Leak Of CIA Hacking Secrets Serves As Alert To Close Security Gaps

The U.S. Government’s response to the publication by WikiLeaks of about 8,000 pages of secret methods used by the Central Intelligence Agency to penetrate everything from cell phones to televisions has been varied.

On one hand, Congress is in a panic. It’s setting up investigations and predicting the end of the world. Intelligence professionals, on the other hand, seem only mildly surprised and not particularly bothered.

The information in Vault 7 of the WikiLeaks dump consists primarily of a catalog of tools used by the CIA and other governmental entities to break into a series of devices.

CIA Wikileaks

 In each case the name of the tool is listed, the target device is there and so is the source of the tool used for hacking. In fact, it’s all presented in a series of matrices so you can look up the target by manufacturer and operating system to see what the tool will do and its limitations.

Included in the material are copies of the source code, instructions for using each of the tools, troubleshooting information on things that might prevent the hacking tools from working and detailed descriptions of what each tool does when it’s put to use.

While most of the attention so far has been towards the cell phones that can be hacked, the fact is that there’s a lot more than that. For example, there are hacking tools for Windows, Linux, macOS, iOS and Android devices.

There’s even a section on how to infect Samsung smart televisions, which has a lot of people worrying that the CIA is able to spy on them while sitting in their living rooms.

Surveillance

Some of the information is enlightening, such as an update-by-update commentary on the effort to hack into those Samsung televisions while still making them appear to be turned off. You can see each step of how the “Fake Off” setting was implemented, how each LED was suppressed, how the camera and microphone were turned on, how the resulting data was stored before being exfiltrated and even how to overcome problems such as the automatic software updates by Samsung.

While that information should be enough for you to choose some other type of television for your conference room, the real interest is in the ability to infect computers, routers and mobile devices.

While you’re doing this, it’s also worth noting the response from the companies that made some of those devices. Apple, for example, has said that the current version of iOS has already fixed most of the vulnerabilities that appear in the WikiLeaks documentation.

Google, meanwhile, has released a huge security update for Android devices, much of which will presumably fix some of the vulnerabilities in the WikiLeaks dump. Microsoft is reportedly hard at work looking at the Windows vulnerabilities. All of this is mostly good news for your organization.

But there’s one area where you will need to look at the reported vulnerabilities and decide if you can afford to take the risk of using Android phones.

Originally published on eWeek