Tag Archives: cia

Wikileaks’ CIA dump plugs massive Cisco security hole

FacebookTwitterGoogle+PinterestLinkedInRedditEmail

If you look into the core of the Internet or just in a typical corporate or institutional data center, you’ll see rack after rack loaded with switches, routers and other gear made by Cisco. A vulnerability in even one of their products can leave a lot of networks and data open to attack. So you might come to the conclusion that spotting that kind of flaw and fixing it as quickly as possible is matter of national security.

You’d be wrong.

It turns out that more than three hundred Cisco devices can be breached via a cracking technique used by the Central Intelligence Agency and revealed in a massive document dump by Wikileaks. Company researchers have concluded that

  • Malware exists that seems to target different types and families of Cisco devices, including multiple router and switches families.
  • The malware, once installed on a Cisco device, seem to provide a range of capabilities: data collection, data exfiltration, command execution with administrative privileges (and without any logging of such commands ever been executed), HTML traffic redirection, manipulation and modification (insertion of HTML code on web pages), DNS poisoning, covert tunneling and others.
  • The authors have spent a significant amount of time making sure the tools, once installed, attempt to remain hidden from detection and forensic analysis on the device itself.
  • It would also seem the malware author spends a significant amount of resources on quality assurance testing – in order, it seems, to make sure that once installed the malware will not cause the device to crash or misbehave.

There’s a quick way to block it – disable telnet, an ancient and insecure communications protocol – but a permanent fix has yet to be released.

Generally, there are two ways the CIA could have obtained this exploit: either it was developed internally or it was purchased on the black market. If the former, it could have been duplicated by anyone with sufficient skill. If the latter, it means the CIA knew that broad swathes of the world’s IT infrastructure was exposed to anyone with deep enough pockets. In either case, its first duty should have been to plug the hole, and not sit on it until its own firewall was breached.

Wikileaks shows there’s no such thing as a top secret hack

FacebookTwitterGoogle+PinterestLinkedInRedditEmail

Not the latest version.

The Central Intelligence Agency’s guide to cracking is getting bad reviews from the tech community. Published earlier this week on Wikileaks, the thousands of files of internal documentation maintained by the CIA’s engineering development group are mostly openly available cook books and mundane advice on how not to get caught.

A story by Sean Gallagher at Ars Technica steps through some of it and concludes it amounts to an outdated “Malware 101” textbook…

It’s not clear how closely tool developers at the CIA followed the tradecraft advice in the leaked document—in part because they realized how dated some of the advice was. Back in 2013, two users of the system said so in the comments area: “A lot of the basic tradecraft suggestions on that page seem flawed,” wrote one. Another followed, “Honestly, that stuff is probably already dated…”

Four years later, some of the recommendations have become even more stale. That’s largely because of the advances made in malware detection and security tools, including those built into many operating systems. But it’s also because the tradecraft used by everyday malware authors without the benefit of state sponsorship have surpassed these sorts of tradecraft suggestions.

One of the takeaways from the Wikileaks dump should come as no surprise: the CIA is an avid collector of zero day exploits, which are bugs in applications, operating systems and hardware that the rightful owners don’t know about yet. But plenty of others will. Apparently, the CIA buys at least some of these backdoors from the grey and black marketeers that openly sell them. Even a flaw discovered by the CIA’s team isn’t exactly a secret – it’s there for the taking by anyone else with the necessary, and far from rare, skills.

Spying is the CIA’s job. But the reason for doing it is to protect the U.S. Feeding the market for malware and hoarding it instead of fixing it makes us all less secure.