Another leaked document via Wikileaks this time about the CIA's Marble Framework obfuscation tool.
I am rather puzzled. The aim of the tools is to obscure the
authorship of a cyber attack. Let's wind back a little. Large numbers of
entities that mount cyber attacks want the attack to succeed but to be
able to deny authorship. For the analyst and investigator this is "the
problem of attribution".
One route for the attacker is to avoid mounting the attack from a
computer that can be associated with them via its IP address. This is
done by hijacking one of the several million unprotected computers and
other devices and launching the attack from there. Or maybe they'll set
up a chain of such devices. So investigators move on to code analysis -
looking for clues in the use of structures and strings. Are there words
in a specific language? Has the code been used before - and by some-one
already known? The problem with this is that there is no enforceable
copyright in attack code and it is relatively easy for a hacker to steal
some-one else's code and hence point the finger of blame at them. This
is known in espionage circles as a "false flag" action.
Marble Framework, if it works, automates the process. The CIA write their attack code and then run it through their Marble software so that any "English" references either are deleted or "foreign language" references added.
So we move on to two other attribution routes - "resource required"
and "motivation". Judgements about the level of resource required to
mount the attack - the difficulty of creating the code, the amount of
research required into accurately focusing the attack on the target -
give clues about the nature of the attacker - lone recreational hacker
or large national security agency or somewhere in between. Judgements
about motivation take us away from technical matters into politics. Who
would want to mount the attack? The attribution of Stuxnet is based on a
combination of resource required and motivation.
Where does Marble Framework fit in? Well presumably in defeating code
analysis by attempting to remove indications of authorship. Will it
actually do so? If future analysts come across code that looks
suspiciously anonymous, will they not say to themselves: "This looks as
though it has been carefully cleaned - I wonder if this is the result of
CIA's Marble tool?"
And of course there will still be the "resource required" and "motivation" tests.
I cover nearly all of these points in my Digital Evidence Handbook Kindle ebook. http://www.digital-evidence.expert.