Vault 7 - Massive Wikileaks release on CIA eavesdropping
- Thread starter squirrelp
- Start date
you're *embarrassing* me 
Spymaster
Plastic Paddy
Yep. That's what I want.
lefteri
Well-Known Member
The anti-virus guys pretty much conclusively traced it back to the CIA iirc
classicdish
Well-Known Member
[journalist: ...can you tell us he wasn't there on behalf of the White House]
Sure,
I, I don't,
He is not
I am not
This is silly
I really don't think that asking where random foreign leaders are, and whether or not, ah, they're there
their fa
I'm sure he was there doing whatever on behalf of the Brit..
[journalist: He's not a leader]
he's a member of, I, I 'k, I understand that but
I'm not, I don't keep his schedule, I'm not sure to...
Sure,
I, I don't,
He is not
I am not
This is silly
I really don't think that asking where random foreign leaders are, and whether or not, ah, they're there
their fa
I'm sure he was there doing whatever on behalf of the Brit..
[journalist: He's not a leader]
he's a member of, I, I 'k, I understand that but
I'm not, I don't keep his schedule, I'm not sure to...
Supine
Newt Member
It more supposition that Israel & CIA did it. The recent film had a CIA whistleblower who said it was them. Although she blamed the Israelis for making it worse and therefore easier to spread and detect.
mauvais
on reddit or something
It was doable in 2013, albeit to a lesser extent, and it's doable now. Most new cars have the mechanical prerequisites. Before long they'll probably be mandatory, or as good as.
As a workable means of getting at someone, it's a niche on a par with polonium in your tea or for that matter Stuxnet, when for the most part you could just, say, hit your victim with a lorry.
Spymaster
Plastic Paddy
Last edited:
camouflage
gaslit at scale.
Repeatedly, to make sure.
Is the CIA using these powers on Americans? It's possible but the Wikileaks leaks don't show that.
mikey mikey
Active Member
Five Eyes, TomUS. Five Eyes.
DotCommunist
So many particulars. So many questions.
yeah but ones a great idea for a modern Columbo and the other is an open aand shut case with no mystery
mwgdrwg
Be a Pisces. Jam.
Cars have already had their brakes disabled:
After Jeep Hack, Chrysler Recalls 1.4M Vehicles for Bug Fix
After Jeep Hack, Chrysler Recalls 1.4M Vehicles for Bug Fix
Spymaster
Plastic Paddy
mwgdrwg
Be a Pisces. Jam.
Why is it balls? Because they took a large team and a long time to figure it out, or needed physical access? So?
"But would it have been as frightening if she had mentioned that this kind of hack requires a car with cellular Internet service,"
I see the new fucking Corsa advert on telly showcasing that it has wi-fi, lol
Spymaster
Plastic Paddy
Did you read the SA article? It's virtually impossible to hack a car in any kind of meaningful way. The Jeep in the piece that you linked to was owned by the hackers themselves and fucked about with for a year to enable them to do it.
If you can get hold of a certain type of car for long enough and install all kinds of software, you can cut it's transmission if it's connected to the internet. But you can't anymore because the manufacturer has fixed the bug.
Not much of a story really is it?
Last edited:
What nonsense. This thread is about CIA spying capabilities being leaked. But continue with your self righteous crusade to save the children.
maomao
普費斯
It's about the implications of the leak and I'm clarifying your position on the CIA for the benefit of posters who might not have read the other thread.
And self righteous crusade? Really? Objecting to the murders of civilians and children in particular is self righteous? Are you sure you don't want to call me a SJW? Scratch a liberal...
Your clarification of my position is false. And I'm not a liberal. I'm a PROUD liberal.
This was pretty informative. Pitty its not on iplayer anymore.
Storyville, Zero Days: Nuclear Cyber Sabotage
maomao
普費斯
They were your exact words. If you deny it again I'll quote the posts. And I think your comments about 'self-righteous crusades' clear up where you stand on US foreign policy.
gentlegreen
I hummus, therefore I am ...
Quote away if you like. You jump to conclusions.
lefteri
Well-Known Member
Yes I saw it, just can't remember the details clearly like pretty much everything I watch and read these days
Bernie Gunther
Fundamentalist Druid
Might be worth going to the source.
Or if you find videos of nerds enthusing to other nerds about stuff that they've hacked too annoying to tolerate, here are their papers.
https://sm.asisonline.org/ASIS SM Documents/remote attack surfaces.pdf
https://securityzap.com/files/Remote Car Hacking.pdf
Basically the reason they need physical access to a sample of the car in question is to reverse-engineer the internal protocols by which the multitude of computers inside them communicate.
This is so they can gain access via one of these control units which is doing something relatively innocuous and pivot from there to a different control unit from which they can e.g. switch off the brakes.
They don't need to be able to install anything on the target vehicle to do the attacks in question, they just need to spend time playing around with a sample until they figure out how to fuck with it.
The particular conjunction of vulnerabilities and configuration issues and difficulty of exploiting them might change from model to model, but the security engineering economics of consumer products mean that in general, any determined group with appropriate skills is going to find a way to do this if they see a benefits case.
http://www.cl.cam.ac.uk/~rja14/Papers/moore-anderson-infoeconsurvey2011.pdf
As manufacturers add more and more features of this kind, the attack surface gets bigger. Indeed a couple of the more lethal exploits actually originate with features that are marketed as increasing safety by e.g. making braking more 'intelligent'.
Their discussion of what happened when they tried to communicate with the manufacturers does little to support breezy confidence in there being a timely response (unless there is an immediate threat that the exploit will be on TV.)
I think it's pretty clear from the detail in their papers that they were resource-limited, e.g. they had to find workarounds rather than spend a few thousand on specialised test gear for proprietary components.
Buying cars to reverse-engineer is likely not an issue for anyone who has a black budget to play with. Indeed, the spooks already have form for getting backdoors installed by the manufacturers into things they're interested in and there are a few chips from e.g. Texas Instruments that come up over and over again in this space.
Last edited:
2hats
Dust.
ISTR that the ani-virus folks didn’t figure everything out (though a couple had speculated on the target based on the observed disproportionate number of infections seen in Iran and the source being Israeli). They knew it was targeting industrial PLCs. Eventually CIA/NSA insiders (perhaps members of the Equation Group) spilled some of the beans because (it was claimed) they were annoyed with Unit 8200 unilaterally rushing out what they saw as a broken, inferior, high risk variant.
mauvais
on reddit or something
Very good post. On this, though, even if there was a rapid response, the logistics are enormous: it would take months to recall millions of cars and the recall uptake would still be a lot less than 100%. Also remember that these are the car companies that famously once worked out the cost of a death and decided it was economical.
Bernie Gunther
Fundamentalist Druid
Thanks mauvais, I know you know your stuff in this area, so that's appreciated.
I think the security engineering economics are the key to understanding the risk here, hence the Ross Anderson link.
I think the security engineering economics are the key to understanding the risk here, hence the Ross Anderson link.
Similar threads
