Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Tuesday November 14 2017, @06:15PM   Printer-friendly
from the sysadmin-sleep-disruption dept.

Vault 8:

Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware.

Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a target computer is useless if there is no way for it to communicate with its operators in a secure manner that does not draw attention. Using Hive even if an implant is discovered on a target computer, attributing it to the CIA is difficult by just looking at the communication of the malware with other servers on the internet. Hive provides a covert communications platform for a whole range of CIA malware to send exfiltrated information to CIA servers and to receive new instructions from operators at the CIA.

Hive can serve multiple operations using multiple implants on target computers. Each operation anonymously registers at least one cover domain (e.g. "perfectly-boring-looking-domain.com") for its own use. The server running the domain website is rented from commercial hosting providers as a VPS (virtual private server) and its software is customized according to CIA specifications. These servers are the public-facing side of the CIA back-end infrastructure and act as a relay for HTTP(S) traffic over a VPN connection to a "hidden" CIA server called 'Blot'.

The code shows how the CIA could impersonate Kaspersky Lab:

According to WikiLeaks, CIA used these fake certificates to impersonate existing entities including Kaspersky Lab. "The three examples included in the source code build a fake certificate for the anti-virus company Kaspersky Laboratory, Moscow pretending to be signed by Thawte Premium Server CA, Cape Town. In this way, if the target organization looks at the network traffic coming out of its network, it is likely to misattribute the CIA exfiltration of data to uninvolved entities whose identities have been impersonated," noted WikiLeaks.

Also at The Register (follow-up).


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: -1, Redundant) by Anonymous Coward on Tuesday November 14 2017, @08:03PM

    by Anonymous Coward on Tuesday November 14 2017, @08:03PM (#596954)

    i worked with Anonymous Coward and he is the fucking worst. just a greasy, unrepentantly gross manchild. i have several friends who've also worked with him, or p.a.'d on sets he's been the "star" of.

    quick anecdote: ended up going for a ride with him on a film i was in (small role), because my friend - also a p.a. - had to drive him back to his house to find a shirt. we sat at his coffee table, covered in about 2409r782374 ash trays and seven boxes of half eaten mike & ikes. what seems like an hour later of uncomfortable stillness he comes barreling out of his bedroom, a little sweaty, panting, and drops fuckin STACKS of vhs tapes on the table in front of us. we were both pretty confused at the point. he then pops one in his combo vhs/dvd player and it's him getting blown by some poor chick with really fuckin terrible roots, he then puts the shirt over his slovenly body, turns to my friend and says, "this good?"

    it is one of the most surreal, ridiculous moments of my life.

    Starting Score:    0  points
    Moderation   -1  
       Redundant=1, Total=1
    Extra 'Redundant' Modifier   0  

    Total Score:   -1