Wikileaks Vault7

[The Human Q-Tip]

This is fucking hilarious.

Gov't is hacking everyone and everything.

The real problem. "Those god damn whistleblowers!"

They should follow the chain of command so it can be covered up at the first instance it would hurt our precious gov't.

More whistleblowers.

More leaks.


Makes me wish I had leaked everything I had access to in my time.

Do yo realize that the latest dump did not show that any of those techniques/technologies were actually used illegally? It was all "look what they can do", and then a freakout.

It is possible for virtually any intelligence technique/technology to be used against our own citizens. But if the mere possibility that something could be abused becomes the standard for what is impermissible, then we can't really have an intelligence capability at all. And the same thing applies if people are free to dump whatever they'd like into the public domain.

If anyone thinks it's a good idea to simply shut down the CIA/DIA/NSA, and our other intelligence-gathering agencies because of the potential that they may abuse their power, then be aware that you're making our troops much less effective/more vulnerable, and greatly increasing the risks to the country from foreign governments, terrorists, and criminals.

It's the equivalent of saying that we shouldn't have any police because some engage in misconduct. Maybe that sounds great to @OptimusPrime , but I'd think most of the rest of us could see why that isn't a good idea.

 

[caf]

If police engage in misconduct there is the potential for evidence to be left behind.

These tools leave no evidence and thus abuse of these tools is impossible to detect.

 

[The Human Q-Tip]

If police engage in misconduct there is the potential for evidence to be left behind.

These tools leave no evidence and thus abuse of these tools is impossible to detect.

I don't think that's any more true with one than the other. It is entirely possible for cops to fix evidence, etc., so that it can't be detected. And sometimes it can be. The same with the intelligence community. Not only is there the potential for illegal activity to be detected, but there is also the potential for whistleblowing of that illegal activity.

Anyway, your comment doesn't really address the core issue. If your point is that the intelligence community shouldn't use technology or techniques that have the potential to be abused, then just say that. But accept the consequences of that for our troops and our security.

 

[gourimoko]

Is it exploit code or is it hacking scripts.

It's exploit code.

One causes more damage than the other and the exploits may not be fixed in time.

Surely. The talk of hacking tools being released is probably a bit silly considering these are just scripts; but it's the exploits themselves that are worrying companies.

But with that said, zero-day exploits exist and go unpatched routinely. The issue here is that the public simply isn't aware of how cybersecurity works. So they think that a privately known vulnerability is a scandal; it's not. It may not be obvious to the developers that such a vulnerability exists, particularly depending upon the language and frameworks used. But with that said, the CIA and NSA are the last institutions that should be disclosing vulnerabilities in software; that's simply not their function and it actually would hamper their work in most cases.

Not disagreeing about companies needing to know. The issue is what is stolen when this is released before the fixes are in place.

I've always looked at that as the cost of doing business as a software or eCommerce company.

I mean, it's not Wikileaks' responsibility to protect software companies; nor is it the CIA's. I just can't envision a company arguing that some other entity has an ethical responsibility to protect their interests by not divulging software exploits -- particularly if we approach this argument from the ethical framework of someone in the FOSS community.

 

[Jack Brickman]

It is possible for virtually any intelligence technique/technology to be used against our own citizens.

You could extend this to any weapon, really. Should we not develop weapons as advanced as (or more advanced than) our enemies because they could be used against our own citizens as well?

Now, if we find out these things are being used against our citizens without warrants then...well, obviously that's a problem that needs to be dealt with harshly.

 

[Wrathe]

You could extend this to any weapon, really. Should we not develop weapons as advanced as (or more advanced than) our enemies because they could be used against our own citizens as well?

Now, if we find out these things are being used against our citizens without warrants then...well, obviously that's a problem that needs to be dealt with harshly.

Exactly, I have no issues w/ our Government developing cyber weapons. That's due diligence. Using them against our own citizens is a completely different matter. That's what Snowden was reporting. Not look at what they can do, but look what they're doing to you. Now you know. Decide if you're ok with it or not.

 

[gourimoko]

If police engage in misconduct there is the potential for evidence to be left behind.

These tools leave no evidence and thus abuse of these tools is impossible to detect.

What makes you think these tools leave no evidence or are impossible to detect? I would think that is virtually impossible with respect to general hacking tools across a broad spectrum of unspecified targets.

 

[Man Called X]

words

I don't even know why you want to discuss topics like this with me. I am always arguing from a completely chaotic point of view. I loathe humanity and society in general and I want nothing more than a complete societal collapse.

If anything could bring us closer to that, then I will always support that narrative. Anything that shifts the balance of power away from those with paper of imaginary worth is a good thing to me.

Now with that said, I know exactly what was dumped and I find it humorous. There's about a dozen exploits for Samsung tvs that allow remote viewing/listening. I personally just find humor in the average person being aware of its existence.

 

[Wrathe]

What makes you think these tools leave no evidence or are impossible to detect? I would think that is virtually impossible with respect to general hacking tools across a broad spectrum of unspecified targets.

For sure, if the target is something w/ an actual IT Security plan in place, someone will find a trace somewhere. That's why its important to cover your source or leave fake "fingerprints".

I'm interested, why are we (not you personally, the royal we) questioning whether the government uses these techniques on civilians? Why are we even asking that now when Snowden's leaks were about actual programs in place, operating against civilians and nobody seemed to care then. Of course they're using this against civilians. Don't worry though, they need a "warrant". I quote that, cause it's not a normal judge, this is Patriot Act era. We have a shadow court w/ a rubber stamp that prints off the needed warrants to violate your constitutional rights.

Scary times. I'm very concerned on the government's position on encryption as well. Trump showed his position on it w/ the Apple / San Bernadino phone drama, so I don't trust him on that. The last regime just nodded, smiled and never really addressed the issue. I wish Trump was president when Snowden news landed. I think the media would have done a much better job making it an issue and informing people what they needed to know now than they did then.

 

[spydy13]

Man, in times like these, I really wonder what Damien O'Connel would think.




























Oh, wait. No, I don't.

Didn't even realize he got banned. Long overdue, imo.

 

[caf]

View: https://mobile.twitter.com/wikileaks/status/841336608506970113

 

[David.]

Didn't even realize he got banned. Long overdue, imo.

I dont think he was that bad. And his last words were directed at me.

Sad.

 

[Wrathe]

I dont think he was that bad. And his last words were directed at me.

Sad.

Do you get a tear tattoo by your eye for every poster you get banned?

 

[Maximus]

WikiLeaks Vault 7 Leak Claims CIA Bugs ‘Factory Fresh’ iPhones
Published 9:22 am EDT, March 23, 2017 Updated 10:37 am EDT, March 23, 2017 24 Comments By S.J. Prince
20.7k
Share376 Tweet Share Email Follow

A visitor tries out an Apple iPhone 7 on the first day of sales of the new phone at the Berlin Apple store on September 16, 2016 in Berlin, Germany. (Sean Gallup/Getty Images)



A new WikiLeaks Vault 7 leak titled “Dark Matter” claims, with unreleased documents, that the Central Intelligence Agency has been bugging “factory fresh” iPhones since at least 2008. WikiLeaks further claims that the CIA has the capability to permanently bug iPhones, even if their operating systems are deleted or replaced.

The documents are expected to be released after a 10 a.m. EDT “press briefing” that WikiLeaks promoted on its Twitter.

View image on Twitter

Follow
WikiLeaks

✔@wikileaks
RELEASE: CIA #Vault7 "Dark Matter" https://wikileaks.org/vault7/darkmatter?cia …

9:02 AM - 23 Mar 2017


Watch a livestream of the Julian Assange led event here.



WATCH: WikiLeaks Vault 7 Livestream on CIA ‘Dark Matter’ Release
WikiLeaks has shared a link to watch the livestream about today's CIA document leak, titled "Dark Matter." Watch the Julian Assange led event here.

Click here to read more
A summary of the documents has been released on the WikiLeaks website. It reads:

Today, March 23rd 2017, WikiLeaks releases Vault 7 “Dark Matter”, which contains documentation for several CIA projects that infect Apple Mac Computer firmware (meaning the infection persists even if the operating system is re-installed) developed by the CIA’s Embedded Development Branch (EDB). These documents explain the techniques used by CIA to gain ‘persistence’ on Apple Mac devices, including Macs and iPhones and demonstrate their use of EFI/UEFI and firmware malware.

Among others, these documents reveal the “Sonic Screwdriver” project which, as explained by the CIA, is a “mechanism for executing code on peripheral devices while a Mac laptop or desktop is booting” allowing an attacker to boot its attack software for example from a USB stick “even when a firmware password is enabled”. The CIA’s “Sonic Screwdriver” infector is stored on the modified firmware of an Apple Thunderbolt-to-Ethernet adapter.

“DarkSeaSkies” is “an implant that persists in the EFI firmware of an Apple MacBook Air computer” and consists of “DarkMatter”, “SeaPea” and “NightSkies”, respectively EFI, kernel-space and user-space implants.

Documents on the “Triton” MacOSX malware, its infector “Dark Mallet” and its EFI-persistent version “DerStake” are also included in this release. While the DerStake1.4 manual released today dates to 2013, other Vault 7 documents show that as of 2016 the CIA continues to rely on and update these systems and is working on the production of DerStarke2.0.

Also included in this release is the manual for the CIA’s “NightSkies 1.2” a “beacon/loader/implant tool” for the Apple iPhone. Noteworthy is that NightSkies had reached 1.2 by 2008, and is expressly designed to be physically installed onto factory fresh iPhones. i.e the CIA has been infecting the iPhone supply chain of its targets since at least 2008.

While CIA assets are sometimes used to physically infect systems in the custody of a target it is likely that many CIA physical access attacks have infected the targeted organization’s supply chain including by interdicting mail orders and other shipments (opening, infecting, and resending) leaving the United States or otherwise.

This is a developing story.
​

 

[AZ_]

Hope this is more legit than exaggeration about the CIA bugging your TV.