31
Information Technology & Cyber Security / Re: WikiLeaks Dumps Docs on CIA’s Hacking Tools
« on: March 09, 2017, 04:45:54 AM »
Most of the Social Media Channels identified in the dump are not surprising (WhatsApp, Signal, etc.) because those are the ones used by ISIS to talk to their followers and conduct recruiting ops. ISIS eschews more popular channels since they know the potential of them cooperating with authorities is extremely high. It should be noted that the CIA did not manage to break the encryption on these applications - rather, much of their success has been at targeting individuals and their more vulnerable endpoints (i.e., phone, tablet, PC, multimedia TV). Encryption itself is still sound, but in a way, this shows that the push to harden encrypted communications has achieved one of the objectives most sought by privacy advocates - the ability of the state to conduct *effective* mass surveillance has been stymied. Unfortunately it does mean that states are now doubling down on individual surveillance, but there is no perfect outcome.
Edited to add: The really telling part about the dump is Project UMBRAGE. As any good IT practitioner has been stating for a long time, Attribution of Cyberwar events is hard. Here is absolute proof that the CIA (and likely any other state intelligence organ) have taken large steps to cover up any of their cyberspace intrusions by attributing it to another organization or even nation-state. Littering known tools, footprints and code in the wake of an attack to throw off the scent. Attribution is not reliable, period. About the only way you can figure out who might be behind a given attack is to see what they achieved, and who might benefit. Beyond that...
Edited to add: The really telling part about the dump is Project UMBRAGE. As any good IT practitioner has been stating for a long time, Attribution of Cyberwar events is hard. Here is absolute proof that the CIA (and likely any other state intelligence organ) have taken large steps to cover up any of their cyberspace intrusions by attributing it to another organization or even nation-state. Littering known tools, footprints and code in the wake of an attack to throw off the scent. Attribution is not reliable, period. About the only way you can figure out who might be behind a given attack is to see what they achieved, and who might benefit. Beyond that...