Security experts are questioning the wisdom of WikiLeaks releasing more source code for US intelligence agency hacking tools
Whistle-blowing organisation WikiLeaks has begun a new series of leaks of the source code of software allegedly designed to run on servers controlled by the US Central Intelligence Agency(CIA).
The first release in the series claims to be source code and analysis for a major component of the infrastructure used to control malware developed by the CIA.
“This publication will enable investigative journalists, forensic experts and the general public to better identify and understand covert CIA infrastructure components,” said WikiLeaks.
The latest publication, dubbed “Vault 8”, comes two months after the last of the “Vault 7” series of leaks made over a seven-month period.
WikiLeaks claimed the documents had come from an isolated, high-security network inside the CIA’s Center for Cyber Intelligence in Langley, Virginia, but this has never been confirmed by the CIA.
The previous series of leaks mentioned a multi-platform CIA malware suite and its associated control software, called “Hive”.
The project was said to provide customisable implants for Windows, Solaris, MikroTik and Linux platforms, and a command and control (C2) infrastructure to communicate with these implants.
The latest release by WikiLeaks provides the source code, development logs and other documentation for Hive.
The documents complement the Hive users guide, developers guide, infrastructure installation and configuration guide, and documentation on the Hive Beacon Infrastructure published previously.
But WikiLeaks claims that, like the Vault7 series, the material published by WikiLeaks does not contain zero-days or other vulnerabilities that could be repurposed by others.
According to WikiLeaks, Hive is designed to make implants (malware) difficult to attribute to the CIA. “Hive provides a covert communications platform for a whole range of CIA malware to send exfiltrated information to CIA servers and receive new instructions from operators at the CIA,” it said.
Hive was designed to solve the “critical problem” of enabling the CIA to communicate with malware implants on target computers in a secure manner that does not draw attention.
Hive achieves this by anonymously registering a cover domain for each operation and using a virtual private server (VPS) rented from a commercial hosting provider to run the domain. These servers are then used as a relay for traffic over a virtual private network (VPN) connection to a “hidden” CIA server.
The cover domain delivers “innocent” content if anyone connects to it by chance and appears to be a normal website. But because the website uses an Optional Client Authentication hypertext transfer protocol secure(HTTPS) server option, implants can use this to authenticate and connect to the CIA server.
Digital certificates for the authentication of implants are generated by the CIA impersonating existing entities. According to WikiLeaks, three examples included in the source code build a fake certificate for the antivirus company Kaspersky Lab, pretending to be signed by Thawte Premium Server CA.
“In this way, if the target organisation looks at the network traffic coming out of its network, it is likely to misattribute the CIA exfiltration of data to uninvolved entities whose identities have been impersonated,” WikiLeaks said.
Within hours of the Vault 8 publication, Kaspersky Lab CEO Eugene Kaspersky responded with at tweet: “We’ve investigated the Vault 8 report and confirm the certificates in our name are fake. Our customers, private keys and services are safe and unaffected.”
In another reaction on Twitter, Alan Woodward, Europol consultant, cyber security expert and visiting professor at Surrey University, said: “WikiLeaks is now releasing source for exploits in Vault 7. Do they remember what happened last time such exploit code was leaked? Standby for another WannaCry.”
A key component of WannaCry was the EternalBlue exploit of Microsoft’s server message block (SMB) protocol, reportedly stolen from the US National Security Agency (NSA) and released by the Shadow Brokers hacking group.