With the various NSA leaks, we've seen that this is exactly the process. One suite of tools to compromise different types of hardware, and another suite of tools to be loaded depending on what outcomes are desired.
It's worth remembering that the picture looks very different for an actor that's known to access 'virgin' devices before they arrive at buyers. If you can get unlimited physical access once, suddenly your primary goal switches from remote access to creating tools that can go undetected for as long as possible.
Yeah, specifically outside of the US. Many times I've nearly bought one from puri.sm but as they're based in America I'd say there's a very high percentage any of those computers leaving the country will get spyware added in during transit.
I don't have a real problem with this - physically accessing target systems to install spyware is exactly the way they should be doing things, as opposed to finding exploits that affect us all and keeping quiet about it.
Frankly, I think this is an unrealistic expectation. The whole point of spying/intelligence is that you operate in foreign environments without their knowledge with the assumption they may have a hostile response if you're discovered. The point is to get the unvarnished truth, not the information filtered through a foreign government which has its own objectives.
You also don't need a warrant for breaking into the systems of a non-citizen outside the borders of country initiating the hack.
As long as the various intelligence agencies are not operating within the borders of their own countries, targeting their own citizens or sharing information in totality with foreign agencies as quid-pro-quo to achieve the same (Five Eyes), I have no moral issue with intelligence agencies doing what they're supposed to do.
It doesn't work like that. If the US wants to conduct an operation in the UK the UK must agree and is subject to its own laws in doing so. They have now declassified the UK/USA agreement so you can see for yourself.
> They have now declassified the UK/USA agreement so you can see for yourself.
You honestly believe that those "words on paper" have any kind of restrictive capacity on these agencies? If you really do, I've got a bridge to sell ya.
> As long as the various intelligence agencies are not operating within the borders of their own countries, targeting their own citizens or sharing information in totality with foreign agencies as quid-pro-quo to achieve the same (Five Eyes)
You mean the U.S. wholesale spying on the British for the British to circumvent British privacy laws and the British doing the same for the U.S.?
In a situation like this, there's little point in saying that intelligence agencies can't spy on Americans, because they're doing it anyway, they're just using a proxy to do so to bypass American laws.
There remains no evidence of this happening, despite countless leaks from the intelligence communities of all involved countries. The members of Five Eyes, formerly BRUSA, explicitly don't spy on each other according to the agreement. http://www.bbc.com/news/world-europe-24715168
> Frankly, I think this is an unrealistic expectation. The whole point of spying/intelligence is that you operate in foreign environments without their knowledge with the assumption they may have a hostile response if you're discovered.
Here is an article from yesterday's Hollywood Reporter where a "genealogist" who just happens to work for the US federal government and has a Top Secret security clearance and claims to use "a global network of public databases" proudly talks about stalking and doxing a local Los Angeles celebrity:
Pretty unfortunate, but this has always been a fact of life. If you are an American of interest, it would be naive to think that there is no chance a foreign intelligence service may be trying to watch you in the same way.
Once again, please stop direct linking to Wikileaks.
It's very unprofessional for anyone who works for the government, as a contractor or in a related industry to be browsing around wikileaks.
Link to a 3rd party summary if you want these people to read and comment.
edit: I don't mean that these people will lose their jobs if they visit wikileaks, just that it's unprofessional in that context. You wouldn't rear a tech article on PornHib's blog at work.
Surely the minority that do want a different source than the original could Google News and post a link in the comments to a summary they read. Stop making everyone victims. If you don't like the link, don't discuss it. It you really want to, it's not hard to find a summary and share for your colleagues: http://lmgtfy.com/?q=Dumbo%3A+WikiLeaks+reveals+CIA+system+t.... This is exactly why the domain is listed next to the headlines on HN, and why browsers show the URL when you mouse over.
If you happen to do work for a repressive government that does not want you to access wikileaks, maybe you should just refrain from clicking links to their domain?
I don't live in the US so I'm perfectly fine reading about their shenanigans, directly on from the source at WL itself.
Consider that anyone actually involved or interested and believe in the mission of Wikileaks would not read it at work. Assuming that, anyone who does read it at work (for the government) is almost certainly reading it with a biased view against the website.
If they are reading Wikileaks with a bias for the site, they probably shouldn't be working for an employer they don't agree with ethically.
Hacker news does not need to cater towards repressive organizations. People like you should not be browsing this website at all, as you are not welcome.
It is your responsibility to filter content not appropriate for your particular situation, not everyone else's. There are countless simple ways for you to avoid sites you don't want to see. Expecting everyone else to filter what they view for your sake is excessive.
Has any wealthy or powerful persons finances ever been leaked before (outside of the Panama leaks)? Or is this just popular political position to make regardless of relevance to reality?
There is a very big difference between the security of peoples financial and tax records compared to say... some 70yr olds private email account stored on a poorly secured home server. Not to mention someone like Putin would likely have layers of shell companies and layers of diversions where it wouldn't be of much use.
People like to pretend Wikileaks can hack and leak anything, and it's merely a political descision for them on who gets hacked. But they are merely a platform for leaks, publishing almost exclusively either opportunistic hacks (Manning leaks) or low hanging fruit (personal email servers) they recieve from other people. They don't direct a network of hackers to do their politically motivated bidding.
That's an honest question. He's widely assumed to be corrupt, to have a large amount of money personally, and an enormous amount more at 1+ removes held by people connected to him. There's no sign that he intends to leave power, which means he can store plenty of it without any paperwork at all - just an implicit "you'll use this as I ask if I ever do ask".
But he's also virtually untouchable, and his wealth-hiding seems to be less "no one can find it" and more "no one can prove it so undeniably that it becomes inconvenient". I'm not convinced there's anything 'leakable' that would be particularly important.
I assume he has little money. Are you assuming he is compromised in some way and getting paid for it? OR do you think that Wikileaks itself is making a lot of money?
PRE-EDIT: The comment I was replying to got deleted. It expressed the sentiment that Assange and Wikileaks should not have aspersions cast upon them based on one's unhappiness that they leaked the Podesta mails, and that an interest in truth must include truth as a whole principle, rather than wanting only truths that reinforce one's political preferences.
----
Furthermore, beyond the campaign coverage, Wikileaks has revealed a lot of non-election related things over the last year, including CIA programs to remotely hijack any Samsung SmartTV and turn it into a listening device.
Wikileaks appear to be staying true to their mission. It's sad that there is such a strong impulse to discredit the organization as a whole, and ignore/derail large amounts of the absolutely critical work they are doing, just because the group exposed the corrupt practices of one's favored political candidate.
Well, the first several tweets in their stream right now are: Project Dumbo (this story, a leak against the CIA), a leaked series of documents on Swedish arms sales to India, a link to leaked transcripts of Trump's calls with Mexican and Australian leaders, a criticism of the Washington Post's decision to leave "minor spelling and grammatical errors" in the leaked documents intact (as these could be useful in identifying the leaker), a criticism that U.S. interference in Venezuela has worsened their governance crisis, and finally, two tweets that link to leaked phone calls which strongly imply Seth Rich was Wikileaks's source for the Podesta mail dumps.
That seems to be pretty much what you'd expect from Wikileaks, no? A bunch of links to raw documents and cited critiques on international meddling and journalistic practice? That stream includes a criticism of U.S. meddling in international affairs, two leaks against the Trump admin, and a criticism of the WaPo's incompetence in sanitizing their leak, thus risking their inside man.
How does it reveal "the side" that Wikileaks is on? If it's simply a matter of willful blindness, please enlighten me; I've got my eyes open here.
They are on the side of transparency and seek to correct propaganda spread about them. They did not choose to be the left's whipping boy, but are in a position of defense.
All of this is predicated on some clear and present danger. Is there some? Where?
Every time someone tests airport security, the tests reveal massive holes and the terrifying ease with which security can be avoided. And yet, we have no terrorism.
We have a massive bureaucratic system of threat avoidance -- and we seem to be missing a threat.
"...is run by the field agent directly from an USB stick; it requires administrator privileges..."
So?
This just in - people with physical and administrative access to a machine can install monitoring software - news at 11. Be sure to tell every MSP or Enterprise IT group to tune in.
Just because a threat vector is well known and not cutting edge does not make the SPECIFIC information of its existence, implementation, and capability completely worthless
Just very very close to worthless. Other than CIA and security cams, I'm straining to figure out what is worthful about this story. Can you help us out?
Confirmation that this is something real and not a theoretical risk. Similarly to Snowden, it wasn't newsworthy because it was possible and probably done, it was newsworthy because it existed and was currently done. (obviously the scope of this news is much more reduced)
If you are a US citizen, that tells you how you tax money is being spent. If you are a foreigner, you may have a few more ammunitions to get the funding for whatever security project you are working on.
Even on HN very few front page items are really worthy of anything more than procrastination material and it succeeded perfectly well at that: both you and I had better things to do than comment on this article.
That's a very blasé attitude btw, reminds me of the first time I have seen a wild tortoise, my family just commented: "yeah I see them all the time on TV, what's the interest?"
This was public then and you can expect the black hats knew this years before. So again, what is new about this other than CIA? Yes, the CIA does these things; they wear black hats and that's also something we've known for quite some time.
Perhaps a more enlightening article would have been a wiki dump of manufacturers and distributors of these 'security' cameras not giving a shit about this problem.
From my comment, the SPECIFIC details of the tool's concepts of operation, implementation, and capability.
The field guide provides great detail on operations and limitations of a specific existing tool (sample GUI screen shots, potential detection threats from personal security products and full crash dumps, detection of cam software process restarts, abilities to stall NIC cards, abilities to BSOD, ability to corrupt existing files, limitations based on cam emulation, limitations of previously saved cam files, the tool's PE names(32bit wscupd.exe, 64bit running outside of system32 wermgr.exe. GUI.exe present in the same folder as above PEs), example of the log.txt file written to the attacking USB, information on differences between winXP requirements vs other systems(scanner.sys driver needs)).
First, that is CBP scooping up data at the border, not the CIA. If the CIA were targeting you, you would not know.
Second, CBP asks for your password. This is not the same as an administrator password, and certainly in the case of some business travelers, they may not know the admin creds.
64-bit XP is MOST CERTAINLY supported by this attack - it's the same kernel/codebase as Server 2K3 and Server 2K3 is indeed attackable with Dumbo since it's the same Vista kernel and codebase.
And if 32-bit XP is supported, you can almost guarantee that Windows 2000 is supported by this attack as well, since XP is literally built on the 2K kernel.
Well, never could say I trusted Wikileaks with 100% accurate information.
You know, the CIA could probably avoid a little public push-back simply by not naming their system penetration components like the demented 1984 creeps that they are.
"The Brutal Kangaroo project consists of the following components: Drifting Deadline is the thumbdrive infection tool, Shattered Assurance is a server tool that handles automated infection of thumbdrives (as the primary mode of propagation for the Brutal Kangaroo suite), Broken Promise is the Brutal Kangaroo postprocessor (to evaluate collected information) and Shadow is the primary persistence mechanism [...]"
It's a shame that when I see "Wikileaks reveals CIA" I'm thinking "Hmm, I wonder what's happening today RE Russia" instead of being concerned with the actual release.
Right - it seemed like they supported "the people" in the early days. They exposed Bush and Obama when they had things worth exposing.
Then came the promises of damning Bank of America leaks that never materialized, holding on to Guantanamo docs until NYT scooped them, the 2010 insurance file that was never cracked, the 2016 insurance file that was never cracked, ...
> Right - it seemed like they supported "the people" in the early days. They exposed Bush and Obama when they had things worth exposing.
Well they're still supporting "the people", just not the ones you align with. Which of course means they've lost all credibility and we should ignore them now, right?
How are they supporting the people? How does this benefit society? All this does is attempt to take away the spotlight from other shit happening in our country. Every major country develops hacking software. This isn't news. This isn't even surprising or ground-breaking. It's not even that invasive, it requires physical access AND an admin account!
This is just a distraction. Society is no better off with this information being public.
Hah no, they lost credibility with the Turkey emails. They hoard secrets yet dumped those without even checking to see what they were - what is that about?
plus it's really only American/+hegemony "leaks" they traffic in these days. I'm sure there's much more juicy Russian/Putin-esca malware and intelligence tools, policies, etc. Granted, those are often obscured in black market, or other 3rd parties, at least based on what we know of, but Brian Krebs is doing a much better job in "exposing" things than Assange at this point.
There is a strong circumstantial case for WikiLeaks being either compromised or having caved to threats from someone. Most of the evidence points to Russia but in the intelligence world you can never be sure. Could just as easily be someone who wants us to think it is Russia. Welcome to the puzzle palace.
I think WikiLeaks started with noble intent but it's really the depths of naivete to think a small volunteer org can play spy games with the big boys.
What we need is a fully decentralized WikiLeaks type platform that is easy enough to use that regular non crypto nerds can use it. No identifiable centralized organization can really be trusted to be objective or impartial or to be resistant to compromise.
A lot of the problems seem to be connected to Assange's leadership. That was the big reason for the 2010 exodus of Wikileaks members, and it seems like the organization has steadily declined since then (and now they're doing bizarre things like pushing the Seth Rich conspiracy).
Yes. From all sides. It's sad thing to witness because my naive young self viewed social media as the promise of free information flow, honest interaction and entertainment. I guess that was wishful thinking.
With every new publication Wikileaks just confirms it's now just an agency of the Russian Goverment whose purpose it's to undermine the confidence of the american people in their institutions.
The title is misleading. This tool is to mute all the speakers, disable all the cameras and network adapter. I think it's required for a meeting etc. A better program maybe just pull the power off.
Since the purpose of the software is to "disable webcams, microphones" (the "takeover" part is not implied in the text) using a USB stick one my assume it more efficient to use the power switch instead...
Can webcams and microphones be turned on without turning on the hardware indicator lights by someone who doesn't have physical access to the device in question?
100 comments
[ 5.0 ms ] story [ 152 ms ] threadmaybe they have stuff like james bond watches that can burn stuff with lasers & stuff.
Dumbo itself needs admin access, but nobody said they don't use multiple tools in combination.
https://puri.sm/learn/hardware-kill-switches/
https://puri.sm/learn/intel-me/
You also don't need a warrant for breaking into the systems of a non-citizen outside the borders of country initiating the hack.
As long as the various intelligence agencies are not operating within the borders of their own countries, targeting their own citizens or sharing information in totality with foreign agencies as quid-pro-quo to achieve the same (Five Eyes), I have no moral issue with intelligence agencies doing what they're supposed to do.
But this is exactly how it works under the precise legal framework you've laid out. This is the problem.
To attack allies internal enemies needs to be prohibited.
You honestly believe that those "words on paper" have any kind of restrictive capacity on these agencies? If you really do, I've got a bridge to sell ya.
You mean the U.S. wholesale spying on the British for the British to circumvent British privacy laws and the British doing the same for the U.S.?
In a situation like this, there's little point in saying that intelligence agencies can't spy on Americans, because they're doing it anyway, they're just using a proxy to do so to bypass American laws.
Here is an article from yesterday's Hollywood Reporter where a "genealogist" who just happens to work for the US federal government and has a Top Secret security clearance and claims to use "a global network of public databases" proudly talks about stalking and doxing a local Los Angeles celebrity:
http://www.hollywoodreporter.com/features/angelyne-la-billbo...
Here is some old news about NSA analysts stalking spouses/girlfriends/women they were interested in:
https://www.washingtonpost.com/news/the-switch/wp/2013/08/24...
CIA/NSA analysts now think that abusing their illegal domestic surveillance programs to stalk and dox people is a fun hobby.
It's very unprofessional for anyone who works for the government, as a contractor or in a related industry to be browsing around wikileaks.
Link to a 3rd party summary if you want these people to read and comment.
edit: I don't mean that these people will lose their jobs if they visit wikileaks, just that it's unprofessional in that context. You wouldn't rear a tech article on PornHib's blog at work.
I don't even work for the government
I don't live in the US so I'm perfectly fine reading about their shenanigans, directly on from the source at WL itself.
If they are reading Wikileaks with a bias for the site, they probably shouldn't be working for an employer they don't agree with ethically.
There is a very big difference between the security of peoples financial and tax records compared to say... some 70yr olds private email account stored on a poorly secured home server. Not to mention someone like Putin would likely have layers of shell companies and layers of diversions where it wouldn't be of much use.
People like to pretend Wikileaks can hack and leak anything, and it's merely a political descision for them on who gets hacked. But they are merely a platform for leaks, publishing almost exclusively either opportunistic hacks (Manning leaks) or low hanging fruit (personal email servers) they recieve from other people. They don't direct a network of hackers to do their politically motivated bidding.
https://www.c-span.org/video/?431852-1/william-browder-overt...
edit: I was having trouble with the C-Span player recently, so here's a youtube cap. https://www.youtube.com/watch?v=S-RsAGjUXtg
One of the senators put it well when they said something like 'it plays out like a novel nobody would buy'.
That's an honest question. He's widely assumed to be corrupt, to have a large amount of money personally, and an enormous amount more at 1+ removes held by people connected to him. There's no sign that he intends to leave power, which means he can store plenty of it without any paperwork at all - just an implicit "you'll use this as I ask if I ever do ask".
But he's also virtually untouchable, and his wealth-hiding seems to be less "no one can find it" and more "no one can prove it so undeniably that it becomes inconvenient". I'm not convinced there's anything 'leakable' that would be particularly important.
----
Furthermore, beyond the campaign coverage, Wikileaks has revealed a lot of non-election related things over the last year, including CIA programs to remotely hijack any Samsung SmartTV and turn it into a listening device.
Wikileaks appear to be staying true to their mission. It's sad that there is such a strong impulse to discredit the organization as a whole, and ignore/derail large amounts of the absolutely critical work they are doing, just because the group exposed the corrupt practices of one's favored political candidate.
It takes a certain willful blindness to think otherwise.
That seems to be pretty much what you'd expect from Wikileaks, no? A bunch of links to raw documents and cited critiques on international meddling and journalistic practice? That stream includes a criticism of U.S. meddling in international affairs, two leaks against the Trump admin, and a criticism of the WaPo's incompetence in sanitizing their leak, thus risking their inside man.
How does it reveal "the side" that Wikileaks is on? If it's simply a matter of willful blindness, please enlighten me; I've got my eyes open here.
Every time someone tests airport security, the tests reveal massive holes and the terrifying ease with which security can be avoided. And yet, we have no terrorism.
We have a massive bureaucratic system of threat avoidance -- and we seem to be missing a threat.
So?
This just in - people with physical and administrative access to a machine can install monitoring software - news at 11. Be sure to tell every MSP or Enterprise IT group to tune in.
If you are a US citizen, that tells you how you tax money is being spent. If you are a foreigner, you may have a few more ammunitions to get the funding for whatever security project you are working on.
Even on HN very few front page items are really worthy of anything more than procrastination material and it succeeded perfectly well at that: both you and I had better things to do than comment on this article.
That's a very blasé attitude btw, reminds me of the first time I have seen a wild tortoise, my family just commented: "yeah I see them all the time on TV, what's the interest?"
https://www.wired.com/2012/05/cctv-hack/
This was public then and you can expect the black hats knew this years before. So again, what is new about this other than CIA? Yes, the CIA does these things; they wear black hats and that's also something we've known for quite some time.
Perhaps a more enlightening article would have been a wiki dump of manufacturers and distributors of these 'security' cameras not giving a shit about this problem.
But hey, Snowden.
The field guide provides great detail on operations and limitations of a specific existing tool (sample GUI screen shots, potential detection threats from personal security products and full crash dumps, detection of cam software process restarts, abilities to stall NIC cards, abilities to BSOD, ability to corrupt existing files, limitations based on cam emulation, limitations of previously saved cam files, the tool's PE names(32bit wscupd.exe, 64bit running outside of system32 wermgr.exe. GUI.exe present in the same folder as above PEs), example of the log.txt file written to the attacking USB, information on differences between winXP requirements vs other systems(scanner.sys driver needs)).
Second, CBP asks for your password. This is not the same as an administrator password, and certainly in the case of some business travelers, they may not know the admin creds.
Wikileaks will next reveal water is wet. Why does anyone pay attention to these charlatans?
And if 32-bit XP is supported, you can almost guarantee that Windows 2000 is supported by this attack as well, since XP is literally built on the 2K kernel.
Well, never could say I trusted Wikileaks with 100% accurate information.
"The Brutal Kangaroo project consists of the following components: Drifting Deadline is the thumbdrive infection tool, Shattered Assurance is a server tool that handles automated infection of thumbdrives (as the primary mode of propagation for the Brutal Kangaroo suite), Broken Promise is the Brutal Kangaroo postprocessor (to evaluate collected information) and Shadow is the primary persistence mechanism [...]"
Regardless of the authenticity of the information, they clearly only release information when it is politically beneficial for their(?) motives.
Then came the promises of damning Bank of America leaks that never materialized, holding on to Guantanamo docs until NYT scooped them, the 2010 insurance file that was never cracked, the 2016 insurance file that was never cracked, ...
Well they're still supporting "the people", just not the ones you align with. Which of course means they've lost all credibility and we should ignore them now, right?
How are they supporting the people? How does this benefit society? All this does is attempt to take away the spotlight from other shit happening in our country. Every major country develops hacking software. This isn't news. This isn't even surprising or ground-breaking. It's not even that invasive, it requires physical access AND an admin account!
This is just a distraction. Society is no better off with this information being public.
I think WikiLeaks started with noble intent but it's really the depths of naivete to think a small volunteer org can play spy games with the big boys.
What we need is a fully decentralized WikiLeaks type platform that is easy enough to use that regular non crypto nerds can use it. No identifiable centralized organization can really be trusted to be objective or impartial or to be resistant to compromise.
There is so much agenda driven propaganda on social media now.
But hey, nothing grows at a regular speed and in straight line, this may still happen.