- cypherpunks - lists.cpunks.org

All Ur BTC Iz Mine(d): "Massive cryptocurrency botnet used leaked NSA exploits"
by Razer 20 May '17

20 May '17

> Massive cryptocurrency botnet used leaked NSA exploits weeks before WCry > > Campaign that flew under the radar used hacked computers to mine > Monero currency. > > On Friday, ransomware called WannaCry used leaked hacking tools stolen > from the National Security Agency to attack an estimated 200,000 > computers in 150 countries. On Monday, researchers said the same > weapons-grade attack kit was used in a much-earlier and possibly > larger-scale hack that made infected computers part of a botnet that > mined cryptocurrency. > > Like WannaCry, this earlier, previously unknown attack used an exploit > codenamed EternalBlue and a backdoor called DoublePulsar, both of > which were NSA-developed hacking tools leaked in mid April by a group > calling itself Shadow Brokers. But instead of installing ransomware, > the campaign pushed cryptocurrency mining software known as Adylkuzz. > WannaCry, which gets its name from a password hard-coded into the > exploit, is also known as WCry. > > Kafeine, a well-known researcher at security firm Proofpoint, said the > attack started no later than May 2 and may have begun as early as > April 24. He said the campaign was surprisingly effective at > compromising Internet-connected computers that have yet to install > updates Microsoft released in early March to patch the critical > vulnerabilities in the Windows implementation of the Server Message > Block protocol. In a blog post published Monday afternoon, Kafeine wrote: > >> In the course of researching the WannaCry campaign, we exposed a lab >> machine vulnerable to the EternalBlue attack. While we expected to >> see WannaCry, the lab machine was actually infected with an >> unexpected and less noisy guest: the cryptocurrency miner Adylkuzz. >> We repeated the operation several times with the same result: within >> 20 minutes of exposing a vulnerable machine to the open web, it was >> enrolled in an Adylkuzz mining botnet. >> >> Figure 1: EternalBlue/DoublePulsar attack from one of several >> identified hosts, then Adylkuzz being downloaded from another host - >> A hash of a pcap of this capture is available in the IOCs table. >> >> The attack is launched from several virtual private servers which >> are massively scanning the Internet on TCP port 445 for potential >> targets. >> >> >> Upon successful exploitation via EternalBlue, machines are infected >> with DoublePulsar. The DoublePulsar backdoor then downloads and runs >> Adylkuzz from another host. Once running, Adylkuzz will first stop >> any potential instances of itself already running and block SMB >> communication to avoid further infection. It then determines the >> public IP address of the victim and download[s] the mining >> instructions, cryptominer, and cleanup tools. >> >> It appears that at any given time there are multiple Adylkuzz command >> and control (C&C) servers hosting the cryptominer binaries and mining >> instructions. >> >> Figure 2 shows the post-infection traffic generated by Adylkuzz >> in this attack. > > > Symptoms of the attack include a loss of access to networked resources > and system sluggishness. Kafeine said that some people who thought > their systems were infected in the WannaCry outbreak were in fact hit > by the Adylkuzz attack. The researcher went on to say this overlooked > attack may have limited the spread of WannaCry by shutting down SMB > networking to prevent the compromised machines from falling into the > hands of competing botnets. > > Proofpoint researchers have identified more than 20 hosts set up to > scan the Internet and infect vulnerable machines they find. The > researchers are aware of more than a dozen active Adylkuzz control > servers. The botnet then mined Monero, a cryptocurrency that bills > itself as being fully anonymous, as opposed to Bitcoin, in which all > transactions are traceable. > > Monday's report came the same day that a security researcher who works > for Google found digital fingerprints tying a version of WCry from > February to Lazarus Group, a hacking operation with links to North > Korea. In a report published last month, Kaspersky Lab researchers > said Bluenoroff, a Lazarus Group offshoot responsible for financial > profit, installed cryptocurrency-mining software on computers it > hacked to generate Monero coins. "The software so intensely consumed > system resources that the system became unresponsive and froze," > Kaspersky Lab researchers wrote. > > Assembling a botnet the size of the one that managed WannaCry and > keeping it under wraps for two to three weeks is a major coup. > Monday's revelation raises the possibility that other botnets have > been built on the shoulders of the NSA but have yet to be identified. > With links: https://arstechnica.com/security/2017/05/massive-cryptocurrency-botnet-used…

1 0

Msg-ing all [CypherPunks] disruption operators: CFP - WOOT '17
by Razer 20 May '17

20 May '17

The USENIX Workshop on Offensive Technologies (WOOT) aims to present a broad picture of offense and its contributions, bringing together researchers and practitioners in all areas of computer security. Offensive security has changed from a hobby to an industry. No longer an exercise for isolated enthusiasts, offensive security is today a large-scale operation managed by organized, capitalized actors. Meanwhile, the landscape has shifted: software used by millions is built by startups less than a year old, delivered on mobile phones and surveilled by national signals intelligence agencies. In the field's infancy, offensive security research was conducted separately by industry, independent hackers, or in academia. Collaboration between these groups could be difficult. Since 2007, the USENIX Workshop on Offensive Technologies (WOOT) has aimed to bring those communities together. WOOT '17 will feature a Best Paper Award and a Best Student Paper Award. Topics Computer security exposes the differences between the actual mechanisms of everyday trusted technologies and their models used by developers, architects, academic researchers, owners, operators, and end users. While being inherently focused on practice, security also poses questions such as "what kind of computations trusted systems are and aren't capable of?," which harken back to fundamentals of computability. State-of-the-art offense explores these questions pragmatically, gathering material for generalizations that lead to better models and more trustworthy systems. WOOT provides a forum for high-quality, peer-reviewed work discussing tools and techniques for attack. Submissions should reflect the state of the art in offensive computer security technology, exposing poorly understood mechanisms, presenting novel attacks, or surveying the state of offensive operations at scale. WOOT '17 accepts papers in both an academic security context and more applied work that informs the field about the state of security practice in offensive techniques. The goal for these submissions is to produce published works that will guide future work in the field. Submissions will be peer reviewed and shepherded as appropriate. Submission topics include but are not limited to: https://www.usenix.org/conference/woot17/call-for-papers

3 3

UK Dead Set On Invasively Controlling The Internet
by grarpamp 20 May '17

20 May '17

http://www.independent.co.uk/life-style/gadgets-and-tech/news/theresa-may-i… https://www.buzzfeed.com/jimwaterson/theresa-may-wants-to-regulate-the-inte… Theresa May is planning to introduce huge regulations on the way the internet works, allowing the government to decide what is said online. Particular focus has been drawn to the end of the manifesto, which makes clear that the Tories want to introduce huge changes the government intends to introduce huge restrictions on what people can post, share and publish online. The plans will allow Britain to become "the global leader in the regulation of the use of personal data and the internet" It comes just soon after the Investigatory Powers Act came into law. That legislation allowed the government to force internet companies to keep records on their customers' browsing histories, as well as giving ministers the power to break apps like WhatsApp so that messages can be read. the government will work even harder to ensure there is no "safe space The new rules would include laws that make it harder than ever to access porn The government will be able to place restrictions on seeing adult content and any exceptions would have to be justified to ministers Tech companies would be forced to help, and pay a tax to support, controversial government schemes like its Prevent strategy to promote extremist government narratives. will also seek to regulate the kind of news that is posted online and how companies are paid for it. If internet companies refuse to comply there will be a strict and strong set of ways to punish them. "We will introduce a sanctions regime and anticipate and reject potential criticism

1 1

Chelsea Manning Is a Free Woman: Her Heroism Has Expanded Beyond Her Initial Whistleblowing
by Cecilia Tanaka 20 May '17

20 May '17

"Chelsea Manning Is a Free Woman: Her Heroism Has Expanded Beyond Her Initial Whistleblowing" - post by Glenn Greenwald https://theintercept.com/2017/05/17/chelsea-manning-is-a-free-woman-her-her…

2 1

Fwd: Top German Court on Internet tracking: IP addresses are personal data
by Cecilia Tanaka 19 May '17

19 May '17

---------- Forwarded message ---------- From: <pab(a)daten-speicherung.de> Press release: +++ Top German Court on Internet tracking: IP addresses are personal data +++ This week the German Federal Supreme Court (Bundesgerichtshof) looked into whether website operators such as Google or Facebook may record which information Internet users read, post or searched on the web – or whether citizens have a right to use the Internet anonymously. The ruling concerns the case of German pirate party politician and privacy activist Patrick Breyer who is suing the German government over logging all visits to government websites (Case VI ZR 135/13). According to the court’s ruling, users‘ IP addresses qualify as personal data and may be collected only where allowed by data protection law. Contrary to some reports, the Court did not decide[2] on whether website operators may retain IP addresses in bulk to guard against online attacks. Instead the court referred the case back to the Court of Appeal (Landgericht) of Berlin in order to establish a sufficient factual basis concerning the necessity and proportionality of such metadata retention. The court’s press release[3] translates as follows: „In the present case the Court of Appeal’s findings were insufficient to balance the interests at stake. The Court of Appeal did not sufficiently establish whether retaining the applicant’s IP addresses is necessary in order to ensure the (general) operability of the services used. The defendent concedes that it does not retain IP addresses regarding many of its websites due to the low risk of an attack. There are no findings as to the risk of attack suffered by other federal websites the applicant wishes to use. After establishing these facts the Court of Appeal will need to balance, as required by the European Court of Justice, the defendent’s interest in ensuring the operability of its online media services against the applicant’s interest or fundamental rights and freedoms. In this context due regard shall be given to the issues of general prevention and law enforcement.“ Breyer calls on the Commission to act on the lack of specific EU rules protecting on-line privacy: „The Commission should amend EU legislation to specifically prohibit any blanket recording of our Internet use by website operators. Europe should reject the ruthless NSA method of ‚collecting it all‘ and enforce our right to freedom of information and expression in the digital age.“ Breyer argues that websites can be safe without tracking every user across every page: „This Internet stalking is about as useful as mounting a CCTV camera next to an open warehouse door. We need secure IT systems, not a general suspicion against Europe’s 400 million Internet users“. Website operators often record and track their users online behaviour for commercial purposes, but also to disclose records to law enforcement agencies and owners of copyright-protected content upon request. Breyer is challenging this practise and demands that operators anonymize users‘ IP addresses: „Banning governments and Internet giants from identifiably recording our browsing habits is the only way to effectively shield our private life and interests, to prevent erroneous infringement notices and false suspicions. IP addresses have turned out to be extremely prone to error und unreliable when used to identify users. For as long as browsing the Internet can result in prosecution, there is no real freedom of information and expression on-line. Nobody has a right to record everything we do and say on-line. Generation Internet has a right to access information on-line just as unmonitored and without inhibition as our parents read the paper, listened to the radio or browsed books.“ Court’s press release (German)[4] Report by Technology Law Dispatch (English)[5] [2] https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-… [3] http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gerich… [4] http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gerich… [5] https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-…

1 0

Re: elastic tabstops
by Zenaan Harkness 19 May '17

19 May '17

On Fri, May 19, 2017 at 10:05:16AM +0100, Nick Gravgaard wrote: > Hi Zenaan, > > Using a character other than tab has been suggested before (either a new > unicode code point or an existing one that's no longer widely used like > vertical tab), but I disagree for a few reasons. > > The first thing to note is that I am not actually changing the behaviour > of tab characters. You are trying to slice a fine cut longitudinally through a hair, using a razor blade - this is a difficult thing to do :) You can argue that "technically" you are correct, but even on your own blog you say "The problem is that we're using tabs and spaces to format text for aesthetic reasons rather than treating them semantically" - that is, you are aware that most people consider the semantic of tabs differently to the ideal TUI utopia, and you want this "to change". Sure, I even agree with you. But it's just a wee bit on the "hypocritical" side to then turn around and say, and I quote your words again, "I am not actually changing the behaviour of tab characters" !! I assume you are trying to provide "reasonable logic grounds" to assist any movement in the direction you suggest (again, which I agree could be ideal in many circumstances, but certainly not in all circumstances). However, it ought go without saying that contradicting yourself (in the words you use --as others receive/ interpret those words--, is only going to weaken, not strengthen, your case . . . > A tab character tells the editor to position the text that follows > it at the next tabstop. That doesn't change under elastic tabstops. >From a certain 'not inclusive of all existing semantic usage(s)' point of view, you are correct. >From many points of view of 'existing semantic for TAB', you will find vehement opposition based on --existing semantic for TAB--, and this ought be obvious. > All elastic tabstops does is set the positions of those > tabstops. No it does not! Here is why the words you have used are being charged as laced with hypocrisy (which I admit may well be completely unintended on your part) - existing semantic for "tab char" is indeed "set the position of tabstops, in a flexible, user-chosen way". This is the --existing-- usage! In Vim, I can set ts to 8 when trying to please the Linux kernel C boffins, to 4 (and replace with space characters) when treading in the godforsaken Python world, and to 3 (but don't replace with spaces), when programming in the truly enlightened Java modality. This is a LOT of flexibility! In fact, Vim is SO flexible, that I can configure it to know about EACH of these different tab requirements based on filetype, so I don't have to keep changing the ts setting every time I open a new file! This is close to TAB nirvana! And so! Although all of this complies with the common understanding of your words "All elastic tabstops does is set the positions of those tabstops", we must delve deeper to find the true disagreement. But the point is - if you wish to establish buy-in to your concept (even changing the -existing- (dominant) semantic for TAB, it may well behoove us (and when I say us, I mean us as in you :) to use words which express your concept with a little more precision. > If you run vi for instance, by default the tabstops are set at > every 8 (or 4 or whatever) characters. If you run a word processor, the > tabstops can be set manually at different positions on different lines. > In these cases, and in the case of elastic tabstops, the tab character > does the same thing. Again, not quite. Elastic tabstops have a little more different semantic to existing tabstops - you know this, I know this, and it is not in our interest for you or anyone to pretend they don't - that just generates counter-productive kickback. > Secondly, existing keyboards have a tab key. I think using a character > which is impossible to insert using a regular keyboard would greatly > damage adoption. Not at all! Did "there's only one TAB key" make Python files in the slightest any more challenging than C files, or indeed the ultimately supreme "TAB is 3 spaces" Java files? Absolutely not! Let's say you go write a Vim module to implement elastic tabstops and save the TUI world from eternal damnation of limited TAB stop options we currently face. Since all the language syntax recognition machinery is already in place, all I then have to do is set elastictabs=true in my .vimrc and BAM! elastic tabstops shall be the one tab to rule them all (did I mention "BAM!"??). Either the Tab key works they way I want, or not. If it doesn't, I change my vim settings. > Thirdly, introducing a new whitespace character would just introduce all > sorts of pain. Possibly, but are you at all, possibly slightly, just remotely may be, ignoring the possibility that it might also -solve- certain problems? > People already have problems telling the difference > between space and tab characters. Yet they do. Successfully so. In Vim, "listchars" is your friend! Seriously, such problems as visualizing eol, tab, space, end-of-para and more, are well and truly solved by competent editing software - if you think this is not the case, you're selling yourself short with substandard software and so you probably need to dump Emacs and bite the bullet and learn Vim. Like seriously. > It would be very difficult to understand 2 kinds of tab character > with 2 sets of tabstops (one static, one elastic) in the same file. Ok, you may have hear the little logical concept called "strawman" - if not, it's easy to search for and learn about, and it would be good for you to recognize that that's what you just did. A low ball by some standards, too. With listchars, I successfully, and optionally for each one, identify (or don't, if I prefer to ignore), tab, space and eol. Even xterm with standard X fixed fonts at relatively small point size has a dozen or so interesting chars to use to be "obviously different" enough to normal chars, to identify everything I need to. And anyway, you've (sort of impressively) snuck TWO strawmans in your one sentence here - the second being that "most people don't use two different indentation styles in the one text file, but I'm going to ignore this fact and pretend it's a major issue, and that now we'll have three or more indentation styles in MOST text files, and it's a massive issue and truly this is why we have to replace the -existing- semantic for TAB in order to save the world". I mean please, nice try, but TWO strawmen in the ONE sentence? I think this might be a case of premature rigorlogicus setting in - you might want to get that looked at :) :) > Thanks for thinking about the problem, but I don't think this is the > right solution. Your think might need more thunking. Thanks for responding, Zenaan > Nick > > > On Fri, 19 May 2017, at 02:00, Zenaan Harkness wrote: > > Hi Nick, > > > > I kinda get that the future awaits and all the sins of past TUIs > > shall be forgiven: > > http://nickgravgaard.com/elastic-tabstops/ > > > > but I think you're pushing the metaphorical heap of cow dung uphill > > to change the "standard behaviour of tab stops". > > > > However, Unicode is large and fullsome of characters, private code > > planes and future possibilities, and so a new ELASTIC_TAB character > > is perhaps the way to truly solve this existential crisis which all > > programmers and markdown authors face. > > > > This way, the new super tab shall be semantically unified within > > itself, and not compromised by existing expectations and semantics, > > which is probably critically foundational to getting wide support for > > elastic tabs. > > > > Time for someone to talk to someone from Unicode... > > > > Regards, > > Zenaan

1 0

"Academic Journal" Elsevier Sues For $15M "Piracy"
by grarpamp 19 May '17

19 May '17

https://torrentfreak.com/elsevier-wants-15-million-piracy-damages-from-sci-… Elsevier, one of the largest academic publishers, is demanding $15 million in damages from Sci-Hub and LibGen, who make paywalled scientific research papers freely available to the public [without permission]. A good chunk of these papers are copyrighted, many by Elsevier. Elsevier has requested a default judgment of $15 million against the defendants for their "truly egregious conduct" and "staggering" infringement. Sci-Hub's efforts are backed by many prominent scholars, who argue that tax-funded research should be accessible to everyone. Others counter that the site doesn't necessarily help the "open access" movement move forward. Sci-Hub's founder Alexandra Elbakyan defends her position and believes that what she does is helping millions of less privileged researchers to do their work properly by providing free access to research results. https://en.wikipedia.org/wiki/Open_access Darknets!!

1 0

elastic tabstops
by Zenaan Harkness 19 May '17

19 May '17

Hi Nick, I kinda get that the future awaits and all the sins of past TUIs shall be forgiven: http://nickgravgaard.com/elastic-tabstops/ but I think you're pushing the metaphorical heap of cow dung uphill to change the "standard behaviour of tab stops". However, Unicode is large and fullsome of characters, private code planes and future possibilities, and so a new ELASTIC_TAB character is perhaps the way to truly solve this existential crisis which all programmers and markdown authors face. This way, the new super tab shall be semantically unified within itself, and not compromised by existing expectations and semantics, which is probably critically foundational to getting wide support for elastic tabs. Time for someone to talk to someone from Unicode... Regards, Zenaan

1 0

[RUS] US State Department: Assad burning 10s of 1000s in furnaces
by Zenaan Harkness 19 May '17

19 May '17

So the USA State Department has officially declared https://www.state.gov/r/pa/prs/ps/2017/05/270865.htm there's anuddah shoah happing under the world's collective nose, with tens of thousands being cremated for their sins in Syria. Of course the obvious questions are being asked by the alternative media, such as "Why would somebody who has slaughtered 13,000 people bothered to dig them individual graves on consecrated ground?" and "why would somebody who is trying to hide 13,000 bodies bury them in a cemetery -- the one place where dead bodies are usually found?" But the obvious nearly always escapes the (((MSM))) getting their collective hard on from tired olde (((sensationalist propaganda))). Who could ever, ever have predicted this type of behaviour? I'm shocked, utterly shocked I tell ya! ** Unhinged US Now Claims Assad Is Burning People in Furnaces by the Tens of Thousands http://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413c… ------------------------------------------------------------ by RI Staff on Wed, May 17, 2017 Here is something that happened two days ago but we're only reporting it today....because it left us utterly speechless. The US State Department has held a press conference where Tillerson's number two responsible for the Middle East explained with a straight face that the Syrian government was executing 50 prisoners a day and then disposing of their bodies in a purpose-built "crematorium". ** Putin Exiles Lavrov to Siberia for Not Divulging Super Sensitive US Secrets Provided by Trump http://russia-insider.us9.list-manage2.com/track/click?u=fa2faf7034c3c3c413… ------------------------------------------------------------ by RI Staff on Wed, May 17, 2017 Russia's Foreign Minister Sergey Lavrov is a traitor. During his secretive meeting with Donald Trump last week, Lavrov was provided with thousands of terabytes of top secret information. Victory! Except after Lavrov returned to Moscow, he failed to divulge this super secret information to Putin or Russia's secret services. As you can probably imagine, Putin is very upset that Lavrov chose to withhold so many juicy American secrets from him. And today Putin publicly reprimanded Lavrov for betraying the Motherland: US rejects Putin’s offer of transcript of Trump-Lavrov meeting http://theduran.com/us-rejects-putin-offer-transcript-trump-lavrov-talks/ US rejects and ridicules unprecedented Russian offer though it offers the one opportunity of ascertaining beyond all doubt what actually happened at the meeting between Trump and Lavrov. (Given the USA spying department's' inability to bug the White House, Putin's offer of a transcrisp was generous if nothing else...) In other news, Trump's despotic dictator quotient continues to rise as America's love for Syria knows no bounds: Confirmed: America attacks Syrian Arab Army and its allies–a crime and blunder http://theduran.com/confirmed-america-attacks-syrian-arab-army-and-its-alli… ... According to a US official, “The strike did happen. It was against a pro-regime force operating in the vicinity of At Tanf. This regime force was operating within a well-established de-confliction (de-escalation) zone. The commander on the ground perceived this force to be a threat to coalition forces”. ... This is indicative of the fact that Russia does not exceed its mandate in the conflict which is merely to aid Syria in fighting terrorism. Russia has no mandate to mediate between let alone controls parties in Syria. Russia can and will advise but will not impose. ... While not directly bound by the letter of the Astana Memorandum, America is bound by international law and under international law the very presence of US military forces in any part of Syria is totally illegal. This is why today’s event is a war crime. ...

1 0

Fwd: [NATURAL_DEFENCE] Who is Publishing NSA and CIA Secrets, and Why?
by grarpamp 18 May '17

18 May '17

So deep in ur base... ---------- Forwarded message ---------- From: ECOTERRA Intl. <office(a)ecoterra-international.org> Date: Mon, May 15, 2017 at 7:31 AM Subject: [NATURAL_DEFENCE] Who is Publishing NSA and CIA Secrets, and Why? To: MAILHUB <mailhub(a)ecoterra.net> Who is Publishing NSA and CIA Secrets, and Why? By Bruce Schneier - May 15, 2017 - CRYPTO-GRAM There's something going on inside the intelligence communities in at least two countries, and we have no idea what it is. Consider these three data points. One: someone, probably a country's intelligence organization, is dumping massive amounts of cyberattack tools belonging to the NSA onto the Internet. Two: someone else, or maybe the same someone, is doing the same thing to the CIA. Three: in March, NSA Deputy Director Richard Ledgett described how the NSA penetrated the computer networks of a Russian intelligence agency and was able to monitor them as they attacked the US State Department in 2014. Even more explicitly, a US ally -- my guess is the UK -- was not only hacking the Russian intelligence agency's computers, but also the surveillance cameras inside their building. "They [the US ally] monitored the [Russian] hackers as they manoeuvred inside the U.S. systems and as they walked in and out of the workspace, and were able to see faces, the officials said." Countries don't often reveal intelligence capabilities: "sources and methods." Because it gives their adversaries important information about what to fix, it's a deliberate decision done with good reason. And it's not just the target country who learns from a reveal. When the US announces that it can see through the cameras inside the buildings of Russia's cyber warriors, other countries immediately check the security of their own cameras. With all this in mind, let's talk about the recent leaks at NSA and the CIA. Last year, a previously unknown group called the Shadow Brokers started releasing NSA hacking tools and documents from about three years ago. They continued to do so this year -- five sets of files in all -- and have implied that more classified documents are to come. We don't know how they got the files. When the Shadow Brokers first emerged, the general consensus was that someone had found and hacked an external NSA staging server. These are third-party computers that the NSA's TAO hackers use to launch attacks from. Those servers are necessarily stocked with TAO attack tools. This matched the leaks, which included a "script" directory and working attack notes. We're not sure if someone inside the NSA made a mistake that left these files exposed, or if the hackers that found the cache got lucky. That explanation stopped making sense after the latest Shadow Brokers release, which included attack tools against Windows, PowerPoint presentations, and operational notes -- documents that are definitely not going to be on an external NSA staging server. A credible theory, which I first heard from Nicholas Weaver, is that the Shadow Brokers are publishing NSA data from multiple sources. The first leaks were from an external staging server, but the more recent leaks are from inside the NSA itself. So what happened? Did someone inside the NSA accidentally mount the wrong server on some external network? That's possible, but seems very unlikely. Did someone hack the NSA itself? Could there be a mole inside the NSA, as Kevin Poulsen speculated? If it is a mole, my guess is that he's already been arrested. There are enough individualities in the files to pinpoint exactly where and when they came from. Surely the NSA knows who could have taken the files. No country would burn a mole working for it by publishing what he delivered. Intelligence agencies know that if they betray a source this severely, they'll never get another one. That points to two options. The first is that the files came from Hal Martin. He's the NSA contractor who was arrested in August for hoarding agency secrets in his house for two years. He can't be the publisher, because the Shadow Brokers are in business even though he is in prison. But maybe the leaker got the documents from his stash: either because Martin gave the documents to them or because he himself was hacked. The dates line up, so it's theoretically possible, but the contents of the documents speak to someone with a different sort of access. There's also nothing in the public indictment against Martin that speaks to his selling secrets to a foreign power, and I think it's exactly the sort of thing that the NSA would leak. But maybe I'm wrong about all of this; Occam's Razor suggests that it's him. The other option is a mysterious second NSA leak of cyberattack tools. The only thing I have ever heard about this is from a Washington Post story about Martin: "But there was a second, previously undisclosed breach of cybertools, discovered in the summer of 2015, which was also carried out by a TAO employee, one official said. That individual also has been arrested, but his case has not been made public. The individual is not thought to have shared the material with another country, the official said." But "not thought to have" is not the same as not having done so. On the other hand, it's possible that someone penetrated the internal NSA network. We've already seen NSA tools that can do that kind of thing to other networks. That would be huge, and explain why there were calls to fire NSA Director Mike Rogers last year. The CIA leak is both similar and different. It consists of a series of attack tools from about a year ago. The most educated guess amongst people who know stuff is that the data is from an almost-certainly air-gapped internal development wiki -- a Confluence server -- and either someone on the inside was somehow coerced into giving up a copy of it, or someone on the outside hacked into the CIA and got themselves a copy. They turned the documents over to WikiLeaks, which continues to publish it. This is also a really big deal, and hugely damaging for the CIA. Those tools were new, and they're impressive. I have been told that the CIA is desperately trying to hire coders to replace what was lost. For both of these leaks, one big question is attribution: who did this? A whistleblower wouldn't sit on attack tools for years before publishing. A whistleblower would act more like Snowden or Manning, publishing immediately -- and publishing documents that discuss what the US is doing to whom, not simply a bunch of attack tools. It just doesn't make sense. Neither does random hackers. Or cybercriminals. I think it's being done by a country or countries. My guess was, and is still, Russia in both cases. Here's my reasoning. Whoever got this information years before and is leaking it now has to 1) be capable of hacking the NSA and/or the CIA, and 2) willing to publish it all. Countries like Israel and France are certainly capable, but wouldn't ever publish. Countries like North Korea or Iran probably aren't capable. The list of countries who fit both criteria is small: Russia, China, and...and...and I'm out of ideas. And China is currently trying to make nice with the US. Last August, Edward Snowden guessed Russia, too. So Russia -- or someone else -- steals these secrets, and presumably uses them to both defend its own networks and hack other countries while deflecting blame for a couple of years. For it to publish now means that the intelligence value of the information is now lower than the embarrassment value to the NSA and CIA. This could be because the US figured out that its tools were hacked, and maybe even by whom; which would make the tools less valuable against US government targets, although still valuable against third parties. The message that comes with publishing seems clear to me: "We are so deep into your business that we don't care if we burn these few-years-old capabilities, as well as the fact that we have them. There's just nothing you can do about it." It's bragging. Which is exactly the same thing Ledgett is doing to the Russians. Maybe the capabilities he talked about are long gone, so there's nothing lost in exposing sources and methods. Or maybe he too is bragging: saying to the Russians that he doesn't care if they know. He's certainly bragging to every other country that is paying attention to his remarks. (He may be bluffing, of course, hoping to convince others that the US has intelligence capabilities it doesn't.) What happens when intelligence agencies go to war with each other and don't tell the rest of us? I think there's something going on between the US and Russia that the public is just seeing pieces of. We have no idea why, or where it will go next, and can only speculate. This essay was first published on Lawfare.com. https://www.lawfareblog.com/who-publishing-nsa-and-cia-secrets-and-why Ledgett: https://www.washingtonpost.com/world/national-security/new-details-emerge-a… Shadow Brokers: https://www.schneier.com/blog/archives/2016/08/major_nsaequati.html https://www.schneier.com/blog/archives/2017/04/shadow_brokers_.html https://arstechnica.com/security/2017/04/nsa-leaking-shadow-brokers-just-du… Snowden on Shadow Brokers: https://twitter.com/Snowden/status/765514477341143040 Kevin Poulsen's speculation: http://www.thedailybeast.com/articles/2017/04/20/is-there-a-russian-mole-in… Hal Martin: https://www.washingtonpost.com/world/national-security/government-contracto… https://www.washingtonpost.com/world/national-security/ex-nsa-contractor-ac… The second NSA leaker: https://www.washingtonpost.com/world/national-security/pentagon-and-intelli… Calls to fire NSA Director Mike Rogers: https://www.washingtonpost.com/world/national-security/pentagon-and-intelli… China: https://www.wired.com/2015/09/us-china-reach-historic-agreement-economic-es… http://www.npr.org/sections/parallels/2017/04/06/522764317/summit-between-c… ____________________________________________________________ - Please send your feedback and comments to office[AT]ecoterra.de All ECOTERRA Media and Disseminations are re-distributable under Creative Commons Non-Commercial Share-Alike Licence, but kindly do not take the ECOTERRA free mailing list services for granted! Become a Friend of ECOTERRA and make a donation NOW to help keep ECOTERRA FREE and INDEPENDENT ============== Pro-active work to protect nature and human rights requires YOU to work with us Even if you have no possibility to be at the front-lines with us, please know we need independent funding. PLEASE consider to support ECOTERRA's work through our trust fund. Send your pledges to ecotrust[AT]ecoterra.net EVERY BIT COUNTS. ------------------- ECOTERRA Intl. SURVIVAL & FREEDOM for PEOPLE & NATURE ----------------- Our full footer, being an essential, legal part of this dissemination, can be found at http://www.ecoterra.net/footer.htm - please read it at least once a month to get important subscription and security updates. - please also ensure that our sender domains @ecoterra.net and @ecoterra-international.org are WHITELISTED with your e-mail account, programme and ISP to receive your information safely. To subscribe, un-subscribe or re-subscribe to most ECOTERRA group-lists just go to http://ccmail.ecoterra-international.org/ or send an e-mail to mailhub(a)ecoterra.net. ---------------------- ECOTERRA Intl. nodes: Canaries - Cairns - Cairo - Calgary - Cape Town - Cassel - Cebu - Cork - Curitiba - La Paz - London - Los Angeles - Nairobi - Roma - Paris - Reykjavik - Stuttgart - Wien - Vanuatu ECOTERRA - FIRST PEOPLES & NATURE FIRST! http://www.ecoterra-international.org 24 h EMERGENCY RESPONSE PHONE LINE: +49-177-235-908-1 Become a pro-ative-member of fPcN-interCultural (write to friends of Peoples close to Nature via collective(a)fpcn-global.org) or of our Marine Group: http://www.ecop.info

3 3