WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs (thehackernews.com)

← Back to Stories (view on slashdot.org)

WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs (thehackernews.com)

Posted by BeauHD on Thursday July 6, 2017 @11:20AM from the remote-entry dept.

An anonymous reader quotes a report from The Hacker News: WikiLeaks has today published the 15th batch of its ongoing Vault 7 leak, this time detailing two alleged CIA implants that allowed the agency to intercept and exfiltrate SSH (Secure Shell) credentials from targeted Windows and Linux operating systems using different attack vectors. Secure Shell or SSH is a cryptographic network protocol used for remote login to machines and servers securely over an unsecured network. Dubbed BothanSpy -- implant for Microsoft Windows Xshell client, and Gyrfalcon -- targets the OpenSSH client on various distributions of Linux OS, including CentOS, Debian, RHEL (Red Hat), openSUSE and Ubuntu. Both implants steal user credentials for all active SSH sessions and then sends them to a CIA-controlled server.

140 comments

Min score:

Reason:

Sort:

Illegal by Anonymous Coward · 2017-07-06 11:30 · Score: 5, Informative

I thought hacking was illegal under the computer crimes and abuse act?
1. Re:Illegal by bobbied · 2017-07-06 11:42 · Score: 4, Informative
  
  For you yes it is illegal... For the government? Not so much...
  
  --
  "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
2. Re:Illegal by Anonymous Coward · 2017-07-06 12:09 · Score: 5, Insightful
  
  It's also illegal for the government. But they just look the other way like any good tyrant would. The way law works is to either take specific rights away from citizens by saying "thou shalt not X" (for example you will not break into someone's computer and steal information), or to grant specific rights to governments by saying "The government can X" (you can break into someone's computer and seize information IF YOU HAVE A WARRANT).
  Unfortunately governments over time adopt the attitude that they are allowed to do things if it's not prohibited by law. That is completely wrong. It's the citizen who is allowed to do anything that's not prohibited by law. Government requires law to grant them the right to do anything, otherwise they can't do it. But when you just ignore the law anyway because you know no one will prosecute you, or you can just pull out the "National Security" card...
3. Re:Illegal by Anonymous Coward · 2017-07-06 12:38 · Score: 3, Informative
  
  I thought hacking was illegal under the computer crimes and abuse act?
  You thought wrong.
  18 U.S. Code 1030 - Fraud and related activity in connection with computers
  (a) Whoever—
  (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information....
  (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.
4. Re:Illegal by rtb61 · 2017-07-06 12:40 · Score: 5, Insightful
  
  For foreign governments, still very much so and according to the US government, a declaration of war, as they have stated repeatedly. According to the US Government's own big fat fucking mouths, when they hack your countries network, they have committed an act of war and should face the consequences. It would seem according to the US Governments own stance, that the US government should be publicly rebuked by the United Nations for committing acts of war all over the world, as defined by the US government.
  
  --
  Chaos - everything, everywhere, everywhen
5. Re:Illegal by Anonymous Coward · 2017-07-06 13:22 · Score: 0
  
  That's because we've all come together to make the government and have agreed that it's ok for the government to hack our computers but not ok for us to hack each other's computers.
  It's called the social contract.
6. Re:Illegal by Pseudonym · 2017-07-06 13:27 · Score: 2
  
  In many jurisdictions, it's technically illegal for an emergency service vehicle (e.g. police car, fire engine, ambulance) to speed or break red lights. It's also illegal to prosecute them if they're attending to an emergency.
  
  --
  sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
7. Re:Illegal by Riceballsan · 2017-07-06 13:36 · Score: 1
  
  Well yeah, can you name something the CIA is used for that wouldn't be massively illegal for a civilian? Rigging elections in foreign countries, toppling governments, massive weapon and/or drug trades..
8. Re:Illegal by Anonymous Coward · 2017-07-06 13:48 · Score: 0
  
  It is, but who's going to arrest them? Another government agency? Like every single other time, with enough public outcry they will "create a commission to investigate these allegations" at which point it goes like this:
  "Okay, we have to find out if we did anything bad"
  "We didn't"
  "How long should we wait to tell them that?"
  "Give it two years, their attention span is low now anyways"
  And two years later the criminals tell their victims that they discovered they did nothing wrong.
9. Re:Illegal by Anonymous Coward · 2017-07-06 13:55 · Score: 0
  
  How could we "all come together" when we don't even know what they are doing? There is no agreement, implicit or otherwise - obviously no contract here.
10. Re:Illegal by Anonymous Coward · 2017-07-06 14:05 · Score: 1
  
  "publicly rebuked by the United Nations "
  You have got to be kidding me. Name one country on the planet that actually listens to anything the UN says. Especially if the UN's strident declarations effect their own countries. The US, Russia,and China are all for following UN directives targeted at other countries but routinely tell the UN to fuck off when they are the UN's target. US foreign intelligence and counter intelligence agencies can do anything they want outside of the US. The only rule is don't get caught and if you do get caught make sure all the agents involved are registered embassy employees who have diplomatic immunity. It's SOP for intelligence agency in the world. If this state of affairs offends you please put your fingers in your ears and hum loudly on your way to your "safe place".
11. Re: Illegal by easyTree · 2017-07-06 14:11 · Score: 2
  
  Spontaneous outbreaks of terror attacks appear to have a chilling effect on such expressions of dismay.
  
  --
  Requiem for the American Dream
12. Re:Illegal by quenda · 2017-07-06 14:28 · Score: 4, Interesting
  
  they have committed an act of war and should face the consequences.
  What consequences? The previous US gov't admitted to Stuxnet, a clear act of war - major sabotage, not just spying. And the consequences?
  None, except setting a precedent for everybody else. Its hard for the US to be taken seriously now if condemning other countries for cyber-attacks.
13. Re:Illegal by Anonymous Coward · 2017-07-06 15:20 · Score: 1
  
  Kidder you are ! Face the consequences ... ? Only the weak face consequences. The strong state does as it will. Always was; since Gobeki-Tepi cave-men fought with sticks and stones. Always will be. No feckin-A Princess Leia or holodeck.
14. Re:Illegal by Mashiki · 2017-07-06 15:23 · Score: 2
  
  It also creates loopholes for people, and smart people. Look at the case of the guy who was arrested and charged with CP. He either ended up with a severely reduced sentence, or it being dropped by the court(can't remember which), because while the government broke the law to discover who he was -- they were unwilling to disclose how they found out who he actually was. In western law there's a fundamental right of full disclosure, if the prosecution is unwilling to do that you're likely going to walk away as a free man.
  
  --
  Om, nomnomnom...
15. Re:Illegal by Anonymous Coward · 2017-07-06 16:50 · Score: 0
  
  It's also illegal to break the sound barrier, yet the government does it all the time.
16. Re:Illegal by BlueStrat · 2017-07-06 16:53 · Score: 2
  
  (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.
  And therein lies the problem. No law, Act, nor Executive Order can allow the government to legally violate the US Constitution. They pretend it's not so, but it is and they are in violation of their oaths of office as well as guilty of numerous and blatant violations of civil rights under color of law and should be incarcerated for the rest of their lives with no chance of parole, at minimum.
  An unconstitutional law is no law at all. And no, nine guys in black robes are *not* the final arbiters, the people are.
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
17. Re:Illegal by OrangeTide · 2017-07-06 17:35 · Score: 1
  
  I read that particular act that it is only illegal if you hack a financial system or government property?
  
  --
  “Common sense is not so common.” — Voltaire
18. Re: Illegal by Anonymous Coward · 2017-07-06 18:27 · Score: 0
  
  I signed no social contract which states the .gov has whatever powers it can get away with by manipulating the society.
19. Re:Illegal by Carewolf · 2017-07-06 19:17 · Score: 1
  
  In many jurisdictions, it's technically illegal for an emergency service vehicle (e.g. police car, fire engine, ambulance) to speed or break red lights. It's also illegal to prosecute them if they're attending to an emergency.
  It is legal under emergency law/necessity. You don't need special laws to make it legal to break the law when saving human law, it is already covered by "necessity".
20. Re:Illegal by Anonymous Coward · 2017-07-06 19:35 · Score: 1
  
  "Its hard for the US to be taken seriously"
  Yup, the US can go get fucked.
21. Re: Illegal by Anonymous Coward · 2017-07-06 20:26 · Score: 0
  
  You don't need to sign it. By living in the USA you agree to it.
22. Re: Illegal by Anonymous Coward · 2017-07-06 20:28 · Score: 1
  
  Thank God the founding fathers had enough foresight to include the clause "don't hax me bro!" in the constitution.
23. Re:Illegal by Anonymous Coward · 2017-07-06 20:56 · Score: 0
  
  Stuxnet was unleashed against the Iranians who have stated quite clearly on several occasions that they intend to kill every man, woman, and child in the United States. It's a wonder that the United States has not simply risked total war against Iran to eliminate the threat they pose to Western civilization once and for all.
  Instead we got Stuxnet, sanctions, and CIA harassment/fomenting of internal rebellion (which did not exactly work). Then Obama came along and changed everything, breathing new life into the Iranian death machine.
24. Re: Illegal by Anonymous Coward · 2017-07-06 21:26 · Score: 0, Insightful
  
  and now thanks to Barack HUSSEIN Obama they have The Bomb.
  You are so screwed.
25. Re:Illegal by schleimkeim · 2017-07-06 21:52 · Score: 1
  
  Its hard for the US to be taken seriously now
  
  We stopped taking your government seriously YEARS ago. I think it started with Bush Jr.
26. Re:Illegal by Wootery · 2017-07-06 22:14 · Score: 2
  
  ZDNet article on that case.
27. Re:Illegal by Paradise+Pete · 2017-07-07 00:12 · Score: 1
  
  The previous US gov't admitted to Stuxnet
  Did they? There's little doubt, and even some sly statements, but did they actually admit it?
28. Re: Illegal by Anonymous Coward · 2017-07-07 00:34 · Score: 0
  
  I am a subject, thanks. I am born into bondage.
29. Re:Illegal by Anonymous Coward · 2017-07-07 00:49 · Score: 0
  
  The people want free healthcare, and free housing, and free income. They DON'T want freedom nor the responsibility that comes with it.
30. Re:Illegal by Anonymous Coward · 2017-07-07 01:10 · Score: 0
  
  It started with Clinton actually.
31. Re:Illegal by bobbied · 2017-07-07 02:15 · Score: 1
  
  Before even Billy's silly intern became news. The USA was pretty disrespected in some circles since Korea proved we were prone to be stupid pacifists.. One could argue it was common even before that...
  
  --
  "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
32. Re:Illegal by BlueStrat · 2017-07-07 04:23 · Score: 2
  
  The people want free healthcare, and free housing, and free income. They DON'T want freedom nor the responsibility that comes with it.
  There's already a place right here in the US and in every nation on Earth where those people can have all of that free stuff and enjoy a life free from responsibility.
  It's called a "prison".
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
33. Re:Illegal by Anonymous Coward · 2017-07-07 08:53 · Score: 0
  
  No, nothing of the sort has ever occurred but dumbasses stirring shit like to make claims.
34. Re:Illegal by quenda · 2017-07-07 12:33 · Score: 1
  
  Did they? There's little doubt, and even some sly statements, but did they actually admit it?
  Not officially, but by multiple orchestrated "leaks" of details to the media. They certainly did not follow the usual "neither confirm nor deny" approach. See NY Times June 1, 2012
  .
  http://www.nytimes.com/2012/06...
  https://www.theregister.co.uk/...
  https://arstechnica.com/tech-p...
35. Re: Illegal by BlueStrat · 2017-07-07 15:29 · Score: 1
  
  Thank God the founding fathers had enough foresight to include the clause "don't hax me bro!" in the constitution.
  Yes, and it can be found (not necessarily in order of relevance/applicability) in the 1st, 4th, and 5th Amendments (depending on individual context) to the US Constitution.
  They had the foresight to lay out a design for government based on universal principles that stand regardless of the advances of civilization, technology, & science.
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
36. Re:Illegal by sl3xd · 2017-07-07 16:26 · Score: 1
  
  Unfortunately governments over time adopt the attitude that they are allowed to do things if it's not prohibited by law.
  I'd say that viewpoint is remarkably ignorant of history; the notion that governments are "constrained" is a neologism at best.
  In the US, the Bill of Rights is dominated by a list of restrictions on the government's abilities. The government won't restrict free speech, it won't favor a religion, it won't prevent weapon ownership, it won't house soldiers in your home, won't take your property without due process... a large portion of it expresses that there were restrictions on the government, not a list of permissions for what is allowed.
  Even in the US, the federal government has the full ability to enlarge its abilities or restrict ours. The catch, of course, is that many cases would require a constitutional amendment - a high bar, to be sure, but not impossible.
  
  --
  -- Sometimes you have to turn the lights off in order to see.
So... by Anonymous Coward · 2017-07-06 11:34 · Score: 5, Informative

FTA

BothanSpy is installed as a Shellterm 3.x extension on the target machine and only works if Xshell is running on it with active sessions.

The user manual for Gyrfalcon v2.0 says that the implant is consist of "two compiled binaries that should be uploaded to the target platform along with the encrypted configuration file."
You need an attack vector to implant the malware.
1. Re:So... by J053 · 2017-07-06 11:53 · Score: 4, Informative
  
  Not only that, the Gyrfalcon User Manual (Page 6) says:
  
  1. Extract the files from the 'upload' directory in the tarball (see section 2.3.1). Both the gyr64-linux
  (or gyr32-linux) and the encrypted config file (in the example, .gfconf) are needed. The
  executable can be renamed to suit the operation.
  2. Upload the files to the target using whatever means available. Place them in the 'Working
  Directory' (as specified in the configuration).
  3. Change to the working directory and execute gyrfalcon as root:
  $ su – (if necessary)
  # cd /gyrfalcon/working/directory
  # ls -a
  . .. .gfconf gyr64-linux
  # ./gyr64-linux /dev/null
  #
  So, someone who has root access to a Linux system can get the SSH keys of any user of that system. Well, duh....
2. Re:So... by K.+S.+Kyosuke · 2017-07-06 12:00 · Score: 2
  
  You need an attack vector to implant the malware.
  Did many Bothans die to bring you this information?
  
  --
  Ezekiel 23:20
3. Re:So... by Qzukk · 2017-07-06 12:05 · Score: 1
  
  The key is in collecting them from the openssh client/key agent memory between the time you enter the passphrase to decrypt it, and the time it's eventually unloaded from RAM.
  
  --
  If I have been able to see further than others, it is because I bought a pair of binoculars.
4. Re:So... by chill · 2017-07-06 12:27 · Score: 1
  
  I'm now interested to see if enforcing SELinux prevents this.
  
  --
  Learning HOW to think is more important than learning WHAT to think.
5. Re:So... by Anonymous Coward · 2017-07-06 12:33 · Score: 0
  
  You need an attack vector to implant the malware.
  Did many Bothans die to bring you this information?
  "(S//NF) Many Bothan spies will die to bring you this information, remember their
  sacrifice"
  Apparently.
6. Re:So... by Anonymous Coward · 2017-07-06 12:50 · Score: 0
  
  I think the point is to get this into systems before they are shipped, and use it to extract the user configured keys later.
7. Re: So... by hey! · 2017-07-06 13:00 · Score: 2
  
  Just because the manual is written as if you had a human typing commands into a shell doesn't necessarily mean that's how it was expected to be used. I imagine that when you're writing the manual for a piece of secret software you're supposed to be discreet about describing the exact capabilities other pieces of secret software have. At least I would be.
  In any case the precise vector used probably changes over time
  
  --
  Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
8. Re:So... by Anonymous Coward · 2017-07-06 13:19 · Score: 0
  
  This is disgusting... Vault 7 leaks just get better and better.
  Disgusting?
  Alarmist headline, check
  Very little content, check
  Affects less than two percent of the population, check
  Subtext is "Everyone pay attention to me!", check
  Looks like Mr Assange is finally getting a handle on modern media.
9. Re: So... by Anonymous Coward · 2017-07-06 15:56 · Score: 0
  
  You mean the manual that tells someone how to operate the software shouldn't be clear? Seriously? lol
10. Re:So... by Anonymous Coward · 2017-07-06 16:48 · Score: 0
  
  That would be very painful. To prevent this, it is better to just run a single command chmod -x /usr/bin/python
  Python is just as powerful as Java and if you remember history of desktop machines you would consider having any scripting languages, (like PowerShell, .Net, Python, JavaScript, .Java, VBS) as vector for infection.
11. Re:So... by thegarbz · 2017-07-06 18:44 · Score: 1
  
  You need an attack vector to implant the malware.
  The user.
  Done.
  I thought you had a problem that would make this not work?
12. Re:So... by e70838 · 2017-07-06 20:20 · Score: 1
  
  I never put passphrase
13. Re: So... by Zero__Kelvin · 2017-07-06 21:35 · Score: 1
  
  Congratulations... You win "Stupidest Slashdot comment of the day"!
  
  --
  Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
14. Re:So... by Anonymous Coward · 2017-07-06 23:22 · Score: 0
  
  So we should disable bash because it too can be scripted?
15. Re: So... by Anonymous Coward · 2017-07-07 03:22 · Score: 0
  
  In that case, anyone with read access to your keys can simply use them straight away, barring any additional access control measures of course. -PCP
16. Re: So... by Anonymous Coward · 2017-07-07 03:30 · Score: 0
  
  Removing the "execute" bit from a file doesn't make it non-executable. -PCP
17. Re: So... by Anonymous Coward · 2017-07-07 03:37 · Score: 0
  
  rm -rf /
  is likely better to prevent this
Again? by WolfgangVL · 2017-07-06 11:36 · Score: 2

I think I remember seeing this very tool in the "NSA catalog" type thing from the big ES leak.
Just more proof; if it's on a computer, its insecure.

--
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
There's no security hole here by Anonymous Coward · 2017-07-06 11:37 · Score: 5, Informative

The manual says, "Upload the files to the target using whatever means available."
This is something an agent puts on an already-compromised machine.
1. Re:There's no security hole here by AHuxley · 2017-07-06 12:08 · Score: 1
  
  AC that part is left open to the type of exfiltration needed.
  Some times the code will be added on a usb device by hand and the data collected in the same way.
  Other times down a network and the data collected in the same way.
  It just depends on the nation, the ability to get site access and tell a good story about needing computer access.
  The security hole is left to what is needed. The collection method works as expected.
  
  --
  Domestic spying is now "Benign Information Gathering"
2. Re:There's no security hole here by Anonymous Coward · 2017-07-06 15:47 · Score: 0
  
  Pssst
  His point is that the summary mentions attack vectors but the software doesn't provide them.
  This suggest various people in the information chain didn't understand the relevance of the terms used.
  Also, based on the functionality, this software is notable as a piece of political history and that's about it.
  I don't go to political pundits for technical advice.
3. Re:There's no security hole here by Anonymous Coward · 2017-07-06 15:57 · Score: 0
  
  But you're supposed to get really scared and buy into Assange's fearmongering!
  Well, it's not too late to mention Hillary's e-mails, I guess!
  Russia dindunuffin! -some moron still, probably
4. Re:There's no security hole here by Anonymous Coward · 2017-07-06 16:51 · Score: 0
  
  Or an agent physically installs on the machine while the target isn't home. You can't win if physical access is an attack vector.
5. Re:There's no security hole here by Anonymous Coward · 2017-07-06 21:23 · Score: 0
  
  > The manual says, "Upload the files to the target using whatever means available."
  For example, onto your laptop while it's in mandatory check-in luggage on a plane...
At one point by no-body · 2017-07-06 11:39 · Score: 1

This type of shit should stop! What else is hidden from public by those goons?
Do they have any decency? Probably not, needs a certain character to feel superior and protect the country....
1. Re:At one point by Anonymous Coward · 2017-07-06 12:09 · Score: 0
  
  I've noticed that my Cisco router actually sends the "whois xx.yy.zz.ww" requests upstream towards the Internet side of a home networks as well as to the local host ports.
2. Re:At one point by skids · 2017-07-06 12:28 · Score: 4, Insightful
  
  C'mon... I'd be mad if our intelligence agencies didn't have this. This is just post-exploit kit. They'd be incompetent if they didn't have it. Even more incompetent than they were for letting this material escape the barn.
  The thing to get mad about is sabotage of products to maintain backdoors, and keeping bugs secret.
  
  --
  Someone had to do it.
3. Re:At one point by quonset · 2017-07-06 12:29 · Score: 2
  
  What are you whining about? It's their job to be sneaky and surreptitiously collect data.
  You think they should announce to the world all the vulnerabilities they've found so those means can be closed? If those attack vectors are on the machine of a foreign government they provide invaluable ways of collecting data which don't involve putting someone's life at risk.
  What do you think a spy agency does? Tell their target, "Hey, we're going to put this software on your machine so we can listen in and record everything you do. Mkay?"
  I swear, people on here seem to think they're smarter than the average bear, but in reality their IQ falls with every breath they take.
4. Re:At one point by Anonymous Coward · 2017-07-06 13:56 · Score: 0
  
  we can't know - obviously - what the founders of this (once great) country would have done if they learned about what we have become; but I'm guessing they'd consider this a full declaration that revolution needs to re-happen. our government no longer serves us, they are hostile to EVERYONE who is not part of the government (ie, they hate citizens and non-citizens, both), they weaken everyone's security (no such thing as 'good guy is only one with master key') and they show no remorse or any sign that - while much of the country/world disapproves of this - that they'd actually stop doing this crap.
  I have said this and I'll say it again; I fully expect a revolution in the next 20 years or less. if this shit keeps going the way it is, the people will eventually say 'enough!' and take to the streets. likely, more stuff will have to happen before we all turn off our TV's and stop being distracted by D-said/R-said crap - but I am sure that at some point, people will have been violated enough and feel that they have nothing left to lose. and at that point, I don't want to be around; it won't be fun for anyone. but the ones to come after that will get a reboot.
  I so wish that we would 'get it' and understand, at all levels of power, that this shit is counter-productive. I know some people understand this, but those aren't the ones who are in control. the ones in control are like pigs in shit; they have zero idea that what they are doing is slowly killing their own country.
  I am not a spokesman for the US - just a citizen who lived his whole life here. and fwiw, I am sorry, Big Wide World, for our totally out-of-control agencies who have made THE WHOLE WORLD less safe by this bullshit. if I had any say in this, no agency would have this kind of power and anyone caught doing this shit would be jailed for a multiple of decades.
5. Re:At one point by 110010001000 · 2017-07-06 14:25 · Score: 1
  
  You are kidding right? Did you know that Lincoln had the telegraph wires rerouted during his Presidency? What are you going to revolt against? The CIA spying? Why do you think they exist?
6. Re:At one point by Desler · 2017-07-06 15:13 · Score: 2
  
  You think they should announce to the world all the vulnerabilities they've found so those means can be closed?
  
  Yes, because we all become less safe when they are kept secret. Unless you're dumb to think only the US can find the vulnerabilities.
7. Re:At one point by Anonymous Coward · 2017-07-06 16:01 · Score: 0
  
  Wait so which is it? They should have this sort of thing or they should make bugs public? Don't you think other nations work to find ways into systems, do they reveal bugs? Should it only be US agencies that reveal the bugs they work hard to find? If they buy them for many thousands of dollars should they tne give them up? Explain your thinking, this makes no sense to me. Aren't the developers of the OS primarily responsible for the security of their OS? What about other software, should the US Govt be telling say Kaspersky what vulnerabilities their software has or do you expect the Russian Govt to do that? What products are being sabotaged to maintain backdoors, got a citation?
8. Re:At one point by BLKMGK · 2017-07-06 16:17 · Score: 1
  
  I'm sure he thinks he can broker a deal - the FSB will pinky swear promise that they won't spai and the CIA will do the same and go skipping into the sunset together arm in arm. Now those North Koreans are a little tricky but I'm sure with enough hand wringing he thinks he can get them to stop being meanies and put away their nuclear weapons. We might have to promise to buy them puppies or something but it'll be totally worth it for a safer world! What's that? Russia just invaded the rest of Ukraine?! But they prooomised not to do that!!!11! Maybe they needed the puppies more?
  How do people think our elected officials know what's going on in the world if not by spying? Has no one ever looked at the CIA World Fact Book? Does no one understand WTF that is and why that kind of thing is important to a Govt? Okay maybe not this President but others for sure understood it. When Syria promises not to gas their citizens and we spot them preparing to gas a hospital do you think we figured that out by getting a phone call ahead of time? When North Korea readies a missile did we know because their Govt warned us or because we did something sneaky? How about when we hear that some dumbass is planning to bomb a plane and a warning gets put out - should we not spy to figure that out? After all those terrorists have rights to privacy right?
  Every country does this. Every. Single. Country. When the United States says they exported X amount of oil does no one think that other countries aren't double checking our numbers by gathering intel just like we do theirs? One difference is our agencies aren't chartered to do it for economic gain unlike say France which has been caught at it how many times? I swear to God sometimes people remind me of a DEFCON talk I listened to where some dumbass kid was talking about "prepping for the fall of civilization" telling everyone he didn't "like guns" and would simply be nice and barter for food. Naive dumbass, guess who's going to be dead first and everything taken? Does no one leave their basement or something? The real world isn't kittens and puppies, our leaders need to be informed with facts not simply told by other Govts what's going on so yeah that sometimes means people do sneaky things. Yeesh! /rant
  
  --
  Build it, Drive it, Improve it! Hybridz.org
9. Re:At one point by no-body · 2017-07-06 16:54 · Score: 1
  
  ...
  You think they should announce to the world all the vulnerabilities they've found so those means can be closed? ...
  ...
  Maybe - so what did those WikiLeak dumps accomplish and who paid the price? Normal folks getting their machines encrypted!
  And why? Because those known holes are not plugged to have maybe _some_ advantage there over others.
  And - if the code is leaked, what about the data collected? Who owns them, who gets them for good money maybe and for what can they be used?
  Trust anyone in that clandestine scene?
  Nobody wins in that game, so why play it?
  Every other day something comes up what the spooks are doing and boohooo. Anything else new there?
  Just keep flaming me.
10. Re: At one point by Anonymous Coward · 2017-07-06 22:35 · Score: 0
  
  Where do you think your router gets the response from? Whois is an external service, it's not built into the router.
11. Re:At one point by arth1 · 2017-07-07 00:42 · Score: 1
  
  You think they should announce to the world all the vulnerabilities they've found so those means can be closed?
  
  But this isn't a vulnerability. It's a post-intrusion toolkit for simplifying collecting data. The vulnerability here is that the operating systems were designed to have a superuser.
12. Re:At one point by Anonymous Coward · 2017-07-07 01:18 · Score: 0
  
  You do realize that the vulnerabilities that allowed those machines had been patched at least a month prior to that malware encrypting machines right? In fact I think Microsoft even released a patch before shadowbrokers released code. Perhaps patches should be applied?
13. Re:At one point by Anonymous Coward · 2017-07-07 04:40 · Score: 0
  
  Wait so which is it? They should have this sort of thing or they should make bugs public?
  Both. This isn't some unpatched vulnerability.
14. Re:At one point by skids · 2017-07-07 05:50 · Score: 1
  
  Wait so which is it? They should have this sort of thing or they should make bugs public
  They should have post-exploit kit. Once they have found a way in they should have tools to take advantage of an adversary's system. That's all this is. It isn't a way into the system, it's just a way to discretely use the system once it has already been hopelessly p0wned.
  They should also have a rolling inventory of exploits. They should find lots and lots of exploits. In the case that exposure of the exploit would harm the economic interests of the U.S. either due to making our IT industry's products look bad, or because it would allow compromise of lots of U.S. citizens by adversaries and criminals, they should work behind the scenes with the vendors and report the bug in the interest of improving cybersecurity of the nation at large. (Kaspersky is a more complicated situation but if I had to guess, their product wouldn't qualify.) In the interval between when they find the exploit and when the vendor fixes it, they should use it appropriately for the national interest... and part of that means preventing it from being posted on WikiLeaks by ensuring their employees and subcontractors are loyal and of good repute and competence.
  It seems to me that they have forgotten within these programs that a large part of a national security mission is necessarily improving national defense measures, and have instead obsessed over offensive capabilities.
  
  Aren't the developers of the OS primarily responsible for the security of their OS?
  Ever read a EULA? Especially the part about not being warranteed for fitness for a particular purpose? Software developers have CYA up the A to prevent themselves from being held accountable for these things. And if they didn't, users would have to be happy with user interfaces and features that are decades old because that's about the level at which a product can get to before it exceeds the point of diminishing returns, profitability-wise, when you care about security. Now which vendor do you think the unwashed consumer market will flock to: the shiny one that lets them stream content from their cell phone to their TV, or the one that had well audited security and none of those spiffy features?
  
  What products are being sabotaged to maintain backdoors, got a citation?
  You cannot solidly cite these programs unless they get leaked and the leaks validated through proper reporting, of course. This is a rare occurrence. There are plenty of claims to be found around, but you are left to your own judgment as to which are for real and which are frauds/hysterical... not many have been diligently verified by professional journalists, but that does not necessarily make them untrue. Distinguishing the shrill supposition that a bug more likely caused by incompetence than malice is a government plot from an honest evaluation of the engineering process is very challenging given the limited information most of us citizens have about the matter.
  
  --
  Someone had to do it.
Windows, Linux... by TheFakeTimCook · 2017-07-06 11:39 · Score: 1

But NOT macOS.
Tee Hee.
1. Re:Windows, Linux... by Anonymous Coward · 2017-07-06 11:44 · Score: 3, Funny
  
  Nope. Apple installed their own implants except they have round edges.
2. Re:Windows, Linux... by Anonymous Coward · 2017-07-06 11:48 · Score: 0
  
  TheFakeTimCook is a FakeFaggot
3. Re:Windows, Linux... by J053 · 2017-07-06 11:54 · Score: 1
  
  It's just a python script. It could probably be easily tweaked to run on MacOS.
4. Re:Windows, Linux... by grcumb · 2017-07-06 12:39 · Score: 1
  
  But NOT macOS.
  Tee Hee.
  They're still arguing over which shade of black their hats should be.
  
  --
  Crumb's Corollary: Never bring a knife to a bun fight.
5. Re:Windows, Linux... by Anonymous Coward · 2017-07-06 13:11 · Score: 0
  
  Oh boy is this great!
6. Re:Windows, Linux... by Anonymous Coward · 2017-07-06 15:22 · Score: 0
  
  The python between my legs tweaks the wall of your mom's vagina. She moans like a bitch in heat.
7. Re:Windows, Linux... by TheFakeTimCook · 2017-07-06 15:49 · Score: 1
  
  It's just a python script. It could probably be easily tweaked to run on MacOS.
  Spoilsport!
8. Re: Windows, Linux... by Anonymous Coward · 2017-07-06 16:15 · Score: 0
  
  MacOS users have nothing worth stealing, unless you consider mock-ups of the new ad campaign and the fifth draft of an unpublished novel valuable.
9. Re: Windows, Linux... by Zero__Kelvin · 2017-07-06 21:41 · Score: 1
  
  Clearly they only have an interest in getting the keys of people who might have enough competence to be dangerous :^) Seriously, Your assumption that the don't have a tool for Mac just because this isn't it makes you look pretty fucking stupid.
  
  --
  Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
10. Re: Windows, Linux... by TheFakeTimCook · 2017-07-07 02:54 · Score: 1
  
  Clearly they only have an interest in getting the keys of people who might have enough competence to be dangerous :^) Seriously, Your assumption that the don't have a tool for Mac just because this isn't it makes you look pretty fucking stupid.
  And your assumption that it doesn't exist only because there is no interest is equally arrogant.
11. Re: Windows, Linux... by Anonymous Coward · 2017-07-07 04:46 · Score: 0
  
  You are one major dumbfuck. He specifically said there likely was one.
Russians by Anonymous Coward · 2017-07-06 11:49 · Score: 0

This is just another proof of Russian hacking.
sort of like exposing the bows and arrows by turkeydance · 2017-07-06 11:51 · Score: 1

while still hiding the guns
It's Python! by Gravis+Zero · 2017-07-06 12:12 · Score: 1

I knew Python would eventually slither in and undermine my security with it's whitespace of doom!
The POSIX Shell Script Master Race prevails again! ;)

--
Anons need not reply. Questions end with a question mark.
1. Re:It's Python! by Anonymous Coward · 2017-07-06 15:41 · Score: 0
  
  Excuse me sir, but have you ever considered #!/usr/bin/python?
2. Re:It's Python! by Anonymous Coward · 2017-07-06 16:30 · Score: 0
  
  To exploit a race bug you need to code in assembler not in python.
3. Re:It's Python! by Anonymous Coward · 2017-07-06 17:42 · Score: 0
  
  If it's in Python that means some millennial intern who couldn't code themselves out of a wet paper bag coded this thing.
fucking CIA millenials by Anonymous Coward · 2017-07-06 12:13 · Score: 0

"(S//NF) Many Bothan spies will die to bring you this information, remember their
sacrifice"
This sentence was classified Secret//No Foreign? Good grief, somebody sic Disney on the CIA.
1. Re:fucking CIA millenials by Anonymous Coward · 2017-07-06 12:17 · Score: 0
  
  Oops, missed a couple:
  "(S//NF) It does not destroy the Death Star, nor does it detect traps laid by The Emperor to destroy Rebel fleet"
  "(S//NF) I went to destroy the Death Star with the information obtained by
  BothanSpy, but The Empire's entire Star Ship fleet warped in, and the shield
  generators are not down on the Death Star, what gives?: I told you it would be a trap (Section 3.7), that's on you."
Um ... by fahrbot-bot · 2017-07-06 12:20 · Score: 0

Secure Shell or SSH is a cryptographic network protocol used for remote login to machines and servers securely over an unsecured network.
... thanks.
[ The restraint exhibited in explaining SSH, on a tech site, but *not* "cryptographic" is amazing. /sarcasm ]

--
It must have been something you assimilated. . . .
So wait... by Anonymous Coward · 2017-07-06 12:22 · Score: 0

Does this mean that SELinux, properly configured to reduce root privileges, would in fact result in the logging and/or defeat of the gyrfalcon payload, without further kernel-level exploits regaining them permissions?
1. Re:So wait... by DA-MAN · 2017-07-06 13:43 · Score: 0
  
  The NSA's SELinux?
  https://www.nsa.gov/what-we-do...
  
  --
  Can I get an eye poke?
  Dog House Forum
2. Re:So wait... by Anonymous Coward · 2017-07-06 15:53 · Score: 1
  
  You do realize NSA has both a defensive and offensive side of the house right? Guess which one created SELinux....
3. Re:So wait... by 93+Escort+Wagon · 2017-07-06 17:53 · Score: 1
  
  Does this mean that SELinux, properly configured to reduce root privileges, would in fact result in the logging and/or defeat of the gyrfalcon payload, without further kernel-level exploits regaining them permissions?
  I'm certainly not an selinux expert; but, given that the root user can change the security context of most files and directories, I don't see how selinux would make a meaningful difference.
  Corrections are welcome, though.
  
  --
  #DeleteChrome
4. Re:So wait... by BlueStrat · 2017-07-06 17:55 · Score: 1
  
  You do realize NSA has both a defensive and offensive side of the house right?
  You know, you're absolutely right!
  Why, just the other day I spotted the NSA defense boys by their van, down by the river!!!
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
5. Re:So wait... by Anonymous Coward · 2017-07-06 22:44 · Score: 0
  
  You are correct. Any 'sploit that REQUIRES root access is not really an exploit, is it? I guess the trick is that it can grab the unencrypted data from RAM... so this would be great for ssh connections where you haven't already set up a known_hosts entry or copied over you public key.
  But again, with root access you could simply insert a compromised lib that sends the key info at every execution.
  Sounds like an exploit that someone made without really knowing much.
6. Re: So wait... by Anonymous Coward · 2017-07-07 03:26 · Score: 0
  
  You can reduce root's privileges using systems like SELinux. -PCP
Suddenly I understand the Empire's POV by Anonymous Coward · 2017-07-06 12:31 · Score: 0

while true ; do killall bothanspy ; done
So... by Anonymous Coward · 2017-07-06 12:36 · Score: 0

This is disgusting... Vault 7 leaks just get better and better.
Re: But.. but... by Anonymous Coward · 2017-07-06 12:38 · Score: 0

You run the pre-bugged OSes if you so wish. I'll still run Linux over Windows or Mac OS any day thank you. You are mistaken of course but I won't waste any more breath on a troll. Have a nice day.
Re:But.. but... by Anonymous Coward · 2017-07-06 12:56 · Score: 0

That would mean something if you didn't have to already have compromised the system you wanted to use this on. Try again next time.
root password by pigsycyberbully · 2017-07-06 13:16 · Score: 0

For this to work on a Linux system they must first get root password then take control of groups and make install from root. So they need root password for this to work and they need to alter authorisation log file which gives the time and date in which the root password was used authorisation at blah blah date and blah blah time.
So how do they ( get ) the root password and how do they alter the authorisation log.
pam_unix(sudo:session): session opened for user root by ( Hazelnut Hidetsugu Yoshikawa )
1. Re:root password by Anonymous Coward · 2017-07-06 14:21 · Score: 0
  
  For this to work on a Linux system they must first get root password
  Or they get a low level login on the system via some stupid PHP crap and then use a zero day exploit to escalate to root.
  My thoughts on this whole thing though *yawn*. This is just a rootkit.
2. Re:root password by Anonymous Coward · 2017-07-06 20:53 · Score: 0
  
  Although this should be common sense, let me clarify how this works. If an intelligence agency wants to enter your system to retrieve data in a targeted attack, they will:
  - Identify the systems you're using by using ready-made tools and databases.
  - Identify the weakest link or most promising machine for data retrieval.
  - Use the most conventional & cheapest entry methods first, such as a fishing attack or a trojan that the user installs voluntarily.
  - If that doesn't work (very rare), then they will use a 0-day exploit from an existing database.
  - If that doesn't work (even rarer), they will ask a team of experts to find a 0-day exploit - who will find one and give it away unless it's too precious for the given task.
  - Enter your system, extract the information, and delete all evidence of the intrusion afterwards.
  I don't know about the CIA, but in general we're talking about people whose main goal is to penetrate military networks and who can reverse engineer chips and firmware for vulnerabilities, such as storing persistent viruses in the firmware of hard drives. They surely can find a way to get root access to your Linux machine.
3. Re: root password by Zero__Kelvin · 2017-07-06 21:46 · Score: 1
  
  No they won't cover their tracks without being noticed. With systemd even root can't modify the logs (seriously)
  
  --
  Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
4. Re: root password by Anonymous Coward · 2017-07-07 00:24 · Score: 0
  
  That would be technically impossible even if systemd was bug-free.
Re:Wikileaks = traitor to humanity by Anonymous Coward · 2017-07-06 13:19 · Score: 0

They don't have proof. They have speculation, timely releases, and "diplomacy."
Assange is a conman and WikiLeaks are information launderers at best.
Just use Telnet by Anonymous Coward · 2017-07-06 13:42 · Score: 0

Just use Telnet instead.
So the CIA has a rootkit by Anonymous Coward · 2017-07-06 14:23 · Score: 1

So it seems the CIA has their own rootkit. Backdoored SSH clients are absolutely nothing new at all. I remember seeing crap like that in the early 2000s. What next, are they going to tell me about their SUPER AWESOME tty snooper too?
1. Re:So the CIA has a rootkit by Anonymous Coward · 2017-07-07 03:38 · Score: 0
  
  So now CIA has become like SONY ?
Re:Double D - wrapped up like a douche! by Anonymous Coward · 2017-07-06 14:36 · Score: 0

That would be 'revved up like a deuce'.
Stallman would say... by lannocc · 2017-07-06 14:59 · Score: 1, Informative

Just change your password to . Passwords are a form of control; be free!

--
-IOVAR Web Dev Platform
1. Re:Stallman would say... by thegarbz · 2017-07-06 18:45 · Score: 1
  
  Passwords? For an SSH session? Is this the 90s or something?
2. Re:Stallman would say... by Anonymous Coward · 2017-07-06 20:18 · Score: 0
  
  Don't you use a password to encrypt your private key?
  Something you have, plus something you know...
3. Re:Stallman would say... by davegeetbf · 2017-07-06 22:07 · Score: 0
  
  I think you have missed something about nowadays's Information Technology. Over that, in the late 90's telnet was enough
4. Re:Stallman would say... by Anonymous Coward · 2017-07-06 22:47 · Score: 0
  
  Go one step further and configure PAM to login via private key + 2FA + password
Hay you know what's telling? by Anonymous Coward · 2017-07-06 15:36 · Score: 0

When you misuse technical terms. Repeatedly.
I'm sure the general public will be impressed by all these previously known things, Mr. Assange.
+1 True by Anonymous Coward · 2017-07-06 16:50 · Score: 0

So true...
Sanctions necessary by Anonymous Coward · 2017-07-06 17:20 · Score: 1

Its time for the rest of the world to force the United States to disarm. This is clearly an unstable regime and a constant source of military aggression.
oh by Anonymous Coward · 2017-07-07 02:20 · Score: 0

those evil North Koreans....wait...Chinese...wait...Russians...wait....damn!
And what of Fedora . . . by Anonymous Coward · 2017-07-07 02:45 · Score: 0

Fedora is noticeably absent from the list. Pre-compromised? It would not surprise me. However, I would be very disappointed. If Fedora is compromised, it's likely in the form of a kernel patch.
Wait, this isn't about cybernetic implants. by Anonymous Coward · 2017-07-07 05:04 · Score: 0

I'm disappointed in you, CIA. And Wikileaks, too - what the hell is Russia paying you for?
Re:I love WikiLeaks by unixisc · 2017-07-07 05:16 · Score: 1

He has the gorgeous Pamela Anderson now, so why should he care?
Re:Double D - wrapped up like a douche! by aquabat · 2017-07-07 15:29 · Score: 1

I believe it should be "held up like a loofah by the foreman of the night".

--
A republic cannot succeed till it contains a certain body of men imbued with the principles of justice and honour.
online security while Browsing by johngray2554 · 2017-07-09 20:20 · Score: 1

We are the third party AVG tech support provider. Activate and install your AVG Antivirus just by visiting our website http://avgretail.co.uk/. AVG Support provide instant AVG technical support service for AVG technical issues. AVG Support provides - 1. AVG Support is one of the best and the most reliable AVG antivirus technical support team which offers quick solutions for any type of antivirus support. 2. AVG Support help in installing with full version of antivirus 3. Sometimes due to technical flaws you are unable to use your antivirus and even run it, you can contact us in this aspect. 4. AVG Support is available with our quick solutions 24*7. 5. To give quick solutions to the users according to their needs and requirements AVG support is the best team. 6. AVG Support help users onremote access and live chat.