Latest WikiLeaks release shows how the CIA uses computer code to hide the origins of its hacking..

Daily Mail ^ | March 31, 2017

[maggief]

WikiLeaks has published hundreds more files today which it claims show the CIA went to great lengths to disguise its own hacking attacks and point the finger at Russia, China, North Korea and Iran.

The 676 files released today are part of WikiLeaks' Vault 7 tranche of files and they claim to give an insight into the CIA's Marble software, which can forensically disguise viruses, trojans and hacking attacks.

WikiLeaks says the source code suggests Marble has test examples in Chinese, Russian, Korean, Arabic and Farsi (the Iranian language).

It says: 'This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese.'

This could lead forensic investigators into wrongly concluding that CIA hacks were carried out by the Kremlin, the Chinese government, Iran, North Korea or Arabic-speaking terror groups such as ISIS.

[maggief]

Full title:

Latest WikiLeaks release shows how the CIA uses computer code to hide the origins of its hacking attacks and 'disguise them as Russian or Chinese activity'

[maggief]

https://wikileaks.org/vault7/?marble#Marble

Marble Framework
31 March, 2017

Today, March 31st 2017, WikiLeaks releases Vault 7 “Marble” — 676 source code files for the CIA’s secret anti-forensic Marble Framework. Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA.

Marble does this by hiding (”obfuscating”) text fragments used in CIA malware from visual inspection. This is the digital equivallent of a specalized CIA tool to place covers over the english language text on U.S. produced weapons systems before giving them to insurgents secretly backed by the CIA.

Marble forms part of the CIA’s anti-forensics approach and the CIA’s Core Library of malware code. It is “[D]esigned to allow for flexible and easy-to-use obfuscation” as “string obfuscation algorithms (especially those that are unique) are often used to link malware to a specific developer or development shop.”

The Marble source code also includes a deobfuscator to reverse CIA text obfuscation. Combined with the revealed obfuscation techniques, a pattern or signature emerges which can assist forensic investigators attribute previous hacking attacks and viruses to the CIA. Marble was in use at the CIA during 2016. It reached 1.0 in 2015.

The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, -— but there are other possibilities, such as hiding fake error messages.

The Marble Framework is used for obfuscation only and does not contain any vulnerabilties or exploits by itself.

[4rcane]

Rubio claim DEM was hacked by location in Russia. Maybe it was CIA

[4rcane]

FBI went snooping at Trump tower, after pings coming from Russia. How do they know Trump servers was pinged from Russia without being the source of the pings or getting having acess to Trump tower servers first

[New Jersey Realist]

You know, if the CIA keeps effing around, they are likely to cause a real cyber attack and America will suffer greatly. I’m sure by now the Russians are super pissed and will seek retribution.

[Pollster1]

These leaks are not helpful. We know what the CIA does, but making it this public will (1) make it harder for the CIA to blame the Russians for their own efforts, and not just their efforts to protect Agency funding in the most recent election, and (2) potentially provoke other countries to turn against us to an even greater extent than the CIA has already turned against us.

[polymuser]

And my confiscated tax contributions pay for this nastiness. B S

[boycott]

I have extremely low trust in the CIA. Especially under Brennan.

[boycott]

These leaks are not helpful. We know what the CIA does, but making it this public will (1) make it harder for the CIA to blame the Russians for their own efforts, and not just their efforts to protect Agency funding in the most recent election, and (2) potentially provoke other countries to turn against us to an even greater extent than the CIA has already turned against us.

---

If it exposes the corrupt CIA under obama and Brennan, it is helpful. The CIA has been out of control for far too long.

[boycott]

Rubio claim DEM was hacked by location in Russia. Maybe it was CIA

—

The ability to hack and make it appear to be from somewhere else isn’t knew. This has been around for a long time.

It is illegal to hack in the USA. So hackers in the USA have been able to make it appear to be from China, Russia, Europe or somewhere else in the world for several years. Even the novice hackers could do this years ago.

[Lady Heron]

These leaks are not helpful.

Really???

I sort of felt it cuts right to the non-stop "Russian hacking the election" crap. At this point the "intelligence" communities run our country, controlling the politicians and judges with their games. There is no oversight that can not be over run with their games. Basically we have a massive mess on our hands.

[MagnoliaB]

Ditto that!! Lord, that picture looks like Comey.

[Wuli]

And when they can do that, they can make communications look like it came from somewhere else (like Russia), and then let it return through the NSA as new “intelligence” from foreign sources.

[buffaloguy]

Any claim that Russia hacked Trump’s computers is null and void.

[Chgogal]

It seem our Intelligence Communities are not that intelligent. They are way too much in the news.

[Cboldt]

-- These leaks are not helpful. --

The tools disclosed here are perhaps not uncommon. And the worry you have swings both ways, it makes it harder for the Russians to blame the US for Russian international instigation. Same goes for self-serving instigation by any other country's agents.

[huldah1776]

I was just thinking that we should be more specific when referring to the intelligence community that was hacking. Those hackers should be named “democrat appointed intelligence agents.” I wonder how many true patriots quit or were canned. The purge was probably the same as the military leader purge. I wonder what they would do if asked to serve again (both intelligence and those conservative military leaders).

While the swamp needs to be drained, the sludge needs to be replaced with unpolluted water.

[old curmudgeon]

Amen

And everyone is misslng the point

[GailA]

Pre teens and teens use ghost apps to hide their online activity, if you kid has 2 calculators on their smart phone, you can bet they are using a ghost app to hide what they are doing online. News piece from last night local news Memphis. Needs a code to open the hidden real app that hides their activity.