WikiLeaks Has Published The CIA’s Secrets For Infecting Windows

WikiLeaks has published what it says is another batch of secret hacking manuals belonging to the US Central Intelligence Agency as part of its Vault7 series of leaks. The site is billing Vault7 as the largest publication of intelligence documents ever.

This installment includes 27 documents related to "Grasshopper," the codename for a set of software tools used to build customised malware for Windows-based computers. 

The Grasshopper framework provides building blocks that can be combined in unique ways to suit the requirements of a given surveillance or intelligence operation. The documents are likely to be of interest to potential CIA targets looking for signatures and other signs indicating their Windows systems were hacked. The leak will also prove useful to competing malware developers who want to learn new techniques and best practices.

"Grasshopper is a software tool used to build custom installers for target computers running Microsoft Windows operating system," one user guide explained. "An operator uses the Grasshopper builder to construct a custom installation executable." The guide continued:

The operator configures an installation executable to install one or more payloads using a variety of techniques. Each payload installer is built from individually configured components that implement part of the installation procedure.

The operator may designate that installation is contingent on the evaluation of the target environment. Target conditions are described using a custom rule language. The operator may configure the tool to output a log file during execution for later exfiltration.

The technical manuals provide a behind-the-scenes look that, for the first time, reveals how the CIA goes about spying on targets that use computers running Microsoft's Windows operating system. Topics that are covered include ways to evade antivirus protection provided by Microsoft's Security Essentials, Symantec, and Kaspersky Lab. 

Also of interest is the CIA's borrowing of the Carberp, a powerful piece of bank-fraud malware that once fetched as much as $40,000 in underground forums. Once the Carberp source code was leaked in 2013, security experts warned it was akin to "handing a bazooka to a child."

A user manual for "Stolen Goods", includes a software component that allows Grasshopper malware to persist even after an infected machine has been rebooted.

The components were taken from malware known as Carberp, a suspected Russian rootkit used by organised crime. The source of Carberp was published online and has allowed AED\RDB to easily 'borrow' components as needed from the malware. 

Most of Carberp was not used in Stolen Goods 2, specifically all the Bot net/Communications components. The persistence method, and parts of the installer, were taken and modified to fit our needs. All components taken from Carberp were carefully analysed for hidden functionality, backdoors, vulnerabilities, etc. A vast majority of the original Carberp code that was used has been heavily modified. Very few pieces of the original code exist unmodified.

AED and RDB are abbreviations for "Advanced Engineering Division" and "Remote Development Branch," respectively. The Advanced Engineering Division does most of the CIA's implant code development. The Remote Development Branch develops remote implants.

Grasshopper was designed to be a development framework that's easy to use. It includes individual modules that can be combined to meet the requirements of a specific operation. For instance, it provides tools that "perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration." It also allows users to customise persistence mechanisms and antivirus evasion to the specific computer that's being targeted.

The latest installment isn't likely to be as damaging as the one published recently at the beginning of April 2017. That one included code libraries CIA developers use to obfuscate their payloads and to conceal any ties to some other malware used by the agency. 

Release of the so-called Marble libraries could make it easier for targets to determine that a previously unattributed hack is the work of the CIA. This latest leak is still a major embarrassment to the CIA, but on the whole the documents don't appear to reveal any specific operations or portray the CIA operating outside its mandated mission.

Ars Technica

You Might Also Read: 

Wikileaks Vault 7 And The CIA Hacking Arsenal:

WikiLeaks Dump Shines Light On US Intelligence’s Zero-Day Policy:

Security & Encryption After Edward Snowden:

Is There A Positive Aspect To CIA Spying?:

 

« Facebook Accused Of Publishing Child Pornography
Ageing Energy Systems Hold Huge Potential For Cyber Attack »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Pen Test Partners LLP

Pen Test Partners LLP

Pen Test Partners provides penetration testing, security assessment and training services.

Hitachi ID Systems

Hitachi ID Systems

Hitachi ID Systems offers comprehensive identity management and access governance, privileged access management and password management solutions.

Patchstack

Patchstack

Patchstack (formerly WebARX) is a web application security platform, which allows digital agencies and developers to monitor, protect and maintain their websites.

SCIPP International

SCIPP International

SCIPP’s courses are based on internationally recognized best business practices for security awareness, for both technical and non-technical staff and to comply with regulatory mandates.

RunSafe Security

RunSafe Security

RunSafe Security is the pioneer of a patented cyberhardening transformation process designed to disrupt attackers and protect vulnerable embedded systems and devices.

Sweepatic

Sweepatic

The Sweepatic reconnaissance platform discovers and analyses all internet facing assets and their exposure to risk.

Telecommunications & Digital Government Regulatory Authority (TDRA) - UAE

Telecommunications & Digital Government Regulatory Authority (TDRA) - UAE

TDRA focuses on regulating the telecommunications sector and enabling government entities in the field of smart transformation. It is responsible for the overall digital infrastructure in the UAE.

Nordic Cyber Summit

Nordic Cyber Summit

Nordic Cyber Security Summit addresses a wide range of technological issues from the IT Security spectrum and also provides a wider perspective from all aspects of the industry.

Conatix

Conatix

Conatix was formed to apply recent advances in AI and other fields of technology to insider fraud, one of the most intractable problems in cybersecurity.

VectorRock

VectorRock

Save Your Business From Cyber Criminals. We specialize in uncovering cyber risks which threaten your organization and fixing them.

SecurityGen

SecurityGen

SecurityGen is a global cybersecurity start-up focused on telecom security, with a focus on 5G networks.

ATHENE National Research Center For Applied Cybersecurity

ATHENE National Research Center For Applied Cybersecurity

ATHENE is the largest research center for cybersecurity and privacy in Europe, conducting application-oriented top-level research for the benefit of the economy, society and the state.

Digital Catapult

Digital Catapult

Digital Catapult is the UK authority on advanced digital technology. We bring out the best in business by accelerating new possibilities with advanced digital technologies.

StepSecurity

StepSecurity

StepSecurity provides a comprehensive security platform for GitHub Actions.

RunReveal

RunReveal

RunReveal's mission is to make sure no breach goes undetected. That means having a product that is accessible and effective for companies of all sizes.

Apexanalytix

Apexanalytix

Apexanalytix is a leading provider of supplier onboarding, risk management and recovery solutions.