The WikiLeaks Vault 7 almost-weekly drip-drip-drip of confidential information on the cybertools and tactics of the CIA continued last week.

The latest document dump is a trove from agency contractor Raytheon Blackbird Technologies for the so-called UMBRAGE Component Library (UCL) Project, which includes reports on five types of malware and their attack vectors.

This is the 17th release of specific CIA hacking or surveillance tools since the initial announcement by WikiLeaks on March 7.

According to a statement announcing the latest release:

The documents were submitted to the CIA between November 21st2014 (just two weeks afterRaytheon acquired Blackbird Technologiesto build aCyber Powerhouse) and September 11th2015. They mostly contain Proof-of-Concept ideas and assessments for malware attack vectors partly based on public documents from security researchers and private enterprises in the computer security field.

Raytheon Blackbird Technologiesacted as a kind of technology scout for theRemote Development Branch (RDB)of the CIA by analysing malware attacks in the wild and giving recommendations to the CIA development teams for further investigation and PoC development for their own malware projects.

The component library includes:

A new variant of the HTTPBrowser Remote Access Tool (RAT), used by a threat actor known as Emissary Panda, believed to be in China, which was built in 2015. It is a keylogger, and according to Raytheon captures keystrokes using the standard RegisterRawInputDevice() and GetRawInput() APIs and writes the captured keystrokes to a file.

A new variant of the NfLog RAT, also known as IsSpace and used by Samurai Panda. It is, according to Raytheon, a basic RAT that polls C2 servers every 6 seconds awaiting an encoded response. If it detects that a user has administrative privileges, it will attempt to reload itself using the elevated permissions.

Regin, described as a very sophisticated malware sample, which has been around since 2013. It is used for target surveillance and data collection. Raytheon said it has a six-stage, modular architecture that affords a high degree of flexibility and tailoring of attack capabilities to specific targets. It is also stealthy, with an, ability to hide itself from discovery, and portions of the attack are memory resident only.

HammerToss, a suspected Russian state-sponsored malware, which became operational in 2014 and was discovered in 2015, uses Twitter accounts, GitHub or compromised websites, and cloud storage to arrange the command and control operations for the malware. It is considered the most sophisticated malware of the five in the current release.

Gamker, an information-stealing Trojan that uses an interesting process for self-code injection that ensures nothing is written to disk.

As WikiLeaks noted in its announcement, these were all malware attacks found in the wild, and therefore not secret. But the CIAs hope clearly was that they would lead to development of their own malware projects to be used to conduct attacks not just on individual computers or systems, but social media platforms like Twitter as well.

Read more from the original source:
WikiLeaks drops another cache of 'Vault7' stolen tools - Naked Security

Justin Berry, right, listens Kurt Eichenwald testify before the House Energy and Commerce Committee regarding sexual exploitation of children over the Internet in Washington in 2006. (Photo: AP)

Well, this is ugly: On Monday evening, international secret-sharing website WikiLeaks, whose founder Julian Assanges behavior of late has been slightly concerning, tweeted out what certainly looks like an Amazon burner account journalist Kurt Eichenwald used to write positive reviews of his own books back in the aughts.

WikiLeaks animosity seems to have been inspired by a legal battle between former Sputnik writer Bill Moran and Newsweek, where Eichenwald published a now-deleted piece in October 2016 claiming President Donald Trump, the Russian government-owned Sputnik, and WikiLeaks were all engaged in a conspiracy to smear Hillary Clinton. Moran fought back with claims of libel and defamation. Moran also alleged that Eichenwald had tried to silence him with bribery and threats. The case resulted in a settlement this month.

Eichenwalds story insinuated WikiLeaks was a tool of the Russian government. Eichenwald is hardly the only person to make the claimUS intelligence linked the hacked documents released by Wikileaks to the Russian government as well, though Assange denies it was his sourcebut Assange and Wikileaks have been reveling in Eichenwalds embarrassment as if it somehow means that Wikileaks didnt influence the election.

Heres Assange suggesting that Eichenwald may have left his job at Newsweek over the Moran affair:

In a reply, Eichenwald claimed to simply be on leave writing a book.

And heres a post from the verified Twitter account of the WikiLeaks Task Force, which the site uses to Correct misinformation about #WikiLeaks. It reads: Haha! Court docs show that @KurtEichenwalds alias is Andrew McDonald. Checkout these Amazon reviews of KEs books.

Linked is an Amazon profile using that name, which has two reviews from 2000 and 2005 calling Eichenwalds books The Informant one of the most exciting, unbelievable and astonishing books I have ever read, and his later book Conspiracy of Fools: A True Story just as thrilling.

The court docs in question were subsequently linked to by WikiLeaks, and are briefs from the defense team of Timothy Ryan Richards, who was convicted of 11 child-pornography related offenses following Eichenwalds 2005 series on JustinsFriends.com, a since-shuttered child porn site.

The documents link Eichenwald to two email addresses under the Andrew McDonald alias via a credit card tied to a PayPal account. Both the email addresses and the PayPal account were allegedly used by Eichenwald in the course of infiltrating JustinsFriends.com.

Eichenwalds reporting on the now-shuttered JustinsFriends.com became a matter of a very public journalistic ethics controversy after it was revealed he paid $2,000 to the sites namesake Justin Berry as part of an attempt to gain his confidence, which he did not disclose to his editors. (Eichenwald later asked for and received repayment of the money.)

Amusingly, all of this decade-old controversy about Eichenwald and his reporting is only coming back into the spotlight now because Eichenwald is being trolled by WikiLeaks following yet another controversial story. Eichenwalds myopic political views and increasingly insufferable behavior on Twitter in recent years have made him a favorite target of online trolls, and WikiLeaks is tossing fuel on the fire in service of its own agenda. Whats worse: Eichenwalds (alleged) humiliating reviews of his own book or WikiLeaks pettiness?

Both Eichenwald and Wikileaks did not respond to a request for comment. Well update if they do.

View original post here:
Wikileaks Pettiness Reveals What Might Be the Secret Amazon ... - Gizmodo

These are the headlines we are tracking for you in this episode of On the News Line:

WikiLeaks: To bring down America

The US has made each and every effort to discredit whistleblower organization WikiLeaks, but the latest remarks by the CIA chief is symptomatic of Washington's failure to reverse the damage done to its image as a result of revelations by the group. Mike Pompeo has described WikiLeaks as a non-state hostile intelligence service.Pompeo says the whistleblower website is plotting to "take down America any way they can and find any willing partner to achieve that end." While exposing the US weaknesses and lies, Pompeo's comments also shows how powerful WikiLeaks is and how the organization and its chief Julian Assange have turned into a nightmare for the US as a self-styled defender of human rights which itself stands accused of violating human rights and international law.

Al-Aqsa tensions: Rights not recognized Tensions are rising to alarming levels in the occupied lands of Palestine over Israels latest controversial security measures at al-Aqsa compound in East Jerusalem al-Quds. Several have died in clashes with the Israelis and many wounded in what many fear could trigger a new uprising by the Palestinians. Criticisms are to the same degree rising against the Palestinian president Mahmoud Abbas over his handling of what many see as an Israeli plot to extend its control over al-Aqsa. Abbas has just ordered the suspension of all official contact with Israel until it stopped the new security measures at the third holiest site in the Muslim world.But many are already criticizing that this is too little and coming too late.

Link:
WikiLeaks versus the US - Press TV

One year afterWikiLeaks began publishingemails from the Democratic National Committee and Clinton campaign chair John Podesta that exposedprominent journalists as partisans, many of those journalists are continuing their careers without, it seems, any serious consequences.

Take Glenn Thrush, for example. Thrush, now with the New York Times, was exposed sending storiesto the Clinton campaign for approval while at Politico.

Glenn Thrush, chief White House political correspondent for the The New York Times, works in the briefing room after being excluded from an off camera gaggle meeting at the White House in Washington, U.S., February 24, 2017. REUTERS/Yuri Gripas

Because I have become a hack I will send u the whole section that pertains to [you], he wrote in an April 30, 2015 email to Podesta, including five paragraphs froma storylater titled Hillarys big money dilemma.

Please dont share or tell anyone I did this, Thrushadded. Tell me if I fucked up anything.

No problems here, Podesta replied.

Glenn Thrush sends a story to the Clinton campaign for approval (Screenshot/WikiLeaks)

On April 17, 2015, Thrushsent an emailto Clinton communications director Jennifer Palmieri with the subject line: pls read asap the [Jennifer Palmieri] bits dont share.

Palmieri forwarded Thrushs email to other Clinton campaign staffers, writing: He did me courtesy of sending what he is going to say about me. Seems fine.

Thrushs career doesnt appear to have been harmed by the fact that he sent stories to Clinton staffers for approval. If anything, his career trajectory has continued upward: Thrush joined the New York Times in December as a White House correspondent.

While covering the Trump administrationfor the NYT, Thrush has oftenco-authoredstories with fellow White House correspondent Maggie Haberman, whom an internal Clinton campaign memo described as a friendly journalist. The memo added: We have had her tee up stories for us before and have never been disappointed.

The leaked DNC emails also revealed CNBC editor at large John Harwood as clearly biased against Republicans especially Trump.

Harwood repeatedly displayed clear partisanship while emailing with Podesta. In one May 2015 email, for example, Harwood warned Podesta towatch out for Republican presidential candidate Dr. Ben Carson.

Ben Carson could give you real trouble in a general, Harwood wrote, including relevantvideo clips of Carson on topics including gay marriage.

In December 2015, Harwood claimed vindication at the Republican party veering off the rails. In the same email, Harwood bragged to Podesta about provoking Trump during a Republican primary debate that Harwood moderated as an ostensibly neutral journalist.

Harwood titled the email, I imagine before continuing in the body: that Obama feels some (sad) vindication at this demonstration of his years-long point about the opposition party veering off the rails.

I certainly am feeling that way with respect to how I questioned Trump at our debate.

John Harwood emails John Podesta about Republicans veering off the rails and brags about provoking Trump. (Screenshot/WikiLeaks)

Harwood wasreferring to the October 2015 debate he moderated, where he asked Trump if he was running a comic book version of a presidential campaign.

Harwood has played a central role in his networks coverage of the first six months of the Trump White House.

Harwood has like much of the news media covered the Russia probe with bombastic language, comparing it to theWatergate scandalthat led to Richard Nixons resignation.

In a story last week, Harwood lay the blame forRepublicans health care struggles at Trumps feet.

New York Times Magazines chief political correspondent, Mark Leibovich, gave the Clinton campaign veto power over what parts of an interview he could and couldnt use, WikiLeaks revealed. (Internal campaign communications described him as sympathetic.)

Leibovich emailed Jennifer Palmieri, the campaigns communications director, following a July 7, 2015 interview with Hillary Clinton. Leibovich told Palmieri she couldveto what you didnt want, includingparts of the interview that he wanted to use.

Palmieri instructed Leibovich to remove a joke Clinton made about Sarah Palin, as well as Clinton saying thatgay rights has moved much faster than womens rights or civil rights, which is an interesting phenomenon somebody in the future will unpack.

Leibovich complied: neither the Palin joke nor Clintons gay rights line were included in his July 15 feature titled, Re-Re-Re-Reintroducing Hillary Clinton.

Leibovich noted in the piece that Clintons campaign at first declined to make her available for an interview. He did not note that he gave the campaign veto power over what parts of the interview he could use.

Leibovich is still writing long-form pieces for NYT Magazine, which are often met with effusive praised fromother journalists on Twitter.

His most recent piece, a July 11 feature titled, This Town Melts Down, explored what has and hasnt changed about D.C. politics in the age of Trump. One thing that apparently hasnt: the prominence of known partisans in the media.

Here is the original post:
One Year Later, Journalists Exposed By WikiLeaks Carry On As Before - The Daily Caller

WikiLeaks has released five documents that private defense contractorRaytheon Blackbird Technologies provided to the CIA towards building the UMBRAGE Component Library (UCL). According to WikiLeaks, Raytheon acted as a technology scout for the CIA, exploring the malware in the wild, and recommending promising malware to CIA development teams for use in their own tools.

The documents, a part of the Vault 7 series of releases contains five reports. The first is a keylogger by the Emissary Panda, a threat actor believed to be based in China. The actual tool was not that sophisticated, it managed to persist on the system but used plain text to communicate with the command and control servers. The second is also a remote access tool by Samurai Panda, another group believed to be operating from China. The tool was a variant of an Adobe Flash exploit used by the Italian group, Hacking Team.

The next document outlines the capabilities of a fairly sophisticated malware known as Regin. Regin has a six stage architecture, and is modular, allowing for the malware to be customised for a particular target or operation. Themalware is customised using the modular payloads for specific purposes, including file system access, networking capabilities, compression operations, port blocking, packet filtering and so on.

Another document describes the Gamker Trojan, used for stealing information. Apparently the Trojan uses unusual instructions in assembly language, to obfuscate the code.

The most sophisticated malware described in this set of releases is HammerToss, which is suspected to be a Russian state sponsored malware. The malware uses Twitter accounts, GitHub or compromised websites, and cloud storage to arrange the command and control operations for the malware. There is a five stage architecture for the malware. The malware contains an algorithm that generates Twitter handles on a daily basis, that requires the malware to check the Twitter handles for receiving further instructions.

The instructions are hidden in a URL Tweeted out by the handles, and the accompanying hashtag provides the information needed to decode the instructions. The malware then downloads the data, and uses the hashtag in the tweet to figure out the instructions. The malware then executes the instructions on the target machine. If data has to be retrieved, it is stored in the cloud, from where it is later retrieved by the operators of the malware.

Incorporating malware already in the wild into their own tools can mask the origin of the malware, allowing the CIA to disguise the source of the malware from forensic investigation teams. Unlike many other releases that are part of the Vault 7 disclosures, the tools revealed in the Raytheon set of leaks are not developed by the CIA itself. These tools are developed by other threat actors, that have been identified as malware of interest, parts of which could be used by the CIA.

Read more here:
WikiLeaks releases documents provided to the CIA by Raytheon for developing malware - Firstpost