There is one specific torrent at issue here. It is the latest torrent, gifiles-2014.tar.bz2.torrent. I identified 20 malicious files in my post:
gifiles-2014\gifiles\attach\6\6566_The Split Betw.doc
gifiles-2014\gifiles\attach\19\19701_MASY - Q MASY HUMINT.doc
gifiles-2014\gifiles\attach\19\19719_List of Addresses - Advance Copies.doc
gifiles-2014\gifiles\attach\152\152977_Happy vacation.pdf
gifiles-2014\gifiles\attach\18\18714_Research_and_R.xls
gifiles-2014\gifiles\attach\117\117687_Lithium.doc
gifiles-2014\gifiles\attach\117\117870_Hybrid write-up2.doc
gifiles-2014\gifiles\attach\117\117793_Hybrid write-up.doc
gifiles-2014\gifiles\attach\47\47247_US Congress re.doc
gifiles-2014\gifiles\attach\47\47329_US Congress re.doc
gifiles-2014\gifiles\attach\52\52004_IRAN_STRAIT_PART.pdf
gifiles-2014\gifiles\attach\151\151784_Command.com
gifiles-2014\gifiles\attach\151\151098_text.zip->(Zip)
gifiles-2014\gifiles\attach\151\151098_text.zip->text.exe
gifiles-2014\gifiles\attach\119\119443_Russia Data Requests.doc
gifiles-2014\gifiles\attach\142\142345_photos.zip->(Zip)
gifiles-2014\gifiles\attach\142\142345_photos.zip->photos.jpg.exe
gifiles-2014\gifiles\attach\146\146924_message.zip->(Zip)
gifiles-2014\gifiles\attach\146\146924_message.zip->message.exe
gifiles-2014\gifiles\attach\17\17102_Draft scenarios for Libya_0416.pdf
If it is your position that these files do not contain malicious files in the torrent I stated, please back up your conclusion with the level of research that I provided in my post(s) on the topic. For all files provide the hashes, for .DOC files provide the output of an application showing no macros or embedded OLE's exist, explain the presence of executables of .COM files in the torrent, provide a hex-dump of the PDFs.
As for the next comment's claim that the presence of malware in this sort of file distribution is irrelevant, such a position is nothing short of madness. These files are viewed by journalists and activists. Malicious software like this, regardless of its source, can compromise the identities of those journalists and activists. The only way I could understand such a contention would be if you were to also claim that journalists and activists should be "outed" for working on such documents. To that claim, I strenuously disagree. I think that those working on these documents should be able to remain private and protected. This is not a torrent containing a pirated movie. This is a torrent containing leaked documents from a defense contractor, provided on a website that (rightly I believe) claims to be a news organization.
Would you think that Fox News embedding malware in their website's flash player would be no big deal? For those of us working toward a safe and secure internet, malware should be removed and/or users notified wherever it exists. Mine is not an extremist position.
Did you read the article past the first paragraph? I explicitly state I am not pointing fingers at anyone in the article in paragraph 6: "I have no information linking Wikileaks, Asssange, Hammond, Monsegur, the FBI or anyone else directly with these malicious files. That very well may change quickly as research progresses, but at no point should this post be considered finger pointing. The purpose of this post is not to assign responsibility but to ensure that the journalists and activists downloading these files or who have already downloaded these files understand the consequences and take proper precautions."
IRC is notorious for this type of garbage. Its pretty neat that the one you found disabled nmap (zenmap?). Did you ever find out what is was, or do you have a hash of the irc bot?
I do not understand what about the title is linkbait. If you are circulating any sort of file you should announce the presence of malware or remove it.
gifiles-2014\gifiles\attach\6\6566_The Split Betw.doc gifiles-2014\gifiles\attach\19\19701_MASY - Q MASY HUMINT.doc gifiles-2014\gifiles\attach\19\19719_List of Addresses - Advance Copies.doc gifiles-2014\gifiles\attach\152\152977_Happy vacation.pdf gifiles-2014\gifiles\attach\18\18714_Research_and_R.xls gifiles-2014\gifiles\attach\117\117687_Lithium.doc gifiles-2014\gifiles\attach\117\117870_Hybrid write-up2.doc gifiles-2014\gifiles\attach\117\117793_Hybrid write-up.doc gifiles-2014\gifiles\attach\47\47247_US Congress re.doc gifiles-2014\gifiles\attach\47\47329_US Congress re.doc gifiles-2014\gifiles\attach\52\52004_IRAN_STRAIT_PART.pdf gifiles-2014\gifiles\attach\151\151784_Command.com gifiles-2014\gifiles\attach\151\151098_text.zip->(Zip) gifiles-2014\gifiles\attach\151\151098_text.zip->text.exe gifiles-2014\gifiles\attach\119\119443_Russia Data Requests.doc gifiles-2014\gifiles\attach\142\142345_photos.zip->(Zip) gifiles-2014\gifiles\attach\142\142345_photos.zip->photos.jpg.exe gifiles-2014\gifiles\attach\146\146924_message.zip->(Zip) gifiles-2014\gifiles\attach\146\146924_message.zip->message.exe gifiles-2014\gifiles\attach\17\17102_Draft scenarios for Libya_0416.pdf
If it is your position that these files do not contain malicious files in the torrent I stated, please back up your conclusion with the level of research that I provided in my post(s) on the topic. For all files provide the hashes, for .DOC files provide the output of an application showing no macros or embedded OLE's exist, explain the presence of executables of .COM files in the torrent, provide a hex-dump of the PDFs.
As for the next comment's claim that the presence of malware in this sort of file distribution is irrelevant, such a position is nothing short of madness. These files are viewed by journalists and activists. Malicious software like this, regardless of its source, can compromise the identities of those journalists and activists. The only way I could understand such a contention would be if you were to also claim that journalists and activists should be "outed" for working on such documents. To that claim, I strenuously disagree. I think that those working on these documents should be able to remain private and protected. This is not a torrent containing a pirated movie. This is a torrent containing leaked documents from a defense contractor, provided on a website that (rightly I believe) claims to be a news organization.
Would you think that Fox News embedding malware in their website's flash player would be no big deal? For those of us working toward a safe and secure internet, malware should be removed and/or users notified wherever it exists. Mine is not an extremist position.