Former CIA Employee Suspected In “Vault 7” WikiLeaks Disclosure

U.S. authorities have identified a suspect in last year’s “Vault 7” leaks of CIA hacking and electronic surveillance tools used in foreign espionage operations, reports the Washington Post. 

The Vault 7 release – a series of 24 documents which began to publish on March 7, 2017 – reveal that the CIA had a wide variety of tools to use against adversaries, including the ability to “spoof” its malware to appear as though it was created by a foreign intelligence agency, as well as the ability to take control of Samsung Smart TV’s and surveil a target using a “Fake Off” mode in which they appear to be powered down while eavesdropping. 

The CIA’s hand crafted hacking techniques pose a problem for the agency. Each technique it has created forms a “fingerprint” that can be used by forensic investigators to attribute multiple different attacks to the same entity.

…

The CIA’s Remote Devices Branch’s UMBRAGE group collects and maintains a substantial library of attack techniques ‘stolen’ from malware produced in other states including the Russian Federation.

With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the “fingerprints” of the groups that the attack techniques were stolen from.

UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques. –WikiLeaks

Joshua Adam Schulte, 29, a former employee in the CIA’s Engineering Development Group, is believed to have provided the agency’s top-secret cyber warfare tools to WikiLeaks – according to a disclosure by federal prosecutors at a January hearing in a Manhattan court on unrelated charges of possessing, receiving and transporting child pornography. Schulte, who has been in jail for months, has pleaded not guilty on the child porn charges. 

Schulte previously worked for the NSA before joining the CIA, then “left the intelligence community in 2016 and took a job in the private sector,” according to a statement reviewed by The Post.

Schulte also claimed that he reported “incompetent management and bureaucracy” at the CIA to that agency’s inspector general as well as a congressional oversight committee. That painted him as a disgruntled employee, he said, and when he left the CIA in 2016, suspicion fell upon him as “the only one to have recently departed [the CIA engineering group] on poor terms,” Schulte wrote. –WaPo

Prosecutors allege that they found a large collection of child pornography on a server maintained by Schulte, however his attorneys argue that anywhere from 50 to 100 people had access to it, which Schulte set up several years ago to share movies and other digital files.  

Federal authorities searched Schulte’s apartment in New York last year and obtained personal computer equipment, notebooks and handwritten notes, according to a copy of the search warrant reviewed by The Washington Post. But that failed to provide the evidence that prosecutors needed to indict Schulte with illegally giving the information to WikiLeaks. –WaPo

And while Schulte “remains a target of that investigation,” prosecutor Matthew Laroche, assistant US attorney in the Southern District of New York, said that the investigation is “ongoing.” Part of that investigation, reports WaPo, is analyzing whether the Tor network – which allows internet users to hide their location (in theory) “was used in transmitting classified information.” 

In other hearings in Schulte’s case, prosecutors have alleged that he used Tor at his New York apartment, but they have provided no evidence that he did so to disclose classified information. Schulte’s attorneys have said that Tor is used for all kinds of communications and have maintained that he played no role in the Vault 7 leaks. –WaPo

“Due to these unfortunate coincidences the FBI ultimately made the snap judgment that I was guilty of the leaks and targeted me,” Schulte said. He has launched Facebook and GoFundMe pages to raise money for his defense, as well as post articles critical of the criminal justice system.

As The Post notes, the Vault 7 release was one of the most significant leaks in the CIA’s history, “exposing secret cyberweapons and spying techniques that might be used against the United States, according to current and former intelligence officials.” 

The CIA’s toy chest includes:

  • Tools code named “Marble” can misdirect forensic investigators from attributing viruses, trojans and hacking attacks to their agency by inserted code fragments in foreign languages.  The tool was in use as recently as 2016.  Per the WikiLeaks release:

“The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, — but there are other possibilities, such as hiding fake error messages.”

  • iPads / iPhones / Android devices and Smart TV’s are all susceptible to hacks and malware. The agency’s “Dark Matter” project reveals that the CIA has been bugging “factory fresh” iPhones since at least 2008 through suppliers. Another, “Sonic Screwdriver” allows the CIA to execute code on a Mac laptop or desktop while it’s booting up.

  • The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell’s 1984, but “Weeping Angel”, developed by the CIA’s Embedded Devices Branch (EDB), which infests smart TVs, transforming them into covert microphones, is surely its most emblematic realization.
  • The Obama administration promised to disclose all serious vulnerabilities they found to Apple, Google, Microsoft, and other US-based manufacturers. The US Government broke that commitment.

“Year Zero” documents show that the CIA breached the Obama administration’s commitments. Many of the vulnerabilities used in the CIA’s cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals.

In addition to its operations in Langley, Virginia the CIA also uses the U.S. consulate in Frankfurt as a covert base for its hackers covering Europe, the Middle East and Africa.

CIA hackers operating out of the Frankfurt consulate ( “Center for Cyber Intelligence Europe” or CCIE) are given diplomatic (“black”) passports and State Department cover. 

  • Instant messaging encryption is a joke.

These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the “smart” phones that they run on and collecting audio and message traffic before encryption is applied.

  • The CIA laughs at Anti-Virus / Anti-Malware programs.

CIA hackers developed successful attacks against most well known anti-virus programs. These are documented in AV defeats, Personal Security Products, Detecting and defeating PSPs and PSP/Debugger/RE Avoidance. For example, Comodo was defeated by CIA malware placing itself in the Window’s “Recycle Bin”. While Comodo 6.x has a “Gaping Hole of DOOM”.

You can see the Vault7 release here.

via RSS https://ift.tt/2rVERMr Tyler Durden

Leave a Reply

Your email address will not be published. Required fields are marked *