Copies of malware used by intelligence agencies to spy on journalists

https://wikileaks.org/spyfiles4/

by gasull • 12 years ago

383 75 12 years ago

wikileaks.org

aetherspawn• 12 years ago

"Handle with care."

Hey guys, let's unzip this so the next guy can run it and spread the worlds most advanced malware on our home network.

cyphunk2• 12 years ago

I didn't see any zips. Though zip is not the only vector one should be concerned with. For downloadable files, handle with extreme care. Exploration of the database content however is static and i'm sure the Internet will thank you if you parse and compile a list of interesting patterns you find from it.

rubbingalcohol• 12 years ago

It would be fun to install in a VM though! Or maybe not.

gasull2• 12 years ago

It will phone home. Don't do it unless it's disconnected from the network. It might also try to spread the infection through other attack vectors, like bluetooth, or trying to break out of the VM.

toomuchtodo• 12 years ago

The equivalent of handling Ebola in your home kitchen.

frozenport• 12 years ago

I doubt its advanced, their customer list doesn't include well established players like China, Russia and the USA. In fact, this might be the cheapest militarized malware you can get. The only way to go cheaper is to use a TeamViewer RAT.

kissickas3• 12 years ago

It might not be the most advanced out there, but I wouldn't belittle the surveillance ability of countries like Pakistan, Qatar, Bahrain, and South Africa.

Surprised to see Italy on there, though.

https://wikileaks.org/spyfiles4/customers.html

cyphunk2• 12 years ago

shared pad for compiling patterns: https://pad.riseup.net/p/gO8Ng806lNnl

zby• 12 years ago

And they all use gmail?!?!?!

sitkack• 12 years ago

It is called NopSec

kissickas3• 12 years ago

Interesting note on Mongolia on the bottom.

Also good to see that, at least for a time, Gmail was able to detect infected files (see the Mongolian feedback numbers 10-12)

https://wikileaks.org/spyfiles4/database.html#feedback

cbhl• 12 years ago

Hmm, I'm not sure if that's Gmail detecting an infected file. I'm pretty sure Gmail just blocks .exe and .bat files altogether (even in .zip archives).

https://support.google.com/mail/answer/6590?hl=en

kissickas3• 12 years ago

The file in question was a PDF - can it detect that?

xkiwi• 12 years ago

I don't usually click EXE,

But when I do,

I do it on my production computer with 200 VM running.

======

and none of my firewalls pop a warning.

philtar• 12 years ago

My AV deleted it as soon as it was extracted.

philangist• 12 years ago

Ha. What AV do you use?

BorisMelnik• 12 years ago

If I were to download this, I'd do it with some masking tape over my webcam, booted from Kali Linux, inside a Windows VM from a library or coffee shop.

atmosx• 12 years ago

Just don't forget to wear gloves.

higherpurpose• 12 years ago

And a ski mask.

ivanca• 12 years ago

They may have cameras in the coffee shop or near there, so you'd better use TOR.

sam_bwut• 12 years ago

Why Kali? Surely you means TAILS?

iancarroll2• 12 years ago

Kali comes with some forensic tools.

icpmacdo• 12 years ago

Would you do that on a laptop hard drive partition or on a clean drive? Would you use that drive after formatting it? I think that physically breaking the connection between the camera and microphone and the laptop would be a good idea.

tux3• 12 years ago

That's pretty much what I did, it's now sitting in my Random-Noise-10GB file waiting to be opened in IDA.

tripzilch• 12 years ago

masking tape over my webcam

what people always seem to forget is that it's not the webcam but the microphone that presents the greatest privacy risk.

if you tape it off, it'll just lower the volume (and possibly dampen higher frequencies, but you just need 300-3800Hz for voice).

additionally (outside the coffee shop scenario you describe here), what's a webcam do? ok, it'll see your face. chances are they already know your identity. maybe it'll catch one second of your underwear, big deal. now compare to a microphone, much less data, but it picks up every conversation in the room, regardless if they're "in view". much worse.

iancarroll2• 12 years ago

I have my microphone (and webcam) disabled from the BIOS. It's pretty effective.

dalke• 12 years ago

Different people have different rankings of what they consider to be a privacy risk. From recent news, we know that some people are very much into distributing personal images made by other people and kept in what was presumed to be private storage. We also know that some people enjoy manipulating images, including sometimes to torment those who have been photographed. Audio manipulation is less disturbing.

Consider also that some people have computers in line of sight of where they have sex, and an illicitly captured video recording of sex without sound is more often thought of as a privacy intrusion than an audio recording without video of the same ... as the noise from my neighbors might attest.

girvo2• 12 years ago

So, it seems the NSW police here in Australia are a customer and use this.

Ignore for a moment whether it's a good or bad thing that police use tools like these. What I want to know is, what happens once they "get their guy", so to speak.

Does the malware stay on that computer forever, violating the privacy of family members, or other users of the computer should it be sold on and not wiped correctly? What happens if it's not the correct person?

Basically, why are the police spying? To me, that raises some ethical questions and makes me feel that the police will handle things like this in a very ham-fisted way, like they usually do with technology. Worrying.

jamesk_au• 12 years ago

(I'm also in NSW)-- The list of "support requests" on the customers page suggests that the tools are used only in accordance with duly-issued warrants. Access would need to be removed once the purpose of the warrant had been fulfilled, but we may never know whether they get that right in practice. Ben Grubb has collated some background information on the operation of those laws.[1]

[1] http://www.smh.com.au/it-pro/government-it/nsw-police-use-ha...

meowface3• 12 years ago

I have not looked at the materials but I suspect most or all Western countries using this toolkit are using it for specific investigations where warrants have been issued.

I personally have no qualms with the FBI planting malware as just another form of surveillance (if they have a warrant to search your home and tap your phone, why shouldn't they be able to get a warrant to monitor your computer?). The problem with Gamma Group, and what I suspect is one of the core reasons for this leak, is that they happily sell their product to extremely oppressive regimes and give them personal support, knowing full well that the tools are being used to spy on and find dissidents, protesters, and political opponents.

girvo2• 12 years ago

Great information, thanks. I'd love to be a fly on the wall and see whether they push things too far...

indrax• 12 years ago

If I were the company writing this, I'd include a remote uninstall command that left as few traces as possible, and encourage its use. It lowers the probability of discovery.

Since law enforcement typically wants convictions, it could be a selling point to prompt for uninstall when a warrant expires.

ogijaoijfawje3• 12 years ago

I know many love to consider Snowden and Assange "heroes", but I think these two are people we should think outside the box on. Are they acting in the interest of everyone, themselves, or another party? The releases, interviews, and otherwise that get released seem very scripted and controlled. The propaganda machine is skilled and there may be unseen benefits to these leaks.

vasco• 12 years ago

You realize that you sound like propaganda yourself?

XorNot• 12 years ago

Like Julian Assange repurposing wikileaks donations into the Julian Assange sexual assault defense fund?

Whatever you may think of the allegations, it has become extremely blurry as what the money donated to wikileaks' operation is actually used for, seeing as how Julian Assange wasn't supposed to be wikileaks.

throwaway8768764• 12 years ago

Since his "sexual assault" allegations were, in essence, an orchestrated smear campaign to discredit him and by extension Wikileaks, and the health of the former depends on the latter, I see absolutely no problem here.

Why do you?

DanBC• 12 years ago

The releases are outside Snowden's control now. He carefully gave a dump of information to two newspapers. Those newspapers control the flow of the information now, and they obviously want to maximise the benefit to themselves by releasing the information in controlled manner.

ogijaoijfawje3• 12 years ago

Snowden is milking the attention as well. Look at the livestream going on right now, he's discussing the information live.

Dylan168072• 12 years ago

Who cares if they're working for someone? Benefit to who?

sarciszewski2• 12 years ago

Nice try, GCHQ!

orblivion• 12 years ago

I hope Norton is updating their database accordingly.

rplnt2• 12 years ago

You can try and submit the files here: https://www.virustotal.com/

nysv2• 12 years ago

Pretty depressing. Only 2 out of 54 scanners currently detect something in the zips of the spyware.

https://www.virustotal.com/en-gb/file/6ee40b8e7d49f4ea70b7ce...

https://www.virustotal.com/en-gb/file/688f1e15390faf8d977351...

wldlyinaccurate• 12 years ago

This company makes millions upon millions of dollars from selling surveillance malware to (by the looks of the customer list) anyone who will pay.

If I were to set up a company which sold similar products at similar prices, I would expect the FBI to come knocking at my door very quickly.

sarciszewski2• 12 years ago

And they'd probably want to seize all your 0dayz to use to spy on activists too. :P

aliquis3• 12 years ago

These periodic reminders that Internet isn't a safe place and that anyone might be spying on us probably makes a lot of people learn about security, come up with better passwords, hesitate before downloading unknown software and so on.

When people get their identities stolen, or lose all the money from their bank accounts, this might be regarded as "random" events, in the same way that most people won't get mugged and when it happens it's because of "randomly" being in the wrong place at the wrong time. But more people have experience dealing with the government, and though they believe that criminals aren't interested in them they know that the government might be, and thus the government is seen as a more tangible threat.

Is it possible that governmental surveillance is on average a good thing, since it raises people's awareness and makes them protect themselves more? Having enough money in your bank account to buy food is, after all, a more basic need in Maslow's hierarchy than not having copies of your e-mail conversations in a government database.

Copies of malware used by intelligence agencies to spy on journalists

Related Stories