Washington: The latest revelations about the US government's powerful hacking tools potentially take surveillance right into the homes and hip pockets of billions of technology users worldwide, showing how a remarkable variety of everyday devices can be turned to spy on their owners.
Televisions, smartphones and even anti-virus software are all vulnerable to CIA hacking, according to WikiLeaks documents released on Tuesday. The capabilities described include recording the sounds, images and private text messages of users, even when they resort to encrypted apps to communicate.
More World News Videos
- Video duration
- 00:53
WikiLeaks releases 'vault 7'
WikiLeaks releases 'vault 7'
Leaked top secret documents from the CIA reveal it has been hacking phones and smart TVs.
Up Next
Volvo sets 2019 fully electric target
- Video duration
- 01:32
- Video duration
- 01:32
Volvo sets 2019 fully electric target
Volvo sets 2019 fully electric target
Volvo has become the first major traditional automaker to set a date for phasing out vehicles powered by internal combustion engines, announcing all new models after 2019 will be electric or hybrid.
Up Next
Missile launch: World leaders react
- Video duration
- 01:51
- Video duration
- 01:51
Missile launch: World leaders react
Missile launch: World leaders react
North Korea's decision to test an intercontinental ballistic missile has provoked anger and stern words from world leaders.
Up Next
US threatens military force against North Korea
- Video duration
- 01:20
- Video duration
- 01:20
US threatens military force against North ...
US threatens military force against North Korea
The United States has told an emergency UN Security Council meeting that it's ready to use force "if we must" to stop North Korea's nuclear missile program.
Up Next
Protesters raid Venezuela's parliament in bloody clash
- Video duration
- 01:43
- Video duration
- 01:43
Protesters raid Venezuela's parliament in ...
Protesters raid Venezuela's parliament in bloody clash
Footage reveals lawmakers and journalists being beaten inside the opposition-controlled National Assembly in a pro-government raid by protesters.
Up Next
Baby Charlie Gard: UK PM responds
- Video duration
- 01:13
- Video duration
- 01:13
Baby Charlie Gard: UK PM responds
Baby Charlie Gard: UK PM responds
British Prime Minister Theresa May said on Wednesday that the hospital treating terminally ill British infant Charlie Gard "will consider" any offers or new information that could help him.
Up Next
Drugs, weapons from seized from extremists in Marawi
- Video duration
- 01:08
- Video duration
- 01:08
Drugs, weapons from seized from ...
Drugs, weapons from seized from extremists in Marawi
The Philippine military said it had recovered 410 firearms and several pieces of equipment during ongoing operations against Islamic State-linked militants inside the besieged city of Marawi on Tuesday.
Up Next
Russia, China join forces over North Korea
- Video duration
- 01:14
- Video duration
- 01:14
Russia, China join forces over North Korea
Russia, China join forces over North Korea
Russia's Vladimir Putin and China's Xi Jinping are calling on the US to sign up to a de-escalation plan for the Korean peninsula ahead of the G20 summit.
WikiLeaks releases 'vault 7'
Leaked top secret documents from the CIA reveal it has been hacking phones and smart TVs.
While many of the attack technologies had been previously discussed at cyber security conferences, experts were startled to see evidence that the CIA had turned so many theoretical vulnerabilities into functioning attack tools against staples of modern life. These include widely used Internet routers, smartphones, and Mac and Windows computers.
In the case of a tool called "Weeping Angel" for attacking Samsung smart TVs, WikiLeaks wrote, "After infestation, Weeping Angel places the target TV in a 'Fake-Off' mode, so that the owner falsely believes the TV is off when it is on. In 'Fake-Off' mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server".
The CIA reportedly also has studied whether it could infect vehicle control systems for cars and trucks, which WikiLeaks alleged could be used to conduct "nearly undetectable assassinations."
And a specialised CIA unit called the Mobile Devices Branch produced malware to control and steal information from iPhones, which according to WikiLeaks were a particular focus because of the smartphone's popularity "among social, political, diplomatic and business elites." The agency also targeted popular phones running Google's Android, the world's leading mobile operating system.
WikiLeaks said it redacted lists of CIA surveillance targets, though it said they included targets and machines in Latin America, Europe and the United States. The anti-secrecy group also said that by developing such intrusive technology - rather than helping tech companies patch flaws in their products - the CIA was undermining efforts to protect the cyber security of Americans.
"The argument that there is some terrorist using a Samsung TV somewhere - as a reason to not disclose that vulnerability to the company, when it puts thousands of Americans at risk - I fundamentally disagree with it," said Alex Rice, chief technology officer for HackerOne, a start-up that enlists hackers to report security gaps to companies and organisations in exchange for cash.
The trove released Tuesday, which could not be independently verified and the CIA has declined to confirm, included 8761 documents - the first batch in a series of planned releases, WikiLeaks said.
This first group, at least, has important differences from the 2013 revelations by former National Security Agency contractor Edward Snowden. His trove of documents largely described mass surveillance of internet-based communications systems, while the WikiLeaks release more often describes attacks on individual devices.
By targeting devices, the CIA reportedly gains access to even well-encrypted communications on such popular apps as Signal and WhatsApp, without having to crack the encryption itself. The WikiLeaks reports acknowledged that difference by saying that the CIA had found ways to "bypass", as opposed to defeat, encryption technologies.
"The idea that the CIA and NSA can hack into devices is kind of old news," said Johns Hopkins University cryptography expert Matthew Green. "Anyone who thought they couldn't was living in a fantasy world."
Snowden's revelations and the resulting backlash made strong encryption a major, well-funded cause for privacy advocates and, perhaps more important, technology companies that had the engineering expertise and budgets to protect data as it flowed across the world.
Google, Microsoft, Facebook, Yahoo and many other companies announced significant new initiatives, in part to protect their brands against accusations by some users that they had made it too easy for the NSA to collect information from their systems. Many websites, meanwhile, began encrypting their data flows to users to prevent snooping. Encryption tools such as Tor were strengthened.
Encrypting apps for private messaging, such as Signal, Telegram and WhatsApp, exploded in popularity, especially among users around the world who were fearful of government intrusion. In the days after the US presidential election last fall, Signal was among the most downloaded programs in Apple's app store, and downloads grew by more than 300 per cent.
Open Whisper Systems, which developed Signal, released a statement on Tuesday saying, "The CIA/Wikileaks story today is about getting malware onto phones, none of the exploits are in Signal or break Signal Protocol encryption."
WhatsApp and Google declined to comment. Telegram and Samsung did not respond to requests for comment.
"Apple is deeply committed to safeguarding our customers' privacy and security. The technology built into today's iPhone represents the best data security available to consumers, and we're constantly working to keep it that way," Apple spokesman Fred Sainz said on Tuesday.
"While our initial analysis indicates that many of the issues leaked today were already patched in the latest iOS, we will continue work to rapidly address any identified vulnerabilities. We always urge customers to download the latest iOS to make sure they have the most recent security updates."
US government authorities had complained loudly that the post-Snowden wave of encryption was undermining their ability to investigate serious crimes, such as terrorism and child pornography. The FBI in 2016 sued Apple in hopes of forcing it to unlock an iPhone used by the San Bernadino, California, killers before announcing, amid heavy public criticism, that it had other ways to crack the device.
Against that backdrop, many privacy advocates argued that devices - often called "endpoints" for their place in chains of communications that can criss-cross continents - were the best available targets in a world with widespread online encryption. The WikiLeaks documents suggest that the CIA may have reached the same conclusion.
"It would certainly be consistent with the hypothesis that we've made real progress in the encryption we've been introducing," said Peter Eckersley, technology projects director for the Electronic Frontier Foundation, a San Francisco-based civil liberties group. "It's impossible to be 100 per cent certain, but reading the tea leaves, it's plausible."
The WikiLeaks revelations also serve as a reminder that, whatever the political backlash to revelations about digital spying, it is not going away and probably will continue to grow.
Aside from the United States, many other advanced nations such as China, Russia, Britain and Israel have extremely sophisticated tools for digital spying. Less-advanced nations have gained access to powerful online spying technology through a robust and lightly regulated industry of surveillance contractors throughout the world.
On Tuesday, resignation and frustration rippled through Silicon Valley as technologists grappled with the revelations of yet another US government attempt to exploit their systems. And cyber security experts reacted with alarm.
"This is explosive," said Jake Williams, founder of Rendition InfoSec, a cyber security firm. The material highlights specific anti-virus products that can be defeated, going further than a release of NSA hacking tools last year, he said.
The WikiLeaks release revealed that the CIA has sophisticated "stealth" capabilities that enable hackers not only to infiltrate systems but to evade detection, as well as abilities to move inside a system freely as if they owned it.
Nicholas Weaver, a computer security researcher at the University of California at Berkeley, said the dates in the WikiLeaks files suggest that the documents were taken in February or March 2016. At least two of them are marked top secret, "which suggests that somebody in early 2016 managed to compromise a top-secret CIA development system and is willing to say that they did."
One internal CIA document listed a set of Apple iPhone "exploits" - tools that can be used to compromise the device by taking advantage of software flaws. Some of the tools are based on "zero day" vulnerabilities that have not been shared with the manufacturer.
So "some of these descriptions will allow Apple to fix the vulnerabilities," Weaver said. "But at the same time, they're out in the public, and whoever stole this data could use them against US interests."
Washington Post
0 comments
New User? Sign up