Kaspersky believes it found new CIA malware

I recall how when we had North Korean hacking activities and official attributions people would say, but how do we know it was them and how do we know the government isn’t making things up?

But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.

I’d say it’s likely they were instructed to sit on it until the time is right

Using inductive reasoning, they're probably still deploying first-stage malware en mass that activates under certain network conditions. Truly scary stuff.

Now compare it to how fast US intelligence analysts are. They may conclude who is behind attack in a matter of days. (For example, recent solarwinds attack)

But CIA developing malware isn't news to anyone. How is this a tit-for-tat then?

Interesting. But if you had cited "my ass" as a source it would be more reliable, because the NSA is probably better at lying.

It's not impossible but it's complicated and the more complicated the harder to it is to keep secret. It's easier to just amass exploits for use when needed.

not convinced. since its the CIA, I trust them they are doing it for a good cause.

Don't overestimate government coders skills...

Often it's a massive team with people of very varied programming skills. The core exploit might be some super high tech, hand coded in assembly rootkit, but then the remote control stuff might ends up being some badly written powershell script or multi-megabyte dot-net, java or python binary pulling in every library under the sun.

Maybe it's less suspicious to have benign metadata than no metadata.

I think it was based more on when the samples were found

The link is included in the article ("Kaspersky’s full description is below, from its <link>quarterly APT report</link> released today.")

The linked article's url is https://securelist.com/apt-trends-report-q1-2021/101967/ , which is from a site called "SECURELIST by Kaspersky".

I’d say the likelihood of an American Big Tech without CIA covert operatives working there is essentially zero, even if there’s no direct cooperation. It doesn’t make sense to not utilize some of your most valuable assets.

It should noted that they can also assign agents to work at these firms or recruit existing employees, so they have a broad pallet to deal with. And a given person working for the secret agencies might not have to do more than turn a blind eye to something once in a while.

However, these large firms have enterprise-wide security and too many people would notice the vacuuming of data for this to be done by single agents. So that would require secret court order and secret laws, as we know existed a few years ago.

So no doubt you have some level of secret agency access but exactly how much is difficult to say. Remember these are companies operating globally and it's in their interests to not be seen as mere extension of US intelligence and foreign policy but at the same time these agencies can very persuasive, etc. etc.

Yes. Although with Google and other tech giants, they have good security, but really bad privacy. So there is little chance of your Google searches being leaked onto some shady darkweb forum, but a better chance it is being leaked to NSA etc. Also haven't you heard about NSLs[0] & Prism[1]?

[0] https://en.wikipedia.org/wiki/National_security_letter

[1] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

Or they just ask, which is essentially how prism already worked for user data.

Sure, as soon as we end all jealousy and suspicion in the human race. Glhf

Almost all government created malware uses 0days that they've kept back or held back from public disclosure, so there's nothing really you can do (aside from waiting for disclosure). That's the point of a CIA hack isn't it?

If there's something you can do, then they've failed at their job, and it's time for hiring the next batch of developers (yes these are developers with a paid day job - to make malware for the CIA).

In university, most computer science or computer engineering students had to make a choice whether to work for the country's security agencies and/or the military industries (via internships, being recruited, or just plain applying to government/pentagon/fbi/cia/nsa/csis jobs, etc), and that's their choice to make.

From the government's point of view, it's no different than recruiting soldiers for the Army/Navy/Marines. If they couldn't train you to their standards for basic fitness and basic shooting skills, they've failed and you'd probably wash out from infantry school.

The other thing you could do is to contribute to initiatives that do specific research into looking for vulnerabilities. It's no guarantee that you'll find the same vulnerabilities that the CIA is exploiting though, or you might find entirely other ones that they've been using for other exploits.

> Kaspersky said that while it has not seen any of these samples in the wild, they believe Purple Lambert samples “were likely deployed in 2014 and possibly as late as 2015.”

You don’t do anything because you are not the target. It’s never been seen in the wild.

While I have no information to share on this specific malware, here is the NSA's TAO Chief on what makes their jobs harder:

https://www.youtube.com/watch?v=bDJb8WOJYdA

Why would you rely on a company that is banned? https://www.nextgov.com/cybersecurity/2019/09/us-finalizes-r...