WikiLeaks dropped a trove of information about hacking tools from the CIA this week. It’s available via BitTorrent, in an encrypted archive, whose password is SplinterItIntoAThousandPiecesAndScatterItIntoTheWinds. That’s amusing, I suppose.
So what’s in the archive and what does it mean?
First, the archive appears to be a dump of an Intranet portal at the CIA, where staff share information about hacking tools. It’s missing a bunch of stuff – images and documents – so the download appears to have been incomplete. Moreover, this is information about the tools, rather than the tools themselves, though those were apparently leaked
earlier in a separate incident.
There are tools here to hack every common operating system – Windows, MacOSX, Linux, Android and iOS. There are also tools for various other platforms, including some Samsung TVs.
There has been a bunch of wild and wooly press coverage about this leak, but no, the CIA does not appear to have tools to compromise encryption in popular messaging system. It’s simply the case that if you can compromise either end of the conversation, then encryption between the two ends of the conversation is irrelevant. They can’t magically turn your TV into a spy device (without first breaking into your house) and they can’t (yet?) cause your car to suddenly crash. All of these things are plausible, and even discussed in the leaked documents, but not described as current capabilities.
Many of the tools discussed in the leak require physical access. i.e., if you are some “bad guy” that the CIA is interested in, and they can touch your phone or PC or TV, then they can install malware on that device to help them spy on you. Clearly, that doesn’t matter much to most people.
Some of the tools work over the network, and obviously that’s more serious, especially if they get into the hands of criminals or other adversaries that the average business or consumer might be more worried about than the CIA.
Also of note is that some of the tools leverage security vulnerabilities in popular products that the vendors and security researchers were not previously aware of. For the US government to discover such bugs and not work with vendors to close them leaves the public at risk and represents quite dubious ethics.
So is it time to panic? Hardly. We already knew that every large and complex piece of software has bugs (they are written by human beings after all) and that some of those bugs can be used to compromise security. We also already knew that all advanced government spy agencies work to compromise device security to either collect information about their adversaries or to disrupt their operations. That the CIA is doing this is only vaguely surprising, in the sense that it really should be the job of their sister agency, the NSA.
Everyone should already be aware that a smart phone is a perfect surveillance device, incorporating network connectivity, a GPS receiver, plus microphones and cameras. It’s obvious that spy agencies would work to hack into these things to monitor people, and would at least sometimes succeed.
So what’s interesting here?
Well, someone at the CIA obviously dislikes their employer enough to leak this information. That’s a serious crime.
The US government does not disclose all zero-day exploits it finds to vendors. That’s morally compromised.
WikiLeaks is more interested in the (fairly mundane) behaviour of the US government than that of various dictatorships, such as Iran and Russia. That makes WikiLeaks and Julian Asange look quite bad, actually. They are pretty much a puppet of the Russian state at this point.
The involvement of both WikiLeaks and Russian intelligence services in the recent US presidential election should be alarming to everyone in the West. There is no reason to believe this kind of interference will stop there — it’ll continue into the future and in other Western countries. This data dump is really just a side show compared to Russian cyber