Vault 7

The first batch of documents named "Year Zero" was published by WikiLeaks on 7 March 2017, consisting of 7,818 web pages with 943 attachments, purportedly from the Center for Cyber Intelligence,[24] which contained more pages than former NSA contractor and leaker, Edward Snowden's NSA release at the time.[25] WikiLeaks had released Year Zero online in a locked archive earlier that week, and revealing the passphrase on the 7th. The passphrase referred to a President Kennedy quote that he wanted “to splinter the CIA in a thousand pieces and scatter it to the winds”.[26]

WikiLeaks did not name the source, but said that the files had "circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive."[1] According to WikiLeaks, the source "wishes to initiate a public debate about the security, creation, use, proliferation and democratic control of cyberweapons" since these tools raise questions that "urgently need to be debated in public, including whether the C.I.A.'s hacking capabilities exceed its mandated powers and the problem of public oversight of the agency."[1]

WikiLeaks attempted to redact names and other identifying information from the documents before their release,[1] but faced criticism for leaving some key details unredacted.[27] WikiLeaks also attempted to allow for connections between people to be drawn via unique identifiers generated by WikiLeaks.[28][29] It also said that it would postpone releasing the source code for the cyber weapons, which is reportedly several hundred million lines long, "until a consensus emerges on the technical and political nature of the C.I.A.'s program and how such 'weapons' should be analyzed, disarmed and published."[1] WikiLeaks founder Julian Assange claimed this was only part of a larger series.[25]

The CIA released a statement saying, "The American public should be deeply troubled by any WikiLeaks disclosure designed to damage the Intelligence Community's ability to protect America against terrorists or other adversaries. Such disclosures not only jeopardize US personnel and operations, but also equip our adversaries with tools and information to do us harm."[30]

In a statement issued on 19 March 2017, Assange said the technology companies who had been contacted had not agreed to, disagreed with, or questioned what he termed as WikiLeaks' standard industry disclosure plan. The standard disclosure time for a vulnerability is 90 days after the company responsible for patching the software is given full details of the flaw.[31] According to WikiLeaks, only Mozilla had been provided with information on the vulnerabilities, while "Google and some other companies" only confirmed receiving the initial notification. WikiLeaks stated: "Most of these lagging companies have conflicts of interest due to their classified work with US government agencies. In practice such associations limit industry staff with US security clearances from fixing holes based on leaked information from the CIA. Should such companies choose to not secure their users against CIA or NSA attacks users may prefer organizations such as Mozilla or European companies that prioritize their users over government contracts".[32][33]

On 23 March 2017 WikiLeaks published the second release of Vault 7 material, entitled "Dark Matter". The publication included documentation for several CIA efforts to hack Apple's iPhones and Macs.[34][35][36] These included the Sonic Screwdriver malware that could use the Thunderbolt interface to bypass Apple's password firmware protection.[37]

On 31 March 2017, WikiLeaks published the third part of its Vault 7 documents, entitled "Marble". It contained 676 source code files for the CIA's Marble Framework. It is used to obfuscate, or scramble, malware code in an attempt to make it so that anti-virus firms or investigators cannot understand the code or attribute its source. According to WikiLeaks, the code also included a de-obfuscator to reverse the obfuscation effects.[38][39]

On 7 April 2017, WikiLeaks published the fourth set of its Vault 7 documents, dubbed "Grasshopper". The publication contains 27 documents from the CIA's Grasshopper framework, which is used by the CIA to build customized and persistent malware payloads for the Microsoft Windows operating systems. Grasshopper focused on Personal Security Product (PSP) avoidance. PSPs are antivirus software such as MS Security Essentials, Symantec Endpoint or Kaspersky IS.[39][40]

On 14 April 2017, WikiLeaks published the fifth part of its Vault 7 documents, titled "HIVE". Based on the CIA top-secret virus program created by its "Embedded Development Branch" (EDB). The six documents published by WikiLeaks are related to the HIVE multi-platform CIA malware suite. A CIA back-end infrastructure with a public-facing HTTPS interface used by CIA to transfer information from target desktop computers and smartphones to the CIA, and open those devices to receive further commands from CIA operators to execute specific tasks, all the while hiding its presence behind unsuspicious-looking public domains through a masking interface known as "Switchblade" (also known as Listening Post (LP) and Command and Control (C2)).[41]

On 21 April 2017, WikiLeaks published the sixth part of its Vault 7 material, code-named "Weeping Angel", a hacking tool co-developed by the CIA and MI5 used to exploit a series of early smart TVs for the purpose of covert intelligence gathering. Once installed in suitable televisions with a USB stick, the hacking tool enables those televisions' built-in microphones and possibly video cameras to record their surroundings, while the televisions falsely appear to be turned off. The recorded data is then either stored locally into the television's memory or sent over the internet to the CIA. Allegedly both the CIA and MI5 agencies collaborated to develop that malware in Joint Development Workshops. Security expert Sarah Zatko said about the data "nothing in this suggests it would be used for mass surveillance," and Consumer Reports said that only some of the earliest smart TVs with built-in microphones and cameras were affected.[42][43][44]

As of this part 6 publication, "Weeping Angel" is the second major CIA hacking tool which notably references the British television show, Doctor Who, alongside "Sonic Screwdriver" in "Dark Matter".[45][46]

On 28 April 2017, WikiLeaks published the seventh part of its Vault 7 materials, dubbed "Scribbles". The leak includes documentation and source code of a tool intended to track documents leaked to whistleblowers and journalists by embedding web beacon tags into classified documents to trace who leaked them.[47] The tool affects Microsoft Office documents, specifically "Microsoft Office 2013 (on Windows 8.1 x64), documents from Office versions 97-2016 (Office 95 documents will not work) and documents that are not locked, encrypted, or password-protected".[48] When a CIA watermarked document is opened, an invisible image within the document that is hosted on the agency's server is loaded, generating a HTTP request. The request is then logged on the server, giving the intelligence agency information about who is opening it and where it is being opened. However, if a watermarked document is opened in an alternative word processor the image may be visible to the viewer. The documentation also states that if the document is viewed offline or in protected view, the watermarked image will not be able to contact its home server. This is overridden only when a user enables editing.[49]

On 5 May 2017, WikiLeaks published the eighth part of its Vault 7 documents, titled "Archimedes". According to U.S. SANS Institute instructor Jake Williams, who analyzed the published documents, Archimedes is a virus previously codenamed "Fulcrum". According to cyber security expert and ENISA member Pierluigi Paganini, the CIA operators use Archimedes to redirect local area network (LAN) web browser sessions from a targeted computer through a computer controlled by the CIA before the sessions are routed to the users. This type of attack is known as man-in-the-middle (MitM). With their publication WikiLeaks included a number of hashes that they claim can be used to potentially identify the Archimedes virus and guard against it in the future. Paganini stated that potential targeted computers can search for those hashes on their systems to check if their systems had been attacked by the CIA.[50]

On 12 May 2017, WikiLeaks published part nine of its Vault 7 materials, "AfterMidnight" and "Assassin". AfterMidnight is a piece of malware installed on a target personal computer and disguises as a DLL file, which is executed while the user's computer reboots. It then triggers a connection to the CIA's Command and Control (C2) computer, from which it downloads various modules to run. As for Assassin, it is very similar to its AfterMidnight counterpart, but deceptively runs inside a Windows service process. CIA operators reportedly use Assassin as a C2 to execute a series of tasks, collect, and then periodically send user data to the CIA Listening Post(s) (LP). Similar to backdoor Trojan behavior. Both AfterMidnight and Assassin run on Windows operating system, are persistent, and periodically beacon to their configured LP to either request tasks or send private information to the CIA, as well as automatically uninstall themselves on a set date and time.[51]

On 19 May 2017, WikiLeaks published the tenth part of its Vault 7 documents, titled "Athena". The published user guide, demo, and related documents were created between September 2015 and February 2016. They are all about a malware allegedly developed for the CIA in August 2015, roughly one month after Microsoft released Windows 10 with their firm statements about how difficult it was to compromise. Both the primary "Athena" malware and its secondary malware named "Hera" are similar in theory to Grasshopper and AfterMidnight malware but with some significant differences. One of those differences is that Athena and Hera were developed by the CIA with a New Hampshire private corporation called Siege Technologies. During a Bloomberg 2014 interview the founder of Siege Technologies confirmed and justified their development of such malware. Athena malware completely hijacks Windows' Remote Access services, while Hera hijacks Windows Dnscache service. Both Athena and Hera also affect all current versions of Windows including, but not limited to, Windows Server 2012 and Windows 10. Another difference is in the types of encryption used between the infected computers and the CIA Listening Posts (LP). As for the similarities, they exploit persistent DLL files to create a backdoor to communicate with CIA's LP, steal private data, then send it to CIA servers, or delete private data on the target computer, as well as Command and Control (C2) for CIA operatives to send additional malicious software to further run specific tasks on the attacked computer. All of the above designed to deceive computer security software. Beside the published detailed documents, WikiLeaks did not provide any evidence suggesting the CIA used Athena or not.[52]

On 1 June 2017, WikiLeaks published part 11 of its Vault 7 materials, "Pandemic". This tool serves as a persistent implant affecting Windows machines with shared folders. It functions as a file system filter driver on an infected computer, and listens for Server Message Block traffic while detecting download attempts from other computers on a local network. "Pandemic" will answer a download request on behalf of the infected computer. However, it will replace the legitimate file with malware. In order to obfuscate its activities, "Pandemic" only modifies or replaces the legitimate file in transit, leaving the original on the server unchanged. The implant allows 20 files to be modified at a time, with a maximum individual file size of 800MB. While not stated in the leaked documentation, it is possible that newly infected computers could themselves become "Pandemic" file servers, allowing the implant to reach new targets on a local network.[53]

On 15 June 2017, WikiLeaks published part 12 of its Vault 7 materials, entitled "Cherry Blossom".[54] Cherry Blossom used a command and control server called Cherry Tree and custom router firmware called FlyTrap to monitor internet activity of targets, scan for “email addresses, chat usernames, MAC addresses and VoIP numbers" and redirect traffic.[55]

On 22 June 2017, WikiLeaks published part 13 of its Vault 7 materials, the manuals for "Brutal Kangaroo".[56] Brutal Kangaroo was a project focused on CIA malware designed to compromise air-gapped computer networks with infected USB drives. Brutal Kangaroo included the tools Drifting Deadline, the main tool, Shattered Assurance, a server that automates thumb drive infection, Shadow, a tool to coordinate compromised machines, and Broken Promise, a tool for exfiltrating data from the air-gapped networks.[57]

On 28 June 2017, WikiLeaks published part 14 of its Vault 7 materials, the manual for the project entitled "Elsa".[58] Elsa was a tool used for tracking Windows devices on nearby WiFi networks.[59]

On 29 June 2017, WikiLeaks published part 15 of its Vault 7 materials, the manual for the project entitled "OutlawCountry".[60] OutlawCountry was a kernel module for Linux 2.6 that let CIA agents spy on Linux servers and redirect outgoing traffic from a Linux computer to a chosen site.[61]

On 6 July 2017, WikiLeaks published part 16 of its Vault 7 materials, the manual for the project entitled "BothanSpy".[62] BothanSpy was a CIA hacking tool made to steal SSH credentials from Windows computers.[63]

On 13 July 2017, WikiLeaks published part 17 of its Vault 7 materials, the manual for the project entitled "Highrise".[64] The Highrise hacking tool, also known as Tidecheck, was used to intercept and redirect SMS messages to Android phones using versions 4.0 through 4.3. Highrise could also be used as an encrypted communications channel between CIA agents and supervisors.[65]

On 19 July 2017, WikiLeaks published part 18 of the Vault 7 materials, documents from Raytheon Blackbird Technologies for the "UMBRAGE Component Library" (UCL) project reports on malware and their attack vectors. According to WikiLeaks, it analysed malware attacks in the wild and gave "recommendations to the CIA development teams for further investigation and PoC development for their own malware projects." It mostly contained Proof-of-Concept ideas partly based on public documents.[66][67]

On 27 July 2017, WikiLeaks published part 19 of its Vault 7 materials, manuals for the project entitled "Imperial".[68] Imperial included three tools named Achilles, Aeris and SeaPea. Achilles was a tool for turning MacOS DMG install files into trojan malware. Aeris was a malware implant for POSIX systems, and SeaPea was an OS X rootkit.[69]

On 3 August 2017, WikiLeaks published part 20 of its Vault 7 materials, manuals for the project entitled "Dumbo".[70] Dumbo was a tool that the Agency used to disable webcams, microphones, and other surveillance tools over WiFi and bluetooth to allow field agents to perform their missions.[71]

On 10 August 2017, WikiLeaks published part 21 of its Vault 7 materials, the manual for the project CouchPotato.[72] CouchPotato was a tool for intercepting and saving remote video streams, which let the CIA tap into other people's surveillance systems.[73]

On 24 August 2017, WikiLeaks published part 22 of its Vault 7 materials from the CIA's "ExpressLane" project. These documents highlighted one of the cyber operations the CIA conducts against other services it liaises with, including the National Security Agency (NSA), the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI).

ExpressLane, a covert information collection tool, was used by the CIA to exfiltrate the biometric data collection systems of services it liaises with. ExpressLane was installed and run under the cover of upgrading the biometric software of liaison services by the CIA's Office of Technical Services (OTS) agents without their knowledge.[74]

On 31 August 2017, WikiLeaks published part 23 of the Vault 7 documents, the manual for the project Angelfire.[75] Angelfire was a malware framework made to infect computers running Windows XP and Windows 7, made of five parts. Solartime was the malware that modified the boot sector to load Wolfcreek, which was a self-loading driver that loaded other drivers. Keystone was responsible for loading other malware. BadMFS was a covert file system that hid the malware, and Windows Transitory File System was a newer alternative to BadMFS. The manual included a long list of problems with the tools.[76]

Protego, part 24 of the Vault 7 documents, was published on 7 September 2017. According to WikiLeaks, Protego "is a PIC-based missile control system that was developed by Raytheon."[77]

The first portion of the documents made public on 7 March 2017, Vault 7 "Year Zero", revealed that a top secret CIA unit used the German city of Frankfurt as the starting point for hacking attacks on Europe, China and the Middle East. According to the documents, the U.S. government uses its Consulate General Office in Frankfurt as a hacker base for cyber operations. WikiLeaks documents reveal the Frankfurt hackers, part of the Center for Cyber Intelligence Europe (CCIE), were given cover identities and diplomatic passports to obfuscate customs officers to gain entry to Germany.[86][89]

The chief Public Prosecutor General of the Federal Court of Justice in Karlsruhe Peter Frank announced on 8 March 2017 that the government was conducting a preliminary investigation to see if it will launch a major probe into the activities being conducted out of the consulate and also more broadly whether people in Germany were being attacked by the CIA.[90] Germany's foreign minister Sigmar Gabriel from the Social Democratic Party responded to the documents of Vault 7 "Year Zero" that the CIA used Frankfurt as a base for its digital espionage operations, saying that Germany did not have any information about the cyber attacks.[91]

On the day the Vault 7 documents were first released, WikiLeaks described UMBRAGE as "a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation," and tweeted, "CIA steals other groups virus and malware facilitating false flag attacks."[92] According to WikiLeaks, by recycling the techniques of third-parties through UMBRAGE, the CIA can not only increase its total number of attacks,[93] but can also mislead forensic investigators by disguising these attacks as the work of other groups and nations.[1][86] Among the techniques borrowed by UMBRAGE was the file wiping implementation used by Shamoon. According to PC World, some of the techniques and code snippets have been used by CIA in its internal projects, whose end result cannot be inferred from the leaks. PC World commented that the practice of planting "false flags" to deter attribution was not a new development in cyberattacks: Russian, North Korean and Israeli hacker groups are among those suspected of using false flags.[94]

A conspiracy theory soon emerged alleging that the CIA framed the Russian government for interfering in the 2016 U.S. elections. Conservative commentators such as Sean Hannity and Ann Coulter speculated about this possibility on Twitter, and Rush Limbaugh discussed it on his radio show.[95] Russian foreign minister Sergey Lavrov said that Vault 7 showed that "the CIA could get access to such 'fingerprints' and then use them."[92]

Cybersecurity writers and experts, such as Ben Buchanan and Kevin Poulsen, were skeptical of those theories.[16][96] Poulsen said the theories were "disinformation" being taken advantage of by Russia and spread by bots. He also wrote, "The leaked catalog isn't organized by country of origin, and the specific malware used by the Russian DNC hackers is nowhere on the list." Robert M. Lee, who founded the cybersecurity firm Dragos, said the "narrative emerged far too quickly to have been organic."[16]

According to a study by Kim Zetter in The Intercept, UMBRAGE was probably much more focused on speeding up development by repurposing existing tools, rather than on planting false flags.[93] Robert Graham, CEO of Errata Security told The Intercept that the source code referenced in the UMBRAGE documents is "extremely public", and is likely used by a multitude of groups and state actors. Graham added: "What we can conclusively say from the evidence in the documents is that they're creating snippets of code for use in other projects and they're reusing methods in code that they find on the internet. ... Elsewhere they talk about obscuring attacks so you can't see where it's coming from, but there's no concrete plan to do a false flag operation. They're not trying to say 'We're going to make this look like Russia'."[97]

HammerDrill is a CD/DVD collection tool that collects directory walks and files to a configured directory and filename pattern as well as logging CD/DVD insertion and removal events.[105]

After WikiLeaks released the first installment of Vault 7, "Year Zero", Apple stated that "many of the issues leaked today were already patched in the latest iOS," and that the company will "continue work to rapidly address any identified vulnerabilities."[106]

On 23 March 2017, WikiLeaks released "Dark Matter", the second batch of documents in its Vault 7 series, detailing the hacking techniques and tools all focusing on Apple products developed by the Embedded Development Branch (EDB) of the CIA. The leak also revealed the CIA had been targeting the iPhone since 2008, and that some projects attacked Apple's firmware.[107] The "Dark Matter" archive included documents from 2009 and 2013. Apple issued a second statement assuring that based on an "initial analysis, the alleged iPhone vulnerability affected iPhone 3G only and was fixed in 2009 when iPhone 3GS was released." Additionally, a preliminary assessment showed "the alleged Mac vulnerabilities were previously fixed in all Macs launched after 2013".[108][109]

WikiLeaks said on 19 March 2017 on Twitter that the "CIA was secretly exploiting" a vulnerability in a huge range of Cisco router models discovered thanks to the Vault 7 documents.[110][111] The CIA had learned more than a year ago how to exploit flaws in Cisco's widely used internet switches, which direct electronic traffic, to enable eavesdropping. Cisco quickly reassigned staff from other projects to turn their focus solely on analyzing the attack and to figure out how the CIA hacking worked, so they could help customers patch their systems and prevent criminal hackers or spies from using similar methods.[112]

On 20 March, Cisco researchers confirmed that their study of the Vault 7 documents showed the CIA had developed malware which could exploit a flaw found in 318 of Cisco's switch models and alter or take control of the network.[113] Cisco issued a warning on security risks, patches were not available, but Cisco provided mitigation advice.[111]

The electronic tools can reportedly compromise both Apple's iOS and Google's Android operating systems. By adding malware to the Android operating system, the tools could gain access to secure communications made on a device.[114]

According to WikiLeaks, once an Android smartphone is penetrated the agency can collect "audio and message traffic before encryption is applied".[1] Some of the agency's software is reportedly able to gain access to messages sent by instant messaging services.[1] This method of accessing messages differs from obtaining access by decrypting an already encrypted message.[114] While the encryption of messengers that offer end-to-end encryption, such as Telegram, WhatsApp and Signal, wasn't reported to be cracked, their encryption can be bypassed by capturing input before their encryption is applied, by methods such as keylogging and recording the touch input from the user.[114]

Commentators, among them Snowden and cryptographer and security pundit Bruce Schneier, observed that Wikileaks incorrectly implied that the messaging apps themselves, and their underlying encryption, had been compromised - an implication which was in turn reported for a period by the New York Times and other mainstream outlets.[1][115]

One document reportedly showed that the CIA was researching ways to infect vehicle control systems. WikiLeaks stated, "The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations."[86] This statement brought renewed attention to conspiracy theories surrounding the death of Michael Hastings.[116]

The documents refer to a "Windows FAX DLL injection" exploit in Windows XP, Windows Vista and Windows 7 operating systems.[24] This would allow a user with malicious intents to hide its own malware under the DLL of another application. However, a computer must have already been compromised through another method for the injection to take place.[117]