason for this is that nontrivial code often has string constants in it, and the string contents are stored in the ELF/PE file in a manner that makes it trivial to extract. Since these strings often reveal a lot about the malware (e.g. a string constant "Your computer has been infected with randomware. Please deposit %d bi…

Thanks for this insight! I'll edit my comment to credit you, but I won't delete it since someone might have the same thought process as me.

My comment:

So I see now (thanks to you) that it is just showing test cases (test warbles) to demonstrate that these scrambling techniques work with foreign languages. However, why would the us gov need to make sure that this program can successfully obfuscate Unicode strings in Chinese/Russian/Arabic/Farsi?

My gut reaction: while code comments would be trivial to forge, it appears the us gov is still using foreign language strings in some way - maybe having just one string constant originally in a foreign language that is then obfuscated/scrambled (such as by xoring every char against a random key)

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#204

Post by eraptic » Sat, Apr 01, 2017, 3:09 AM UTC

openasocket wrote: post #199

DBNO wrote: post #198

Earlier quoted context omitted.

Edit: part of my comment is corrected by comment below - Thanks openasocket! Another comment about the content of this article: Three quarters down the wiki page there is code for "adding foreign language" to the code. The options are are to add code comments in Arabic/Chinese/Russian/Korean/Farsi. My gut reaction is the purpose of this added language is to obfuscate the true source of the code - i.e. the code has Ch…

This is for obfuscating string constants, the foreign languages included is a red herring. The reason for this is that nontrivial code often has string constants in it, and the string contents are stored in the ELF/PE file in a manner that makes it trivial to extract. Since these strings often reveal a lot about the malware (e.g. a string constant "Your computer has been infected with randomware. Please deposit %d bi…

Considering that debug symbols, comments in code and Cyrillic characters in the metadata of files is being used a solid evidence Russia hacked the DNC, I'd say that it's probably still a useful tool

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#205

Post by openasocket » Sat, Apr 01, 2017, 3:14 AM UTC

eraptic wrote: post #204

openasocket wrote: post #199

Earlier quoted context omitted.

This is for obfuscating string constants, the foreign languages included is a red herring. The reason for this is that nontrivial code often has string constants in it, and the string contents are stored in the ELF/PE file in a manner that makes it trivial to extract. Since these strings often reveal a lot about the malware (e.g. a string constant "Your computer has been infected with randomware. Please deposit %d bi…

Considering that debug symbols, comments in code and Cyrillic characters in the metadata of files is being used a solid evidence Russia hacked the DNC, I'd say that it's probably still a useful tool

Source? I've read the stuff Crowdstrike and Manidant have put out and they mentioned none of those as evidence. Just binary analysis and network indicators from what I've seen.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#206

Post by Natsu » Sat, Apr 01, 2017, 3:22 AM UTC

elemenopy wrote: post #113

mhermher wrote: post #99

Earlier quoted context omitted.

Do you hold WaPo, NYT, CNN to those same standards? Because that is mainly what American "MSM" does, selectively publish information which bebefits the agenda of American foreign policy interests. It's fair if you align yourself with American foreign policy interests, I do too, but to single out other publications that don't follow that agenda is just a case of having self interested double standards. All of the crit…

I disagree: I think there is a reasonable case to hold WikiLeaks and the NYT to different standards. I think WikiLeaks holds itself out as a much more anarchic news organisation than traditional outlets like the NYT. WikiLeaks isn't connected or have allegiance to any particular country, and will publish, let the facts speak for themselves and damn the establishment and any particular national interests that are harm…

The problem with holding Wikileaks as "selective" is that you would have to establish that there are true leaks which they have withheld from us. There's this popular misconception that Wikileaks actually hacks to obtain the data, but this is false and no one has ever so much as attempted to prove otherwise.

So given that they can't select the sources, the claims of them being "selective" just sound ignorant to anyone who knows how they operate, especially when those same claims are so often repeated in publications which are openly selective.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#207

Post by bluejekyll » Sat, Apr 01, 2017, 3:23 AM UTC

asimpletune wrote: post #161

How about instead of talking about whether Wikileaks is good or bad or whether you support them or not, let's talk about the content of the post. From what I've read so far, this is pretty freaking cool. It's super interesting to read these docs and see their thought process involved, especially since the product their building is so different from what people are making on a day to day business. It actually looks pr…

Ok. In that vain, here's a question; should you use any of these tools as an American citizen, beyond what you use them for, are you breaking any laws? That is, could you be guilty of something like sedition or something like it by using these thing illegally gotten?

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#208

Post by Natsu » Sat, Apr 01, 2017, 3:29 AM UTC

reddytowns wrote: post #112

mhermher wrote: post #99

Earlier quoted context omitted.

Do you hold WaPo, NYT, CNN to those same standards? Because that is mainly what American "MSM" does, selectively publish information which bebefits the agenda of American foreign policy interests. It's fair if you align yourself with American foreign policy interests, I do too, but to single out other publications that don't follow that agenda is just a case of having self interested double standards. All of the crit…

By complaining about WaPo, et al, you are guilty of "whataboutism" yourself. Is the standard so low that we can't even mention that a non profit(?) organization devoted to releasing leaks of wrongdoing shouldn't be blatantly partisan? Edit: I misread the last part of your comment about "whataboutism". Yet my question still applies, isn't it?

The claims of partisanship rely on claims that Wikileaks somehow selects their sources. They are not a hacking organization and they do not go choosing targets to hack for the leaks, so they cannot be selective in the same way that, for example, the NYT chooses openly to be.

I have yet to see anyone even claim that Wikileaks participates in the hacks themselves, let alone to provide evidence thereof.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#209

Post by dredmorbius » Sat, Apr 01, 2017, 3:43 AM UTC

toufka wrote: post #195

dredmorbius wrote: post #173

Earlier quoted context omitted.

To what extent are Wikileaks actively soliciting inputs from Russia or China? Why, for example, was the Panama Papers leak (or other major financial disclosure leaks) not handled through Wikileaks? (Edward Snowden's disclosures would be another example, though that did target the US.)

I believe most if not all of thier staff is English-speaking (and not Chinese/Russian-speaking). They'd have to find different staff to work in yhose other languages, or to even inderstand the documents' importance.

Hiring staff capable of handling such materials would be another material step Wikileaks could take in addressing its glaring bias problems.

Re: Wikileaks releases CIA's Marble: Malware obfuscation tools

#210

Post by travmatt » Sat, Apr 01, 2017, 4:13 AM UTC

VikingCoder wrote: post #82

elif wrote: post #31

Earlier quoted context omitted.

The truth isn't responsible for serving anyone's interests, and especially not the interests of the biggest secret keeper. The truth is not political, except that it is the natural enemy of politics which rely upon secrecy. If your perspective is that more secrets are being kept by more egregious actors than the US, the truth welcomes your contribution...

> The truth is not political Nonsense. Discovering and revealing the truth, and the timing of those actions, can absolutely be political. If one out of 4 PARTY-X Congressmen are cheating on their wives, and one out of 5 PARTY-Y Congressmen are cheating on their wives... But somehow wikileaks publishes a list of Congressmen cheating on their wives a week before the election, and they're all PARTY-X on the list, and no…

It's always been a bullshit and disingenuous argument, especially for the goal of defending Wikileaks.

The truth is Assange is paid to hurt the US, and censor information that damages Russia. That's why he does things like publish the personal info of CIA personnel children, censor emails damaging to Russia, and hold regular meetings with arms of Russian propaganda. Assange has tacitly admitted this and didn't even try to deny it.