Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky believes it found new CIA malware

therecord.media

Post reply on HN
Print view View original

71–80 of 314 posts

Re: Kaspersky believes it found new CIA malware

#71

Post by seppin »

viro wrote: post #33
throwaway210222 wrote: post #19

Earlier quoted context omitted.

Or: "they're a company that has been accused without evidence of cooperating with the FSB in attacks against the US government by US entities aligned to the US-based actors that they have exposed". FTFY.

> without evidence of cooperating with the FSB That isn't true. This "without evidence" shit is rather silly when it comes to top-secret sources and methods. Blow decades of work and risk getting people killed to Prove that an ex-KGB officer helps an authoritative regime thats known to poison its enemies. People said the same shit about Huawei, then all the KPN shit. Link: https://www.bloomberg.com/news/articles/2017…

People still don't understand the fundamentally different rules that Russian or Chinese companies operate under. They cannot refuse government requests, for anything.

Re: Kaspersky believes it found new CIA malware

#72

Post by cyberlab »

asimpletune wrote: post #66
cyberlab wrote: post #64

> the malware samples appear to have been compiled seven years ago, in 2014 So it was possible then to analyze the metadata of the files and determine when the malware was made/compiled? That seems like bad OPSEC. If I was CIA I would be rigorous in modifying and faking when certain files were last modified or created, and possibly stripping other damaging metadata (if it's incriminating enough). This is basic metada…

I think it was based more on when the samples were found

Yet the samples retain their original creation date?

Re: Kaspersky believes it found new CIA malware

#74

Post by boomboomsubban »

mc32 wrote: post #4
efnx wrote: post #2

So this was deployed in 2014 and we’re just connecting all the dots now? It really makes you wonder what’s being deployed at the moment. The fact that they can determine all this from some binary is amazing. Security researchers really are techno-archaeologists.

I recall how when we had North Korean hacking activities and official attributions people would say, but how do we know it was them and how do we know the government isn’t making things up? But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.

>But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.

This thread also isn't full of calls for sanctions against the US or talk of overthrowing the government.

I don't actually doubt many of the reports claiming North Korea or whoever were behind some attack, I know they are likely engaging in such activities. I just don't think the evidence is convincing enough to use as a casus belli or similar reason to take our own malicious actions. I would take a similar stance with this CIA malware, but nobody here is calling for punishment based on it.

Re: Kaspersky believes it found new CIA malware

#75

Post by hugh-avherald »

cyberlab wrote: post #64

> the malware samples appear to have been compiled seven years ago, in 2014 So it was possible then to analyze the metadata of the files and determine when the malware was made/compiled? That seems like bad OPSEC. If I was CIA I would be rigorous in modifying and faking when certain files were last modified or created, and possibly stripping other damaging metadata (if it's incriminating enough). This is basic metada…

Maybe it's less suspicious to have benign metadata than no metadata.

Re: Kaspersky believes it found new CIA malware

#76

Post by cyberlab »

brummm wrote: post #42

I always wonder. The CIA/NSA must essentially target the big Amazon, google and microsoft clouds to get blanket access to everything running and stored there. Seems like a no brainer from their standpoint.

Yes. Although with Google and other tech giants, they have good security, but really bad privacy. So there is little chance of your Google searches being leaked onto some shady darkweb forum, but a better chance it is being leaked to NSA etc. Also haven't you heard about NSLs[0] & Prism[1]?

[0] https://en.wikipedia.org/wiki/National_security_letter

[1] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

Re: Kaspersky believes it found new CIA malware

#78

Post by xtracto »

oefrha wrote: post #52
brummm wrote: post #42

I always wonder. The CIA/NSA must essentially target the big Amazon, google and microsoft clouds to get blanket access to everything running and stored there. Seems like a no brainer from their standpoint.

I’d say the likelihood of an American Big Tech without CIA covert operatives working there is essentially zero, even if there’s no direct cooperation. It doesn’t make sense to not utilize some of your most valuable assets.

Back in the 70s to 90s the CIA had presidents of Mexico as operatives (see LITEMPO). So, I wouldn't be surprised that nowadays some high level people at Google, Microsoft, etc are CIA assets.

Re: Kaspersky believes it found new CIA malware

#79

Post by Jenk »

mc32 wrote: post #4
efnx wrote: post #2

So this was deployed in 2014 and we’re just connecting all the dots now? It really makes you wonder what’s being deployed at the moment. The fact that they can determine all this from some binary is amazing. Security researchers really are techno-archaeologists.

I recall how when we had North Korean hacking activities and official attributions people would say, but how do we know it was them and how do we know the government isn’t making things up? But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.

Given the public image of North Korea is one of a time capsule from the 60s I think it's more a case that the North Korean effort is considered inadequate or incapable, whilst the US TLAs have virtually limitless resources.

Re: Kaspersky believes it found new CIA malware

#80

Post by reedjosh »

kube-system wrote: post #63
reedjosh wrote: post #59

Earlier quoted context omitted.

> What does "force of evil" mean anyway? Yes, subjective. But here's my belief and how I believe it applies. I believe evil is the abandonment of reason in any way. Instigation of force or coercion is an un-reason-able act no matter whether done by an individual or group of people. Currently the US is engaged in numerous instigative forceful and coercive acts. Further, much of what the US does would not be possible w…

The people who define it differently than you also use reason -- just a different line of reasoning. This is the entire issue with the phrase to begin with, there's no universal definition of what it means. It assumes a shared value system. Almost everyone who fights anyone else believes that they are right and has a reason for it.

> This is the entire issue with the phrase to begin with, there's no universal definition of what it means. It assumes a shared value system.

True it's not precise language and maybe could have been better, but I think that would require a much larger post. Still I agree with it based on my value system.

> Almost everyone who fights anyone else believes that they are right and has a reason for it.

Sure, but at least my value system will have me not only not instigating a fight, but actively avoiding people that do.

For clarity, I _never_ attempt to avoid a well reasoned argument. You've made good points, and I thank you for doing so. :)

Post reply on HN