RELEASE: CIA Vault 7 part 3

wikileaks.org/vault7/?marble#Marble Framework

Marble Framework
31 March, 2017

Today, March 31st 2017, WikiLeaks releases Vault 7 "Marble" – 676 source code files for the CIA's secret anti-forensic Marble Framework. Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA.

Marble does this by hiding ("obfuscating") text fragments used in CIA malware from visual inspection. This is the digital equivallent of a specalized CIA tool to place covers over the english language text on U.S. produced weapons systems before giving them to insurgents secretly backed by the CIA.

Marble forms part of the CIA's anti-forensics approach and the CIA's Core Library of malware code. It is "[D]esigned to allow for flexible and easy-to-use obfuscation" as "string obfuscation algorithms (especially those that are unique) are often used to link malware to a specific developer or development shop."

The Marble source code also includes a deobfuscator to reverse CIA text obfuscation. Combined with the revealed obfuscation techniques, a pattern or signature emerges which can assist forensic investigators attribute previous hacking attacks and viruses to the CIA. Marble was in use at the CIA during 2016. It reached 1.0 in 2015.

The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, — but there are other possibilities, such as hiding fake error messages.

The Marble Framework is used for obfuscation only and does not contain any vulnerabilties or exploits by itself.

Other urls found in this thread:

t.co/M5NBFlXRu4
wikileaks.org/vault7/?marble#Dark Matter
wikileaks.org/vault7/document/Marble/Marble.zip
reddit.com/r/news/comments/62lwjv/wikileaks_releases_marble_source_code_used_by_the/
endchan.xyz/8leaks/res/1.html
archive.org/details/8chSecretDataminingBotnetFiles
8ch.net/leaked/res/1609.html
mega.nz/#!1YkiXaxZ!y6ssWrq0YZ41f_PIV2rAnZdqR-paSjQxGZsRp5Q0UUo
mediafire.com/?w1k8sv1ktciz8ne
archive.org/details/OPSECMEGACOLLECTION
twitter.com/wikileaks/status/850285712696061953
twitter.com/NSFWRedditImage

Fuck forgot link
t.co/M5NBFlXRu4

Bumping wikileaks thread

b-but, muh Russian hackers!!!

Based mods

Not a mod, one stickied it tho. Good thing too, In the rush to copy and paste had a brain fart and though hadn't included link, god knows what crap would happen if was a mod :)

Explain this to me since i'm retarded.

What does this mean and imply?

...

mods can we ban this person to raise the avg IQ of the board? They're probably too stupid to evade it, so it would be worth it.

I literally have over 200 IP's to switch between.

Hell i'm using a Proxy right now.

Fucking shills

A-L-S-O-T-H-E-G-A-M-E

I'm using my work phone, and you're a faggot

Sup Langley?

It's a way to commit (digital) crimes and use someone else's fingerprints. Like if you went on a burglary spree and were able to leave nigger prints everywhere.

How is this any different from UMBRAGE?

actually it's not a perfect analogy. If you commit a robbery and on the surveillance camera it shows two arabs mumbling to one another in vernacular arabic and discussing the crime, the cops are going to look for Arabs.

JSOC has been doing this for a while. They build IEDs called "the x-box" using chinese parts and techniques that can be linked to known bomb-makers so that even if it goes to FBI, they're going to come back with forensic analysis linking it somewhere else. Seeing the book "Relentlessness Strike: a history of JSOC" by sean naylor.

It's more advance to where it hides text and actually shows the code attempted to be corrected in another language.

Something like this, or not at all?

So, we got proof now that the CIA could've hacked the DNC and blame it on Russian hacking groups?

Yes, esp. given that DNC wouldn't even allow FBI to see the server. It's advanced digital gaslighting against forensic analysis.

How can we obfuscate gondolas with this?

did he died?

Dude that video was made over a decade ago of course he's dead by now.

It's fake.

Geralt of Rivia strikes again.

When the fuck did I miss Part 2?

Part 2 was the bronies getting their iPhones hacked from the factory.

JSOC that brags about how they can enter anywhere?

Spot the female journalist.

Funny, because it's true haha!

Time to google translate my botnet to hebrew

T. kike

The CIA has recreated the signature knives of many countries, but the knives still had "made in the USA" on them. With Marble, they can recreate those signature Knives, put "Made in Russia" on them, and then poorly scrape off "made in Russia". This makes it seem Russia is using their homemade signature knives, and did a poor job covering it up. It's the best possible way to convince a forensics investigator that the knives were used by Russia.

dubs confirm all nigger crimes are actually just clever whites

It says they even hide fake error messages in chinese for example, and leave traces of trying to make it look like the use of the chinese language was trying to be obfuscated.

Dark Matter leaks was Part 2.

————————————-

Does anyone know what happened to archive.is?

It suddenly went down today.

It seems like we are starting to turn the corner where Trump won't have to be on the defensive as much. It won't even be a year and the Russia bullshit will be disproven. The racist xenophobe shit feels like a decade old and doesn't work anymore. The Trump taxes narrative was also destroyed. What do they have left exactly?

I thought this would be a huge struggle for Trump but its looking like a fucking cakewalk and were only the 3rd month in.

Missed part 2. What's Dark Matter codenamed for, the biggest critical hit out of the CIA leak from 1 was Umbrage right? How does DM compare.

wikileaks.org/vault7/?marble#Dark Matter

Biggest thing probably that the CIA malware "NightSkies" had been installed in iPhones at the factories since 2008.

Surely someone will upload the code in a textfile or pdf in this thread, right?

wikileaks.org/vault7/document/Marble/Marble.zip

This seems pretty nasty, I dont use apple shit but i guess all the hipsters who said apple was virus free got BTFO to the highest extent.

Same shit as intel having backdoor NSA keys in the processor then, the CIAbronyniggers were jealous?

I'd argue it's still Seth Rich who leaked the DNC e-mails, no hack involved at all. The cover up was the work of the CIA, which included his murder and the attribution of the crime to Russian hackers. In this they found not only a solid cover but also a strong weapon against their enemy, Donald Trump. From there they planted (flimsy) "evidence" to continue the narrative.

A.) You are a dumb nigger of the kikest order.

B.) USNATGOV can basically hack anyone and blame it upon ANYONE.

C.) If you are in fact this dumb, and are in fact still alive, consider buying a lottery ticket, since you are apparently the luckiest motherfucker on the planet.

(witnessed)
Goddamn Adolf grab a sniggers

wir mussen die Juden ausrotten!

I can see it from a mile assange is already a cia stooge now,can't people realize how cia is using chaos and confusion as a punishment for Apple not obliging their requests to tarnish it's image and now the tech nerds will go everywhere around the internet doing cia work for free.

ZOG's attempt to tar Trump with the brush of treason is becoming an epic failure… Nobody with an IQ above room temperature is likely to believe a word that ZOG's MSM prints or broadcasts any longer.

But I am Not saying this in a triumphant tone of voice. Indeed, to the contrary, I am a little bit worried that ZOG will try to put us into a major war overnight one night soon in order for them to hold onto power.

What enzyme is that on the left?

Will there ever be a leak showing the CIAniggers doing anything good?

do you think the CIAniggers actually do anything good?

LOOK AT WHAT YOU DID CIA NIGGER

Wasn't there an Irish movie with a scene kind of similar to that?

YOU STUPID GOYIM NOW I HAVE TO REWRITE MY HOLOCAUST MEMOIRS.

was it real in her mind?


wind that shakes the barley

Why would you think ISIS / CIA mercenaries wouldn't do this ? Are you a nigger?

Just was shadowbanned from reddit for this I think.

You talk like a kike

I'm not saying they wouldn't, but that they are claims that sound hysterical much like holocaust claims. Body parts on a table don't change that.

Nice try CIAnigger

The highest post on /r/news has only 110 points btw and is just as heavily shilled.

reddit.com/r/news/comments/62lwjv/wikileaks_releases_marble_source_code_used_by_the/

Show us one similar video of the greatest hoax that should have happened that is even remotely comparable to an average Isis video.

Underrated meme

as I said, "I'm not saying they wouldn't," but that doesn't make another shitskin claiming they kneaded 250 children to death any more credible. I ain't trying to prove shit.

You're defending ISIS in the manner of a slimy jew, which is exactly what a CIAnigger would do

okay who the fuck cares though?

normies will eat that shit up and we can meme ISIS as "teh new notsee's" and scare them into doing something about the shitskins.

Now that cia/statedept aren't supporting ISIS, what do we care? Assad is doing good. I care about exposing jews and removing our own problems, not about the fucking middle east. And I care about defeating our commies, not making someone 'teh new notsee's'. We can scare people enough with provable shit or memetic manipulation, we aren't jews who need boogeymen and disinfo I'm still not saying it's disinfo, just at first glance it's hysterical, in both meanings

both used the phrase 'teh new notsee's'

samefag cianiggers

They're trying to push attention away from their active campaign of aiding ISIS?

reread
he's quoting me.

You're saying it seems too hystericle, which means you're a fucking idiot or you don't want us to focus on CIAniggers proxy-war crimes and how they should get hanged. Making fake anti-isis propaganda to make them seem barbaric makes about as much logical sense as shilling that water is wet.

go back to reddit


It's a legit disinfo tactic, no different than having jonestein talk about real topics and follow it with outrageous claims to kill legitimacy. I don't give a shit about fighting their puppets, I care about the scumbags sitting in langley and DC.

wasn't shadowbanned btw but three posts by me only appeared after five minutes and two others didn't appear at all.

nice d&q shill

i'm not a shill

(checked)
ok but enough of argouments you two, just let the thread proceed in peace

On a scale of 1-10 how mad is the cia right now?

11.

Kek trusts you, but don't shut out redpilled redditors, we are fighting the good fight over there.


So mad that most news sites don't dare to touch this topic. There are three german articles on the internet covering this for example, two from Russia, one from Austria. It's ridiculous.

news.google.com/news/story?ncl=dsRXyuCS_TMkrWMY2uO6TDqFa7IRM&q=news+wikileaks&lr=German&hl=de&sa=X&ved=0ahUKEwiihsqX9oHTAhUIWiwKHUwqBAEQqgIIHDAA

you are being monitored by the cia tor user

Seriously man, do what you need to elsewhere but you need to be lurking.

see

it's not a demand but rather advice, you'd be wise to take it.

So bloody true. Journokikes will be my favourite on DOTR.

Has anyone been able to compile this?

You may well be, but respect the house that you are in and acclimate to the norms of the site. You're acting like a guy who just tracked dog shit all over a clean floor and gets huffy when the people who live there ask you to take off your shoes.

Bellissimo

Holla Forums is back, everyone.

Damn I missed you guys.
cuckchan's Holla Forums is definitly not the same.

we should get a sticky as to whom is responsible for all of this. Probably (((them))) but still, that person who did this should not get away free with all of this.

It's good to be back.
I love you guys. no homo.

also to add: I am really mad, you glorious fagets are the vanguard against all of this. I thought that we were getting slid big time somehow. Was thinking of who wanted to slip past some news or actions past us these days.

Frog report in.
At least we can post!
Guys, It's not the same without you.
Seriously, 420 Holla Forums can suck my acid dick.

The only big thing I'm personally aware of is the revelation that Rice is the one that ordered the unmasking of Trump's aids in the intel that they "didn't" collect on Trump and his team before the election.

well start thinking again, our fort is made whole again. Do what you guys usually do lol. What we missed and what potentially could be slid and some clarification and help from /baph/, I dont want to sound like a provocateur or whatever but whoever fucked with us should get pain, probably. If it was some neutral party who wanted to complain about the code or whatever. Or something else still. I dont know, but I am mad and someone has to pay.

Same as you, the fucks who did this will pay for it, and they'll pay the hard price.
My first thoughts were about cuckchan first but it's smell like CIA.

It's only a matter of when, not if, we find them. The dehumanization phase is complete, now we must face to bloodshed.

testing to see if we are up yet

the service that this website has to humanity as a whole is innumerable. There are many parties coming here wishing to remove the jew pox. Not even kidding ha. Its one of the best places to learn all about them and also their newest ploys. I would donate some money but I fear that if I did that I would get cops on my door haha.

alright, who sent you?

wat? Nobody did. I just type like a fag and got used to typing like one to annoy people on cuckchan. with LOL at the end. Similar thing really. Srsly tho, this place needs to exist. Stop being such faggets to let it fall into decay or to hostile forces still.

Okay, now I'm sure it's Reddit.

Cucchan Holla Forums has been destroyed by leddit, consensus cracking and demotivational posts.

A mass of anons looking for a home, who nevertheless allow any home they find to be subverted time and time again. These are the people headed our way. If we do not teach them, they will give away this home too.

FROGMAN REPORTING IN

Funny thing, I got a girl's phone number while Holla Forums was down. Thank god it's back up.

Lol @infinitechan has been speaking to them freely, they said it was just a prank and literally talk like teen skids pretending to be foreign. They said sorry later.

lol

no tho, I have been talking to many anons in the general of different nations and a lot of them do come here for some more intellectually stimulating stuff. I dont dare mention this place lightly and never do but sometimes you just know if someone is ready or not for this place. Yesterday it was some portugese user who only managed to learn the history of his nation thanks to places like this. because of the huge censorship everywhere.

Some /x/ophile user I know also frequents this place still, also Holla Forums here. It seems like the kiddy pool that is 4chan is not exactly the most popular anymore, probably a great learning too for the newfags but not much more.

I would bet the security flaw has been known for some time. I would guess that it had to do with the ability to login as a "public" admin, I always thought that behavior was strange.


I went to a normie party, what a sad place for directionless. I used it though to post irl about the dangers of "International Monetary Finance".

smoking gun

sheeeeit those niggers really think theyre above the law. If people can't be assed to use encryption they sure as hell shouldnt run the cunt-reeeee.
also funny how that shitskin sandnigger huma abedin isn't going to divorce weiner "because he dindu nuffin"

The only respite I have is that real European pagans, not neo-kikes, love Christians.

test post

So basically the same thing students do when they cheat on their programming assignments?

...

I'll say it– they wouldn't do it. It's too fucking messy and sounds like bullshit propaganda. People here need to talk to Serbs about muslims and lying. They have a saying that goes something like "a muslim learns to lie before they learn to talk."

As for the international Jew "she threw the apple over the fence every day, and in my mind, I believe it" it's a tough call. I believe that if the war in Syria ever ends in our lifetime and we get a look into just how deeply Mossad has been involved with ISIS, people will barely believe it.

The first muslims suicide bombers began in the first intifada against the Jews. I'm going to get called jew, muslim, etc.. by 85 IQ retards who have never studied these 2 semities. We already know the Jews give medical care to ISIS. I'd bet a sizeab;e amount the Jews are paying the Saudis to have their bought clerics direct them away from Israel and funnel the attacks toward Europe. This Jew policy is called "living with low level chaos." Essentially, if all the arabs are fighting one another (another term they use is "Lebanonization"), they won't be able to focus on the Jews.

fuck, forget this:

I didn't realize this existed got all excited for a sec, went there. Shit is basically Plebbit.

No suprise, Kirtaner is a tranny-worshipping pedogoon who had his side of Zoey Quinns rancid pussy.

420chan sure ain't what she used to be. Believe this or not. I self-imposed myself to never visit 4chan from Holla Forumsday in 2006. I would bounce between 7chan, 420chan, and eventually 711chan until that was shut down. Fast forward to 2009, despite all the faggotry and changes that went on at 420chan, I stuck around. I was already jew-wise at this point and would continue to debate the majority anarchist and communist Holla Forums at 420chan besides a few libertarians which are easy pickings for anyone. Back around this period that Holla Forums was quite active. Probably moreso than Holla Forums on here. Around this time, believe it or not I had not been back to 4chan since perhaps 2007. So much, that I had no idea about /new/ or Holla Forums. I figured I would be alone on my views and the former glory of the internet hate machine rising again seemed nil. Forward to 2013. I wasn't visiting 420chan at all by that point. It was too far gone. I just decided, fuck it and went to 4chan and to my amazement there was Holla Forums. An angry, more extreme Holla Forums discussing the JQ like I've never seen. I think the rest of you anons know what turned into an amazing crescendo of events henceforth. Lulz for the first time in years were had by this oldfag. I believe the great meme war was one of the finest accomplishments in chan history, thus far. In all the /i/ and even old Holla Forums raids operations I have taken apart in. It was our finest hour. From way back then to now on Holla Forums. We must continue the struggle. We must also never forget what happened after the scientology raids. Protestfags, the rise of SJWs, that damn Guy Fawkes mask using the name anonymous. We are the vanguard of the internet. We have the power to change political landscapes. I don't know how to close this out. Praise Kek.

I remember finding that place when I was hankering for raiding something. Such anarchy.

idk, but me on the right

there 3 or 4 data leaks now?
endchan.xyz/8leaks/res/1.html

No freech trash.

Why doesn't she want this to be sent through the system?

Endchan, .pl and 4chan are all part of one grander chan network.
Get used to seeing this shit more often. I'm tired of this bickering, all chans have different flavours, different mod treatments, different content.

I come here because they scrutinise shills very harshly but have their "issues" - such as manic trolling. Endchan is for more "open" thinking. .pl is basically a backup 8ch with cucked moderation because of laws. 4chan is where we "mess around with left leaning shills, while slowly red pilling them."

We have chan illiuminati sects now. I for one welcome this.

8ch Secret Datamining Botnet Files Hack.zip 135 MB

archive.org/details/8chSecretDataminingBotnetFiles

We know, you're just annoying the mods now.

We've known for quite some time :^)

Also anyone notice how this "8ch" leak came as soon as wikileaks gave evidence that the "russian hackers" were CIA after all.

That's not a coincidence or anything. It's not like they were trying to push people away from the only board that still wanted to attack this MSM narrative.
It's not like they were trying to steal anons for their own schemes.
It's not like they were secretly Clinton goons trying to subvert the chans.

All righty then!!!

I think the 8ch hack was because of this:

Donald Trump-Spoofed IP Hacking Blaming Russia.zip 9MB
8ch.net/leaked/res/1609.html

mega.nz/#!1YkiXaxZ!y6ssWrq0YZ41f_PIV2rAnZdqR-paSjQxGZsRp5Q0UUo
mediafire.com/?w1k8sv1ktciz8ne

Please spam it everywhere, and see just what happens when all of the angered CIA spooks and hackers out there try even harder to suppress the truth!!!

I've read it.

I've taken precautions for some time.
Also I heard the endchan mods were compromised themselves.
All of them are. Forum owners are wankers. They always have been. Moot was a wanker, Hiro was a wanker, jim and likely the mods on endchan who clearly have some degree of left wing bias in some circumstances.

You want to be safe?
Make your own chan. You'll find yourself very lonely.

disappointing

I prefer these tabs
and it's on internet explorer

...

Question. Shouldn't we not be posting any zip files because of the high potential for malware?
Is there anyway to detect sockpuppets who say "checked it out, file is good" in the event it's a trojan?

OPSEC MEGA COLLECTION.zip 387MB Download

archive.org/details/OPSECMEGACOLLECTION

Lookie what I found in the 8ch leak!!!

Nice malware, fag.

What?!!! All that work I did today just for some user to call me a FAG?!!!

OPSEC MEGA COLLECTION.zip 387MB
archive.org/details/OPSECMEGACOLLECTION

Thanks user. Appreciate it.

Sorry, but no. That link of your has been around quite a while, I guess the bait doesn't work that well, huh?


WHOEVER CODED YOU MUST DIE IN A FIRE

Criminally underchecked quads

Can't be done. Yes, you can disable a lot of the default logging, but that doesn't secure the OS from any actual vulnerabilities.
Using Windows is a bad idea full stop.
Not that exploits don't exist for Mac or Linux, (they do) but there are generally less of them and the biggest threats are OS-independent, eg. multi-platform browser exploits (Firefox, for example), UEFI exploits, and Intel Management Engine remote access.

Hitler's right, too many hardware backdoors. Real OpSec is keeping sensitive info on hidden hard drives when you're not using it, doing that only on an airgapped computer (in a Faraday cage if you're worried about rogue signals), and sticking to as much security in hardware and software as you can; have a 3rd computer (besides a work computer for maintaining your pretense of being a filthy casual) which you'll use to go online away from where you live, too.
It seems over the top, but if you actually are working with dangerous shit, you can't ever be safe enough. And the most important part is acting perfectly normal throughout.

It was destroyed by oldfags leaving and cancer coming in. Also by moot.

HAPPENING: new release :Grasshoper
twitter.com/wikileaks/status/850285712696061953

7 April, 2017

Today, April 7th 2017, WikiLeaks releases Vault 7 "Grasshopper" – 27 documents from the CIA's Grasshopper framework, a platform used to build customized malware payloads for Microsoft Windows operating systems.

Grasshopper is provided with a variety of modules that can be used by a CIA operator as blocks to construct a customized implant that will behave differently, for example maintaining persistence on the computer differently, depending on what particular features or capabilities are selected in the process of building the bundle. Additionally, Grasshopper provides a very flexible language to define rules that are used to "perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration". Through this grammar CIA operators are able to build from very simple to very complex logic used to determine, for example, if the target device is running a specific version of Microsoft Windows, or if a particular Antivirus product is running or not.

Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The requirement list of the Automated Implant Branch (AIB) for Grasshopper puts special attention on PSP avoidance, so that any Personal Security Products like 'MS Security Essentials', 'Rising', 'Symantec Endpoint' or 'Kaspersky IS' on target machines do not detect Grasshopper elements.

One of the persistence mechanisms used by the CIA here is 'Stolen Goods' - whose "components were taken from malware known as Carberp, a suspected Russian organized crime rootkit." confirming the recycling of malware found on the Internet by the CIA. "The source of Carberp was published online, and has allowed AED/RDB to easily steal components as needed from the malware. ". While the CIA claims that "[most] of Carberp was not used in Stolen Goods" they do acknowledge that "[the] persistence method, and parts of the installer, were taken and modified to fit our needs".

The documents WikiLeaks publishes today provide an insights into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise