WikiLeaks Has Published The CIA’s Secrets For Infecting Windows

WikiLeaks has published what it says is another batch of secret hacking manuals belonging to the US Central Intelligence Agency as part of its Vault7 series of leaks. The site is billing Vault7 as the largest publication of intelligence documents ever.

This installment includes 27 documents related to "Grasshopper," the codename for a set of software tools used to build customised malware for Windows-based computers. 

The Grasshopper framework provides building blocks that can be combined in unique ways to suit the requirements of a given surveillance or intelligence operation. The documents are likely to be of interest to potential CIA targets looking for signatures and other signs indicating their Windows systems were hacked. The leak will also prove useful to competing malware developers who want to learn new techniques and best practices.

"Grasshopper is a software tool used to build custom installers for target computers running Microsoft Windows operating system," one user guide explained. "An operator uses the Grasshopper builder to construct a custom installation executable." The guide continued:

The operator configures an installation executable to install one or more payloads using a variety of techniques. Each payload installer is built from individually configured components that implement part of the installation procedure.

The operator may designate that installation is contingent on the evaluation of the target environment. Target conditions are described using a custom rule language. The operator may configure the tool to output a log file during execution for later exfiltration.

The technical manuals provide a behind-the-scenes look that, for the first time, reveals how the CIA goes about spying on targets that use computers running Microsoft's Windows operating system. Topics that are covered include ways to evade antivirus protection provided by Microsoft's Security Essentials, Symantec, and Kaspersky Lab. 

Also of interest is the CIA's borrowing of the Carberp, a powerful piece of bank-fraud malware that once fetched as much as $40,000 in underground forums. Once the Carberp source code was leaked in 2013, security experts warned it was akin to "handing a bazooka to a child."

A user manual for "Stolen Goods", includes a software component that allows Grasshopper malware to persist even after an infected machine has been rebooted.

The components were taken from malware known as Carberp, a suspected Russian rootkit used by organised crime. The source of Carberp was published online and has allowed AED\RDB to easily 'borrow' components as needed from the malware. 

Most of Carberp was not used in Stolen Goods 2, specifically all the Bot net/Communications components. The persistence method, and parts of the installer, were taken and modified to fit our needs. All components taken from Carberp were carefully analysed for hidden functionality, backdoors, vulnerabilities, etc. A vast majority of the original Carberp code that was used has been heavily modified. Very few pieces of the original code exist unmodified.

AED and RDB are abbreviations for "Advanced Engineering Division" and "Remote Development Branch," respectively. The Advanced Engineering Division does most of the CIA's implant code development. The Remote Development Branch develops remote implants.

Grasshopper was designed to be a development framework that's easy to use. It includes individual modules that can be combined to meet the requirements of a specific operation. For instance, it provides tools that "perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration." It also allows users to customise persistence mechanisms and antivirus evasion to the specific computer that's being targeted.

The latest installment isn't likely to be as damaging as the one published recently at the beginning of April 2017. That one included code libraries CIA developers use to obfuscate their payloads and to conceal any ties to some other malware used by the agency. 

Release of the so-called Marble libraries could make it easier for targets to determine that a previously unattributed hack is the work of the CIA. This latest leak is still a major embarrassment to the CIA, but on the whole the documents don't appear to reveal any specific operations or portray the CIA operating outside its mandated mission.

Ars Technica

You Might Also Read: 

Wikileaks Vault 7 And The CIA Hacking Arsenal:

WikiLeaks Dump Shines Light On US Intelligence’s Zero-Day Policy:

Security & Encryption After Edward Snowden:

Is There A Positive Aspect To CIA Spying?:

 

« Facebook Accused Of Publishing Child Pornography
Ageing Energy Systems Hold Huge Potential For Cyber Attack »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

TechInsurance

TechInsurance

TechInsurance is America's top technology insurance company offering a range of technology related products including Cyber Liability insurance.

H3C Group

H3C Group

H3C provides a full range of Computer, Storage, Networking and Security solutions.

Anglo African

Anglo African

Anglo African is an information technology firm providing end-to-end solutions to different industries, from IT Infrastructure to DataCom as well as Cloud & InfoSec services.

Sera-Brynn

Sera-Brynn

Sera-Brynn is one of the highest-ranked, pure-play cybersecurity compliance and advisory firms in the world.

Zeguro

Zeguro

Zeguro provides complete cybersecurity risk assessment, mitigation and insurance, allowing you to easily manage your cyber risk.

SMESEC

SMESEC

SMESEC is a lightweight Cybersecurity framework for protecting small and medium-sized enterprises (SME) against Cyber threats.

Andreessen Horowitz (a16z)

Andreessen Horowitz (a16z)

Andreessen Horowitz (known as "a16z") is a venture capital firm in Silicon Valley, California that backs bold entrepreneurs building the future through technology.

Sum&Substance (Sumsub)

Sum&Substance (Sumsub)

Sum&Substance is a developer of remote verification solutions. Our technology allows online services around the world to meet regulatory requirements, prevent fraud and enhance customer confidence.

Digital Magics

Digital Magics

Digital Magics is an incubator for innovative startups which offer content and services with high technological value. Areas of focus include IoT, Enterprise Software, AI, Industry 4.0 and Blockchain.

HackHunter

HackHunter

HackHunter’s passive sensor network continuously monitors, detects and alerts when a malicious WiFi network and/or hacking behaviour is identified.

KBR

KBR

To help governments and other agencies to combat cyber threats, KBR is safeguarding their most valuable systems with sophisticated tools, hardware and training.

3wSecurity

3wSecurity

3wSecurity provides visibility to your company’s internet facing systems throughout the security life cycle, allowing for a more thorough approach to vulnerability management.

Plante Moran

Plante Moran

Plante Moran is a leading audit, tax, consulting, and wealth management firm. Areas of consulting expertise include cybersecurity.

Sterling Information Technologies

Sterling Information Technologies

Sterling is an information security, operational risk consulting and advisory group. Our Advisory services help to safeguard information assets while supporting business operations.

OneZero Solutions

OneZero Solutions

OneZero specialize in cybersecurity operations, information assurance, computer network operations, solutions engineering, and project management.

Kolide

Kolide

Kolide ensures that if a device isn't secure, it can't access your apps.