Evil Leaders : Documentary on Joseph Stalin and Adolf Hitler – Film

Advertisements

Unveiled – As done by “GoMoPa” – Cyber Bulletin: Korean Malware Potentially Used in Sony Pictures Attack

 

The following bulletin was posted on the document sharing website Scribd by Politico Cybersecurity Editor Shaun Waterman.  The bulletin refers to Korean malware used by “unknown computer network exploitation (CNE) operators” that is believed to have been used in the recent attack on Sony Pictures Entertainment.  These actions ressemble to the “GoMoPa” cyber-attacks. The bulletin was first reported by Reuters on December 1, 2014.

FBI-KoreanMalware

FBI Liaison Alert System #A-000044-mw

  • 5 pages
  • TLP: GREEN
  • December 1, 2014

Download

The FBI is providing the following information with HIGH confidence:

Destructive malware used by unknown computer network exploitation (CNE) operators has been identified. This malware has the capability to overwrite a victim host’s master boot record (MBR) and all data files. The overwriting of the data files will make it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods. Analysis of this malware is presented to provide the computer network defense (CND) community with indicators of this malware.

TECHNICAL DETAILS

The FBI is providing the following information with HIGH confidence:

This group uses some custom tools that should be immediately flagged if detected, reported to FBI CYWATCH, and given highest priority for enhanced mitigation.
The aforementioned actors have used identified domains names and IP addresses as both source and/or destination IPs. The FBI is distributing the indicators associated with this attack to enable network defense activities and reduce the risk of similar attacks in the future. The FBI has high confidence that these indicators are being used by CNE operators for further network exploitation. The FBI recommends that your organization help victims identify and remove the malicious code.

Below are descriptions of malware and associated malware signatures:

The malware has the following characteristics:

File: d1c27ee7ce18675974edf42d4eea25c6.bin
Size: 268579 bytes (262.3 KB)
MD5: D1C27EE7CE18675974EDF42D4EEA25C6
PE Compile Time: 2014-11-22 00:06:54
Language pack of resource section: Korean

The original filename of this file is unknown, but it was likely “diskpartmg16.exe”. This file serves as a dropper. It drops destructive malware, “igfxtrayex.exe”. When the dropper file was executed, it started a second instance of itself with “-i” as an argument, then terminated.

The second instance of the dropper file installed itself as the “WinsSchMgmt” service with “-k” as a command line argument, started the service, then terminated.

The “WinsSchMgmt” service executed the file with “-k” as an argument, which started another instance of the file using “-s” as an argument.

The “-s” instance dropped and executed “igfxtrayex.exe”, created “net_ver.dat”, and began generating network traffic over TCP ports 445 and 139 to victim IP addresses.

The following files were added:
C:\Documents and Settings\User\Desktop\igfxtrayex.exe
C:\WINDOWS\system32\net_ver.dat

The following strings of interest were in this dropper file:

– – – BEGIN STRINGS – – –
recdiscm32.exe
taskhosts64.exe
taskchg16.exe
rdpshellex32.exe
mobsynclm64.exe
comon32.exe
diskpartmg16.exe
dpnsvr16.exe
expandmn32.exe
hwrcompsvc64.exe
cmd.exe /q /c net share shared$ /delete
\\%\admin$\syswow64
\\%s\admin$\system32
cmd.exe /q /c net share shared$=%SystemRoot%
cmd.exe /q /c net share shared$=%SystemRoot% /GRANT:everyone, FULL
RasSecurity
RasMgrp
cmd.exe /c wmic.exe /node: ”%s” /password: “%s” PROCESS CALL CREATE “%s” >
%s
WinsSchMgmt
Windows Schedule Management Service
– – -END STRINGS – – –

File: net_ver.dat
Size: 4572 bytes (4.5 KB)
MD5: 93BC819011B2B3DA8487F964F29EB934

This is a configuration file containing what appear to be hostnames, IP addresses, and the number 2. Entries in the file have the structure “HOSTNAME | IP Address | 2”. The victim IP addresses in this file correspond with the victim IP addresses listed under the file with MD5 hash D1C27EE7CE18675974EDF42D4EEA25C6 (noted above).

File: igfxtrayex.exe
Size: 249856 bytes (244.0 KB)
MD5: 760c35a80d758f032d02cf4db12d3e55
PE Compile Time: 2014-11-24 04:11:08
Language pack of resource section: Korean

This file is destructive malware: a disk wiper with network beacon capabilities. If “igfxtrayex.exe” is run with no parameters, it creates and starts a copy of itself with the “–i” argument. After 10 minutes, the “igfxtrayex.exe” makes three copies of itself and places them in the same directory it was executed from. These copies are named according to the format “taskhostXX.exe” (where X is a randomly generated ASCII character). These copies are then executed, each with a different argument (one being “-m”, one being “-d” and the other “-w”). Network connection attempts are made to one of three hard-coded IP addresses in a random order to either port 8080 or 8000. If a connection to the IP address cannot be made, it attempts to connect to another of the three IP addresses, until connections to all three IP addresses have been attempted. The following command-line string is then executed: “cmd.exe /c net stop MSExchangeIS /y”. A 120 minute (2 hour) sleep command is issued after which the computer is shutdown and rebooted.

File: iissvr.exe
Size: 114688 bytes (112.0 KB)
MD5: e1864a55d5ccb76af4bf7a0ae16279ba
PE Compile Time: 2014-11-13 02:05:35
Language pack of resource section: Korean

This file when executed starts a listener on localhost port 80. It has 3 files contained in the resource section, all xor’d with 0x63.

File: usbdrv3_32bit.sys
Size: 24280 bytes (23.7 KB)
MD5: 6AEAC618E29980B69721158044C2E544
PE Compile Time: 2009-08-21 06:05:32

This SYS file is a commercially available tool that allows read/write access to files and raw disk sectors for user mode applications in Windows 2000, XP, 2003, Vista, 2008 (32-bit). It is dropped from resource ID 0x81 of “igfxtrayex.exe”.

File usbdrv3_64bit.sys
Size: 28120 bytes (27.5 KB)
MD5: 86E212B7FC20FC406C692400294073FF
PE Compile Time: 2009-08-21 06:05:35

This SYS file is a also a commercially available tool that allows read/write access to files and raw disk sectors for user mode applications in Windows 2000, XP, 2003, Vista, 2008 (64-bit). It is dropped from resource ID 0x83 of “igfxtrayex.exe”.

RECOMMENDED STEPS FOR INITIAL MITIGATION

The following Snort signature can be used to detect the beacon traffic, though by the time the beacons occur, the destructive process of wiping the files has begun:

Alert tcp any any – > [88.53.215.64, 217.96.33.164, 203.131.222.102] [8080, 8000] (msg: “wiper_callout”; dsize:42; content: “|ff ff ff ff|”; offset: 26; depth: 4; sid: 314;)

The following YARA signatures will detect this malware on the host:

rule unknown_wiper_str{

meta: unique string in wiper malware

strings:

$STR1 = “#99E2428CCA4309C68AAF8C616EF3306582A64513E55C786A864BC83DAFE0C78585B692047273B0E55275102C66” fullword nocase

$MZ = “MZ”

condition:

$MZ at 0 and $STR1

}

rule unknown_wiper_IPs{

meta: unique IPs in wiper malware

strings:

$IP1 = “203.131.222.102” fullword nocase
$IP2 = “217.96.33.164” fullword nocase
$IP3 = “88.53.215.64” fullword nocase
$MZ = “MZ”

condition:

$MZ at 0 and all of them

}

rule unknown_wiper_error_strings{

meta: unique custom error debug strings discovered in the wiper malware

strings:

$ERR1 = “$MFT Record read failed.” fullword nocase
$ERR2 = “Drive Boot Sector read failed.” fullword nocase
$ERR3 = “SetFilePointer failed.” fullword nocase
$MZ = “MZ”

condition:

$MZ at 0 and all of them

}

Reporting Notice

The FBI encourages recipients who identify the use of tool(s) or techniques discussed in this document to report information to their local FBI field office or the FBI’s 24/7 Cyber Watch (CyWatch). Field office contacts can be identified at http://www.fbi.gov/contact-us/field. CyWatch can be contacted by phone at 855-292-3937 or by e-mail at CyWatch@ic.fbi.gov. When available, each report submitted should include the date, time, location, type of activity, number of people, and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact.

TOP-SECRET – The Secret List of KGB Spies in Eastern Europe, Part 45, CO,

wolf-im-schafspelz

 

 

IPN BU 644/992 COCHOŃ KAZIMIERZ
IPN BU 01013/318 COCHOWSKA MARIA
IPN BU 00283/446 COHOMIRSKI ANDRZEJ
IPN 00 1043/1668 COLIN ELŻBIETA
IPN BU 002086/814 COLLINS-WICHNIEWICZ ELŻBIETA
IPN 00 1043/1841 COŁOSZYŃSKI SŁAWOMIR
IPN BU 001102/1737 COMBRZYŃSKI WALDEMAR
IPN BU 00244/120 COMPA KAZIMIERZ
IPN BU 0891/407 COMRZYŃSKI CZESŁAW
IPN 00 1052/1209 COPIJA KRZYSZTOF
IPN BU 644/96 CORA MARIAN
IPN BU 00191/715 CORBERT ERNST REINHARD
IPN BU 00751/170 CORNIK MARIAN
IPN BU 001102/1667 CORNIK MARIAN
IPN BU 00191/239 COSNA ANDRZEJ
IPN BU 00283/417 COTA STANISŁAW
IPN BU 00612/605 COTA STANISŁAW
IPN 00 1043/2520 COVIC DYLĄG JACHNIK HANNA
IPN BU 0193/5302 COZEL STANISŁAW
IPN BU 00200/579 CSATO JUSTYNA ANNA
IPN 00 1052/1896 CSATO JUSTYNA ANNA
IPN BU 00277/1102 CSERNAK MAGDALENA
IPN BU 001121/3279 CSERNAK MAGDALENA
IPN BU 0854/933 CUBALA JÓZEF
IPN BU 0772/2428 CUBAŁA SABINA
IPN BU 0901/1407 CUBER DARIUSZ
IPN BU 0901/562 CUBER MURAWSKA MARIA ELŻBIETA
IPN BU 00277/469 CUBER ROMAN
IPN BU 001121/2684 CUBER ROMAN TADEUSZ
IPN BU 698/499 CUBER WACŁAWA
IPN BU 636/1787 CUBER WANDA
IPN BU 636/1787 CUBER WANDA
IPN BU 00415/400 CUBERA DARIUSZ
IPN BU 0958/992 CUBRZYŃSKI ANTONI
IPN BU 0988/842 CUBRZYŃSKI ANTONI
IPN BU 0242/834 CUCH DANUTA
IPN BU 0193/8432 CUCH IRENEUSZ
IPN BU 0988/1278 CUCH KAZIMIERZ
IPN BU 0242/858 CUCH WALDEMAR
IPN BU 0242/3269 CUCH ZENON
IPN BU 0912/1923 CUCHEWICZ WŁADYSŁAW
IPN BU 01256/32 CUDAK LECH
IPN BU 001040/272 CUDAK MAREK
IPN BU 00611/1444 CUDAK TADEUSZ
IPN BU 001198/2631 CUDAK TADEUSZ
IPN BU 0902/128 CUDNA (PISKORSKA) URSZULA
IPN BU 698/500 CUDNA APOLANIA
IPN BU 01000/859 CUDNA DANUTA
IPN BU 0772/73 CUDNA JADWIGA
IPN BU 0806/3008 CUDNA MARIA
IPN BU 645/133 CUDNA URSZULA
IPN BU 0951/286 CUDNIK – CHMIELAK JANINA
IPN BU 0951/228 CUDNIK BRONISŁAW
IPN BU PF 125/17 CUDNIK KAZIMIERZ
IPN BU PF 2/81 CUDNIK ZOFIA
IPN BU 00249/423 CUDNY KAZIMIERZ
IPN BU 001121/1049 CUDNY KAZIMIERZ
IPN BU 01000/2137 CUDNY LUCJAN
IPN BU 0193/7988 CUDNY MARIAN
IPN BU 0902/122 CUDNY STANISŁAW
IPN BU 644/1013 CUDNY STANISŁAW
IPN BU 00200/1234 CUDNY STANISŁAW
IPN BU 001102/836 CUDNY STANISŁAW
IPN BU 0193/6353 CUDNY SZCZEPAN
IPN BU 0607/7 CUDNY ZBIGNIEW
IPN BU 01013/310 CUDYN KAZIMIERZ
IPN BU 00334/165 CUDZEWICZ MARIANNA
IPN BU 001134/2893 CUDZEWICZ MARIANNA JOANNA
IPN BU 001198/92 CUDZIK HENRYK
IPN BU 00612/2572 CUDZIK JÓZEF
IPN BU 0772/963 CUDZIŁO KAROLINA
IPN BU 00277/659 CUDZIŃSKI KAROL
IPN 00 1052/460 CUGLEWSKA-MUSZAK IWONA
IPN BU 0193/5461 CUGLEWSKI ZDZISŁAW
IPN BU 0772/964 CUKERMAN MORDACH (MORDUCH)
IPN BU 00750/131 CUKIER DAWID
IPN BU 001164/398 Cukier Dawid
IPN BU 01434/153 CUKIERKANDEL PIOTR
IPN BU 0993/1519 CUKIERMAN TEOFILA
IPN BU 644/1014 CUKIERSKI CZESLAW
IPN BU 00464/126/46 CUKIERSKI K.
IPN BU 0314/9 CUKIERSKI KAZIMIERZ
IPN BU 00945/2737 CUKIERSKI KAZIMIERZ
IPN BU 01013/4 CUKIERSKI WIKTOR
IPN BU 00612/1196 CUKIERZ HAINA
IPN BU 01000/2236 CUKROWSKI ALFRED
IPN BU 00612/2718 CUKROWSKI ANDRZEJ
IPN BU 0604/1296 CUKROWSKI BOGUSŁAW
IPN BU 0193/6945 CUKROWSKI CZESŁAW
IPN BU 00232/226 CUMIELEWSKI BOLESŁAW
IPN BU 01434/238 CUNG-SOBIESKI JERZY
IPN BU 644/1015 CUPAŁ WŁADYSŁAW
IPN BU 0772/2429 CUPCZYŃSKI HENRYK
IPN BU 0290/107 CUPER BALBINA
IPN BU 00612/2926 CUPER GRZEGORZ
IPN BU 0988/1099 CUPER RAJMUND
IPN BU 644/1016 CUPIAK KAZIMIERZ
IPN BU 0901/2463 CUPIAŁ JAN
IPN BU 0902/129 CUPIAŁ JAN
IPN BU 01000/1188 CUPIAŁ JAN
IPN BU 0218/2003 CUPIAŁ KAZIMIERZ
IPN BU 001121/182 CUPIAŁ ZBIGNIEW
IPN BU 0218/2914 CUPIAŁ ZDZISŁAW
IPN BU 0901/822 CUPISZ (KACZMARCZYK) MARIA JOLANTA
IPN BU PF 71/36 CUPRIAK ARKADIUSZ
IPN BU 0855/2321 CUPRYJAK (CUPRJAK) ZYGMUNT
IPN BU 0193/1592 CUPRYJAK HALINA HENRYKA
IPN BU 0958/546 CUPRYJAK HELENA
IPN BU 0872/214 CUPRYJAK JAN
IPN BU 0218/3515 CUPRYJAK JERZY BOGUSŁAW
IPN BU 0901/963 CUPRYJAK KAZIMIERA ŁASKA
IPN BU 00275/381 CUPRYN ELŻBIETA
IPN BU 001134/231 CUPRYN ELŻBIETA JANINA
IPN BU 00275/433 CUPRYΠTOMASZ
IPN BU 001134/336 CUPRYŒ TOMASZ MIKOŁAJ
IPN BU 00557/XII/14 CUR ELŻBIETA
IPN 00 1043/407 CURLANIS BOHDAN RYSZARD BOGDAN
IPN BU 0866/97 CURLEJ ANTONI
IPN BU 0958/547 CURUŁ STANISŁAWA
IPN BU 00612/204 CURYŁŁO LIDIA
IPN BU 0772/965 CURYŁO BRONISŁAWA
IPN BU 00328/1195 CURYŁO EDWARD
IPN BU 001134/2083 CURYŁO EDWARD
IPN BU 709/877 CURYŁO HENRYK
IPN 00 1043/1740 CURYŁO HENRYK
IPN BU 0772/2430 CURYŁO JANINA
IPN BU 0218/155 CURYŁO MARIANNA
IPN BU 00612/1279 CURYŁO SŁAWOMIR
IPN BU 001198/4566 CURYŁO SŁAWOMIR

 

Video – OIL COLLAPSE: Putin to Go Nuclear on U.S. Sanctions

Noch’n Agent – Eberhard Feik alias „Thanner“ „Schimanski“-Partner war IM bei der Stasi

index

 

DDR, Staatssicherheit, Stasi, ARD, Tatort

WDR/PrimkeGötz George (l.) als Horst Schimanski und Eberhard Feik als Christian Thanner

Als Christian Thanner war der Schauspieler Eberhard Feik einer der beliebtesten „Tatort“-Ermittler überhaupt. Jahrelang arbeitete an der Seite von Kommissar Schimanski, gespielt von Götz George. Nun wurde bekannt, dass er über Jahre bei der Stasi als Inoffizieller Mitarbeiter geführt wurde.

Über zehn Jahre hinweg stand Eberhard Feik als Christian Thanner im Ruhrpott-„Tatort“ dem legendären Kommissar Horst Schimanski zur Seite. Die von Götz George gespielte Figur Schimanski wurde sogar für das Kino verfilmt und erhielt 1997 eine eigene gleichnamige Krimireihe.

Die eigene Krimi-Serie erlebte Eberhard Feik nicht mehr. Er starb im Jahr 1994 im Alter von 50 Jahren an einem Herzinfarkt. Nun wurde bekannt, dass er während seiner Zeit als TV-Kommissar als Inoffizieller Mitarbeiter (IM) der Staatsicherheit der DDR geführt wurde.

Decknamen „Lear“ und „Queen“

Von 1977 bis 1984 waren Feik und seine Frau in der Auslandsabteilung der Stasi registriert. Ihre Decknamen: „Lear“ und „Queen“. Feiks Witwe gab Kontakte zur Staatssicherheit gegenüber dem „Zeit Magazin“ zu, erklärte jedoch, dass beide nie aktiv für den Geheimdienst gearbeitet hätten.

Laut „Zeit Magazin“ können tatsächlich keine konkreten Aktivitäten der beiden aus den Unterlagen herausgelesen werden, beispielsweise also das Weitergeben von Spitzel-Informationen. Der schiere Umfang der Akte zeigt jedoch, dass durchaus intensiver Kontakt zwischen Stasi und dem Ehepaar bestanden haben muss.

Offenbar keine Spitzel-Aktionen

Beide waren offenbar Ende der Siebziger Jahre in West-Berlin in Berührung mit der Stasi gekommen. Laut Unterlagen aus der Stasi-Unterlagenbehörde in Berlin sollte Eberhard Feik zur Weitergabe von Informationen zwischen IMs dienen, die Ehefrau sollte als “IM mit besonderen Aufgaben” beispielsweise über Medien in der Bundesrepublik gezielt Informationen verbreiten.

Revealed – NSA Snowden Releases Tally Update – *2,694 Pages

8 December 2014

4 December 2014. Add 63 pages to The Intercept. Tally now *2,627 pages of The Guardian first reported 58,000 files; caveat: Janine Gibson, The Guardian NY, said on 30 January 2014 “much more than 58,000 files in first part, two more parts” (no numbers) (tally now less than ~4.3%). DoD claims 1,700,000 files (~.015% of that released). ACLU lists 525 pages released by the press. However, if as The Washington Post reported, a minimum of 250,000 pages are in the Snowden files, then less than 1% have been released. Note Greenwald claim on 13 September 2014 of having “hundreds of thousands” of documents.

25 November 2014. Add 72 pages to Süddeutsche Zeitung.

17 November 2014, charts by Cryptome:

[Image]

6 November 2014. At current rate of release it will take 31 to 908 years for full disclosure.

10 October 2014. Add 69 pages to The Intercept.

17 September 2014. Add 2 pages to The Intercept.

14 September 2014. Add 68 pages to Der Spiegel.

13 September 2014. In video Glenn Greenwald claims to have “hundreds of thousands” of documents (at 9:06 min)

http://www.3news.co.nz/tvshows/thenation/interview-glenn-greenwald-2014091311?ref=video

Audio excerpt: http://youtu.be/xnfIp38AAhM

5 September 2014. Add 32 pages to The Intercept. Tally now *2,293 pages of The Guardian first reported 58,000 files; caveat: Janine Gibson, The Guardian NY, said on 30 January 2014 “much more than 58,000 files in first part, two more parts” (no numbers) (tally now less than ~3.5%). DoD claims 1,700,000 files (~.012% of that released). ACLU lists 525 pages released by the press. However, if as The Washington Post reported, a minimum of 250,000 pages are in the Snowden files, then less than 1% have been released.

31 August 2014. Add 34 pages to Der Spiegel.

25 August 2014. Add 55 pages to The Intercept.

16 August 2014. Add 26 pages to Heise.

12 August 2014. Add 6 pages to The Intercept.

5 August 2014. Add 12 pages to The Intercept.

4 August 2014. Add 23 pages to The Intercept.

25 July 2014. Add 4 pages to The Intercept.

14 July 2014. Add 8 pages to The Intercept.

14 July 2014. “I’m as mad as hell and I’m not going to take this anymore!”

http://en.wikipedia.org/wiki/Network_%28film%29

Cryptome has sent a demand for accounting and public release specifics to holders of the Snowden documents: New York Times, Washington Post, The Guardian, Barton Gellman, Laura Poitrias, Glenn Greenwald, ACLU, EFF and John and Jane Does, US Citizens:

http://cryptome.org/2014/07/snowden-documents-demand-14-0714.pdf

11 July 2014. See related essay, Open the Snowden Files, Krystian Woznicki, 11July 2014:

English: http://berlinergazette.de/wp-content/uploads/Open-the-Snowden-Files_KW_E.pdf
German: http://berlinergazette.de/open-the-snowden-files/

11 July 2014. @PaulMD notes this claim in the Washington Post, 11 July 2014:

We did not have an official NSA list of targets. We had to find them in the pile ourselves. Soltani, an independent researcher, did most of the heavy lifting on that. Because the information was not laid out in rows and columns, the way it might be in a spreadsheet, Soltani wrote computer code to extract what we were looking for from something like a quarter-million pages of unstructured text.

If a minimum of 250,000 pages are in the Snowden files, then less than 1% have been released.

9 July 2014. Add 8 pages to The Intercept.

9 July 2014. Add 1 page to Washington Post.

23 June 2014. Add 9 pages to Der Spiegel.

22 June 2014. Add 41 pages to Information-The Intercept.

Revised. This is included in entry above. 18 June 2014. Add 20 pages to The Intercept.

18 June 2014. Add 200 pages to Der Spiegel.

16 June 2014. Add 4 pages to Der Spiegel.

1 June 2014. Add 4 pages to New York Times.

23 May 2014. Cryptome placed online No Place to Hide, 310 pages, to compensate for failure to release Snowden documents:

http://cryptome.org/2014/05/npth-freed.htm

http://cryptome.org/2014/05/npth.7z (27MB)

19 May 2014. The Intercept released 12 pages.

13 May 2014. Glenn Greenwald released 107 pages, some new, some previously published, some full pages, some page fragments.

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf

5 May 2014. Related tally of redactions of Snowden releases:

http://cryptome.org/2014/05/snowden-redactions.htm

30 April 2014. Add 19 pages to The Intercept.

30 April 2014. Add 2 pages to Dagbladet belatedly.

5 April 2014. Add 21 pages to The Intercept.

4 April 2014. ACLU offers NSA documents search: https://www.aclu.org/nsa-documents-search

Also:

http://freesnowden.is/category/revealed-documents/index.html

https://www.eff.org/deeplinks/2013/11/nsa-spying-primary-sources

https://www.aclu.org/nsa-documents-released-public-june-2013

http://leaksource.wordpress.com/

If more lists please send: cryptome[at]earthlink.net

2 April 2014.

29 March 2014. Add 1 page to Der Spiegel.

22 March 2014. Add 3 pages to Der Spiegel.

22 March 2014. Add 2 pages to New York Times.

21 March 2014. Add 7 pages to Le Monde.

20 March 2014. Add 6 pages to The Intercept.

18 March 2014. Add 4 pages to Washington Post.

13 March 2014. Add 1 page to The Intercept.

12 March 2014. Add 35 pages to The Intercept.

12 March 2014. Add 62 pages to New York Times. Add 2 pages to NRC Handelsblad.

7 March 2014. Add 8 pages to The Intercept.

27 February 2014. Add 3 pages to Guardian.

25 February 2014. Add 11 pages to NBC News.

24 February 2014. Add 4 pages to The Intercept.

24 February 2014. Add *50 pages to The Intercept (7 pages are duplicates of GCHQ Psychology).

18 February 2014. Add *45 pages to The Intercept (37 pages are duplicates of release by NBC News).

Note: Between 10-17 February 2014, The Intercept disclosed fragments of Snowden pages and the New York Times referenced some but as far as known did not release them in full. If available please send link.

10 February 2014. Add 1 page to NRC Handelsblad (via Electrospaces.blogspot.com).

7 February 2014. Add 15 pages NBC News.

5 February 2014. Add 14 pages NBC News.

31 January 2014. Add 27 pages to CBC News.

27 January 2014. Add 47 pages to NBC News.

27 January 2014. Add 18 pages to Anonymous via New York Times.

16 January 2014. Add 8 pages to The Guardian.

* 14 January 2014. Add 21 pages to Information.dk (duplicate).

* 13 January 2014. Add 4 pages to Information.dk (duplicate).

Related Snowden Document and Page Count Assessment:

http://cryptome.org/2014/01/snowden-count.htm

* 5 January 2014. Add 16 pages to Der Spiegel (30 December 2013. No source given for NSA docs). Tally now *962 pages (~1.7%) of reported 58,000. NSA head claims 200,000 (~.50% of that released).

4 January 2014. The source was not identified for *133  pages published by Der Spiegel and Jacob Appelbaum in late December 2013. They are included here but have not been confirmed as provided by Edward Snowden. Thanks to post by Techdirt.

Glenn Greenwald tweeted:

Glenn Greenwald @ggreenwald, 8:05 AM – 29 Dec 13@Cryptomeorg @ioerror I had no involvement in that Spiegel article, ask them – and they don’t say those are Snowden docs.

Matt Blaze tweeted, 11:24 AM – 2 Jan 14

matt blaze @mattblazeIf there are other sources besides Snowden, I hope journalists getting docs are careful to authenticate them (& disclose uncertainty).

3 January 2014. Add 13 pages to Washington Post.

3 January 2014. See also EFF, ACLU and LeakSource accounts:

https://www.eff.org/deeplinks/2013/11/nsa-spying-primary-sources

https://www.aclu.org/nsa-documents-released-public-june-2013

http://leaksource.wordpress.com/

2 January 2014. Add 1 page to Washington Post published 10 July 2013.

* 31 December 2013. Add 16 pages to Der Spiegel.

* 30 December 2013. Add 50 pages of NSA ANT Catalog by Jacob Appelbaum (no source given for NSA docs).

* 30 December 2013. Add 21 pages from 30C3 video by Jacob Appelbaum (no source given for NSA docs).

* 30 December 2013. Add 42 pages (8 duplicates) to Der Spiegel (no source given for NSA docs).

* 29 December 2013. Add 4 pages to Der Spiegel (no source given for NSA docs).

24 December 2013. Add 2 pages to Washington Post.

23 December 2013

http://www.adn.com/2013/12/22/3243451/pincus-snowden-still-has-a-road.html

We’ve yet to see the full impact of former National Security Agency contractor Edward Snowden’s unauthorized downloading of highly classified intelligence documents.

Among the roughly 1.7 million documents he walked away with — the vast majority of which have not been made public — are highly sensitive, specific intelligence reports, as well as current and historic requirements the White House has given the agency to guide its collection activities, according to a senior government official with knowledge of the situation.

The latter category involves about 2,000 unique taskings that can run to 20 pages each and give reasons for selective targeting to NSA collectors and analysts. These orders alone may run 31,500 pages.

13 December 2013. Add 26 pages to Trojkan (SVT). Tally now 797 pages (~1.4%) of reported 58,000. NSA head claims 200,000 (~.40% of that released). Australia press reports “up to 20,000 Aussie files.”

Rate of release over 6 months, 132.8 pages per month, equals 436 months to release 58,000, or 36.3 years. Thus the period of release has decreased in the past month from 42 years.

12 December 2013. Belatedly add 27 pages to Guardian and 18 pages to Washington Post.


21 November 2013. See also EFF and ACLU accounts:

https://www.eff.org/deeplinks/2013/11/nsa-spying-primary-sources

https://www.aclu.org/nsa-documents-released-public-june-2013


3 November 2013

47 42 Years to Release Snowden Documents

Out of reported 50,000 pages (or files, not clear which), about 446 514 pages (>1% 1%) have been released over 5 months beginning June 5, 2012. At this rate, 89 100 pages per month, it will take 47 42 years for full release. Snowden will be 77 72 years old, his reporters hoarding secrets all dead.

NY Times, 3 November 2013:

Whatever reforms may come, Bobby R. Inman, who weathered his own turbulent period as N.S.A. director from 1977 to 1981, offers his hyper-secret former agency a radical suggestion for right now. “My advice would be to take everything you think Snowden has and get it out yourself,” he said. “It would certainly be a shock to the agency. But bad news doesn’t get better with age. The sooner they get it out and put it behind them, the faster they can begin to rebuild.”


Timeline of releases:

[See tabulation below for full timeline.]


5 October 2013

26 Years to Release Snowden Docs by The Guardian

Out of reported 15,000 pages, The Guardian has published 192 pages in fourteen releases over four months, an average of 48 pages per month, or 1.28% of the total. At this rate it will take 26 years for full release.

Edward Snowden will be 56 years old.
Glenn Greenwald will be 72.
Laura Poitras will be 75.
Alan Rusbridger will be 86.
Barton Gellman will be 78.
Julian Assange will be 68.
Chelsea Manning will be 52.
Keith Alexander will be 88.
Barack Obama will be 78.
Daniel Ellsberg will be 108.
This author will be 103.


Number Date Title Pages

The Guardian 276
27 February 2014 GCHQ Optic Nerve 3
21 16 January 2014 SMS Text Messages Exploit 8
20 9 December 2013 Spying on Games 2
18 18 November 2013 DSD-3G 6
19 1 November 2013 PRISM, SSO
SSO1 Slide
SSO2 Slide
13*
18 4 October 2013 Types of IAT Tor 9
17 4 October 2013 Egotistical Giraffe 20*
16 4 October 2013 Tor Stinks 23
15 11 September 2013 NSA-Israel Spy 5
14 5 September 2013 BULLRUN 6*
13 5 September 2013 SIGINT Enabling 3*
12 5 September 2013 NSA classification guide 3
11 31 July 2013 XKeyscore 32
10 27 June 2013 DoJ Memo on NSA 16
9 27 June 2013 Stellar Wind 51
8 21 June 2013 FISA Certification 25
7 20 June 2013 Minimization Exhibit A 9
6 20 June 2013 Minimization Exhibit B 9
5 16 June 2013 GCHQ G-20 Spying 4
4 8 June 2013 Boundless Informant FAQ 3
3 8 June 2013 Boundless Informant Slides 4
2 7 June 2013 PPD-20 18
1 5 June 2013 Verizon 4

Washington Post 297
9 July 2014 NSA Emails 1
18 March 2014 NSA SCALAWAG 2
18 March 2014 NSA MYSTIC 2
2 January 2014 Quantum Computer 2 10
2 January 2014 Quantum Computer 3
23 December 2013 NSA/CSS Mission 2
11 December 2013 Excessive Collection 9
11 December 2013 SCISSORS 2 7
11 December 2013 SCISSORS 1 4
11 December 2013 Yahoo-Google Exploit 6
11 December 2013 Cable Spying Types 7
11 December 2013 WINDSTOP 1
11 December 2013 Co-Traveler 24
11 December 2013 GSM Tracking 2
11 December 2013 SIGINT Successes 4
11 December 2013 GHOSTMACHINE 4
5 December 2013 Target Location 1
4 December 2013 FASCIA 2
4 December 2013 CHALKFUN 1
26 November 2013 Microsoft a Target? 4
4 November 2013 WINDSTOP, SSO, Yahoo-Google 14
30 October 2013 MUSCULAR-INCENSOR Google and Yahoo 4
14 October 2013 SSO Overview 4
14 October 2013 SSO Slides 7
14 October 2013 SSO Content Slides 9
4 October 2013 Tor 49
4 October 2013 EgotisticalGiraffe 20*
4 October 2013 GCHQ MULLENIZE 2
4 October 2013 Roger Dingledine 2
30 August 2013 Budget 17
10 July 2013 PRISM Slide 1
29 June 2013 PRISM 8
20 June 2013 Warrantless Surveillance 25*
7 June 2013 PPD-20 18*
6 June 2013 PRISM 1

Der Spiegel * 413
14 September 2014 GCHQ STELLAR 26
14 September 2014 NSA Treasure Map 38
14 September 2014 NSA Treasure Map New 4
31 August 2014 NSA GCHQ Spy Turkey 34
23 June 2014 NSA German SIGADs 9
18 June 2014 NSA German Spying-2 200
16 June 2014 NSA German Spying 4
29 March 2014 NSA Spy Chiefs of State 1
22 March 2014 NSA SHOTGIANT 2NSA SHOTGIANT 1 21
31 December 2013 QFIRE * 16
30 December 2013 TAO Introduction * 16
30 Deceber 2013 QUANTUM Tasking (8 duplicates of QUANTUMTHEORY) 28*
30 December 2013 QUANTUMTHEORY 14
29 December 2013 TAO ANT COTTONMOUTH (images)
TAO ANT COTTONMOUTH
(DE article)
4
17 November 2013 ROYAL CONCIERGE (DE)ROYAL CONCIERGE (EN) 2
29 October 2013 NSA-CIA SCS 3
27 October 2013 NSA-CIA SCS 2
20 October 2013 Mexico President 1
20 September 2013 Belgacom 3
16 September 2013 SWIFT 3
9 September 2013 Smartphones 5
1 September 2013 French Foreign Ministry 0
31 August 2013 Al Jazeera 0

O Globo Fantastico ~87
7 October 2013 CSE Brazil Ministry 7
8 September 2013 Petrobas ~60
3 September 2013 Brazil and Mexico 20

New York Times 124
1 June 2014 NSA Identity Spying 4
22 March 2014 NSA Huawei SHOTGIANT 2
12 March 2014 NSA Stellarwind Classification
NSA FISA FAA Classification
AG Dissemination
NSA Cryptanalyist FISA Database
NSA Spying Timeline
37
18
2
4
1
9 December 2013 Spying on Games 82*
23 November 2013 SIGINT Strategy 2012-2016 5
3 November 2013 SIGINT Mission 2013SIGINT Mission 2017 22
28 September 2013 Contact Chaining Social Networks 1
28 September 2013 SYANPSE 1
5 September 2013 BULLRUN 4*
5 September 2013 SIGINT Enabling 3*

ProPublica 89
9 December 2013 Spying on Games 82*
5 September 2013 BULLRUN 4*
5 September 2103 SIGINT Enabling 3*

Le Monde 20
21 March 2014 CSE SNOWGLOBE 7
25 October 2013 NSA Hosts FR Spies 4
22 October 2013 Wanadoo-Alcatel 1
22 October 2013 Close Access Sigads 2
22 October 2013 Boundless Informant 2
22 October 2013 PRISM 11

Dagbladet 15
April 2014
December 2013
Norway Assistance 2
19 November 2013 BOUNDLESSINFORMANT 13

NRC Handelsblad 7
12 March 2014 NSA Aids Dutch Anti-Piracy 2
8 February 2014 MIVD BoundlessInformant
Cryptome mirror
1
30 November 2013 Dutch SIGINT 3
23 November 2013 SIGINT Cryptologic Platform 1

Huffington Post 3
27 November 2013 Muslim Porn Viewing 3

CBC 36
30 January 2014 CESC IP Profiling 27
10 December 2013 NSA-CSEC Partnership 1
10 December 2013 G8-G20 Spying 4*
2 December 2013 G8-G20 Spying 3
29 November 2013 G8-G20 Spying 1

The Globe and Mail 18
30 November 2013 CSEC Brazil Spying 18*

SVT (Swedish TV) 2
5 December 2013 Sweden Spied Russia for NSA 2

L’Espresso 3
6 December 2013 NSA Spies Italy 3

Trojkan (SVT) 29
11 December 2013 NSA Sweden FRA Relationship 1*
11 December 2013 NSA 5 Eyes Partners 1
11 December 2013 NSA Sweden FRA Agenda 8
11 December 2013 NSA Sweden FRA RU Baltic 1
11 December 2013 NSA GCHQ Sweden FRA COMINT 1
11 December 2013 NSA Sweden FRA  XKeyscore Plan 5
11 December 2013 NSA Sweden FRA XKeyscore Sources 1
11 December 2013 NSA Sweden FRA XKeyscore Tor et al 3
11 December 2013 NSA Sweden FRA XKeyscore Slide 1
11 December 2013 NSA Sweden FRA Quantum 1 1
11 December 2013 GCHQ Sweden FRA Quantum 1
11 December 2013 NSA Sweden FRA Quantum Accomplishments 2
9 December 2013 NSA and Sweden Pact 3*

Jacob Appelbaum * 71
30 December 2013 NSA Catalog * 50
30 December 2013 NSA Catalog Video Clips * 21

Information.dk 63*
19 June 2014 NSA Partners 41*
14 January 2014 SSO (duplicate) 7*
14 January 2014 PRISM (duplicate) 11*
13 January 2014 5-Eyes Spy G8-G20 (duplicate) 4*

Anonymous/
New York Times
18
27 January 2014 NSA Smartphones Analysis 14
27 January 2014 GCHQ Mobile Theme 4

NBC News 87
25 February 2014 GCHQ Cyber Effects 11
7 February 2014 GCHQ Cyber Attack 15
5 February 2014 GCHQ Anonymous 14
27 January 2014 GCHQ Squeaky Dolphin 47

The Intercept 522*
4 December 2014 NSA AURORA GOLD et al 63
10 October 2014 10 NSA Releases
Computer Network Exploitation Declass
National Initiative Task Security 2
National Initiative Task Security 1
Exceptionally Controlled Info Compartments
Exceptionally Controlled Info Pawleys
Exceptionally Controlled Information
Sentry Eagle 2
Sentry Eagle 1
Tarex Classification Guide
Whipgenie Classification Guide
69
17 September 2014 NSA Visit by NZ Spy 2
5 September 2014 Masterspy Quadrennial Report 2009 32
25 August 2014 NSA ICREACH 55
12 August 2014 GCHQ Covert Mobile Phones Policy 6
5 August 2014 NCTC Terrorist Identifies 12
4 August 2014 US-NSA Pays Israel $500,000 2
4 August 2014 NSA-Israel Spying Pact 2013 3
4 August 2014 Israel-US Spying Pact 1999 16
25 July 2014 NSA Saudi Arabia 4
14 July 2014 NSA JTRIG Tools-Techniques 8
9 July 2014 NSA FISA Accounts 8
19 June 2014 NSA Partners 41*
19 May 2014 12 Various Pages 12
30 April 2014 GHOSTMACHINE-ECHOBASE
NSA Visit by GCHQ Lobban
PRISM with Olympics
14:6+8
4:1+3
1:
4 April 2014 GCHQ Full Spectrum Cyber
NSA 5-Eyes SIGDEV Conference
19
2
20 March 2014 NSA Hunt Sysadmins 6
13 March 2014 NSA Third Party 1
12 March 2014 NSA HammerchantNSA UK on Mikey and Ibake

NSA Turbine and Turmoil

NSA Thousands of Implants

NSA More Than One Way

NSA GCHQ Quantumtheory

NSA Selector Types

NSA Quantum Insert

NSA Analysis of Converged Data

NSA Phishing and MTM Attacks

NSA Menwith Hill xKeyscore

NSA Industry Exploit

NSA 5 Eyes Hacking

43

2

1

1

11

1

5

1

3

1

1

1

7 March 2014 NSA Ask Zelda 8
24 February 2014 GCHQ Disruption 4
24 February 2014 GCHQ Online Deception
(7 pages duplicates of GCHQ Psychology)
*50
18 February 2014 GCHQ Psychology37 Duplicates of NBC News *44
18 February 2014 NSA-GCHQ Discovery 1
Glenn Greenwald
13 May 2014 A variety of documents 107
Cryptome 310
23 May 2014 No Place to Hide (27MB) 310
Heise 26
16 August 2014 NSA GCHQ CSEC HACIENDA 26
Süddeutsche Zeitung 7
25 November 2014 Vodafone GCHQ Cables List and Slides 72

Unveiled – Senate Select Committee on Intelligence Study of the CIA Detention and Interrogation Program

The following report was released December 9, 2014 by the Senate Select Committee on Intelligence.  A collection of additional views as well as minority views and additional minority views (13.8 MB) from the committee are also available.

Senate Select Committee on Intelligence Committee Study of the Central Intelligence Agency’s Detention and Interrogation Program

  • 525 pages
  • April 3, 2014
  • 62.7 MB

Download

 

Senate-CIA-TortureReport_Page_001 Senate-CIA-TortureReport_Page_002 Senate-CIA-TortureReport_Page_003Senate-CIA-TortureReport_Page_004 Senate-CIA-TortureReport_Page_005 Senate-CIA-TortureReport_Page_006Senate-CIA-TortureReport_Page_007