Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

CIA AED Development Tradecraft DOs and DON'Ts : antiforensics | Torhoo darknet markets

Here is an interesting read that might you some idea about US Intelligence's tradecraft mindset on implant/malware development:
https://wikileaks.org/ciav7p1/cms/page_14587109.html

/u/MJA20WithA3

1 points

6 years ago

We need an Auto-Article summary bot.

/u/v0id0ne

2 points

6 years ago

I second this.

/u/Astronut

1 points

6 years ago

Directive Rationale

(S//NF) DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory at the moment the data is needed. When a previously de-obfuscated value is no longer needed, it should be wiped from memory.
(S//NF) String data and/or configuration data is very useful to analysts and reverse-engineers.
(S//NF) DO NOT decrypt or de-obfuscate all string data or configuration data immediately upon execution. (S//NF) Raises the difficulty for automated dynamic analysis of the binary to find sensitive data.

/u/Strike

1 points

6 years ago

Thanks

/u/Astronut

1 points

6 years ago

Basically encrypt the binary, only decrypt when using a feature, make the code generic to avoid USA attribution, manually delete the malware

/u/Strike

1 points

6 years ago

You need to know what malware you got first. Also many people buying guides have no idea wtf malware is in them dont hate on me but my guess is at least 50% of people who downloaded anything from the darknet are infected they dont understand the concept TAILS ALONE IS NOT ENOUGH do not run tails on any computer you use daily for real OPSEC install tails on a usb and never plug that usb back into any computer use only a laptop purchase one with no HD any dell with a side slide HD is good since you can remove the hard drive as easy as opening the cd-tray install xp pro on a NEW encrypted HD and put that in the laptop you use as a burner now you have xp on a removable HD so you can still use windows or Linux (if you choose a Linux distro to install on your HD) to update tails when the "manual updates" are released

/u/Astronut

1 points

6 years ago

Qubes/Whonix is good for that.

/u/Strike

1 points

6 years ago

yea i have used cubes i maybe mistaking this but wasnt cubes stated to maybe have a bug a while back then was patched? Again i may be mistaking cubes with something else

/u/Astronut

1 points

6 years ago

Qubes OS.

And yeah it probably had a bug. Qubes is still the best.

/u/wekhiu48 Qubes OS + Whonix + USBkill

1 points

6 years ago

All software has bugs and the fact that they are being kept up with and patched on Qubes part should be encouraging.

/u/AZERTY

1 points

6 years ago

you don't need to outrun the bear, just the other campers

/u/Strike

1 points

6 years ago

i do believe me in the past i have donated some coin to tor and other non profits that are tor/dn related