I know it's annoying to hear this, but I'm going to keep saying it: this stuff is silly. The DLL injection stuff in the CIA leaks should embarrass the CIA. If you're calibrating your defenses based on the idea that application programs on Windows and OS X can defend against malware, you're playing to lose.
Here's the rootkits track from Black Hat 2008 --- keep in mind that this is almost a decade old and that it's public work:
* Deeper Door: Exploiting NIC Chipsets
* A New Breed of Rootkit: The System Management Mode Rootkit
* Insane Detection of Insane Rootkits
* Crafting OS X Kernel Rootkits
* Viral Infections on Cisco IOS
* Detecting And Preventing Xen Hypervisor Subversions
* Bluepilling (implementing a hypervisor rootkit) The Xen Hypervisor
This is just one year's work. If you summed all of it together, you're talking ~2.5 FTEs across 7 different research projects which we will very generously assume took a full year to develop (spoiler: no, none of them did). People who can write hypervisor rootkits command a pretty decent salary, but it's not 2x the prevailing SFBA senior salary. So this is at most mid-single-digit millions worth of work.
I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses. Maybe it's some weird turf thing they're doing against NSA? But the stuff in the CIA leaks is not the standard you need to be protecting yourself against.
The CIA probably isn't stupid. Why would they waste attacks like the ones you listed if the silly stuff simply works for most targets. Also those "silly stuff" things are perfect because anybody could have developed them and not necessarily a nation state actor.
Also just because some information got leaked, doesn't mean that there aren't more units / projects at the CIA where maybe the more skilled people are working and where the "good" attacks don't get leaked.
This looks to be the kind of stuff for the day in, day out operations.
This is just the exploits that contractors were given. There's probably another set of more carefully guarded and important 0 days. Given how easily these were passed around this was most likely a cache of common exploits used every day on regular operations. Huge deal if compromised, but not all the keys in the kingdom.
I suspect the CIA is doing these primitive basic attacks for one reason: they work a lot of the time. CIA likely doesn't use ONLY these attacks (and the more intricate ones are probably run by a different group), but I mean, c'mon, buffer overflows and SQL injection are STILL effective venues of attack. Why give up on something that works just because there are other, stronger, tools? This lets you reduce risk of your involved attacks being caught - use them less often. Meanwhile, you can get 80% (made up number) of your targets with "silly" stuff, and only bring out the big guns on the 20%.
This is literally exactly what they want you to think. The CIA is smarter than you, and they have a lot to gain by misleading you otherwise.
Some of the most talented software engineers in the world work intelligence, and they can write better than you, exploit faster than you, debug more thoroughly than you, etc.
State intelligence is especially dangerous and devious. The average security researcher doesn't stand a chance, much less the average basement hacker.
Understanding what the CIA does and why they do it is designed to be more or less impossible from the outside. It's the nature of intelligence really, to be incomprehensible from outside the sphere.
The CIA may just not need that much for 80% of their targets. We aren't talking about top-level security experts. The CIA might use these tools on very low-tech focused threats. The mere fact that they focus on Samsung smart tvs tell us something about their targets. What person serious about security would have a TV that even had a chance of recording their conversations if it was hacked?
For the other 20% of targets who are serious about security (High-level government actors in countries that can invest a lot of money into serious computer security.) The CIA probably has a bunch of high-level tools that were not leaked.
>I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses.
Got to have something to spend the budget on to ask for more next year?
Maybe they are just trawling and they have more skilled people pick out the wheat from the chaff or combine exploits. It would make sense if there are some bigger picture people directing the contractors. A library of low-level shit might be useful if you're building entire frameworks.
Strong currents push to classify work. Structures like jetties and piers oppose declassification.
Silt builds up at classification boundaries. You should expect to see a bunch of S crap that can't get to the TS tools, TS crap that can't get the compartments needed for the great tools---all in service of not devaluing the tech.
Those topics you list make for cool presentations, but at the end of the day some poor schmuck does have to write that "capture the phone calls from Skype" and "exfiltrate the IM messages" code. That super-meta rootkit certainly isn't doing it on its own. It's boring, there is probably XML involved, but so is that CRUD web app that is rewritten thousand times over on every continent of this planet.
DLL injection seems like a perfectly fine hammer in the toolbox for that purpose. Nobody is claiming that they are using it for anything more than targeting specific applications once they have already gained system access. How they got that access might make for more interesting documents.
The CIA is in the business of obtaining information, not malware research.
Would you say that Black Hat talks are representative of the state-of-the-art of malware? Or is it likely that commercial spyware/malware/rootkit authors know "more" than what's presented at Black Hat (or a similar conference)?
> I know it's annoying to hear this, but I'm going to keep saying it: this stuff is silly. The DLL injection stuff in the CIA leaks should embarrass the CIA.
Are you calling Notepad++ or the CIA silly, here?
If the first case (which I assume) you're comically missing the point yourself, which is a big middle finger to a hostile government agency. This is an international Open Source software, used worldwide, that has taken a stance against US politics before (export restrictions).
So yeah maybe it is to embarrass the CIA, but not quite in the way you describe.
By publicly releasing this "fix", they're making a noise calling out LOOK WHAT THE CIA IS DOING PEOPLE, instead of shrugging "eh, is that all, I sure hope they got better exploits from my tax money" and "gosh I wonder why whoever released all this is angry with the US or something, I bet it's cause they're biased".
Now there's a public post on their site, on record, being shared everywhere that says BUGFIX BECAUSE THE CIA ACTIVELY TARGETED OUR SOFTWARE, so that people know this is no longer some "'They' could potentially do X and Y" but that it's actually happening and in this particular case "They" are the CIA.
I think you understand perfectly well how this sends a very different message to a very different (broader) audience than the (admittedly much more serious) revelations at Blackhat conferences. You remember that all these serious capabilities have been around for a long time, but the public didn't really take it seriously because many people believe "they wouldn't really" or the attacks were surely theoretical or otherwise we'd hear more about it, right? Or even when the capabilities have been right there, clear as day, for a decade, to actually assume "They" are really listening on your Samsung Smart TV's microphones (or you name it), has been flat out conspiracy nut territory or at best you could say "surely they only deploy these capabilities on a very small, targeted scale, responsibly".
And now they're not. We know it's happening. New proof of new scandalous breaches of privacy of individual indiscriminate members of the public comes out every other month or so. The whole world knows that the US/UK surveillance apparatus has spiralled out of control and is surveilling, spying and collecting data on everyone, everywhere. To say now, let's not make a big deal out of this because it just confirms what everybody could have known all along, is an idea that should have its motives questioned (by which I mean, you should maybe ask yourself, not that you're doing it deliberately).
Does Notepad++ really believe that with this fix they've successfully defended their software against CIA (or other gov.actor) exploits? Of course not. But they do get to make a big fuss out of it. And that's important too. If the police beat you up, is that something to make a big fuss out of and try to fix and make sure they don't get away with, even if it doesn't help with them still getting away with actually shooting people dead elsewhere? You can argue about that, but I wouldn't call it "silly".
Are there now people who will think "phew at least now Notepad++ is protected against CIA hacks"--well, probably, quite a few. But you're not addressing or helping those people by talking about Blackhat and hypervisor rootkits.
(... and if it's the second case, "silly" is a bit of an understatement given what these people have been up to the past half century or so--it's not actually quite as funny as in the film Burn after reading)
The cynic in me would assume this is a well played game. Look at us, we can't even use Vi properly, and we use these unsophisticated attacks to break your defenses. Nothing to fear from us, don't worry...
We have ot agreed on many a topic... but I just want to say; I love you and keep doing what you're doing (PROVIDED youre not perpetuating the Deep State) - but yeah, youre sound and I will still keep calling you 'Patrick'
This is a useless change. There was no issue in Notepad++. The attack involving scilexer.dll just happened to be a convenient way to inject code GIVEN you already have root access to write to the program directory. There are an endless number of other ways they could have done it in those circumstances.
They don't even have to be spies; judging by the leak, which had a number of personal and informal comments, CIA employees appear to be people too. I wouldn't be surprised if those working on government malware frequent HN just like you and me.
Note: The machine I tested this already had v7.3.2 installed. The hash of SciLexer.dll from my (x86) install matches the above, but independent verification is recommended over taking my word for it.
> This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.
I guess the attack allowed them to inject code into a Notepad++ process without breaking the signature on notepad++.exe itself. There's probably some value to the CIA doing this, or they wouldn't have done it (...right?)
I suppose this could help anyone that is currently being targeted. Once they update it should be obvious that the dll is compromised. Maybe some will come out of the woodwork and show it.
>> The DLL injection stuff in the CIA leaks should embarrass the CIA.
Haha, nice try.
No, it should embarrass the entire US public.
CIA is not some autonomous entity, its actions directly relate to the will and wants of the US government. People are not going to stand by and clap as their text editors are wiretapped. Note: I noticed the homing behavior when using it in wine, so I switched to PSPad.
What is the actual attack vector? The leak document just lists a dll that could be replaced to do nefarious things. How are these dlls getting replaced?
If you follow the links to from the release notes to the relevant wikileaks pages, you will find a list that also include chrome, firefox, vlc, opera, libreoffice as well as Kasparsky and McAfee antivirus and many other commonly used software packages, many of them open source.
It is also the first time I have seen evidence that they also target Linux, since they have a hijacked "CMD prompt" on Linux, whatever that means. They may also have targeted Linux with the other software packages of cause.
Is there a real need to go at this level? Notepad++ has a 3rd party plugin model which it happily auto-updates all the time. I wonder what would it take for CIA (or any big pocketed attackers) to "buy" one of those things and push updates with their own stuff. Chrome extensions are even more merky. Many of these 3rd party popular extensions would be happy to sell their business for couple of millions dollars and let buyer push whatever they wanted.
Argh, we have this all over our lan. Is there anywhere I can get a copy or the md5 of the trojan scilexer.dll? Also, - how many people just downloaded these binaries?
> Checking the certificate of a DLL makes it harder to hack. Note that once users’ PCs are compromised, the hackers can do anything on the PCs. This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.
[+] [-] tptacek|9 years ago|reply
Here's the rootkits track from Black Hat 2008 --- keep in mind that this is almost a decade old and that it's public work:
* Deeper Door: Exploiting NIC Chipsets
* A New Breed of Rootkit: The System Management Mode Rootkit
* Insane Detection of Insane Rootkits
* Crafting OS X Kernel Rootkits
* Viral Infections on Cisco IOS
* Detecting And Preventing Xen Hypervisor Subversions
* Bluepilling (implementing a hypervisor rootkit) The Xen Hypervisor
This is just one year's work. If you summed all of it together, you're talking ~2.5 FTEs across 7 different research projects which we will very generously assume took a full year to develop (spoiler: no, none of them did). People who can write hypervisor rootkits command a pretty decent salary, but it's not 2x the prevailing SFBA senior salary. So this is at most mid-single-digit millions worth of work.
I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses. Maybe it's some weird turf thing they're doing against NSA? But the stuff in the CIA leaks is not the standard you need to be protecting yourself against.
[+] [-] softblush|9 years ago|reply
Also just because some information got leaked, doesn't mean that there aren't more units / projects at the CIA where maybe the more skilled people are working and where the "good" attacks don't get leaked.
This looks to be the kind of stuff for the day in, day out operations.
[+] [-] jorblumesea|9 years ago|reply
[+] [-] ergothus|9 years ago|reply
All speculation, of course.
[+] [-] killin_dan|9 years ago|reply
Some of the most talented software engineers in the world work intelligence, and they can write better than you, exploit faster than you, debug more thoroughly than you, etc.
State intelligence is especially dangerous and devious. The average security researcher doesn't stand a chance, much less the average basement hacker.
Understanding what the CIA does and why they do it is designed to be more or less impossible from the outside. It's the nature of intelligence really, to be incomprehensible from outside the sphere.
[+] [-] Nightshaxx|9 years ago|reply
For the other 20% of targets who are serious about security (High-level government actors in countries that can invest a lot of money into serious computer security.) The CIA probably has a bunch of high-level tools that were not leaked.
[+] [-] kryptiskt|9 years ago|reply
[+] [-] dan1234|9 years ago|reply
[+] [-] FLUX-YOU|9 years ago|reply
Got to have something to spend the budget on to ask for more next year?
Maybe they are just trawling and they have more skilled people pick out the wheat from the chaff or combine exploits. It would make sense if there are some bigger picture people directing the contractors. A library of low-level shit might be useful if you're building entire frameworks.
[+] [-] brians|9 years ago|reply
Silt builds up at classification boundaries. You should expect to see a bunch of S crap that can't get to the TS tools, TS crap that can't get the compartments needed for the great tools---all in service of not devaluing the tech.
This was the U silt pile.
[+] [-] jonchang|9 years ago|reply
[+] [-] revelation|9 years ago|reply
DLL injection seems like a perfectly fine hammer in the toolbox for that purpose. Nobody is claiming that they are using it for anything more than targeting specific applications once they have already gained system access. How they got that access might make for more interesting documents.
The CIA is in the business of obtaining information, not malware research.
[+] [-] Cyph0n|9 years ago|reply
[+] [-] unknown|9 years ago|reply
[deleted]
[+] [-] Spooky23|9 years ago|reply
[+] [-] tripzilch|9 years ago|reply
Are you calling Notepad++ or the CIA silly, here?
If the first case (which I assume) you're comically missing the point yourself, which is a big middle finger to a hostile government agency. This is an international Open Source software, used worldwide, that has taken a stance against US politics before (export restrictions).
So yeah maybe it is to embarrass the CIA, but not quite in the way you describe.
By publicly releasing this "fix", they're making a noise calling out LOOK WHAT THE CIA IS DOING PEOPLE, instead of shrugging "eh, is that all, I sure hope they got better exploits from my tax money" and "gosh I wonder why whoever released all this is angry with the US or something, I bet it's cause they're biased".
Now there's a public post on their site, on record, being shared everywhere that says BUGFIX BECAUSE THE CIA ACTIVELY TARGETED OUR SOFTWARE, so that people know this is no longer some "'They' could potentially do X and Y" but that it's actually happening and in this particular case "They" are the CIA.
I think you understand perfectly well how this sends a very different message to a very different (broader) audience than the (admittedly much more serious) revelations at Blackhat conferences. You remember that all these serious capabilities have been around for a long time, but the public didn't really take it seriously because many people believe "they wouldn't really" or the attacks were surely theoretical or otherwise we'd hear more about it, right? Or even when the capabilities have been right there, clear as day, for a decade, to actually assume "They" are really listening on your Samsung Smart TV's microphones (or you name it), has been flat out conspiracy nut territory or at best you could say "surely they only deploy these capabilities on a very small, targeted scale, responsibly".
And now they're not. We know it's happening. New proof of new scandalous breaches of privacy of individual indiscriminate members of the public comes out every other month or so. The whole world knows that the US/UK surveillance apparatus has spiralled out of control and is surveilling, spying and collecting data on everyone, everywhere. To say now, let's not make a big deal out of this because it just confirms what everybody could have known all along, is an idea that should have its motives questioned (by which I mean, you should maybe ask yourself, not that you're doing it deliberately).
Does Notepad++ really believe that with this fix they've successfully defended their software against CIA (or other gov.actor) exploits? Of course not. But they do get to make a big fuss out of it. And that's important too. If the police beat you up, is that something to make a big fuss out of and try to fix and make sure they don't get away with, even if it doesn't help with them still getting away with actually shooting people dead elsewhere? You can argue about that, but I wouldn't call it "silly".
Are there now people who will think "phew at least now Notepad++ is protected against CIA hacks"--well, probably, quite a few. But you're not addressing or helping those people by talking about Blackhat and hypervisor rootkits.
(... and if it's the second case, "silly" is a bit of an understatement given what these people have been up to the past half century or so--it's not actually quite as funny as in the film Burn after reading)
[+] [-] JustSomeNobody|9 years ago|reply
[+] [-] annnnd|9 years ago|reply
[+] [-] unknown|9 years ago|reply
[deleted]
[+] [-] samstave|9 years ago|reply
[+] [-] samstave|9 years ago|reply
So, yeah, we're fucked, yes?
[+] [-] Traubenfuchs|9 years ago|reply
I mean I know I am not that important but it would have boosted my ego. Way to go NSA. Thanks for nothing.
[+] [-] shawnz|9 years ago|reply
[+] [-] everydaypanos|9 years ago|reply
If this world is corrupted then spies are among us here too
[+] [-] Mahn|9 years ago|reply
[+] [-] agumonkey|9 years ago|reply
[+] [-] Arnavion|9 years ago|reply
x86: D7F9B9FD1459EDF6B417244E14EB5D734A973914
x64: 506F6CE3F09BFD1B0A982F2E6ECCBA397FD07BC2
1. Downloaded .bin.zip and .bin.x64.zip from https://notepad-plus-plus.org/download/v7.3.2.html
2. Verified sha1 against https://notepad-plus-plus.org/repository/7.x/7.3.2/npp.7.3.2... (for posterity: E32326B860815688302DF006C37395F13E24AABD and C81E940B04BAF11DE485068D9DCA4CD5CCE0E418)
3. Extracted SciLexer.dll from zips
4. Generated sha1 of SciLexer.dll
Note: The machine I tested this already had v7.3.2 installed. The hash of SciLexer.dll from my (x86) install matches the above, but independent verification is recommended over taking my word for it.
[+] [-] svenfaw|9 years ago|reply
[+] [-] rossy|9 years ago|reply
> This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.
The CIA attack is an application directory attack, and the application directory is a trusted location on Windows. See: https://blogs.msdn.microsoft.com/oldnewthing/20161013-00/?p=...
I guess the attack allowed them to inject code into a Notepad++ process without breaking the signature on notepad++.exe itself. There's probably some value to the CIA doing this, or they wouldn't have done it (...right?)
[+] [-] tgragnato|9 years ago|reply
Useless, yes. Nobody thinks he should solve the problems of the world, that's just a message.
[+] [-] infogulch|9 years ago|reply
[+] [-] kevincox|9 years ago|reply
However in practice we don't have a full signed and verified stack.
[+] [-] nurettin|9 years ago|reply
Haha, nice try.
No, it should embarrass the entire US public.
CIA is not some autonomous entity, its actions directly relate to the will and wants of the US government. People are not going to stand by and clap as their text editors are wiretapped. Note: I noticed the homing behavior when using it in wine, so I switched to PSPad.
[+] [-] hl5|9 years ago|reply
[+] [-] eps|9 years ago|reply
Because if it's the former, it's trivial to just sign dll with any key and add it to the local trusted store (if needed).
[+] [-] staunch|9 years ago|reply
Is there someone I can follow on Twitter that's doing great analysis?
[+] [-] bagels|9 years ago|reply
[+] [-] bigbugbag|9 years ago|reply
[+] [-] alephnil|9 years ago|reply
It is also the first time I have seen evidence that they also target Linux, since they have a hijacked "CMD prompt" on Linux, whatever that means. They may also have targeted Linux with the other software packages of cause.
This is really scary.
[+] [-] devopsproject|9 years ago|reply
if you had high opinions of those programs, you have bigger problems
[+] [-] sytelus|9 years ago|reply
[+] [-] thehardsphere|9 years ago|reply
[+] [-] nthcolumn|9 years ago|reply
[+] [-] joering2|9 years ago|reply
[+] [-] wila|9 years ago|reply
Right click the file scilexer.dll in your notepad folder and select properties. Then verify the certificate manually.
Another way is to download the same version from the notepad++ website and compare your version with theirs.
Really I wouldn't worry so much as long as you're not a CIA target they have no incentive to spent the time to deploy such a DLL on your system.
[+] [-] infogulch|9 years ago|reply
[+] [-] boznz|9 years ago|reply
[+] [-] menkaur|9 years ago|reply
[+] [-] mrweasel|9 years ago|reply
> Checking the certificate of a DLL makes it harder to hack. Note that once users’ PCs are compromised, the hackers can do anything on the PCs. This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.
[+] [-] pknerd|9 years ago|reply