Tag:

WikiLeaks

Archimedes: An update to CIA's Fulcrum

by Editor's Desk May 8, 2017

Archimedes is used to attacking computers inside an office LAN

In its seventh CIA leak since March 23rd, WikiLeaks has just revealed the user manual of a CIA hacking tool ‘Archimedes’ which is ostensibly used to attack computers inside a Local Area Network (LAN).

The CIA tool works by redirecting a target’s web page search to a CIA server which serves up a web page that looks exactly like the original page they were expecting to be served, but which contains malware. It’s only possible to detect the attack by examining the page source.

Archimedes is usually used in offices. It allows the redirecting of traffic from the target computer inside the LAN through a computer infected with this malware and controlled by the CIA. This technique is used by the CIA to redirect the target’s computers web browser to an exploitation server while appearing as a normal browsing session.

The document illustrates a type of attack within a protected environment as the tool is deployed into an existing local network abusing existing machines to bring targeted computers under control and allowing further exploitation and abuse. octopus-inc-designing-and-printing

The technique is used to redirect the target’s computer web browser to an exploitation server while appearing as a normal browsing session, the whistleblowing site said. In this way, the hackers gain an entry point that allows them access to other machines on that network.

The tool’s user guide, which is dated December 2012, explains that it’s used to re-direct traffic in a Local Area network (LAN) from a “target’s computer through an attacker-controlled computer before it is passed to the gateway.”

This allows it to insert a false webserver response that redirects the target’s web browser to a server that will exploit their system all the while appearing as if it’s a normal browsing session.

It may be mentioned here that Archimedes is an update to a tool called ‘Fulcrum’ and it offers several improvements on the previous system, including providing a method of “gracefully shutting down the tool on demand.”

www.TrickyScribe.in

Total Views: 3,27,880

May 8, 2017

Public Health & Nutrition

CIA's HIVE project

by TrickyScribe April 15, 2017

written by TrickyScribe

@ScribeAditya: WikiLeaks on Friday published six documents from the CIA’s HIVE project created by its “Embedded Development Branch” (EDB).

HIVE is a back-end infrastructure malware with a public-facing HTTPS interface which is used by CIA implants to transfer exfiltrated information from target machines to the CIA and to receive commands from its operators to execute specific tasks on the targets. HIVE is used across multiple malware implants and CIA operations. The public HTTPS interface utilizes unsuspicious-looking cover domains to hide its presence.

Anti-Virus companies and forensic experts have noticed that some possible state-actor malware used such kind of back-end infrastructure by analyzing the communication behavior of these specific implants but were unable to attribute the back-end (and therefore the implant itself) to operations run by the CIA. In a recent blog post by Symantec, that was able to attribute the “Longhorn” activities to the CIA based on the Vault 7, such back-end infrastructure is described:

For command and control (C&C) servers, Longhorn typically configures a specific domain and IP address combination per target. The domains appear to be registered by the attackers; however, they use privacy services to hide their real identity. octopus-inc-designing-and-printing

The IP addresses are typically owned by legitimate companies offering virtual private server (VPS) or Webhosting services. The malware communicates with C&C servers over HTTPS using a custom underlying cryptographic protocol to protect communications from identification.

The documents from this publication might further enable anti-malware researchers and forensic experts to analyze this kind of communication between malware implants and back-end servers used in previous illegal activities.

www.TrickyScribe.in

Total Views: 3,30,640

April 15, 2017

Public Health & Nutrition

Carberp Trojan code for malware deployment?

by TrickyScribe April 8, 2017

written by TrickyScribe

WikiLeaks reveals CIA’s modern espionage tools

WikiLeaks on Friday (April 7, 2017) released Vault 7, Grasshopper, 27 documents from the CIA’s Grasshopper framework, a platform used to build customized malware payloads for Microsoft Windows operating systems.

Grasshopper contains modules that can be used by a CIA operator as blocks to construct a customized implant that behaves differently, for example maintaining persistence on the computer differently, depending on what particular features or capabilities are selected in the process of building the bundle. Additionally, Grasshopper provides a flexible language to define rules that are used to “perform a pre-installation survey of the target device, assuring that the payload will only (be) installed if the target has the right configuration”.

Through this grammar, CIA operators can build from very simple to very complex logic used to determine, for example, if the target device is running a specific version of Microsoft Windows or if a particular Antivirus product is running or not.

Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The requirement list of the Automated Implant Branch (AIB) for Grasshopper puts special attention on PSP (personal security products) avoidance, so that PSPs like ‘MS Security Essentials’, ‘Rising’, ‘Symantec Endpoint’ or ‘Kaspersky IS’ on target machines do not detect Grasshopper elements.

One of the persistence mechanisms used by the CIA here is ‘Stolen Goods’, whose “components were taken from malware known as Carberp, a suspected Russian organized crime rootkit (a set of software tools).”

Confirming the recycling of malware found on the Internet by the CIA. “The source of Carberp was published online and has allowed AED/RDB to steal components easily as needed from the malware.”

While the CIA claims that “(most) of Carberp was not used in stolen goods” they, however, do acknowledge that “(the) persistence method and parts of the installer, were taken and modified to fit our needs,” providing a further example of reuse of portions of publicly available malware by the CIA, as observed in their analysis of the material leaked from Italian company “HackingTeam”.

The documents published by WikiLeaks provide an insight into the process of building modern espionage tools and how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise.

www.TrickyScribe.in

Total Views: 3,31,480

April 8, 2017