Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copies of malware used by intelligence agencies to spy on journalists

wikileaks.org

Post reply on HN
Print view View original

61–70 of 80 posts

Re: Copies of malware used by intelligence agencies to spy on journalists

#61

Post by girvo »

jamesk_au wrote: post #35
girvo wrote: post #19

So, it seems the NSW police here in Australia are a customer and use this. Ignore for a moment whether it's a good or bad thing that police use tools like these. What I want to know is, what happens once they "get their guy", so to speak. Does the malware stay on that computer forever, violating the privacy of family members, or other users of the computer should it be sold on and not wiped correctly? What happens if…

(I'm also in NSW)-- The list of "support requests" on the customers page suggests that the tools are used only in accordance with duly-issued warrants. Access would need to be removed once the purpose of the warrant had been fulfilled, but we may never know whether they get that right in practice. Ben Grubb has collated some background information on the operation of those laws.[1] [1] http://www.smh.com.au/it-pro/go…

Great information, thanks. I'd love to be a fly on the wall and see whether they push things too far...

Re: Copies of malware used by intelligence agencies to spy on journalists

#62

Post by tripzilch »

BorisMelnik wrote: post #15

If I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.

> masking tape over my webcam

what people always seem to forget is that it's not the webcam but the microphone that presents the greatest privacy risk.

if you tape it off, it'll just lower the volume (and possibly dampen higher frequencies, but you just need 300-3800Hz for voice).

additionally (outside the coffee shop scenario you describe here), what's a webcam do? ok, it'll see your face. chances are they already know your identity. maybe it'll catch one second of your underwear, big deal. now compare to a microphone, much less data, but it picks up every conversation in the room, regardless if they're "in view". much worse.

Re: Copies of malware used by intelligence agencies to spy on journalists

#63

Post by nysv »

Strom wrote: post #49
nysv wrote: post #43

Earlier quoted context omitted.

Pretty depressing. Only 2 out of 54 scanners currently detect something in the zips of the spyware. https://www.virustotal.com/en-gb/file/6ee40b8e7d49f4ea70b7ce... https://www.virustotal.com/en-gb/file/688f1e15390faf8d977351...

Those zips are encrypted, that's why. I have included links to the unencrypted results [1,2], with ~80% detection rate. Notable green checkmark by Microsoft, perhaps FinFisher made extra sure to not get caught by Microsoft's heuristics? [1] https://www.virustotal.com/en-gb/file/f827c92fbe832db3f09f47... [2] https://www.virustotal.com/en-gb/file/0b465877a998a993a64a14...

Microsoft too detects them now. Too late, but at least they are updating their signatures fairly rapidly.

Interestingly, both files were first uploaded to VT in 2010, meaning that AV vendors have had chances to analyze them.

Re: Copies of malware used by intelligence agencies to spy on journalists

#64

Post by rplnt »

nysv wrote: post #63
Strom wrote: post #49

Earlier quoted context omitted.

Those zips are encrypted, that's why. I have included links to the unencrypted results [1,2], with ~80% detection rate. Notable green checkmark by Microsoft, perhaps FinFisher made extra sure to not get caught by Microsoft's heuristics? [1] https://www.virustotal.com/en-gb/file/f827c92fbe832db3f09f47... [2] https://www.virustotal.com/en-gb/file/0b465877a998a993a64a14...

Microsoft too detects them now. Too late, but at least they are updating their signatures fairly rapidly. Interestingly, both files were first uploaded to VT in 2010, meaning that AV vendors have had chances to analyze them.

Malware vendors usually use these services to test their load. They wouldn't release anything that would get detected on day 0. And I think antivirus vendors do more in-house analysis only if there are reasons to - such as votes from users, or other AVs detecting the sample.

Re: Copies of malware used by intelligence agencies to spy on journalists

#65

Post by iancarroll »

sam_bwut wrote: post #38
BorisMelnik wrote: post #15

If I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.

Why Kali? Surely you means TAILS?

Kali comes with some forensic tools.

Re: Copies of malware used by intelligence agencies to spy on journalists

#66

Post by iancarroll »

tripzilch wrote: post #62
BorisMelnik wrote: post #15

If I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.

> masking tape over my webcam what people always seem to forget is that it's not the webcam but the microphone that presents the greatest privacy risk. if you tape it off, it'll just lower the volume (and possibly dampen higher frequencies, but you just need 300-3800Hz for voice). additionally (outside the coffee shop scenario you describe here), what's a webcam do? ok, it'll see your face. chances are they already k…

I have my microphone (and webcam) disabled from the BIOS. It's pretty effective.

Re: Copies of malware used by intelligence agencies to spy on journalists

#67

Post by TeMPOraL »

iancarroll wrote: post #66
tripzilch wrote: post #62

Earlier quoted context omitted.

> masking tape over my webcam what people always seem to forget is that it's not the webcam but the microphone that presents the greatest privacy risk. if you tape it off, it'll just lower the volume (and possibly dampen higher frequencies, but you just need 300-3800Hz for voice). additionally (outside the coffee shop scenario you describe here), what's a webcam do? ok, it'll see your face. chances are they already k…

I have my microphone (and webcam) disabled from the BIOS. It's pretty effective.

Up until you catch a BIOS exploit. If the disabling is done by software, it's not really disabling.

Physical switches and/or duct tape FTW.

Re: Copies of malware used by intelligence agencies to spy on journalists

#68

Post by dalke »

tripzilch wrote: post #62
BorisMelnik wrote: post #15

If I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.

> masking tape over my webcam what people always seem to forget is that it's not the webcam but the microphone that presents the greatest privacy risk. if you tape it off, it'll just lower the volume (and possibly dampen higher frequencies, but you just need 300-3800Hz for voice). additionally (outside the coffee shop scenario you describe here), what's a webcam do? ok, it'll see your face. chances are they already k…

Different people have different rankings of what they consider to be a privacy risk. From recent news, we know that some people are very much into distributing personal images made by other people and kept in what was presumed to be private storage. We also know that some people enjoy manipulating images, including sometimes to torment those who have been photographed. Audio manipulation is less disturbing.

Consider also that some people have computers in line of sight of where they have sex, and an illicitly captured video recording of sex without sound is more often thought of as a privacy intrusion than an audio recording without video of the same ... as the noise from my neighbors might attest.

Re: Copies of malware used by intelligence agencies to spy on journalists

#69

Post by __P »

meowface wrote: post #50
jamesk_au wrote: post #35

Earlier quoted context omitted.

(I'm also in NSW)-- The list of "support requests" on the customers page suggests that the tools are used only in accordance with duly-issued warrants. Access would need to be removed once the purpose of the warrant had been fulfilled, but we may never know whether they get that right in practice. Ben Grubb has collated some background information on the operation of those laws.[1] [1] http://www.smh.com.au/it-pro/go…

I have not looked at the materials but I suspect most or all Western countries using this toolkit are using it for specific investigations where warrants have been issued. I personally have no qualms with the FBI planting malware as just another form of surveillance (if they have a warrant to search your home and tap your phone, why shouldn't they be able to get a warrant to monitor your computer?). The problem with…

There is a weird "Us and Them" vibe from your comment.

Is the US/Australia/Uk's treatment of Julian Assange (as an example) not count as "oppressive regimes" and "...dissidents, protesters, and political opponents."?

How is that different to ? (I ask honestly, not rhetorically)

Re: Copies of malware used by intelligence agencies to spy on journalists

#70

Post by higherpurpose »

atmosx wrote: post #17
BorisMelnik wrote: post #15

If I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.

Just don't forget to wear gloves.

And a ski mask.
Post reply on HN