CIA CAN AND DOES HACK ALMOST EVERY DEVICE

Giant WikiLeak of agency's secrets reveals it infiltrates iPhones, smart TVs and Whatsapp and can even take over self-driving cars which could be programmed to kill

By Emily Crane and Associated Press
March 7, 2017

WikiLeaks has published thousands of documents claiming to reveal top CIA hacking secrets, including the agency's ability to infiltrate encrypted apps like Whatsapp, break into smart TVs and phones and program self-driving cars.

WikiLeaks said the files released on Tuesday - mysteriously dubbed ' Vault 7' - are the most comprehensive release of U.S. spying files ever made public.

The leak purportedly includes 8,761 documents and files from an isolated, high-security network situated inside the CIA's Center for Cyber Intelligence in Langley, Virgina.

It details intelligence information on CIA-developed software intended to hack iPhones, Android phones, smart TVs and Microsoft, Mac and Linux operating systems.

WikiLeaks alleges that some of the remote hacking programs can turn these electronic devices into recording and transmitting stations to spy on their targets.

It also claims the CIA can bypass the encryption of Whatsapp, Signal, Telegram, Wiebo, Confide and Cloakman by hacking the smart phones the applications run on.

The CIA was also looking at hacking the vehicle control systems used in modern cars and trucks, WikiLeaks claims.

According to a document in 2014, CIA's Embedded Devices Branch met to discuss malware that could infect vehicle systems.

'The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations,' WikiLeaks said.

The documents could not immediately be authenticated, but WikiLeaks has a long track record of releasing top secret government documents. A spokesman for the CIA would not comment.

WikiLeaks, which had been dropping cryptic hints about the release for a month, said in a lengthy statement that the CIA had 'recently' lost control of a massive arsenal of CIA hacking tools as well as associated documentation.

The organization said that 'the archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner' and that one of them 'provided WikiLeaks with portions of the archive.'

They said the archive of files - referred to as Year Zero - introduces the scope of the CIA's global covert hacking program and includes software that could allow people to take control of consumer electronic products.

The documents cover a range of topics, including what appeared to be a discussion about how to compromise smart televisions and turn them into improvised surveillance devices.

The alleged program called 'Weeping Angel' is said to have been developed in conjunction with the British spy agency MI5 and allows them to hack a Samsung smart TV when it is seemingly switched off.

'After infestation, Weeping Angel places the target TV in a 'Fake-Off' mode, so that the owner falsely believes the TV is off when it is on,' the files say, according to WikiLeaks.

'In 'Fake-Off' mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server.'

WikiLeaks said the leaked data also included details on the agency's efforts to subvert American software products and smartphones, including Apple's iPhone, Google's Android and Microsoft's Windows.

The files claim the CIA had developed numerous attacks to remotely hack and control popular smart phones.

'Infected phones can be instructed to send the CIA the user's geolocation, audio and text communications as well as covertly activate the phone's camera and microphone,' the files state.

'A similar unit targets Google's Android which is used to run the majority of the world's smart phones including Samsung, HTC and Sony.'

According to WikiLeaks, the CIA knew about several flaws in software made by Apple, Google, Samsung and others but didn't tell the companies about them.

Disclosing such vulnerabilities is supposed to be common practice so companies could fix them before hackers use them. But WikiLeaks says the CIA kept knowledge of the vulnerabilities to itself for use in bypassing the encryption on apps such as WhatsApp, Signal, Telegram and Confide.

WikiLeaks says the CIA had two dozen such undisclosed vulnerabilities for Android gadgets alone.

A 'substantial library' of digital espionage techniques borrowed from Russia and other countries is in the data as well, WikiLeaks said.

WikiLeaks claims each technique the CIA has created 'forms a "fingerprint" that can be used by forensic investigators to attribute multiple different attacks to the same entity'.

'The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation.

'With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the "fingerprints" of the groups that the attack techniques were stolen from.'

WikiLeaks said it redacted the names of CIA officers and avoided publishing damaging details of cyber weapons.

They said they will refrain from doing do 'until a consensus emerges on the technical and political nature of the CIA's program and how such 'weapons' should analyzed, disarmed and published.'

The files also reveal that in addition to its operations in Virginia, the CIA also uses the U.S. consulate in Frankfurt as a covert base for its hackers covering Europe, the Middle East and Africa.

Wikileaks said the release of confidential documents on the agency already eclipses the total number of pages published over the first three years of the Edward Snowden NSA leaks.

Experts who've started to sift through the material said it appeared legitimate - and that the release was almost certain to shake the CIA.

If it did prove legitimate, the dump would represent yet another catastrophic breach for the U.S. intelligence community at the hands of WikiLeaks and its allies, which have repeatedly humbled Washington with the mass release of classified material.

Jake Williams, a security expert with Augusta, Georgia-based Rendition Infosec, has experience dealing with government hackers. He said that the voluminous files' extensive references to operation security meant they were almost certainly government-backed.

'I can't fathom anyone fabricated that amount of operational security concern,' he said. 'It rings true to me.'

'The only people who are having that conversation are people who are engaging in nation-state-level hacking.'

Bob Ayers, a retired U.S. intelligence official currently working as a security analyst, agreed, saying that the release was 'real bad' for the agency.

Ayers noted that WikiLeaks has promised to release more CIA documents, saying Tuesday's publication was just 'the first full part of the series.'

'The damage right now is relatively high-level,' he said. '(But) the potential for really detailed damage will come in the following releases.'