Wikileaks Global Intelligence File Dump Contained Malicious Software(joshwieder.net)
joshwieder.net
Wikileaks Global Intelligence File Dump Contained Malicious Software
http://www.joshwieder.net/2015/03/wikileaks-global-intelligence-file-dump.html
5 comments
It is the latest torrent file. The file is still there, and still is the malware.
this seems like a non-issue to me as well. you would expect malicious stuff to be there surely.
There is one specific torrent at issue here. It is the latest torrent, gifiles-2014.tar.bz2.torrent. I identified 20 malicious files in my post:
gifiles-2014\gifiles\attach\6\6566_The Split Betw.doc gifiles-2014\gifiles\attach\19\19701_MASY - Q MASY HUMINT.doc gifiles-2014\gifiles\attach\19\19719_List of Addresses - Advance Copies.doc gifiles-2014\gifiles\attach\152\152977_Happy vacation.pdf gifiles-2014\gifiles\attach\18\18714_Research_and_R.xls gifiles-2014\gifiles\attach\117\117687_Lithium.doc gifiles-2014\gifiles\attach\117\117870_Hybrid write-up2.doc gifiles-2014\gifiles\attach\117\117793_Hybrid write-up.doc gifiles-2014\gifiles\attach\47\47247_US Congress re.doc gifiles-2014\gifiles\attach\47\47329_US Congress re.doc gifiles-2014\gifiles\attach\52\52004_IRAN_STRAIT_PART.pdf gifiles-2014\gifiles\attach\151\151784_Command.com gifiles-2014\gifiles\attach\151\151098_text.zip->(Zip) gifiles-2014\gifiles\attach\151\151098_text.zip->text.exe gifiles-2014\gifiles\attach\119\119443_Russia Data Requests.doc gifiles-2014\gifiles\attach\142\142345_photos.zip->(Zip) gifiles-2014\gifiles\attach\142\142345_photos.zip->photos.jpg.exe gifiles-2014\gifiles\attach\146\146924_message.zip->(Zip) gifiles-2014\gifiles\attach\146\146924_message.zip->message.exe gifiles-2014\gifiles\attach\17\17102_Draft scenarios for Libya_0416.pdf
If it is your position that these files do not contain malicious files in the torrent I stated, please back up your conclusion with the level of research that I provided in my post(s) on the topic. For all files provide the hashes, for .DOC files provide the output of an application showing no macros or embedded OLE's exist, explain the presence of executables of .COM files in the torrent, provide a hex-dump of the PDFs.
As for the next comment's claim that the presence of malware in this sort of file distribution is irrelevant, such a position is nothing short of madness. These files are viewed by journalists and activists. Malicious software like this, regardless of its source, can compromise the identities of those journalists and activists. The only way I could understand such a contention would be if you were to also claim that journalists and activists should be "outed" for working on such documents. To that claim, I strenuously disagree. I think that those working on these documents should be able to remain private and protected. This is not a torrent containing a pirated movie. This is a torrent containing leaked documents from a defense contractor, provided on a website that (rightly I believe) claims to be a news organization.
Would you think that Fox News embedding malware in their website's flash player would be no big deal? For those of us working toward a safe and secure internet, malware should be removed and/or users notified wherever it exists. Mine is not an extremist position.
gifiles-2014\gifiles\attach\6\6566_The Split Betw.doc gifiles-2014\gifiles\attach\19\19701_MASY - Q MASY HUMINT.doc gifiles-2014\gifiles\attach\19\19719_List of Addresses - Advance Copies.doc gifiles-2014\gifiles\attach\152\152977_Happy vacation.pdf gifiles-2014\gifiles\attach\18\18714_Research_and_R.xls gifiles-2014\gifiles\attach\117\117687_Lithium.doc gifiles-2014\gifiles\attach\117\117870_Hybrid write-up2.doc gifiles-2014\gifiles\attach\117\117793_Hybrid write-up.doc gifiles-2014\gifiles\attach\47\47247_US Congress re.doc gifiles-2014\gifiles\attach\47\47329_US Congress re.doc gifiles-2014\gifiles\attach\52\52004_IRAN_STRAIT_PART.pdf gifiles-2014\gifiles\attach\151\151784_Command.com gifiles-2014\gifiles\attach\151\151098_text.zip->(Zip) gifiles-2014\gifiles\attach\151\151098_text.zip->text.exe gifiles-2014\gifiles\attach\119\119443_Russia Data Requests.doc gifiles-2014\gifiles\attach\142\142345_photos.zip->(Zip) gifiles-2014\gifiles\attach\142\142345_photos.zip->photos.jpg.exe gifiles-2014\gifiles\attach\146\146924_message.zip->(Zip) gifiles-2014\gifiles\attach\146\146924_message.zip->message.exe gifiles-2014\gifiles\attach\17\17102_Draft scenarios for Libya_0416.pdf
If it is your position that these files do not contain malicious files in the torrent I stated, please back up your conclusion with the level of research that I provided in my post(s) on the topic. For all files provide the hashes, for .DOC files provide the output of an application showing no macros or embedded OLE's exist, explain the presence of executables of .COM files in the torrent, provide a hex-dump of the PDFs.
As for the next comment's claim that the presence of malware in this sort of file distribution is irrelevant, such a position is nothing short of madness. These files are viewed by journalists and activists. Malicious software like this, regardless of its source, can compromise the identities of those journalists and activists. The only way I could understand such a contention would be if you were to also claim that journalists and activists should be "outed" for working on such documents. To that claim, I strenuously disagree. I think that those working on these documents should be able to remain private and protected. This is not a torrent containing a pirated movie. This is a torrent containing leaked documents from a defense contractor, provided on a website that (rightly I believe) claims to be a news organization.
Would you think that Fox News embedding malware in their website's flash player would be no big deal? For those of us working toward a safe and secure internet, malware should be removed and/or users notified wherever it exists. Mine is not an extremist position.
No, what my post was claiming is that the presence of malware didn't hurt my system and wasn't an issue when I browsed the files (on a practical basis).
I understand the potential.
I think it's valuable for you to do this.
You should continue to look for malicious files in a variety of places online.
Good work.
I understand the potential.
I think it's valuable for you to do this.
You should continue to look for malicious files in a variety of places online.
Good work.
Okay... so the computer they grabbed the data from was infected with various old malware. So why the link bait title?
More accurately, it appears that the dump included files from a mail server which, like most mail servers these days, received some messages with virus-laden attachments. It doesn't appear to be anything obviously malicious on the part of the creators of the dump, or Stratfor, or even Wikileaks.
http://www.joshwieder.net/2015/07/hector-monsegur-formerly-s...
http://www.joshwieder.net/2015/07/hector-monsegur-formerly-s...
I do not understand what about the title is linkbait. If you are circulating any sort of file you should announce the presence of malware or remove it.
The way it's worded heavily implies that this was done on purpose to hurt anyone who tries to view this stuff, and that you will get infected if you try to download it.
I'm not sure how you could word it differently. It implies nothing, and the article itself explicitly denies any finger-pointing.
> I ought to be clear from the outset: I have no information linking Wikileaks, Asssange, Hammond, Monsegur, the FBI or anyone else directly with these malicious files. That very well may change quickly as research progresses, but at no point should this post be considered finger pointing. The purpose of this post is not to assign responsibility but to ensure that the journalists and activists downloading these files or who have already downloaded these files understand the consequences and take proper precautions. If I can encourage security researchers to take a look at these files it would be a bonus.
Also answers your question of "why the [arguably] click-bait title?" To get attention, which it deserves.
> I ought to be clear from the outset: I have no information linking Wikileaks, Asssange, Hammond, Monsegur, the FBI or anyone else directly with these malicious files. That very well may change quickly as research progresses, but at no point should this post be considered finger pointing. The purpose of this post is not to assign responsibility but to ensure that the journalists and activists downloading these files or who have already downloaded these files understand the consequences and take proper precautions. If I can encourage security researchers to take a look at these files it would be a bonus.
Also answers your question of "why the [arguably] click-bait title?" To get attention, which it deserves.
I think the headline would be much better like, "Wikileaks Global Intelligence File Dump Contains a Great Deal of Malicious Software."
The problem is "loaded" which has two rather different meanings in this context. "X is loaded with Y" can just mean that X contains a lot of Y, but it can also mean that someone loaded a lot of Y into X. If you go for the second meaning, which is an entirely natural reading of the original headline, then the headline is saying "Someone (such as the NSA or their friends) put a lot of malware into this stuff."
As to the "why" question (which for the record was not mine) I don't think it's justifiable to use a misleading headline just because the information is important. Although I imagine the misleading nature of this headline was entirely unintentional.
The problem is "loaded" which has two rather different meanings in this context. "X is loaded with Y" can just mean that X contains a lot of Y, but it can also mean that someone loaded a lot of Y into X. If you go for the second meaning, which is an entirely natural reading of the original headline, then the headline is saying "Someone (such as the NSA or their friends) put a lot of malware into this stuff."
As to the "why" question (which for the record was not mine) I don't think it's justifiable to use a misleading headline just because the information is important. Although I imagine the misleading nature of this headline was entirely unintentional.
It depends on how you parse loaded.
I parsed it as "Loaded" as in the way I like my Baked Potatoes "Loaded" with Sour Cream and Bacon.
I can see how you parsed it the other way.
Reading the authors other posts--would it be worth giving him the benefit of the doubt that the author wasn't trying link bait?
I parsed it as "Loaded" as in the way I like my Baked Potatoes "Loaded" with Sour Cream and Bacon.
I can see how you parsed it the other way.
Reading the authors other posts--would it be worth giving him the benefit of the doubt that the author wasn't trying link bait?
You leave me wondering if you read my comment, since "it depends on how you parse loaded" is most of what I said, and I explicitly gave the author the benefit of the doubt by saying it was probably unintentional.
Ok, we took "loaded" out of the title as arguably loaded.
[deleted]
particularly when the people viewing those files will be journalists and activists who very much need to protect themselves from surveillance
"Loaded with" vs. "contains a little".
True, though if you're downloading some else's entire mailspool you should expect to find viruses and spam and malware.
Hector Monsegur has commented on the files & their relevance: http://www.joshwieder.net/2015/07/hector-monsegur-formerly-s...
It's an interesting problem:
* If Wikileaks edits the content it can be criticized for tampering.
* If Wikileaks leaves malware in it can be criticized for circulating malware.
It may also give an excuse to search engines and other partners of the government to block the site on account of it hosting files that are infected.
A pretty nasty no-win situation.
Also think about what this means for the sources of the documents. It means that the surveillance and intelligence information from these firms was likely compromised. Yikes.
* If Wikileaks edits the content it can be criticized for tampering.
* If Wikileaks leaves malware in it can be criticized for circulating malware.
It may also give an excuse to search engines and other partners of the government to block the site on account of it hosting files that are infected.
A pretty nasty no-win situation.
Also think about what this means for the sources of the documents. It means that the surveillance and intelligence information from these firms was likely compromised. Yikes.
What's wrong with providing one dump without malware, and a second dump of just the infected files, which when put together gives you the whole thing? That way you have full disclosure, the people who want the infected files can easily get it, and the people who don't want it can easily avoid it.
I really like this solution.
Critics might be able to say that Wikileaks BOTH hosts malware AND tampers with evidence - but if Wikileaks has a voice to respond it has a pretty good reply.
Filters and services sometimes block entire domains because one page hosts malware. So it might be that the excuse could still be used to block Wikileaks if they did host both - but again agreed that hosting both is pretty good.
It does increase the work staff at Wikileaks must do and the amount of data they have to host/manage.
But yeah overall if this becomes a problem for them doing both seems like a pretty good solution.
Nice!
Critics might be able to say that Wikileaks BOTH hosts malware AND tampers with evidence - but if Wikileaks has a voice to respond it has a pretty good reply.
Filters and services sometimes block entire domains because one page hosts malware. So it might be that the excuse could still be used to block Wikileaks if they did host both - but again agreed that hosting both is pretty good.
It does increase the work staff at Wikileaks must do and the amount of data they have to host/manage.
But yeah overall if this becomes a problem for them doing both seems like a pretty good solution.
Nice!
Practice safe computing instead of expecting others to do it for you.
What malware 'is" can even be a difficult question. Is a RAT malware, or a way to log people snooping on your computer? Also, new malware is discovered. So it'd have to be a curated collection.
What malware 'is" can even be a difficult question. Is a RAT malware, or a way to log people snooping on your computer? Also, new malware is discovered. So it'd have to be a curated collection.
Unfortunately it is more difficult than this.
Even if you practice safe computing it's likely that your information will be compromised - especially in the long term and especially if you are an organization.
That's not to say this practice isn't important. It's just that it's not enough. We need both of these things (and more).
The state of computer security is fundamentally asymmetric.
Even if you practice safe computing it's likely that your information will be compromised - especially in the long term and especially if you are an organization.
That's not to say this practice isn't important. It's just that it's not enough. We need both of these things (and more).
The state of computer security is fundamentally asymmetric.
In the case the pre-screener is honest, having them pre-check the work only saves you downloading a few virus executables at the cost of some work.
If the case the pre-screener isn't honest, it's saved you nothing at all and cost you a lot because you're likely to be less cautious.
Do you remember the tagline (roughly) "Outgoing email scanned and verified by AVG"? That was 100% worthless and actually very counterproductive. Expecting someone to check leaks like that is just as bad.
Scan everything. You've got the same technology they do.
If the case the pre-screener isn't honest, it's saved you nothing at all and cost you a lot because you're likely to be less cautious.
Do you remember the tagline (roughly) "Outgoing email scanned and verified by AVG"? That was 100% worthless and actually very counterproductive. Expecting someone to check leaks like that is just as bad.
Scan everything. You've got the same technology they do.
You're correct but this is not an argument against screening on the distribution end. Not everybody will do this and if you can protect them from problems due to their own lack of screening then you should.
Just because you can avoid problems on one end if you do everything right doesn't mean you shouldn't also try to avoid problems on the other end.
Just because you can avoid problems on one end if you do everything right doesn't mean you shouldn't also try to avoid problems on the other end.
This very specifically is an argument against scanning on the distribution end.
A false sense of security hurts more than deleting STONED.EXE (and likewise, all other malware caught by signature) helps.
Point to a modern virus scanner and also list what you've found in the archive. That gives a good baseline for people to check against without promising to have made anything safe to touch without scanning.
A false sense of security hurts more than deleting STONED.EXE (and likewise, all other malware caught by signature) helps.
Point to a modern virus scanner and also list what you've found in the archive. That gives a good baseline for people to check against without promising to have made anything safe to touch without scanning.
> A pretty nasty no-win situation.
It's a pretty easy win-win situation–offer both, inform users appropriately. And then provide a third set: a list of the sanitized files not present in the virus-free dump. I think a quick spot check through those would show whether any editorializing was going on.
I have serious concerns about their publishing the private emails of employees of a private company that, from all I can gather, turned out to be pretty non-evil. But the virus issues, while not Stratfor's or Wikileaks's direct fault, could have been mitigated by Wikileaks pretty easily.
(Disclosure: I've subscribed to them for many years, but have no interest beyond that.)
It's a pretty easy win-win situation–offer both, inform users appropriately. And then provide a third set: a list of the sanitized files not present in the virus-free dump. I think a quick spot check through those would show whether any editorializing was going on.
I have serious concerns about their publishing the private emails of employees of a private company that, from all I can gather, turned out to be pretty non-evil. But the virus issues, while not Stratfor's or Wikileaks's direct fault, could have been mitigated by Wikileaks pretty easily.
(Disclosure: I've subscribed to them for many years, but have no interest beyond that.)
The emails from SONY had some controversial stuff in them.
For example here is an interaction between the CEO and the State Department about setting up a group of media executives to develop US propaganda for the Middle East and Russia: https://wikileaks.org/sony/emails/emailid/117082
Of course it was also revealed that The Interview was a propaganda product aimed at destabilizing North Korea (in anticipation of the upcoming planned unification).
These sorts of things can only be found when there's wide access given to journalists. It's also true that the emails were available via torrent and hosted other places online.
To play the other side, 99% of the SONY leaks were innocuous. While it is a company with management that works, like most US international corporations, with the US government on 'shady things', it is also in large part also a private company with the usual mundane concerns of a corporation.
For example here is an interaction between the CEO and the State Department about setting up a group of media executives to develop US propaganda for the Middle East and Russia: https://wikileaks.org/sony/emails/emailid/117082
Of course it was also revealed that The Interview was a propaganda product aimed at destabilizing North Korea (in anticipation of the upcoming planned unification).
These sorts of things can only be found when there's wide access given to journalists. It's also true that the emails were available via torrent and hosted other places online.
To play the other side, 99% of the SONY leaks were innocuous. While it is a company with management that works, like most US international corporations, with the US government on 'shady things', it is also in large part also a private company with the usual mundane concerns of a corporation.
Sorry, I was just talking about Stratfor.
> Of course it was also revealed that The Interview was a propaganda product aimed at destabilizing North Korea (in anticipation of the upcoming planned unification).
I missed all that–can you point me in the right direction?
> These sorts of things can only be found when there's wide access given to journalists.
Sure, but there's an argument to be made that the only way to end domestic violence is to place cameras inside all homes. Obviously that tradeoff is one most people aren't willing to make, and I don't think that leaking the private emails of employees of a private company is ultimately morally defensible.
Whistleblowing is one (very important) thing–bulk dumps of 99% of innocuous stuff became there's 1% of stuff in there that isn't great (but probably isn't all that bad, in the grand scheme of things) is both tactically questionable–leaking something with a 1:99 S/N ratio is a terrible way to get your message across–it's also morally suspect.
If Wikileaks & Co. truly wanted to change the world (and it wasn't about garnering attention and giving indiscriminate anger an outlet), they'd be approaching things differently.
> Of course it was also revealed that The Interview was a propaganda product aimed at destabilizing North Korea (in anticipation of the upcoming planned unification).
I missed all that–can you point me in the right direction?
> These sorts of things can only be found when there's wide access given to journalists.
Sure, but there's an argument to be made that the only way to end domestic violence is to place cameras inside all homes. Obviously that tradeoff is one most people aren't willing to make, and I don't think that leaking the private emails of employees of a private company is ultimately morally defensible.
Whistleblowing is one (very important) thing–bulk dumps of 99% of innocuous stuff became there's 1% of stuff in there that isn't great (but probably isn't all that bad, in the grand scheme of things) is both tactically questionable–leaking something with a 1:99 S/N ratio is a terrible way to get your message across–it's also morally suspect.
If Wikileaks & Co. truly wanted to change the world (and it wasn't about garnering attention and giving indiscriminate anger an outlet), they'd be approaching things differently.
Oh sorry.
The Stratfor leaks had a TON of shady stuff.
> I missed all that–can you point me in the right direction?
Sure!
The CEO of SONY, high level state department officials, RAND specialist on nuclear deproliferation, regime change and North Korea, and Special Envoy to Korea discussed what direction the ending of the movie should go for it to most optimally destabilize the Kim regime. Special Envoy talked about plans (and RAND specialist Bennett) mention plans to seed the film into NK:
http://www.thedailybeast.com/articles/2014/12/17/exclusive-s...
Covered in the prior link and here (http://www.democracynow.org/2014/12/22/the_interview_pokes_f...) the State Department was given early screenings of the Interview.
The CIA and Hillary staffers were on set of the Interview (https://wikileaks.org/sony/emails/emailid/109275); Seth Rogan even mentioned getting inside information about Kim Jong Un's disappearance for surgery during the production from officials on set he thought were CIA (http://www.nytimes.com/2014/12/21/movies/james-franco-and-se...).
The decision to name the leader of NK in the film came down from executives - in the original script it had entirely fictional names (http://www.scpr.org/programs/the-frame/2014/12/15/40758/how-...). This is also confirmed by the SONY leaks, which have the executives trade emails concerned about the appearance of their having brought up the idea.
This all came out pretty early during the hacks but unfortunately the skepticism over it having been NK behind the hacks overwhelmed the media at the time. (It did turn out to be pretty definitively North Korea, or at least sympathizers, after all).
> 99% v. 1%
I happen to agree with you wholeheartedly. I do like the way that Wikileaks operates, though. They don't want to be the people in charge of curating and censoring information because they feel that this process can become politicized. So they publish everything.
The cost of their publications is extremely high. The returns are also high and IMO the ROI is good so in general I'm for them. But yeah if the ROI wasn't very good I would question it a lot more.
Definitely Wikileaks operates in pretty challenging legal waters.
The Stratfor leaks had a TON of shady stuff.
> I missed all that–can you point me in the right direction?
Sure!
The CEO of SONY, high level state department officials, RAND specialist on nuclear deproliferation, regime change and North Korea, and Special Envoy to Korea discussed what direction the ending of the movie should go for it to most optimally destabilize the Kim regime. Special Envoy talked about plans (and RAND specialist Bennett) mention plans to seed the film into NK:
http://www.thedailybeast.com/articles/2014/12/17/exclusive-s...
Covered in the prior link and here (http://www.democracynow.org/2014/12/22/the_interview_pokes_f...) the State Department was given early screenings of the Interview.
The CIA and Hillary staffers were on set of the Interview (https://wikileaks.org/sony/emails/emailid/109275); Seth Rogan even mentioned getting inside information about Kim Jong Un's disappearance for surgery during the production from officials on set he thought were CIA (http://www.nytimes.com/2014/12/21/movies/james-franco-and-se...).
The decision to name the leader of NK in the film came down from executives - in the original script it had entirely fictional names (http://www.scpr.org/programs/the-frame/2014/12/15/40758/how-...). This is also confirmed by the SONY leaks, which have the executives trade emails concerned about the appearance of their having brought up the idea.
This all came out pretty early during the hacks but unfortunately the skepticism over it having been NK behind the hacks overwhelmed the media at the time. (It did turn out to be pretty definitively North Korea, or at least sympathizers, after all).
> 99% v. 1%
I happen to agree with you wholeheartedly. I do like the way that Wikileaks operates, though. They don't want to be the people in charge of curating and censoring information because they feel that this process can become politicized. So they publish everything.
The cost of their publications is extremely high. The returns are also high and IMO the ROI is good so in general I'm for them. But yeah if the ROI wasn't very good I would question it a lot more.
Definitely Wikileaks operates in pretty challenging legal waters.
[deleted]
wikileaks could flag infected content and force people to click a "I know what I'm doing" button to download or view.
It seems like a scraper which could manage submitting to and checking virustotal would be a good idea.
Also, perhaps wikileaks / virustotal could come to sort of agreement to scan things and flag them while still making assets available to researchers whom still need raw docs, but with large virus warnings which intercept downloads to a warning landing page confirmation if there's no referrer (direct, deep linking).
Finally, the other issue is that not all malware (past, current or future) is known. We ran Windows Servers (NT, 2003) boxes directly on the internet (before I forced them to offer departmental firewalls) and these boxes had already attracted all sorts of multi-vendor unseen malware, rootkits and backdoors long before I got there. After deploying WOLF to a number of boxes, Mark Russinovich was like "yea, you should probably take [the IT sec depts advice]" by just get firewalls and then format all these boxes back to clean image, fully-patched and strong, production-usable, security policy state. Most IT folks don't conduct forensics research... they see strange behavior, try to find a scanner/remover (maybe 80% success), or partially remove it and continue despite unprovable to fully remove all traces... Or they wipe the boxes, start over and guess/pray that the same 'sploit doesn't exist twice. There's just too many unknown variants of existing sploits and too many new sploits to have much faith in antivirus (it's reactive, last line-of-defense security). Antivirus is an opposite Bloom filter... it'll tell you if you're pwned or may not pwned. It's a good to have, just not a complete holistic security posture.
Also, perhaps wikileaks / virustotal could come to sort of agreement to scan things and flag them while still making assets available to researchers whom still need raw docs, but with large virus warnings which intercept downloads to a warning landing page confirmation if there's no referrer (direct, deep linking).
Finally, the other issue is that not all malware (past, current or future) is known. We ran Windows Servers (NT, 2003) boxes directly on the internet (before I forced them to offer departmental firewalls) and these boxes had already attracted all sorts of multi-vendor unseen malware, rootkits and backdoors long before I got there. After deploying WOLF to a number of boxes, Mark Russinovich was like "yea, you should probably take [the IT sec depts advice]" by just get firewalls and then format all these boxes back to clean image, fully-patched and strong, production-usable, security policy state. Most IT folks don't conduct forensics research... they see strange behavior, try to find a scanner/remover (maybe 80% success), or partially remove it and continue despite unprovable to fully remove all traces... Or they wipe the boxes, start over and guess/pray that the same 'sploit doesn't exist twice. There's just too many unknown variants of existing sploits and too many new sploits to have much faith in antivirus (it's reactive, last line-of-defense security). Antivirus is an opposite Bloom filter... it'll tell you if you're pwned or may not pwned. It's a good to have, just not a complete holistic security posture.
Edit: One box had really crazy, clever malware (backdoor IRC bot which was firmly detectable by NIDS (snort) and by remote nmap) which defeated local nmap, portmon and rootkitrevealer... and it was a 24x7 production oracle box (no HA or archive log mode master-slave repl) running the dining order, meals and inventory databases, so live cd / usb-hdd-specialized hdd dongle (better forensics) weren't possible.
0. If I had budget authority, I would've ordered something which could grab memory and disk images on a live system and sign-up multiple .edu researchers & symantec security group and equivalent shops under NDA to analyze them.
1. And I would've yanked all those janky (R)ILO (aka RMSA, aka DRAC) cards with their always outdated Linux / Java / PHP "wifi router"-like whatever embedded systems.
2. Finally, I would've spent some cash on honeynet setups and cc: to item 0.
Edit^2: Props to Josh Wieder for taking sounding the sec awareness alarm. I would only do active sec research on untrusted materials within a decent hypervisor's VM on a virtual desktop (VDI) which has "nonpersistence" on all storage, so it's clean on every power cycle.
0. If I had budget authority, I would've ordered something which could grab memory and disk images on a live system and sign-up multiple .edu researchers & symantec security group and equivalent shops under NDA to analyze them.
1. And I would've yanked all those janky (R)ILO (aka RMSA, aka DRAC) cards with their always outdated Linux / Java / PHP "wifi router"-like whatever embedded systems.
2. Finally, I would've spent some cash on honeynet setups and cc: to item 0.
Edit^2: Props to Josh Wieder for taking sounding the sec awareness alarm. I would only do active sec research on untrusted materials within a decent hypervisor's VM on a virtual desktop (VDI) which has "nonpersistence" on all storage, so it's clean on every power cycle.
IRC is notorious for this type of garbage. Its pretty neat that the one you found disabled nmap (zenmap?). Did you ever find out what is was, or do you have a hash of the irc bot?
format all these boxes back to clean image, fully-patched and strong, production-usable, security policy state
No. You can't do that. Maybe in 1995. These days you have to throw out the hardware, due to the plethora of firmware rootkits: IPMI BMCs, network cards, hard disk controllers, etc.
No. You can't do that. Maybe in 1995. These days you have to throw out the hardware, due to the plethora of firmware rootkits: IPMI BMCs, network cards, hard disk controllers, etc.
A script that automatically submits to virustotal is like reinventing a very slow virus scanner.
Exactly, hence the preference for a partnership directly to get some more API access priority / infrastructure $ for dedicated scanner worker bots (virustotal is probably a bunch of internal VMs with COM instrumentation agents to WinRM or CLI Linux scanner versions, so more of those for private/dedicated users * ).
* I think virustotal could be easily monetized (without altering or cheapening itself) by freemium to orgs, nonprofits, govts that want faster, private, shared/dedicated access to the same "cloud" capabilities. There was HitmanPro which was good early on, but it didn't seem to be stay anywhere near as comprehensive as virustotal.
* I think virustotal could be easily monetized (without altering or cheapening itself) by freemium to orgs, nonprofits, govts that want faster, private, shared/dedicated access to the same "cloud" capabilities. There was HitmanPro which was good early on, but it didn't seem to be stay anywhere near as comprehensive as virustotal.
Would you rather have a slow virus scanner or a computer that is constantly slowed down by a virus scanner that is not always needed?
Pretty much every virus scanner since the dawn of viruses can be set to only scan on-demand.
Virustotal doesn't run locally, there's zero client impact!
Wikileaks' purpose is to publish leaked data, not tamper with it.
Please have a look at what I wrote... Not tamper, inform (least surprises).
The author should really add this in the beginning of the article...
"Any set of emails this large containing attachments is bound to contain malware, viruses, trojans and other malicious software - just like anybody's inbox which receives more than 5 mails a day. This is a reminder to everyone downloading this data to handle it with caution. Do no execute code, and view things only inside constrained network isolated virtual machines".
The way its worded right now seems to point fingers at wikileaks.
"Any set of emails this large containing attachments is bound to contain malware, viruses, trojans and other malicious software - just like anybody's inbox which receives more than 5 mails a day. This is a reminder to everyone downloading this data to handle it with caution. Do no execute code, and view things only inside constrained network isolated virtual machines".
The way its worded right now seems to point fingers at wikileaks.
Did you read the article past the first paragraph? I explicitly state I am not pointing fingers at anyone in the article in paragraph 6: "I have no information linking Wikileaks, Asssange, Hammond, Monsegur, the FBI or anyone else directly with these malicious files. That very well may change quickly as research progresses, but at no point should this post be considered finger pointing. The purpose of this post is not to assign responsibility but to ensure that the journalists and activists downloading these files or who have already downloaded these files understand the consequences and take proper precautions."
Personally I have looked through these files and have not run into any malware issues pointed out by the article.
I found it very informative and interesting to look through the intelligence files. One of my favorite finds are the docs on CANVAS and some of the US destabilization operations in Venezuela and color revolutions.