Category Archives: Surveillance

Profile of “genius” Parscale, who “won” for Trump & the Facebook political influence juggernaut

Parscale — and every political consultant in a similar situation — is doing this interview to build his business. The introduction of sophisticated digital tools to the process of electing candidates has resulted in a bumper crop of people claiming that they have mastered this inscrutable system and that you should hire them.

Fleshed out, Parscale is the man behind the Trump campaign’s digital media efforts in 2016. He was hired to create a website for $1,500 (as he explained in that “60 Minutes” interview) and then his role expanded until he was managing tens of millions of dollars intended to promote the presidential candidate online.

The point of the interview was, in part, to serve as a profile of Parscale but, more broadly, to explain the primary way in which those millions were spent. Per Parscale’s accounting, that was largely on Facebook advertising. Trump’s team advertised on other platforms, too, but “Facebook was the 500-pound gorilla, 80 percent of the budget kind of thing,” Parscale said.

If you do a search for Brad Parscale’s appearance on “60 Minutes,” the first thing that pops up above the results as of Monday morning is an ad for Brad Parscale. And that, in a nutshell, is Brad Parscale.

Right after the campaign, it was the firm Cambridge Analytica that was making this case, arguing that its black-box analysis of the psychology of American voters allowed Trump to target specific sorts of people with ads that dug deep into their brains to trigger a response. The company (owned in part by the family of Robert Mercer, which was in other ways essential to Trump’s success) wanted to convince future candidates that they could work their magic to get them elected, too.

To “60 Minutes,” Parscale dismissed that claim — in part because he was in the midst of claiming that he was the one with the magic touch. He didn’t think Cambridge Analytica’s system of creating “psychographic” profiles of people was sinister, he said — he just didn’t think it worked.

Which is a simply bizarre claim in the broader context. It isn’t that Parscale doesn’t think that building profiles of people to target ads to them doesn’t work. It’s that Parscale doesn’t seem to realize that this is basically what Facebook was doing for him, in real-time.

By its very nature, Facebook does a more complete and more robust version of what Cambridge Analytica claims to accomplish. In 2014, we explained how Facebook’s political tools work, how it combines data about what you’ve clicked with outside consumer data to get as complete a picture of who you are and what you like as anything that exists. But then it overlays the ability to advertise specific things to specific people — and to test and refine and improve on those ads.

This is what Parscale was describing to “60 Minutes” — not his genius, but Facebook’s. He shows the nifty tricks that you can do with Facebook, A/B testing (as the process is known) different versions of ads with different photos and ads that allow the most effective to quickly rise to the surface. He clearly used all of those secret buttons, clicks and technology that he sought, leveraging Facebook’s deep sense of its individual users and tools to target them. Stepping back, Parscale comes off like the guy who hires LeBron James to play on his team in a 3-on-3 basketball tournament and then brags about his capable coaching. He’s an ad buyer, who lets the platform — say, on Google, when you search for his name — do the work.

The takeaway from the “60 Minutes” interview is simple. Facebook is a juggernaut that’s probably more influential in politics than it realizes itself. (See this New York magazine article to that end.)

Parscale says that his wife likes to say that “[he] was thrown into the Super Bowl, never played a game and won.” Right. It’s just that, in that example, he’s neither Tom Brady nor Bill Belichick. At best, he’s the guy who decided to hire them.

Full story ‘60 Minutes’ profiles the genius who won Trump’s campaign: Facebook https://www.washingtonpost.com/news/politics/wp/2017/10/09/60-minutes-profiles-the-genius-who-won-trumps-campaign-facebook/?utm_term=.5c686f2463e8

Lyrics for a Surveillance Society – The Hacking Suite for Governmental Interception

Lyrics by Hacking Team. Music by Azerbaijan, Bahrain, Egypt, Ethiopia, Kazakhstan, Morocco, Nigeria, Oman, Saudi Arabia, Sudan, and several United States agencies including the DEA, FBI and Department of Defense.

Criminals and terrorists rely on mobile phones, tablets, lap tops and computers equipped with universal end-to-end encryption to hide their activity. Their secret communications and encrypted files can be critical to investigating, preventing and prosecuting crime. Hacking Team provides law enforcement an effective, easy-to-use solution. Law enforcement and intelligence communities worldwide rely on Hacking Team in their mission to keep citizens safe. The job has never been more challenging or more important.

You have new challenges today

Sensitive data is transmitted over encrypted channels

Often the information you want is not transmitted at all

Your target may be outside your monitoring domain

Is passive monitoring enough?

You need more ….

You want to look through your target’s eyes

You have to hack your target

While your target is …. Browsing the web, Exchanging documents, Receiving SMS, Crossing the borders

You have to hit many different platforms – Windows, OS X, Linux, Android, iOS, Blackberry, Windows Phone, Symbian

You have to overcome encryption and capture relevant data – Skype & Voice Calls, Social Media, Target Location, Messaging, Relationship, Audio & Video

Being stealth and untraceable

Immune to protection systems

Hidden collection infrastructure

Deployed all over your country

Up to hundreds of thousands of targets

All managed from a single place

Exactly what we do

Remote Control System – Galileo – The Hacking Suite for Governmental Interception

Hacking Team – Rely On Us

ENDS

Using Stylometry DHS have id’d Bitcoin creator Nakamoto with help from NSA PRISM & MUSCULAR programs

Allegedly using word surveillance and stylometry the effort took less than a month. Apparently using encryption and complex obfuscation methods is not a defence when the “seeker” has access to trillions of writing samples from a billion or so people across the globe.

By taking Satoshi’s texts and finding the 50 most common words, the NSA was able to break down his text into 5,000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a ‘fingerprint’ for anything written by Satoshi that could easily be compared to any other writing.

It is worth noting that the original post is littered with comments that request more details on the source of the information that informed the post or some other such proof of the veracity of the claims being made but the author declared in response:

Many readers have asked that I provide third party citations to ‘prove’ the NSA identified Satoshi using stylometry. Unfortunately, I cannot as I haven’t read this anywhere else — hence the reason I wrote this post. I’m not trying to convince the reader of anything, instead my goal is to share the information I received and make the reader aware of the possibility that the NSA can easily determine the authorship of any email through the use of their various sources, methods, and resources.

Many readers have asked who Satoshi is and I’ve made it clear that information wasn’t shared with me. Based on my conversation I got the impression (never confirmed) that he might have been more than one person. This made me think that perhaps the Obama administration was right that Bitcoin was created by a state actor. One person commented on this post that Satoshi was actually four people. Again, I have no idea.

If it is true then “The moral of the story? You can’t hide on the internet anymore. Your sentence structure and word use is MORE unique than your own fingerprint. If an organization, like the NSA, wants to find you [sic] they will.

Full story by Alexander Muse is on Medium.

ENDS

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #20 – CouchPotato

CouchPotato enabled CIA agents to remotely use the tool to stealthily collect RTSP/H.264 video streams (RTSP/H.264: Real Time Streaming Protocol is a network control protocol designed for use in entertainment and communication systems and is a control mechanism for streaming media servers).

The tool provided CIA operatives with a number of options:

  • Collect the media stream as a video file (AVI);
  • Capture still images (JPG) of frames from the media stream;
    • This function was capable of being triggered only when there was change (threshold setting) in the pixel count from the previous capture;

The tool uses FFmpeg to encode and decode video and images and Real Time Streaming Protocol connectivity. The CouchPotato tool works stealthily without leaving any evidence on the attacked systems facilitated by ICE v3 “Fire and Collect” loader.

This is an in-memory code execution (ICE) technique that runs malicious code without the module code being written to the disk.

Neither Wikileaks, nor the leaked user guide explains how the agency penetrates the attacked systems, but as many CIA malware, exploits and hacking tools have already leaked in the Vault 7 publications, the agency has probably used CouchPotato in combination with other tools.” – TAD Group

The 10th August 2017 WikiLeaks release overview:

“Today, August 10th 2017, WikiLeaks publishes the the User Guide for the CoachPotato project of the CIA. CouchPotato is a remote tool for collection against RTSP/H.264 video streams. It provides the ability to collect either the stream as a video file (AVI) or capture still images (JPG) of frames from the stream that are of significant change from a previously captured frame. It utilizes ffmpeg for video and image encoding and decoding as well as RTSP connectivity. CouchPotato relies on being launched in an ICE v3 Fire and Collect compatible loader.”

One document was published alongside this release:

CouchPotato v1.0 — User Guide

Previous and subsequent Vault 7 WikiLeaks CIA document dump synopses are available via the Quick Reference Resource: WikiLeaks CIA Vault 7 Leaks

ENDS 

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #18 – UCL / Raytheon

In November 2014, Raytheon announced its acquisition of Blackbird Technologies. This acquisition expanded Raytheon’s special operations capabilities in several areas including:

  • Tactical Intelligence
  • Surveillance and reconnaissance
  • Secure tactical communications
  • Cybersecurity

Raytheon stated that their existing capabilities were now augmented by the Blackbird Technologies acquisition “across a broad spectrum of globally dispersed platforms and communications networks”. Blackbird Technologies was synergistic with Raytheon’s existing expertise and capabilities specifically in the areas of:

  • Sensors
  • Communications
  • Command & Control

This document dump contains suggested PoC’s for malware attack vectors. Raytheon Blackbird Technologies acted as a “kind of “technology scout” for the Remote Development Branch (RDB) of the CIA”.

They analysed malware attacks in the public domain and then gave the CIA recommendations for malware projects. These suggestions by RBT to the CIA were in line with the agencies stated objectives. These malware recommendations benefitted from data derived from “test deployments” in the field by other malware actors. Weaknesses in legacy deployments were assessed and designed out in the CIA versions.

The 19th July 2017 WikiLeaks release overview:

Today, July 19th 2017, WikiLeaks publishes documents from the CIA contractor Raytheon Blackbird Technologies for the “UMBRAGE Component Library” (UCL) project. The documents were submitted to the CIA between November 21st, 2014 (just two weeks after Raytheon acquired Blackbird Technologies to build a Cyber Powerhouse) and September 11th, 2015. They mostly contain Proof-of-Concept ideas and assessments for malware attack vectors – partly based on public documents from security researchers and private enterprises in the computer security field. Raytheon Blackbird Technologies acted as a kind of “technology scout” for the Remote Development Branch (RDB) of the CIA by analysing malware attacks in the wild and giving recommendations to the CIA development teams for further investigation and PoC development for their own malware projects.

Forty One (41) documents accompanied this release:

  1. 11 September, 2015 (S//NF) CSIT 15083 — HTTPBrowser
  2. 11 September, 2015 (S//NF) CSIT 15085 — NfLog
  3. 11 September, 2015 (S//NF) Symantec — Regin – Stealthy Surveillance
  4. 11 September, 2015 (S//NF) FireEye — HammerToss – Stealthy Tactics
  5. 11 September, 2015 (S//NF) VB — Gamker
  6. 4 September, 2015 (S//NF) SentinelOne – Rombertik
  7. 4 September, 2015 (S//NF) FireEye – Window into Russian Cyber Ops
  8. 4 September, 2015 (S//NF) MalwareBytes — HanJuan Drops New Tinba
  9. 4 September, 2015 (S//NF) Cisco — Rombertik
  10. 4 September, 2015 (S//NF) RSA — Terracotta VPN
  11. 28 August, 2015 (S//NF) Dell SecureWorks — Sakula
  12. 28 August, 2015 (S//NF) CSIT 15078 — Skipper Implant
  13. 28 August, 2015 (S//NF) Symantec — Evolution of Ransomware
  14. 28 August, 2015 (S//NF) CSIT 15079 — Cozy Bear
  15. 28 August, 2015 (U) McAfee DLL Hijack — PoC Report
  16. 28 August, 2015 (U) HeapDestroy – DLL Rootkit — PoC Report
  17. 21 August, 2015 (S//NF) TW — WildNeutron
  18. 21 August, 2015 (S//NF) NMehta — Theories on Persistence
  19. 21 August, 2015 (S//NF) CERT-EU — Kerberos Golden Ticket
  20. 21 August, 2015 (S//NF) VB Dridex 2015 — Dridex
  21. 14 August, 2015 (S//NF) Symantec — Black Vine
  22. 14 August, 2015 (S//NF) CSIR 15005 — Stalker Panda
  23. 14 August, 2015 (S//NF) CSIT 15016 — Elirks RAT
  24. 14 August, 2015 (S//NF) Eset — Liberpy
  25. 14 August, 2015 (S//NF) Eset — Potao
  26. 7 August, 2015 (U) Sinowal Web Form Scraping — PoC Report
  27. 7 August, 2015 (S//NF) MIRcon — Something About WMI
  28. 7 August, 2015 (U) PoC Report — Anti-Debugging and Anti-Emulation
  29. 7 August, 2015 (S//NF) SY 2015 — Butterfly Attackers
  30. 7 August, 2015 (S//NF) Symantec — ZeroAccess Indepth
  31. 7 August, 2015 (S//NF) CI 2015 — PlugX 7.0
  32. 7 August, 2015 (U) Mimikatz Password Scanning Analysis — PoC Report
  33. 7 August, 2015 (S//NF) TrendMicro — Understanding WMI Malware
  34. 4 August, 2015 (S//NF) CanSecWest 2013 — DEP/ASLR Bypass Without ROP/JIT
  35. 26 June, 2015 (U) Software Restriction Policy: A/V Disable — PoC Report
  36. 26 June, 2015 (U) WMI Persistence Proof of Concept — Supplemental Report
  37. 29 May, 2015 (U) Mimikatz PoC Report
  38. 29 May, 2015 (U) Pony / Fareit PoC Report
  39. 26 January, 2015 (U) SIRIUS Pique Proof-of-Concept Delivery — User-Mode DKOM — Final PoC Report
  40. 29 December, 2014 (U) SIRIUS Pique Proof-of-Concept Delivery — Direct Kernel Object Manipulation (DKOM) — Interim PoC Report
  41. 21 November, 2014 (U) Direct Kernel Object Manipulasiton (DKOM) — Proof-of-Concept (PoC) Outline 21 November, 2014

Previous and subsequent Vault 7 WikiLeaks CIA document dump synopses are available via the Quick Reference Resource: WikiLeaks CIA Vault 7 Leaks

ENDS 

 

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #19 – Dumbo

Dumbo is a capability to suspend processes utilizing webcams and corrupt any video recordings that could compromise a PAG deployment. The PAG (Physical Access Group) is a special branch within the CCI (Center for Cyber Intelligence); its task is to gain and exploit physical access to target computers in CIA field operations. *

Vault7 Projects - Images - AAC Dumbo - PAG

The 3rd August 2017 WikiLeaks release overview:

Today, August 3rd 2017 WikiLeaks publishes documents from the Dumbo project of the CIA. Dumbo is a capability to suspend processes utilizing webcams and corrupt any video recordings that could compromise a PAG deployment. The PAG (Physical Access Group) is a special branch within the CCI (Center for Cyber Intelligence); its task is to gain and exploit physical access to target computers in CIA field operations. Dumbo can identify, control and manipulate monitoring and detection systems on a target computer running the Microsoft Windows operating sytem. It identifies installed devices like webcams and microphones, either locally or connected by wireless (Bluetooth, WiFi) or wired networks. All processes related to the detected devices (usually recording, monitoring or detection of video/audio/network streams) are also identified and can be stopped by the operator. By deleting or manipulating recordings the operator is aided in creating fake or destroying actual evidence of the intrusion operation. Dumbo is run by the field agent directly from an USB stick; it requires administrator privileges to perform its task. It supports 32bit Windows XP, Windows Vista, and newer versions of Windows operating system. 64bit Windows XP, or Windows versions prior to XP are not supported.

Log Excerpt:

Vault7 Projects - Images - AAC Dumbo - LOG

Eight documents were also published alongside this release:

Dumbo v3.0 — Field Guide

Dumbo v3.0 — User Guide

Dumbo v2.0 — Field Guide

Dumbo v2.0 — User Guide

Dumbo v1.0 — TDR Briefing

Dumbo v1.0 — User Guide

Dumbo Epione v1.0 — TDR Briefing

Dumbo Epione v1.0 — User Guide

Previous and subsequent Vault 7 WikiLeaks CIA document dump synopses are available via the Quick Reference Resource: WikiLeaks CIA Vault 7 Leaks

ENDS 

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #17 – Imperial: Achilles, SeaPea, & Aeris

These leaked documents relate to a CIA project codenamed ‘Imperial’, they include details of three CIA hacking tools and implants that have been designed to compromise computers running Apple Mac OS X and different Linux distributions. *

The three hacking tools are:

  1. Achilles – A tool to trojanize a legitimate OS X disk image (.dmg) installer;
  2. SeaPea – A Stealthy Rootkit For Mac OS X Systems;
  3. Aeris – An Automated Implant For Linux Systems.

The 27th July 2017 WikiLeaks release overview:

Today, July 27th 2017, WikiLeaks publishes documents from the Imperial project of the CIA. Achilles is a capability that provides an operator the ability to trojan an OS X disk image (.dmg) installer with one or more desired operator specified executables for a one-time execution. Aeris is an automated implant written in C that supports a number of POSIX-based systems (Debian, RHEL, Solaris, FreeBSD, CentOS). It supports automated file exfiltration, configurable beacon interval and jitter, standalone and Collide-based HTTPS LP support and SMTP protocol support – all with TLS encrypted communications with mutual authentication. It is compatible with the NOD Cryptographic Specification and provides structured command and control that is similar to that used by several Windows implants. SeaPea is an OS X Rootkit that provides stealth and tool launching capabilities. It hides files/directories, socket connections and/or processes. It runs on Mac OSX 10.6 and 10.7.

Vault7 Projects - Images - HackRead Imperial

Three documents were also published alongside this release:

Achilles — User Guide

The malware has been tested to be compatible with Intel processors running 10.6 OS.

SeaPea — User Guide

This hack was written in 2011. It is listed as “tested” on OS X 10.6/Snow Leopard and Mac OS X 10.7/Lion. The malware works by assigning processes to any one of the three categories namely: Normal, Elite, and Super-Elite. ** The commands in SeaPea are executed as Elite processes.

Aeris — Users Guide

The coding for the Aeris hacking tool was done in C and it affects the following systems:

Debian Linux 7 (i386), Debian Linux 7 (amd64), Debian Linux 7 (ARM), Red Hat Enterprise Linux 6 (i386), Red Hat Enterprise Linux 6 (amd64), Solaris 11 (i386), Solaris 11 (SPARC), FreeBSD 8 (i386), FreeBSD 8 (amd64), CentOS 5.3 (i386) and CentOS 5.7 (i386). ***

Previous and subsequent Vault 7 WikiLeaks dumps synopses are available on WikiLeaks and also see further analysis of Imperial at HackRead and The Hacker News.

ENDS

Header image courtesy of The Hacker News (Twitter @TheHackersNews) & in-article image courtesy of HackRead (Twitter @HackRead)

* Content courtesy of Pierluigi Paganini “Security Affairs” article  WikiLeaks published another batch of classified documents from the CIA Vault 7 leak, it includes details of the Imperial project

** References from content courtesy of HackRead – Twitter @HackRead

*** References from content courtesy of The Hacker News – Twitter @TheHackersNews