Don&#x27;t get a false impression, everyone is hacking everybody.Some are just better at hiding it.

A slight correction: &quot;Germany is an US occupied country since the end of WWII&quot;.This is the truth about Nato, friendship between US and Japan, EU countries, South Korea, etc... There are no friends in geopolitics, only masters and slaves.

Germany knows they&#x27;re there, are you kidding?

European governments have agreements with the CIA to spy on their own citizens (which is in illegal for them do), in exchange for their spy agencies spying on American citizens.

I hope Europe and Germany especially finally wake up and start kicking out these pests. The US&#x2F;CIA is conducting crimes against humanity on foreign soil. Like the drone war. The US may not be part of the international court but Germany is.

Do you have any examples of them being glossed over?

&gt; I&#x27;m not sure how Trump&#x27;s election is going to change that; if anything it might produce the opposite effect since these agencies seem to be feuding with Trump on some levelA big part of Trump&#x27;s appeal is that he&#x27;s seen as anti-establishment. I don&#x27;t think it&#x27;s unreasonable to expect that he may make significant changes at those agencies as a result of their &quot;feuding&quot; with him.&gt; wikieaks is a pro-Trump organizationI don&#x27;t believe that for a moment. WikiLeaks helped Trump&#x27;s campaign, certainly - but their reason for doing so was orthogonal to Trump himself.If WikiLeak&#x27;s behavior during the 2016 election was driven by anything personal or partisan, I would say it was Assange&#x27;s own personal vendetta against Hillary Clinton.

The tech community has been pretty up in arms against the three letter agencies ever since Snowden&#x27;s revelation, so I&#x27;m not sure how Trump&#x27;s election is going to change that; if anything it might produce the opposite effect since these agencies seem to be feuding with Trump on some level. Besides, wikieaks is a pro-Trump organization so I doubt that Trump losing the election would have caused them to go more softly with their criticisms of the government.

The best offense is a good defense. Improving the quality of software in general would be far more beneficial than developing zero-day short-sighted tools.

I haven&#x27;t heard of RU attempts to Balkanize USA; could you please elaborate.

I&#x27;m not a US citizen, but if I was, I would want professionals sworn to defend my country and the constitution to be able to modernize their capabilities. Today, these tools are essential to defense. It may turn out to have been the best defense against RU attempt to Balkanize USA.

&gt; Anyone that thinks the Trump administration is going to lead the charge on reforming these agencies is foolhardy.I think they were saying that the public (and tech community especially) will demand the reforms because they view Trump as nefarious; not that Trump &amp; co will freely relinquish them.

Anyone that thinks the Trump administration is going to lead the charge on reforming these agencies is foolhardy.Governments rely on information to function.Once an administration comes into power and sees the amount of information provided to them through these means, there&#x27;s no way they would relinquish it in any meaningful sense.

&gt; We used to believe that free and open societies would naturally prosper compared to authoritarian&#x2F;totalitarian societies but what if that was all a lie?Then give up your freedom and start advocating for monarchy in America.

If we are ever going to be dominated by something, I wish it&#x27;s an Artificial Superintelligence

I agree but unless every other nation stops doing this there is little value in being the only &quot;clean&quot; country (assuming somehow we stop). And what are the implications of doing so? We used to believe that free and open societies would naturally prosper compared to authoritarian&#x2F;totalitarian societies but what if that was all a lie? &quot;Five Eyes&quot; dates back to the 1940&#x27;s, ECHELON at least the 1980&#x27;s - none of this is new. Maybe we are all just naive to the realities of geopolitics? Is this just the modern version of &quot;We sleep soundly in our beds because rough men stand ready in the night to visit violence on those who would do us harm.&quot;?Personally, I&#x27;d rather live in a world dominated by America&#x2F;Europe than one dominated by Russia or China. All parties have lengthy histories of atrocious behaviour but the US&#x2F;Europe doesn&#x27;t have a &quot;Great Firewall&quot; and critics of our leadership are not disappeared (yet?). I just hope &quot;If you want a vision of the future, imagine a boot stamping on a human face - forever.&quot; remains fictional....

This comment is just too depressing and accurate. It kills me I voted for obama and the dems, and they just spied on people nonstop. It is uniparty...

The same way Obama&#x27;s election was going to bring transparency and &quot;change&quot;?

In this case the enemy of your enemy is a deranged megalomaniac. I&#x27;ll take the enemy thanks.

This had the potential of being a positive development brought by Trump&#x27;s election: many behaviors by the US three letter agencies that were glossed over for the past 8 years (due to the party in power being &quot;on the right side of history&quot;) are again reprehensible and deemed a threat to be fought by the tech community.

Indeed, that&#x27;s what the doc implies. They say they reckon the CIA has no recourse. Probably sue-able for breaking their employment contract where they presumably agree to never disclose anything, regardless of classification level. But doubtful that&#x27;d be a federal crime.

Or their life expectancy would decrease significantly.

Does that mean that someone who leaked them could not be prosecuted? Or simply that they would be prosecuted under some other law?

One very interesting thing is that the exploits, rootkits, etc are all unclassified and the CIA has no copyright on them either. The logic is supposedly that an agent putting a classified rootkit&#x2F;trojan&#x2F;whatever on a machine is mishandling classified information and thus it would be illegal.

The &quot;with no just cause&quot; part of the argument is what scares me because the government&#x27;s idea of a just cause for domestic spying and my own, are often very, very different.

&gt;&gt; So, now, you get to worry about anybody else that might have this toolset.You also have to consider who has the capability to actually use these tools - its not like they come with a user manual. Could Joe Schmo download these and start using them tomorrow? Probably not.Also, I&#x27;m pretty sure this isn&#x27;t &quot;the entire hacking capacity of the CIA&quot;. If you consider all the stuff that came out with the Snowden leaks, you&#x27;d think this is more likely the tip of the iceberg in terms of tools they&#x27;re currently using. I would think they&#x27;re developing new tools and techniques daily.

One cause for concern is that the CIA appears to not only have lost control of the documentation, but of the tools themselves:&quot;Recently, the CIA lost control of the majority of its hacking arsenal...and associated documentation. This extraordinary collection...gives its possessor the entire hacking capacity of the CIA.&quot;So, now, you get to worry about anybody else that might have this toolset. (Not withstanding your note that some of it might have already been available)

Again, I think there is a difference between the desired and realistic roles of an intelligence agency in disclosing exploits. Sure, I would hope they disclose them. But at the same time if they are actively using an exploit, I have pretty much no expectation of them disclosing it.I think this has way more to do with our reference-point than anything else. My expectations were never quite as high!

Not to nitpick, I absolutely agree that the NSA should be responsible for disclosing this type of information to help secure the USA and its infrastructure.The CIA on the other hand has clear (though not always followed) directive to only act outside the US and to act against foreign nationals.It&#x27;s less clear to me that they should be required to disclose these. Another post makes the claim that the CIA may have lost these, that case seems clearer that they must disclose to protect US interests.

&gt; this is exactly what I expect a spy agency would be doingFrom Wikileaks&#x27; overview:&quot;In the wake of Edward Snowden&#x27;s leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis — rather than hoard — serious vulnerabilities, exploits, bugs or &quot;zero days&quot; to Apple, Google, Microsoft, and other US-based manufacturers.
...
&quot;Year Zero&quot; documents show that the CIA breached the Obama administration&#x27;s commitments. Many of the vulnerabilities used in the CIA&#x27;s cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals.&quot;By not releasing this information to technology companies affected, they are increasing the risk of the same exploits being used against high profile US targets.

I believe that in my heart as well. However, we don&#x27;t currently live in a world with a federated global government. The recent election in the US highlighted that people do divide the world into imaginary lines on maps and it had a slogan: AMERICA FIRST. It&#x27;s not just the political class that sees these divisions, it&#x27;s a majority of the citizens.How would you spark a revolution in people&#x27;s thinking?

That has less to do with how I feel and more to do with how the CIA is setup. Their role in domestic affairs is severely restricted, that is primarily the job of the FBI which has more requirements to conduct &quot;searches&quot;. For them to be operating to the fullest extent of their perceived role, I can&#x27;t find myself to be upset.

That some governments use that kind of tribal moral relativism to justify war does not mean that war cannot be waged for justifiable and morally good reasons.

&gt; Why do you believe the world should be divided into &quot;people who were issued bits of paper by my overlords&quot; and &quot;people who weren&#x27;t&quot;?Because different people, and different groups of people, have different beliefs and intentions. The current divisions, such as nation states, may seem arbitrary, but some of them are currently necessary.We quite simply do not live in a unified utopia as some posters here have deluded themselves into believing (which is an easy trap to fall into when one lives in a well-fed, massively rich democracy where one wants for nothing, such as the ones we all live in).Like it or not, these divisions exist, and will continue to exist well beyond our lifetimes. Groups of humans want to dominate other groups, to exterminate them, or worse. The divisions are necessary to protect the things we value, such as social progress, our loved ones, our innovations, and so on.In short, there is still a very clear and objective distinction between good and evil in the collective human species, and this leads to the development of the divisions with which you&#x27;re uncomfortable.Thankfully, such feelings of &quot;that&#x27;s icky!&quot; are not (yet) a primary factor in the decision-making process with respect to defending our side of the line. If it were, we wouldn&#x27;t be having this discussion. We wouldn&#x27;t be able to have many discussions at all, and particularly not on a medium so free as this one. We&#x27;d probably be doing manual labor in between sessions of worship to some supreme leader or god-authority.Yeah, I&#x27;ll... I&#x27;ll take those divisions for now, please.

There&#x27;s a big difference between war and spying. Accurate intelligence can actually prevent wars as it keeps governments honest about their movements and actions. It can also limit the damage of aggressive actions as it allows us to help target only the actual enemies rather than the enemies plus everyone in the entire village (obviously not 100% accurate).Your claim that having the tools to spy on people is inherently unethical, but I don&#x27;t buy that. The ability to hack a TV is nowhere near the ability to destroy a city with a WMD. It&#x27;s not even on the same slope.

&gt; If these actions are being done domestically against US citizens, with no just cause sure I will get upset, but that has yet to be seen.May I just ask, why does this distinction matter? Why do you believe the world should be divided into &quot;people who were issued bits of paper by my overlords&quot; and &quot;people who weren&#x27;t&quot;?I never understood this division in other people&#x27;s heads. It leads to all sorts of philosophical problems, like for example people believing that war is ethical.

They provided an overview which I read through, but I find it a bit silly to expect any single person to read through the entire report and fact-check it as well. That is what journalists are for.

So you didn&#x27;t read any of it nor wait for anyone else to but have already come to a number of overarching conclusions and dismiss the release as whole?I guess we can go ahead and close this particular thread then. If you don&#x27;t want to read any of the source materials, you could possibly at least make the effort to respond to the various philosophical or policy questions this poses, that takes only an opinion.

This is a past revelation that was already investigated, no? Without any direct connection to the current release it muddies the waters.

&gt;What exactly in the admittedly shortened list am I supposed to be upset about? It makes no distinction between US citizens and overseas parties. If these actions are being done domestically against US citizens, with no just cause sure I will get upset, but that has yet to be seen.From the Reppublica article: &quot;Three years ago the news that the Agency had spied on the US Senate intelligence committee&#x27;s years-long effort to investigate CIA&#x27;s tortures by penetrating the computers of the committee staff members sparked public outrage and political fury.&quot;

That type of hyperbole isn&#x27;t helpful. 0-days are hardly equivalent to atomic bombs, much known and patched vulnerabilities.

&gt; this is exactly what I expect a spy agency would be doingLoosing their &quot;cyber&quot; equivalents of atomic bombs after they deemed it unnecessary to improve the protection of the US against such those weapons is what you expect?

Didn&#x27;t you know, the best way to ensure the citizenry is informed, is to keep lots of secrets?!?

I&#x27;m sorry but I didn&#x27;t realize it was a requirement for spies to exist to have a free society.

I would also expect a spy agency to be hoarding exploits. I don&#x27;t think that&#x27;s the concerning part of the reveal. Here&#x27;s what I gather are the main issues the analysis discusses.1. Poor control of the resources means a proliferation concern. Hacking tools are not classified, because it would then be illegal to deploy them if they were. But leaving them unclassified makes it easier for them to spread outside of the agency.2. The CIA is duplicating the NSA&#x27;s capabilities for no real reason other than institutional rivalries.One of the lesser issues I thought was particularly interesting is that the CIA works to make attribution more difficult, and in particular, to pin things on the Russians. That&#x27;s got to be relevant in the current political climate.

You don&#x27;t have to be upset to find something interesting and worthy of discussion.

&#x27;further reach&#x27; is stretching it to put it lightly. all of the cia tools appear to be individually targeted, whereas the nsa&#x27;s programs are broadly based on mass surveillance.

I believe the revelation here is the the CIA has built a duplicate version of the NSA, but with much further reach and less accountability.

I don&#x27;t understand making this point unless it&#x27;s to give yourself permission not to think about this. Feel free not to.

You don&#x27;t actually say why they shouldn&#x27;t be doing this, though. Everyone with this opinion seems to base it on moral grounds around privacy, but in practical terms, is this really harming citizens? So far there&#x27;s zero evidence these things being used illegally domestically. IE: Without a warrant. There is some evidence that they&#x27;ve prevented some wrongdoing with it, though.I get the theoretical moral argument. I just don&#x27;t understand why it matters in practical terms.If the government wants to blackmail me, or discriminate against me, or whatever, they&#x27;re going to do it with or without these tools. To not build them is to willfully give up an important competitive edge on the global stage.

It sounds like you believe that what you do on the internet is private and that everyone will just agree to leave it at that. Global diplomacy is a competition, and if you aren&#x27;t doing everything you can, and keeping pace with technology, you will get left behind. It might not be pleasant, but I would rather, have my country gathering intelligence about me in this manner than other countries. Plus warfare has always been one of the biggest drivers of innovation, this war will and is stimulating innovation in cyber security.

your chart is defective, the y-axis is supposed to continue indefinitely in either direction

&gt; What exactly in the admittedly shortened list am I supposed to be upset about?That, with taxpayer dollars, the government of the United States is undermining the security of consumer devices around the world.Part of the difference between your worldview and the view of those of us who find this behavior childish and unacceptable is that you &quot;expect a spy agency would be doing [this;] if they were not then [you] would be disappointed.&quot; Whereas for many of us, the legitimacy of the state is already on thin ice and is subject to descent below the x-axis as the internet comes to supplant it.Listening to my neighbor through their TV set is just one thing I want the state to stop doing as our species moves into the internet age; other things I want it to stop include all the other things it does.

&gt; am I supposed to be upset about?Who do you imagine is asking you to be upset about anything. A strawman?This is knowledge. Wikileaks is about spreading knowledge. How you react to that knowledge is entirely up to you.

Is it really that bad?!  The FBI took Apple to court because it couldn&#x27;t crack its iPhones...

I&#x27;m just disappointed with the phone industry for the current state of rampant insecurity.

No, spy agencies aren&#x27;t supposed to spy on every single person in the country.

The internet and all electronics have just become one big spying and manipulation device and this is further evidence of that. No person who values freedom wants anything like that. I don&#x27;t want to sit at home knowing that someone can listen in and see and record every thing I do! I am so close to throwing all of these electronics devices in the bin.You are right that a spy agency should be expected to try to find ways into all of these devices. You are of course wrong in trusting that the spy agency is acting in your best interests. They don&#x27;t have any accountability as we cannot see what they are doing. Wikileaks is the only organisation trying to bring accountability to the unaccountable.

What I find most interesting is that Trump tweets about Obama tapping his phone and then a few days later this leak happens. In the minds of his supporters this makes him credible.But it also shows that he or Bannon might have known this leak was coming and the &quot;wiretapp&quot; rant was the set up. Which makes things very messy indeed.

&gt; What exactly in the admittedly shortened list am I supposed to be upset about?This part concerns me:&gt; The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.So, not so much the contents of the leak, but that it happened at all, and that Wikileaks is just one of many who have access. If the total cyber arsenal of the CIA were floating around on the web somehow, I&#x27;m glad that Wikileaks made that public. Could potentially see a big spike in viruses, and maybe make plans to avoid products with known exploits and stuff.

Based on the overview alone (of course I can&#x27;t read the entire report that fast!), this is exactly what I expect a spy agency would be doing -- if they were not then I would be disappointed.What exactly in the admittedly shortened list am I supposed to be upset about? It makes no distinction between US citizens and overseas parties. If these actions are being done domestically against US citizens, with no just cause sure I will get upset, but that has yet to be seen.As usual it seems Wikileaks publishes a sensationalist story around one of their leaks, claiming dozens of zero-day releases where most were already patched. Hell, they included the i0nic jailbreak as one of the 0-day exploits (<a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_13205587.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_13205587.html</a>).I&#x27;ll let journalists parse through the full report before coming to any conclusion as of yet. I just find it hard to get excited about any Wikileaks release that has yet to be vetted.

&gt; The asset has the ability to plug in a personal thumbdrive to the network.Sounds like it just patches a local copy of VLC by running an installer. I don&#x27;t know if I would consider that compromised.

It&#x27;s a version of VLC that, in addition to the things it normally does, collects information. The operator, who knowingly runs the software, can then collect the information and turn it over to someone else.

Please don&#x27;t spread disinformation.&quot;...the asset will have &#x27;downloaded&#x27; the portable version of VLC player (2.1.5)...&quot;This does not sound like a copy of the public version and that it&#x27;s &quot;compromised&quot;. You could check for yourself if you like: <a href="https:&#x2F;&#x2F;github.com&#x2F;videolan&#x2F;vlc" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;videolan&#x2F;vlc</a> :)

VLC 2.1.5 compromised <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_15729066.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_15729066.html</a>edit: please see response below from remlovedit: this post was premature, see below posts

Why would you be surprised by the fact that if your phone is compromised, even the best encryption software in the world isn&#x27;t going to help?

Yep. We all knew it was happening but turn a blind eye.And then one of these revelations are exposed and we all start wearing tin foil hats for a month or two.

&gt; Intercepting audio&#x2F;texts before encryption by Signal, Whisper, WhatsApp etcI wish I could say that I&#x27;m surprised but no... not surprised at all. Same for the IoT stuff.

No mention of Windows Phone. I guess I&#x27;m safe =)

Yes, that&#x27;s nothing new, and it&#x27;s obvious to us here on HN.However, I disagree that the intention can only be sensationalism. The average computer&#x2F;smartphone user (or journalist!) absolutely does not understand that if their device&#x27;s operating system is compromised, that so are all the apps they run. Saying that messages can be intercepted before they are encrypted is worth pointing out as a realistic consequence of someone&#x27;s device being compromised; a consequence that J. Random Journalist would not realize if it were not specifically pointed out.

&gt; Intercepting audio&#x2F;texts before encryption by Signal, Whisper, WhatsApp etc.This basically means if your device is compromised, expect malware to be able to read all content (including Signal, WhatsApp messages). Nothing new. The way it&#x27;s phrased makes it sound like Signal, WhatsApp have vulnerabilities, but no, the intention is sensationalism over sound analysis.

&gt; vulnerabilities first published by jailbreak teams,I guess we now know who is sponsoring these jailbreak guys and why.

I was upset that our government is exploiting our consumer devices. Now I&#x27;m upset that our government isn&#x27;t exploiting our consumer devices better.

The iOS attack breakdown lists a combination of vulnerabilities in very old versions of iOS, vulnerabilities first published by jailbreak teams, and a couple purchased vulnerabilities. The breakdown ends with a publicly jailbroken iOS version.The Smart TV implant appears to just be a modified version of an open source firmware replacement project.

- Smart TV turned into listening devices with fake off mode?- Intercepting audio&#x2F;texts before encryption by Signal, Whisper, WhatsApp etc.- Dozens of O-day attacks again Andriod and iPhone.Pretty powerful stuff.

Maybe in Russia and China such leaks would be punishable with death penalty effectively.

Russia and China have not got their stuff leaked, yet. Punishments in those countries are far more severe, too.

While one cannot expect editorial independence from Wikileaks, I believe the language and cultural barrier also plays an important partNot to mention those with that access level on those countries wouldn&#x27;t release any information like that &quot;for free&quot;

My feeling - based on reading only publicly-available resources - is that China and Russia rely more on more traditional &quot;HUMINT&quot; (Human Intelligence), while the US has come to rely more and more and &quot;SIGINT&quot; (Signals Intelligence).

The CIA dump apparently contains malware stolen from other countries. So perhaps if&#x2F;when wikileaks starts releasing them, that&#x27;ll include Russian&#x2F;Chinese malware.It may also be that they simply have far smaller security states, with fewer people who feel alarm at the extent of what&#x27;s happening. Or maybe leaking to Wikileaks just isn&#x27;t in vogue in those countries.

There was recently a leak from BND (Germany) all documents in Germant. No one enjoys reading German.

Maybe it is just my lack of knowledge but why were all the recently leaked hacking tools made by US and none by Russia or China?

Feel much safer knowing the CIA keeps them safe and only use them for good causes &#x2F;s

According to Wikileaks [0], they were explicitly redacted until their safety could be assessed. They didn&#x27;t want to be responsible for accidentally releasing malware in to the wild.0: <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;#FAQ" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;#FAQ</a>

I&#x27;d like to hear a security expert&#x27;s opinion on whether releasing even patched 0-days could be considered harmful ? even if the &#x27;sploits dont work out of the box, it seems like they would still advance the state of the art, and allow moderately-skilled hackers to build on very sophisticated designs, adapt and make them effective again - &quot;stand on the shoulders of giants&quot; kind of thing.

I&#x27;m pretty okay with wikileaks not releasing hundreds of zero day exploits into the wild en mass.

Wow this is really big. There are tons of documents about the various tools they use, but it seems the majority of the actual source code is still being reviewed and the links just show a link to the file list. I hope they eventually release the source code, as a lot of these tools seem very interesting. I can imagine that many at the CIA are running around on fire, as this seems like a big problem for them.

Streisand effect; didn&#x27;t know they&#x27;re holding a press conference.

Are they implying that Facebook is being DOS&#x27;ed?

I wonder how many of the exploits&#x2F;tools released are still usable today.Also, the actual video press release had to be rescheduled due to their video stream being attacked.[0]&quot;NOTICE: As Mr. Assange&#x27;s Perscipe+Facebook video stream links are under attack his video press conference will be rescheduled.&quot;[0]: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;wikileaks&#x2F;status&#x2F;839104886625157120" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;wikileaks&#x2F;status&#x2F;839104886625157120</a>

Unbelievable the depth and scope. Absolutely frightening that most of these tools are out in the wild.

And Visual Studio
<a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_11629039.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_11629039.html</a>

And watch out if you don&#x27;t test! <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;files&#x2F;359jzz.jpg" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;files&#x2F;359jzz.jpg</a>(via <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_13763158.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_13763158.html</a> )

They have secret unit testing tips too! <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_11629048.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_11629048.html</a>

Now whenever I get into a holy war, at least I&#x27;ll know Uncle Sam approves of my tribe.

They have vim editing tips <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_3375350.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_3375350.html</a>No emacs?

I guess some responsible disclosure to the affected vendors would be nice. If the tools are being actively exploiting bugs, which they are, there&#x27;s not much else to do in order to stop the exploitation. Give it a few weeks and then publish them in the wild.

The parent isn&#x27;t being naïve, they take issue with the current state of affairs and tell how they would like it to work. They&#x27;re not surprised that that&#x27;s not the case.

After Snowden, the Obama administration made a commitment to the tech community that it would not hoard security vulnerabilities, and would instead pass them on to vendors to fix.This release shows that they did not honour that commitment.

LoL why are you so naive? It&#x27;s CIA, not google Zero day project

This might sounds naive, but I am genuinely wondering whether they are failing at this mission in the long run, though? They can hardly believe they&#x27;re they are the only ones in control of these exploits. Can&#x27;t the same exploits be used against them?

True, but that&#x27;s a general indictment of any spy agency for any country.  More broadly than just software, their mission is to control information...who gets it &#x2F; who doesn&#x27;t.

They&#x27;re being paid by the spooks!On a serious note, doesn&#x27;t cyberwarfare sound more like it could lead to nasty consequences, such as regular warfare, rather than preventing it?

&gt; A hacked computer can avoid armed conflict where people die.Yet we see armed conflicts with CIA origins within plenty of history books...

Or Why don&#x27;t we have like a &quot;Open BSD&quot; equivalent on the Android Platform?

&gt; why aren&#x27;t major vendors devoting a fraction of the resources to find this stuff and fix it on their own?I&#x27;m pretty sure most of the competent ones are... it&#x27;s just really slow, expensive, hard work, with little financial upside (beyond preventing the financial downside of disastrous long-tail exploits). Spending ever more on it probably isn&#x27;t an easy sell to business people with normal (read: bad) human probabilistic intuitions. And a lot of the people best at it probably just choose to work for themselves because they can auction their work to IC or criminal collectors for much more than they&#x27;d get from a fixed rate bug bounty.

I think that&#x27;s an absurd position. The government has a need to be able to access hostile systems. A hacked computer can avoid armed conflict where people die.A better question is... why aren&#x27;t major vendors devoting a fraction of the resources to find this stuff and fix t on their own?

We are past the point of holding them to even basics ethics.  The CIA and NSA already see the people as cannon fodder at best.  If we can no longer expect moral behavior concerning issues like black sites for torture, drug trafficking, or setting up murder and rape regimes, then why even waste the breath asking for cybersecurity ethics?

The NSA does albeit it&#x27;s not advertised when they report bugs to companies. Not sure about the CIA but the NSA has a dual mission of intercepting foreign intelligence and helping secure american systems. Hence how we got things like SELinux and other contributions.They&#x27;ve done some terrible stuff but they are big agencies with many competing objectives within.

There are no &quot;proper cybersecurity ethics&quot;. Whatever your chosen ethical framework is, it&#x27;s not absolute and you don&#x27;t get to impose yours on all other people.

This idea that the government should somehow be exempt from proper cybersecurity ethics is disgusting. When the CIA or the NSA find zero day attacks in software, they should report them immediately to be fixed, not build tools specifically to exploit them. It&#x27;s only a matter of time before these attacks either leak or are rediscovered by other malicious parties. The government is effectively turning their own people into cannon fodder for their ridiculous &quot;cyberwar.&quot;

This is an incredible and sensational claim that, if true, can quite literally &quot;break the internet&quot;. Makes me very sad to imagine that CIA grade cyber weapons for getting into iPhones are now in the hands of heaven knows who. Hope Apple security teams are on this.EDIT: To clarify, I&#x27;m commenting on the original situation of the tools getting out of CIA to the entities it was &quot;circulated to&quot;, not this leak later by WikiLeaks - presumably the damage has already been done.

Seems to have been having issues with premature self destruction:&quot;Discrepancy report DR-00134-2012 was issued after Operations determined that Hive version 2.5 was
self-deleting prematurely. Analysis showed that a calculation involving the current time and the file
modification time used to determine the time since last contact could result in a negative number that
was then cast from an integer to an unsigned long integer. This resulted in a large positive number that
exceeded the delete delay and subsequently caused Hive to self-delete.&quot;

This looks interesting: Hive&#x27;s developer guide. It has a auto-destruct feature, just like in the movies:<a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;files&#x2F;DevelopersGuide.pdf" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;files&#x2F;DevelopersGuide.pdf</a>

I will continue using Swiss cheese and hungry mice as my metaphor for global network security.

Poster is referring to this thing, for anyone curious:<a href="http:&#x2F;&#x2F;www.gettyimages.fr&#x2F;%C3%A9v%C3%A9nement&#x2F;russian-orthodox-cathedral-sainte-trinite-under-construction-in-paris-667550103#russian-orthodox-cathedral-saintetrinite-and-russian-orthodox-and-picture-id599854670" rel="nofollow">http:&#x2F;&#x2F;www.gettyimages.fr&#x2F;%C3%A9v%C3%A9nement&#x2F;russian-orthod...</a>

Not long ago it was hinted that US ambassy in Paris is a nice CIA antenna too. Nobody denied nobody answered, question still up in the air.Also, latest Russian project, a large church-like building in Paris is suspected to hide intel dept.

&gt; Germany always knew operations were conducted there but now must react to this overt news.Snowden outed Frankfurt (and Berlin) years ago. [0] There&#x27;s no more interest in meaningful consequences now as it was back then.[0] <a href="http:&#x2F;&#x2F;www.spiegel.de&#x2F;international&#x2F;germany&#x2F;cover-story-how-nsa-spied-on-merkel-cell-phone-from-berlin-embassy-a-930205.html" rel="nofollow">http:&#x2F;&#x2F;www.spiegel.de&#x2F;international&#x2F;germany&#x2F;cover-story-how-...</a>

Sorry, news flash, virtually all of the countries&#x27; embassies and consulates are a natural place where a lot of intelligence operations are conducted. Counterintelligence operations watch them very closely.The fact that Frankfurt is a hub among their European intelligence operations is not terribly interesting IMO.&gt; I wonder how Germany will react to this.Germany always knew operations were conducted there but now must react to this overt news.

It was pretty much an open secret already.

&quot;U.S. Consulate in Frankfurt is a covert CIA hacker base
&quot;Germans are usually privacy nuts. I know many who maintain no presence on Facebook, Twitter and Instagram. I wonder how Germany will react to this.

&gt; Is there some special set of software that always gets patched because the CIA uses it?If so, a diff between the &quot;CIA version&quot; and the &quot;civilian version&quot; would be highly instructive.

Presumably the same thing others do when they know about 0-days? Signatures.

This is a great question. Surely they look for vulnerabilities also in their own systems but then what do they do when they find them? Is there some special set of software that always gets patched because the CIA uses it?

Doubtful. Part of being an undercover operative means deniability. Imagine if a foreign power arrested a suspected spy, and found non-standard software on their phone.So they&#x27;d probably use off the shelf software and mitigate risks in other ways.(Ex: not bringing smartphones to sensitive meetings)

I wander what phones &#x2F; computers CIA operatives use - do they have special patched versions which address the zero day exploits they are aware of.

&quot;Deep State&quot;<a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Deep_state_in_the_United_States" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Deep_state_in_the_United_Sta...</a>

More, being those tools not effective, development and maintenance is stupid spending, and certainly the tools are having other uses.My conspiracy side looks at CIA like a public sector (state owned) company in Brazil: they are not owned by the government, but by the chaste of unionized workers that work there.

I would suspect that at a time of war, especially in the first few months, there is a lot of tactical info to be collected from whatsapp and Facebook conversations between people and their families (&quot;I&#x27;m going to be busy tonight with an operation, but I promise I&#x27;ll call when I&#x27;m back, love&quot;). Whether this can be efficiently processed is a different question, which I believe google can answer affirmatively, and likely also palantir and some TLAs

I wonder if, supposing a legit war use, those tools would work. Maybe in taking down some enemy tech infra, but on collecting information, i really have doubts. That would be too much data to process unless they had specific targets. Human intelligence would be much more effective.Anyway, I remember a story of a US submarine that hacked soviet cables in the 70s or 80s.

While the above is certainly plausible(killing someone with a car), I highly doubt this is the case here:<a href="https:&#x2F;&#x2F;www.metabunk.org&#x2F;debunked-michael-hastings-crash-cars-just-dont-blow-up-kim-dvorak.t2148&#x2F;#post-62380" rel="nofollow">https:&#x2F;&#x2F;www.metabunk.org&#x2F;debunked-michael-hastings-crash-car...</a>

Michael Hastings? [0][0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Michael_Hastings_(journalist)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Michael_Hastings_(journalist)</a>

That doesn&#x27;t explain the photos of the car&#x27;s aftermath.I mean, it&#x27;s just as likely people pressured his family to say this (either organized crime or the government .. really the same thing).It&#x27;s not dying because it&#x27;s highly suspicious and the narrative doesn&#x27;t fit, the news reports are conflicting and much of the evidence is gone.

I can&#x27;t believe this meme won&#x27;t die -- it&#x27;s so incredibly disrespectful to his family. Honestly no better than the Sandy Hook Truther bullshit.Michael Hastings was a recovering alcoholic and meth-abuser whose brother, Jonathan, had flown into town the day before because he suspected that Michael was having a manic breakdown similar to the ones he had in the past. Jonathan had been called to LA since several of Michael&#x27;s coworkers had reached out about his mental state.After spending the day with Michael, Jonathan called their third brother to come help get Michael back into rehab. That brother arranged to fly out the next day but that night, at 4:30am, Michael snuck out of his apartment and crashed his car into a tree at very high speed.Here&#x27;s what Jonathan Hastings thinks about his brother&#x27;s death:I really rule out foul play entirely. I might have been suspicious if I hadn’t been with him the day before he died. After all, he definitely was investigating and writing about a lot of sensitive subjects. But based on being with him and talking to people who were worried about him in the weeks leading up to his death, and being around him when he had had similar problems when he was younger, I was pretty much convinced that he wasn’t in danger from any outside agency.<a href="https:&#x2F;&#x2F;www.salon.com&#x2F;2013&#x2F;11&#x2F;05&#x2F;michael_hastings_life_and_death_a_brothers_reflections&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.salon.com&#x2F;2013&#x2F;11&#x2F;05&#x2F;michael_hastings_life_and_d...</a>

&gt;&quot;As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks. The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations.&quot;Reminds me of the reporter who was supposedly working on a massive investigation and then died in a flaming car crash while skipping town. Forgot his name

I&#x27;m surprised so many acronyms from their org chart are missing.FINO is Financial Operations Group. 
FIO is Field Intelligence Officer.
ESD is Executive Services Directorate.
Don&#x27;t see a single term that anyone who spent any time in the intelligence community wouldn&#x27;t recognize.

These documents were being passed around by former CIA hackers. It says this right on the page. Harold has already been disproven to have any connection to leaks. He was just a hoarder with a mental illness.This hasn&#x27;t stopped people from connecting every leak since his arrest to him.

I&#x27;m wondering if these documents are going to match the same ones that were taken by Harold Martin III and if the CIA will out him as the Wikileaks source.

That video of Hillary touting that &quot;17 different intelligence agencies yada yada Russia is who hacked my emails&quot; is going to be even more amusing now.

The term &quot;hacked the election&quot; goes beyond the literal computer hacking of the dnc. It also covers the well-targeted &quot;fake news&quot; propoganda program ... something not touched by the release of these tools.The &quot;hack&quot; of the election was trickery to twist a system to a desired end. Like all good hacks it ignored definitions to employ whatever techiques were availible regardless. That some were not traditionally called &quot;hacking&quot; means nothing given the overall effectiveness of the program.

The Russians really seem like to most likely there still. It would’ve taken quite a bit of knowhow and resources so the Russians would be one of the few organization with motive and opportunity so at this point it seems highly likely that it was the Russians. It could also be some nation state that wants us to think that they are Russian (which I don’t know who would have motive for this). The only other option would be a corporation or hacker group that is really good and knows enough to be able to (and also have a motive to) implicate the Russians convincingly, but that seems unlikely.That’s the analysis I heard so it doesn’t really change the overall analysis but I’m no expert and I’m open to other views.

&gt; So far we only know the DNC leaks were very likely Russian.We don&#x27;t know that at all. There isn&#x27;t a single piece of evidence for it anywhere.

The circumstantial evidence in the Podesta phishing is pretty decent, not really &#x27;up in the air&#x27;.<a href="https:&#x2F;&#x2F;www.secureworks.com&#x2F;research&#x2F;threat-group-4127-targets-google-accounts" rel="nofollow">https:&#x2F;&#x2F;www.secureworks.com&#x2F;research&#x2F;threat-group-4127-targe...</a><a href="https:&#x2F;&#x2F;twitter.com&#x2F;pwnallthethings&#x2F;status&#x2F;816621553643294720" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;pwnallthethings&#x2F;status&#x2F;81662155364329472...</a>(the second link is a lengthy thread)

There is no hard evidence where the DNC&#x2F;Podesta leaks came from. However, Julian Assange has repeatedly said that the source is not the russian goverment or a affiliated state party [1] and in a other interview has hinted that the source may be Seth Rich [2], a former DNC staff member that was murdered in Washington DC.[1] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=uyCOy25GdjQ" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=uyCOy25GdjQ</a>[2] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=Kp7FkLBRpKg" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=Kp7FkLBRpKg</a>

Can you point to information to research about connections to the DNC hack and Russia?

I am nearly convinced by The Grugq&#x27;s summary:<a href="https:&#x2F;&#x2F;medium.com&#x2F;@thegrugq&#x2F;the-russian-way-of-cyberwar-edb9d52b4876#.v2muiatty" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;@thegrugq&#x2F;the-russian-way-of-cyberwar-edb...</a>&quot;Alternating Competing Hypothesis&quot;

What public evidence is there that the DNC leaks were related to Russia?

There also still hasn&#x27;t been any public evidence that Wikileaks got their Podesta email data from Russians yet. So far we only know the DNC leaks were very likely Russian. That means until today only about ~50% of the &#x27;election hacks&#x27; have been attributed to Russia with public evidence.Now this leak calls into question some of the evidence about the DNC hack [1]. This evidence being the malware was Russian. But there were many other pieces of evidence that pointed to Russia so I&#x27;m personally not anymore persuaded it wasn&#x27;t Russia for the DNC stuff. The Podesta stuff is still up in the air AFAIK. [edit: see pvg reply]Either way this leak will just add to the deniability angle for the partisan hawks. Although this is probably way over the head of CNN&#x2F;Fox News crowd so it&#x27;s also possible it will have zero effect.[1] Previous leaks mentioned NSA&#x2F;Five Eyes collected foreign malware. This leaks adds CIA to that group and further solidifies the &quot;misdirected attribution&quot; angle.

Yeah it&#x27;s irritating how our media is ignoring the propaganda machine and looking at &quot;hacks&quot; instead.

Through leaks like this one. Leaks that can be partially validated or corroborated, but which (by their nature) cannot be entirely proven true.And those leaks were very transparently beneficial to a person&#x2F;group who are also going to benefit from this one.I don&#x27;t trust the CIA at all. But I don&#x27;t trust Wikileaks either. I see way too many self-described &quot;skeptical&quot; types who aren&#x27;t approaching any of this with any shred of skepticism.

Objective proof is usually not considered &quot;propaganda&quot;. We used to call it &quot;investigative journalism&quot;.

There&#x27;s also an argument to be made that Hillary would not have been the nominee had the DNC played fair. The leaked emails show that they actively worked to suppress Bernie, who had huge rallies, similar to Trump.

Actually, that was the claim, but once people started undermining the story they had to shift to the word &quot;influence&quot; to save face. This kind of shit is why middle-class rightwing America cheers when Trump calls out fake news. A complete inability to honestly say, ok, we don&#x27;t know, or ok, we fucked up. Nope, the story always was X... sure it was.

I think it&#x27;s a little more nuanced than that.I think the more likely objective (assuming the Russians were behind this, which for the time being is a fair assumption) is that they wanted to delegitimize a President Clinton. Everyone thought she would win. I think it&#x27;s a bold claim to make that the Kremlin set out on a campaign to elevate an obtuse philanderer in a field of 16 who ignores any semblance of political norms. Rather, I think they just wanted to further tarnish Clinton&#x27;s image, as President, as a corrupt establishment figure.

&gt; that &quot;Russians&quot; hacked the electionThat&#x27;s not the claim. In fact, multiple people have said that is not the claim.The claim is that the Russians influenced the election in favor of Trump by promoting propaganda against Clinton.

&gt; although I can&#x27;t imagine the CIA wanting to hack the election in Trump&#x27;s favourDoesn&#x27;t preclude planting &#x27;evidence&#x27; of Russian hacking to stir up a red scare (towards renewed cold war -level funding of the intelligence community) irrespective of the election&#x27;s outcome. I.e., the fact that anyone actually uncovered secret data through some other means could have just been unrelated&#x2F;incidental. E.g., if Wikileaks got their material from an inside whistle-blower as they&#x27;ve insinuated.I wouldn&#x27;t either be surprised if the &#x27;evidence&#x27; of Russian interference was just circumstantial rather than planted... E.g., &quot;Woah, we found evidence of probing originating from Russia (in the pile of probing evidence from script-kiddies all over the world, mostly Nigerian princes but those don&#x27;t bolster our narrative)!&quot;<a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=7j_ZfKmcnSk" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=7j_ZfKmcnSk</a><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Operation_Northwoods" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Operation_Northwoods</a><a href="http:&#x2F;&#x2F;www.mintpressnews.com&#x2F;migrant-crisis-syria-war-fueled-by-competing-gas-pipelines&#x2F;209294&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.mintpressnews.com&#x2F;migrant-crisis-syria-war-fueled...</a>

Source?I&#x27;ve always understood the FBI v. CIA conflict as a classic Red vs Blue security alignment. FBI aligned with Defense and CIA aligned with State.

Trump has been aggressively critical of the CIA and has, to some extent at least, ignored their intelligence briefings. He openly opposes much of what they advocate. I don&#x27;t think they like him.

Actually, if you look at donations in the last election government employees in all branches donated over 85% to Clinton. So I&#x27;m not sure I&#x27;d say overwhelmingly Rebublican by any means.

&gt;although I can&#x27;t imagine the CIA wanting to hack the election in Trump&#x27;s favourCIA is overwhelmingly republican, just like the FBI. So yes they would.

Agreed. All this fuss gives Russia more prestige&#x2F;soft power.

&gt; In reality they allegedly hacked computers of people related to a single party and brought to light the illicit activities that party was doing.My understanding was the Security professionals expected that the most likely scenario was that both parties were hacked: one side was revealed and the other one used for leverage.

I think it&#x27;s vitally important, at least in this forum where tech knowledge is fairly high to avoid saying that &quot;Russia hacked the election&quot; without any sort of qualifier. Because the implication is that they hacked voter booths or somehow changed votes.In reality they allegedly hacked computers of people related to a single party and brought to light the illicit activities that party was doing.tl;dr Saying Russia hacked the election is the same as saying that some kid hacked the FBI when all he did was deface their website. It implies a level of sophistication that did not happen.

Well, you&#x27;ve nailed it in your parenthetical comment. Lack of a credible motive is one of the telltale signs of conspiracy theories, but has never kept conspiracy nuts from presuming all kinds of nefarious motives if they fit into their preconceived world-view.Of course the CIA could have constructed a complicated false flag operation to get Trump elected, but they lack a reasonable motive. Similar things can be said about many conspiracy theories, only few of them attribute credible motives to the state actors and&#x2F;or individuals involved.

IMO it just doesn&#x27;t make much sense, though, as soon as you picture actual groups of people running these schemes. It&#x27;s super secret and all, but behind the iris-scanner doors and extreme vetting, people are sitting in offices, drink coffee, have meetings, etc. There&#x27;s oversight, reports to file and activity logs. Now how should a group of employees, in this environment, sit together and decide to manipulate an election in their own country? That just doesn&#x27;t seem feasible.I honestly imagine the day-to-day activity there to be way more mundane than we imagine. It&#x27;s probably just sifting through thousands of pages worth of intelligence (transcribed phone calls from terrorism suspects, reports from people at foreign embassies, etc) for things that are usable. Probably often with few results. I don&#x27;t even think the amount of information is the real limitation. It&#x27;s probably the quality.

The CIA&#x27;s Remote Devices Branch&#x27;s UMBRAGE group collects and maintains a substantial library of attack techniques &#x27;stolen&#x27; from malware produced in other states including the Russian Federation.With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the &quot;fingerprints&quot; of the groups that the attack techniques were stolen from.This has interesting implications for the claim that &quot;Russians&quot; hacked the election (although I can&#x27;t imagine the CIA wanting to hack the election in Trump&#x27;s favour).

An obscure OS would potentially help protect you on that one layer, but it&#x27;s hardly a panacea. For one thing, an obscure OS means fewer friendly eyes looking for vulnerabilities. For another, you&#x27;re still going to be vulnerable to things like a baseband attack:<a href="https:&#x2F;&#x2F;dwaterson.com&#x2F;2013&#x2F;11&#x2F;18&#x2F;vulnerabilities-of-the-second-operating-system-of-your-smartphone&#x2F;" rel="nofollow">https:&#x2F;&#x2F;dwaterson.com&#x2F;2013&#x2F;11&#x2F;18&#x2F;vulnerabilities-of-the-seco...</a>

It&#x27;s not security through obscurity (which I agree is bad). It&#x27;s more like &quot;more security&quot; through &quot;less market share&quot;.

Security through obscurity isn&#x27;t a thing

So will this zero days be reported to Google,Apple,Microsoft &amp; Co.? Or is this more a &quot;FYI document&quot;?
It seems you can be on the safer side if you use a more exotic phone OS which is not widely used or a more dumb feature phone.

In that case, you say &quot;I can&#x27;t answer that question&quot; and let the system do its job.You don&#x27;t lie.

It would have been illegal for him to tell the truth in that testimony, since it was public. I know people don&#x27;t like that, but it&#x27;s true. He could either lie or break serious secrecy laws. There&#x27;s no immunity just because you&#x27;re talking to congress.

If they call in James Clapper, will he perjure himself again?<a href="http:&#x2F;&#x2F;www.hasjamesclapperbeenindictedyet.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.hasjamesclapperbeenindictedyet.com&#x2F;</a>

Thats how you know the leak is real, because this is classic internal Wiki shenanigans, you can&#x27;t make this up. Also, though there are some talented people working here (you can identify some of their github accounts, thanks to wikileaks tying users to their posts by ID) but I think a LOT of these tools are made&#x2F;stolen&#x2F;purchased from elsewhere..

I don&#x27;t really get into political commentary, and I&#x27;m not a US citizen, but there&#x27;s some great RE tips in there.I genuinely lol&#x27;ed at their assessment about Comodo&#x27;s whitelist-only firewall&#x2F;av.Also, this: <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_17760284.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_17760284.html</a>(ﾟヮﾟ)

The US chemical weapons program is downright frightening. Unlike these exploits which you can just leave in an office and never use (and which con subsequently go stale as people find and patch exploits), chemical weapons were stored in massive US facilities and many of them have started leaking over the years:<a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=FjA0EQPeUGM" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=FjA0EQPeUGM</a>

Obviously there&#x27;s a difference between cyber and conventional weapons, but imagine if the same rationale were extended to physical munitions: &quot;We can&#x27;t drop this bomb on the enemy, it contains classified technology&quot;

&gt;once used it&#x27;s possible for the enemy to vaccinate against them.So think long term...Is this an innoculation game &gt;10 years out????

&gt; Command &amp; Control and Listening Post software were classified, then CIA officers could be prosecuted or dismissed for violating rules that prohibit placing classified information onto the Internet. Consequently the CIA has secretly made most of its cyber spying&#x2F;war code unclassified.This is almost hilarious.Not that being classified would make any difference: cyber-&quot;weapons&quot; have something in common with biological weapons in that they&#x27;re prone to leaking and blowing upwind, but also once used it&#x27;s possible for the enemy to vaccinate against them.

Think about it. Having the code copyrighted, would leave a paper trail.

Lol like anyone in this field cares about copyrights.  It is like suggesting that North Korea cannot build nuclear bombs because doing so would infringe US patents.  Some things are above IP rules.

The bigger issue I think is when the prosecution of the CIA leakers happens. If the material is unclassified, they&#x27;re just distributing materials that are public domain and definitely in the interest of the public. If it&#x27;s classified, it&#x27;s a breach and they should be punished in some way.

I think that&#x27;s referring to people who want to sell them, like the people who supply cracking tools to questionable governments.

&gt; This means that cyber &#x27;arms&#x27; manufactures and computer hackers can freely &quot;pirate&quot; these &#x27;weapons&#x27; if they are obtained.Does the author really think that if the tools were exposed then people who wanted to use these tools actually wouldn&#x27;t simply because they were labelled &quot;classified&quot; somewhere?

&gt; The CIA has primarily had to rely on obfuscation to protect its malware secrets.Ugh.

That is the fun part, attacking with a virus is basically the same as releasing the code (modulo IDA pro). So a US government official can not use a classified virus, while everybody else can.

This is often overlooked, but very correct.&quot;Classification&quot; only pertains to how the material should be treated within the government.Once its out, the only penalty can fall on the person who let it out into the wild.

Classified or not, works of the federal government are all in the public domain. And classification is not legally relevant to anyone except to those entrusted with protecting classified data.

I honestly think this makes sense, based on how government bureaucracy is. Obviously everything else about it, is classified.

I think what it&#x27;s trying to convey is that there&#x27;s absolutely no legal recourse in any capacity for the CIA at this point to try and do any sort of damage control.

That passage is just dumb. Copyright would not stop hackers from using the tool once it is leaked.

I’m going to assume that the response would be that there are no such thing as Vault 7, a digital capability or even the CIA.

&quot;classified&quot; is not the only reason FOIA requests are denied.

So then there would be no justifiable reason to reject a FOIA request for the source code.

Nobody makes &quot;decisions&quot; like this in an organization with the level of complexity and bureaucracy that the CIA has. A lot of these decisions can be seen more as emergent behavior, subject to politics, short-term immediate incentives, and the pragmatic observation that any attempt to make significant changes (i.e. &quot;change the laws around classification of documents&quot;) has such a high time horizon that it&#x27;s better to bypass the law than try to fix it.

Why do they make such monumentally short-sighted, clearly bad decisions? Is it weak technical leadership (weak political or just old fashioned weak)? What is the internal logic these people use to justify pure folly that&#x27;s probably done more harm than good even to their own interests and goals? Baffling.

In what is surely one of the most astounding intelligence own goals in living memory, the CIA structured its classification regime such that for the most market valuable part of &quot;Vault 7&quot; — the CIA&#x27;s weaponized malware (implants + zero days), Listening Posts (LP), and Command and Control (C2) systems — the agency has little legal recourse.The CIA made these systems unclassified.Why the CIA chose to make its cyberarsenal unclassified reveals how concepts developed for military use do not easily crossover to the &#x27;battlefield&#x27; of cyber &#x27;war&#x27;.To attack its targets, the CIA usually requires that its implants communicate with their control programs over the internet. If CIA implants, Command &amp; Control and Listening Post software were classified, then CIA officers could be prosecuted or dismissed for violating rules that prohibit placing classified information onto the Internet. Consequently the CIA has secretly made most of its cyber spying&#x2F;war code unclassified. The U.S. government is not able to assert copyright either, due to restrictions in the U.S. Constitution. This means that cyber &#x27;arms&#x27; manufactures and computer hackers can freely &quot;pirate&quot; these &#x27;weapons&#x27; if they are obtained. The CIA has primarily had to rely on obfuscation to protect its malware secrets.One of the more interesting passages. The arsenal must not be classified to protect those who deploy it from legal action. This cyberwarfare kit, which can just as easily be used to destroy the US as one of its enemies, is public domain software created and released at US taxpayer expense.

Have there been any leaks showing TLAs using Intel&#x27;s ME or AMD&#x27;s PSP as a means to compromise a target?

Arguably loading DLLs from non-system folders is bad design in this day and age.

Any executable is vulnerable to DLL hijacking, they&#x27;re just looking for easier targets that load known DLLs (with known function signatures) from their own folders (NOT system folders).I&#x27;m assuming the goal is to minimise detection by what they call PSPs (av &#x2F; security products)This is not a flaw within notepad++

One of the findings: Notepad++ has a DLL hijack [1][1] <a href="https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_26968090.html" rel="nofollow">https:&#x2F;&#x2F;wikileaks.org&#x2F;ciav7p1&#x2F;cms&#x2F;page_26968090.html</a>

CIA malware and hacking tools