macOS Zero-Day Used Against Hong-Kong Activists
Daily reminder that the identity of the victim or allegations of "state-actor" are <i>not</i> reliable pieces of evidence when it comes to determining culpability of a cybercrime.<p>From the article:<p>> Wardle found that the software contained code strings in Chinese, such as 安装成功 (Successful installation), and that the command and control server it connected to was located in Hong Kong.<p>From the CIA:<p>> In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation. The source code revealed that Marble had examples in Chinese, Russian, Korean, Arabic and Persian. These were the languages of the US's main cyber-adversaries – China, Russia, North Korea, and Iran.<p><a href="https://en.wikipedia.org/wiki/Vault_7#Marble_framework" rel="nofollow">https://en.wikipedia.org/wiki/Vault_7#Marble_framework</a>