WikiLeaks Reveals the 'Snowden Stopper': CIA Tool To Track Whistleblowers (zerohedge.com)

schwit1 quotes a report from Zero Hedge: As the latest installment of it's "Vault 7" series, WikiLeaks has just dropped a user manual describing a CIA project known as "Scribbles" (a.k.a. the "Snowden Stopper"), a piece of software purportedly designed to allow the embedding of "web beacon" tags into documents "likely to be stolen." The web beacon tags are apparently able to collect information about an end user of a document and relay that information back to the beacon's creator without being detected. Per WikiLeaks' press release. But, the "Scribbles" user guide notes there is just one small problem with the program: it only works with Microsoft Office products. So, if end users use other programs such as OpenOffice of LibreOffice then the CIA's watermarks become visible to the end user and their cover is blown.

Comments

Next item on News at 10

[Alain Williams]

LibreOffice is just a Russian tool to help their spies in the USA. Presidential order to ban its use.

Air gap?

[Anonymous Coward]

Or just use a machine not connected to any network when you open the files! Anyone who is opening stolen classified docs is going to use an air gapped machine

Re:Air gap?

[DontBeAMoran]

Or you could simply use a MacBook Air. It's got Air in its name so you know it's secure.

Yeah, sure

[zm]

it only works with Microsoft Office products

That's what they want you to think.

MS's role?

[vistic]

Is this suggesting cooperation from MS?

Is it MS' software that was reading these tags and relaying them to some other process that phones it home to the CIA? Or does MS' software do that directly?

Re:MS's role?

[AHuxley]

The understanding that some member of the press will take the document back to work or networked home desktop computer and double click on the icon.
As they read the document the network makes a connection.
Its about the idea of the average reader in an average network location given the origin of the documents and their daily habits and the expectation of software they are provided with.

If a document is ever found the in the wild, it looks like malware with a good cover story to read while the code reports the user.
Add in OS X, Windows and Linux OS detection, complex ip reporting that works and a lot of different security researchers get interested and that adds interest to the document.
A "CIA" document with MS malware, thats just malware with better than average bait to get the user to open it.
A CIA document with unique phone home code that spans different OS's in very interesting ways would add to the CIA part.
Sometimes simple is better given the tools the reader is expected to use daily. The reader could be expected to us MS software to see all the document and uncover other details in the document.
A member of the press will want to look for any details in the document. Dates, notes, draft, corrections, history. Names, locations, officials that can be tracked to their job descriptions. If such simple facts hold, it can be passed on to document experts for further consideration.
A member of the press does not know who else has the document and could be expected to want to read and understand and then get published.
A security consultant looking over the document first could see rivals publishing first or finding details in the hours the security consultant was working.
A person who understood security issues could take the document to a special computer and fake network and see how the document responds in a MS Windows and MS application setting.
Does it phone home, what and how much data does it risk when it phones home.
Same document, very different first approaches. The understanding of set time to publish and the need to publish will push back decades of expected document security advice.
The US press does not care if they are tracked to their office as they have freedom to publish and freedom after publication. Read first, have the document looked over, get the story out.

A CIA version of FIRSTFRUIT. "The Most Intriguing Spy Stories From 166 Internal NSA Reports" (2016-05-16) https://theintercept.com/2016/...
"scanned 350 press items daily for “cryptologic insecurities” and maintained a database called FIRSTFRUIT with “over 5,000 insecurity-related records” ranging from “espionage damage assessments” to “liaison exchanges.”"

Re:MS's role?

[Gravis Zero]

Is it MS' software that was reading these tags and relaying them to some other process that phones it home to the CIA? Or does MS' software do that directly?

It's much less nefarious than that but it's criminally stupid on Microsoft's part.

The article seems to indicate that word documents have the ability to grab online resources that are referenced within documents. I suspect the tool merely embeds a reference to a transparent image that must be grabbed from a CIA controlled server. Effectively, word documents are more like html documents that can embed resources or load them from an URI.

Re:ha?

[vtcodger]

"Why would the beacons be limited to MS-products reading MS Office documents?"

I'd assume the beacons use some sort of macro that's unique to MS products or that works differently in their free software equivalents -- like maybe asking permission before phoning home.

That's the trouble with being a spook. All those persnickety details one has to worry about.

"Snowden stopper" ? Whistleblowers ?

[GuB-42]

Is there something in the leaked documents that mention Snowden or whistleblowers?
This is a watermark system system mostly intended to unmask foreign spies. It wouldn't have stopped Snowden since he used airgaps and released everything at once after leaving and was quickly caught after that.
It looks similar to the kind of tool content owners use to track pirates.
Not all secret documents are stolen by whistleblowers and journalists, far, far from it.