Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Tuesday November 14 2017, @06:15PM   Printer-friendly
from the sysadmin-sleep-disruption dept.

Vault 8:

Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware.

Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a target computer is useless if there is no way for it to communicate with its operators in a secure manner that does not draw attention. Using Hive even if an implant is discovered on a target computer, attributing it to the CIA is difficult by just looking at the communication of the malware with other servers on the internet. Hive provides a covert communications platform for a whole range of CIA malware to send exfiltrated information to CIA servers and to receive new instructions from operators at the CIA.

Hive can serve multiple operations using multiple implants on target computers. Each operation anonymously registers at least one cover domain (e.g. "perfectly-boring-looking-domain.com") for its own use. The server running the domain website is rented from commercial hosting providers as a VPS (virtual private server) and its software is customized according to CIA specifications. These servers are the public-facing side of the CIA back-end infrastructure and act as a relay for HTTP(S) traffic over a VPN connection to a "hidden" CIA server called 'Blot'.

The code shows how the CIA could impersonate Kaspersky Lab:

According to WikiLeaks, CIA used these fake certificates to impersonate existing entities including Kaspersky Lab. "The three examples included in the source code build a fake certificate for the anti-virus company Kaspersky Laboratory, Moscow pretending to be signed by Thawte Premium Server CA, Cape Town. In this way, if the target organization looks at the network traffic coming out of its network, it is likely to misattribute the CIA exfiltration of data to uninvolved entities whose identities have been impersonated," noted WikiLeaks.

Also at The Register (follow-up).


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by The Mighty Buzzard on Tuesday November 14 2017, @10:27PM (4 children)

    by The Mighty Buzzard (18) Subscriber Badge <themightybuzzard@proton.me> on Tuesday November 14 2017, @10:27PM (#597020) Homepage Journal

    When I was about six years old, I asked my dad when cow season was. He got a good laugh out of that.

    Just an FYI though: I own one firearm and have yet to put a single round through it since I got it. I'm more of a liberty-sexual.

    --
    My rights don't end where your fear begins.
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 3, Funny) by Gaaark on Wednesday November 15 2017, @01:20AM (3 children)

    by Gaaark (41) on Wednesday November 15 2017, @01:20AM (#597084) Journal

    Is that like Freedom Fries?
    ;)

    --
    --- Please remind me if I haven't been civil to you: I'm channeling MDC. ---Gaaark 2.0 ---
    • (Score: 2) by The Mighty Buzzard on Wednesday November 15 2017, @03:16AM (2 children)

      by The Mighty Buzzard (18) Subscriber Badge <themightybuzzard@proton.me> on Wednesday November 15 2017, @03:16AM (#597119) Homepage Journal

      Nah, I have a thing for that New York chick with the torch.

      --
      My rights don't end where your fear begins.
      • (Score: 3, Insightful) by bob_super on Wednesday November 15 2017, @09:00AM (1 child)

        by bob_super (1357) on Wednesday November 15 2017, @09:00AM (#597215)

        She's a legal immigrant, yet they never let her get past Ellis Island.
        Discrimination against the French, I guess.

        • (Score: 3, Insightful) by aristarchus on Thursday November 16 2017, @04:51AM

          by aristarchus (2645) on Thursday November 16 2017, @04:51AM (#597582) Journal

          Now that I have learned that not only is The Mighty Buzzard not really a Native American, but that also he only owns one gun, that he has never fired? Oh My Gawd! What kind of anarchist right libertarian can you be with a questionable racial purity, but more importantly a lack of actual ammosexual orgasmic activity, shared with lots of other men, um, in a totally firearms and not at all gay way? I am just asking. Are you not a total fraud, TMB? A complete "internet" libertarian, all talk, and no ammo. I should have known. TMB's attempt to censor me just expose the fact that he has never fired his weapon. If he had, he would understand what I am talking about, instead of being taken in by the purveyors of right-wing homosexual homo-phobic propaganda.