A few days ago WikiLeaks brought us a new series of leaks, this time on the on the U.S.
Central Intelligence Agency.
Code-named "Vault 7".
It is the largest ever publication of confidential documents on the agency.
The first full part of the series, "Year Zero", comprises 8,761 documents and files from an
isolated, high-security network.
It gives a huge insight to the hacking power of the CIA, which includes zero day weaponized
exploits against a wide range of U.S. and European company products, including Apple
iPhone, Google Android, Microsoft Windows and even Samsung TVs, which are turned into
covert microphones.
Sadly I can’t even be shocked by this release, after all the Snowden revelations about the
NSA.
I have to wonder why the United States is intent on destroying its technology companies?
Why would people want to buy into the Software and Hardware from a country so obsessed with
carrying out mass surveillance against its citizens and against people all around the
world.
The CIA release is not just surveillance, it also covers weaponised zero day exploits
with the potential to kill.
Such is the scale of the CIA's undertaking that by 2016, its hackers had utilized more
code than that used to run Facebook.
The CIA had created, in effect, its "own NSA" with even less accountability and without
publicly answering the question as to whether such a massive budgetary spend on duplicating
the capacities of a rival agency could be justified.
In a statement to WikiLeaks the source details policy questions that they say urgently need
to be debated in public, including whether the CIA's hacking capabilities exceed its
mandated powers and the problem of public oversight of the agency.
The source wishes to initiate a public debate about the security, creation, use, proliferation
and democratic control of cyberweapons.
CIA malware and hacking tools are built by EDG (Engineering Development Group), a software
development group within Center for Cyber Intelligence
EDG is responsible for the development, testing and operational support of all backdoors,
exploits, malicious payloads, trojans, viruses and any other kind of malware used by the
CIA in its covert operations.
The attack against Samsung smart TVs was developed in cooperation with the United Kingdom's MI5.
After infestation, the target TV is placed in a 'Fake-Off' mode, so that the owner falsely
believes the TV is off when it is actually on and listening to conversations in the room
and sending them over the Internet to a covert CIA server.
As of October 2014 the CIA was also looking at infecting the vehicle control systems used
by modern cars and trucks.
The purpose of such control is not specified, but it would permit the CIA to engage in nearly
undetectable assassinations.
There is a conspiracy theory that the vehicle infection attack could have been used to kill
investigative journalist Michael Hastings.
Mr Hastings died in a single vehicle automobile crash in his Mercedes C250 Coupé at approximately
4:25 a.m. in the Hancock Park neighborhood of Los Angeles.
A witness to the crash said the car seemed to be traveling at maximum speed and was creating
sparks and flames before it fishtailed and crashed into a palm tree.
Witnesses described the car's engine being ejected 50 to 60 yards from the scene.
Yes sounds highly suspicious, and could well have been caused by a cyber attack against
the vehicle.
A cyber assasination?
Despite iPhone's minority share (14.5%) of the global smart phone market in 2016, a specialized
unit in the CIA's Mobile Development Branch produces malware to infest, control and exfiltrate
data from iPhones and other Apple products running iOS, such as iPads.
CIA's arsenal includes numerous local and remote "zero days" developed by CIA or obtained
from GCHQ, NSA, FBI or purchased from cyber arms contractors.
The disproportionate focus on iOS may be explained by the popularity of the iPhone among social,
political, diplomatic and business elites.
A similar unit targets Google's Android which is used to run the majority of the world's
smart phones (~85%).
"Year Zero" shows that as of 2016 the CIA had 24 "weaponized" Android "zero days" which
it has developed itself and obtained from GCHQ, NSA and cyber arms contractors.
These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram,
Wiebo, Confide and Cloackman by hacking the "smart" phones that they run on and collecting
audio and message traffic before encryption is applied.
The CIA also runs a very substantial effort to infect and control Microsoft Windows users
with its malware.
This includes multiple local and remote weaponized "zero days", air gap jumping viruses such
as "Hammer Drill" which infects software distributed on CD/DVDs, media such as USBs, systems to
hide data in images or in covert disk areas.
In the wake of Edward Snowden's leaks about the NSA, the U.S. technology industry secured
a commitment from the Obama administration that the executive would disclose on an ongoing
basis — rather than hoard — serious vulnerabilities, exploits, bugs or "zero days" to Apple, Google,
Microsoft, and other US-based manufacturers.
Serious vulnerabilities not disclosed to the manufacturers places huge swathes of the population
and critical infrastructure at risk to foreign intelligence or cyber criminals who independently
discover or hear rumors of the vulnerability.
If the CIA can discover such vulnerabilities so can others.
Good point.
Just because the CIA is carrying out substantial work on discovering zero days, there is no
reason not to believe that other countries are not doing the same thing
"Year Zero" documents show that the CIA breached the Obama administration's commitments.
Many of the vulnerabilities used in the CIA's cyber arsenal are pervasive and some may already
have been found by rival intelligence agencies or criminals.
In addition to its operations in Langley, Virginia the CIA also uses the U.S. consulate
in Frankfurt as a covert base for its hackers covering Europe, the Middle East and Africa.
In the wake of this huge revelation from the CIA it’s now up to the tech companies to
respond and patch their software .
Apple has been quick to point out that vulnerabilities mentioned in the documents have already been
addressed.
Microsoft and Samsung have said they are "looking into" things, and now the Linux Foundation
has spoken out.
The Linux Foundation says that while it is "not surprising" that Linux would find itself
a target, the open source project has a very fast release cycle, meaning that kernel updates
are released every few days to address any issues which are found.
The rapid release cycle means that vulnerabilities can be fixed faster than in other software.
"Linux is an incredibly active open source project.
Thousands of professional developers and volunteers - including many of the most talented in the
world - are constantly contributing improvements and fixes to the project.
This allows the kernel team to release updates every few days one of the fastest release
cycles in the industry.
Just as with Apple's response, the Linux Foundation does not make reference to any specific vulnerabilities
that have been fixed.
The Development Tradecraft DOs and DON'Ts is interesting as it shows just how much effort
the the CIA goes to hiding the true origin of an attack.
I’ve always had the mindset of whatever country of origin you see in an IP address
or malware sample, that is not the country attacking you.
Some examples here: DO NOT leave dates/times such as compile timestamps,
build times, or access times that correlate to general US core working hours.
DO NOT use US-centric timestamp formats
DO NOT perform operations that will cause the target computer to become unresponsive
to the user
DO NOT have "dirty words" in the binary.
Its not all bad stuff though: Heres a guide on how to Install Ubuntu on
Mac hardware
And some tips and tricks for Git
I think that all this information from Wikileaks has done is just confirm what some of us already
suspected.
This Orwellian world of 1984 is most certainly a reality.
Thanks for watching, I’ll see you all later