Vault 7

Vault 8

On 9 November 2017, WikiLeaks began publishing Vault 8, which it described as "source code and analysis for CIA software projects including those described in the Vault 7 series." The stated intention of the Vault 8 publication was to "enable investigative journalists, forensic experts and the general public to better identify and understand covert CIA infrastructure components." The only Vault 8 release has been the source code and development logs for Hive, a covert communications platform for CIA malware. WikiLeaks published the Hive documentation as part of Vault 7 on 14 April 2017.

In October 2021, a new backdoor based on the Hive source code was discovered being used "to collect sensitive information and provide a foothold for subsequent intrusions." Researchers called it xdr33 and released a report on it in January 2022. The malware targets an unspecified F5 appliance and allowed hackers to upload and download files. It also allowed network traffic spying and executing commands on the appliance.

Organization of cyber warfare

WikiLeaks said that the documents came from "an isolated, high-security network situated inside the CIA's Center for Cyber Intelligence (CCI) in Langley, Virginia". The documents allowed WikiLeaks to partially determine the structure and organization of the CCI. The CCI reportedly has a unit devoted to compromising Apple products.

The cybersecurity firm Symantec analyzed Vault 7 documents and found some of the described software closely matched cyberattacks by "Longhorn," which it had monitored since 2014. Symantec had previously suspected that "Longhorn" was government-sponsored and had tracked its usage against 40 targets in 16 countries.

Frankfurt base

The first portion of the documents made public on 7 March 2017, Vault 7 "Year Zero", revealed that a top secret CIA unit used the German city of Frankfurt as the starting point for hacking attacks on Europe, China and the Middle East. According to the documents, the U.S. government uses its Consulate General Office in Frankfurt as a hacker base for cyber operations. WikiLeaks documents reveal the Frankfurt hackers, part of the Center for Cyber Intelligence Europe (CCIE), were given cover identities and diplomatic passports to obfuscate customs officers to gain entry to Germany.

The chief Public Prosecutor General of the Federal Court of Justice in Karlsruhe Peter Frank announced on 8 March 2017 that the government was conducting a preliminary investigation to see if it will launch a major probe into the activities being conducted out of the consulate and also more broadly whether people in Germany were being attacked by the CIA. Germany's foreign minister Sigmar Gabriel from the Social Democratic Party responded to the documents of Vault 7 "Year Zero" that the CIA used Frankfurt as a base for its digital espionage operations, saying that Germany did not have any information about the cyber attacks.

UMBRAGE

The documents reportedly revealed that the agency had amassed a large collection of cyberattack techniques and malware produced by other hackers. This library was reportedly maintained by the CIA's Remote Devices Branch's UMBRAGE group, with examples of using these techniques and source code contained in the "Umbrage Component Library" git repository.

False flag conspiracy theories

On the day the Vault 7 documents were first released, WikiLeaks described UMBRAGE as "a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation," and tweeted, "CIA steals other groups virus and malware facilitating false flag attacks." According to WikiLeaks, by recycling the techniques of third parties through UMBRAGE, the CIA can not only increase its total number of attacks, but can also mislead forensic investigators by disguising these attacks as the work of other groups and nations. Among the techniques borrowed by UMBRAGE was the file wiping implementation used by Shamoon. According to PC World, some of the techniques and code snippets have been used by CIA in its internal projects, whose result cannot be inferred from the leaks. PC World commented that the practice of planting "false flags" to deter attribution was not a new development in cyberattacks: Russian, North Korean and Israeli hacker groups are among those suspected of using false flags.

A conspiracy theory soon emerged alleging that the CIA framed the Russian government for interfering in the 2016 U.S. elections. Conservative commentators such as Sean Hannity and Ann Coulter speculated about this possibility on Twitter, and Rush Limbaugh discussed it on his radio show. Russian foreign minister Sergey Lavrov said that Vault 7 showed that "the CIA could get access to such 'fingerprints' and then use them."

Cybersecurity writers and experts, such as Ben Buchanan and Kevin Poulsen, were skeptical of those theories. Poulsen said the theories were "disinformation" being taken advantage of by Russia and spread by bots. He also wrote, "The leaked catalog isn't organized by country of origin, and the specific malware used by the Russian DNC hackers is nowhere on the list." Robert M. Lee, who founded the cybersecurity firm Dragos, said the "narrative emerged far too quickly to have been organic."

According to a study by Kim Zetter in The Intercept, UMBRAGE was probably much more focused on speeding up development by repurposing existing tools, rather than on planting false flags. Robert Graham, CEO of Errata Security told The Intercept that the source code referenced in the UMBRAGE documents is "extremely public", and is likely used by a multitude of groups and state actors. Graham added: "What we can conclusively say from the evidence in the documents is that they're creating snippets of code for use in other projects and they're reusing methods in code that they find on the internet. ... Elsewhere they talk about obscuring attacks so you can't see where it's coming from, but there's no concrete plan to do a false flag operation. They're not trying to say 'We're going to make this look like Russia'."

Marble framework

The documents describe the Marble framework, a string obfuscator used to hide text fragments in malware from visual inspection. Some outlets reported that foreign languages were used to cover up the source of CIA hacks, but technical analysis refuted the idea. According to WikiLeaks, it reached 1.0 in 2015 and was used by the CIA throughout 2016.

In its release, WikiLeaks said "Marble" was used to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation. The source code revealed that Marble had examples in Chinese, Russian, Korean, Arabic and Persian.

Analysts called WikiLeaks' description of Marble's main purpose inaccurate, telling The Hill its main purpose was probably to avoid detection by antivirus programs.

Marble also contained a deobfuscator tool with which the CIA could reverse text obfuscation.

Security researcher Nicholas Weaver from International Computer Science Institute in Berkeley told the Washington Post: "This appears to be one of the most technically damaging leaks ever done by WikiLeaks, as it seems designed to directly disrupt ongoing CIA operations."

Compromised technology and software

CDs/DVDs

HammerDrill is a CD/DVD collection tool that collects directory walks and files to a configured directory and filename pattern as well as logging CD/DVD insertion and removal events.

Apple products

After WikiLeaks released the first installment of Vault 7, "Year Zero", Apple stated that "many of the issues leaked today were already patched in the latest iOS," and that the company will "continue work to rapidly address any identified vulnerabilities."

On 23 March 2017, WikiLeaks released "Dark Matter", the second batch of documents in its Vault 7 series, detailing the hacking techniques and tools all focusing on Apple products developed by the Embedded Development Branch (EDB) of the CIA. The leak also revealed the CIA had been targeting the iPhone since 2008, and that some projects attacked Apple's firmware. The "Dark Matter" archive included documents from 2009 and 2013. Apple issued a second statement assuring that based on an "initial analysis, the alleged iPhone vulnerability affected iPhone 3G only and was fixed in 2009 when iPhone 3GS was released." Additionally, a preliminary assessment showed "the alleged Mac vulnerabilities were previously fixed in all Macs launched after 2013".

Cisco

WikiLeaks said on 19 March 2017 on Twitter that the "CIA was secretly exploiting" a vulnerability in a huge range of Cisco router models discovered thanks to the Vault 7 documents. The CIA had learned more than a year ago how to exploit flaws in Cisco's widely used internet switches, which direct electronic traffic, to enable eavesdropping. Cisco quickly reassigned staff from other projects to turn their focus solely on analyzing the attack and to figure out how the CIA hacking worked, so they could help customers patch their systems and prevent criminal hackers or spies from using similar methods.

On 20 March, Cisco researchers confirmed that their study of the Vault 7 documents showed the CIA had developed malware which could exploit a flaw found in 318 of Cisco's switch models and alter or take control of the network. Cisco issued a warning on security risks, patches were not available, but Cisco provided mitigation advice.

Smartphones/tablets

The electronic tools can reportedly compromise both Apple's iOS and Google's Android operating systems. By adding malware to the Android operating system, the tools could gain access to secure communications made on a device.

Messaging services

According to WikiLeaks, once an Android smartphone is penetrated the agency can collect "audio and message traffic before encryption is applied". Some of the agency's software is reportedly able to gain access to messages sent by instant messaging services. This method of accessing messages differs from obtaining access by decrypting an already encrypted message. While the encryption of messengers that offer end-to-end encryption, such as Telegram, WhatsApp and Signal, wasn't reported to be cracked, their encryption can be bypassed by capturing input before their encryption is applied, by methods such as keylogging and recording the touch input from the user.

Commentators, including Snowden and cryptographer and security pundit Bruce Schneier, observed that WikiLeaks incorrectly implied that the messaging apps themselves, and their underlying encryption, had been compromised – an implication which was in turn reported for a period by the New York Times and other mainstream outlets.

Vehicle control systems

One document reportedly showed that the CIA was researching ways to infect vehicle control systems. WikiLeaks stated, "The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations." This statement brought renewed attention to conspiracy theories surrounding the death of Michael Hastings.

Windows

The documents refer to a "Windows FAX DLL injection" exploit in Windows XP, Windows Vista and Windows 7 operating systems. This would allow a user with malicious intent to hide malware under the DLL of another application. However, a computer must have already been compromised through another method for the injection to take place.

Commentary

On 7 March 2017, Edward Snowden commented on the importance of the release, stating that it reveals the United States Government to be "developing vulnerabilities in US products" and "then intentionally keeping the holes open", which he considered highly reckless. On 7 March 2017, Nathan White, Senior Legislative Manager at the Internet advocacy group Access Now, wrote:

Today, our digital security has been compromised because the CIA has been stockpiling vulnerabilities rather than working with companies to patch them. The United States is supposed to have a process that helps secure our digital devices and services — the 'Vulnerabilities Equities Process.' Many of these vulnerabilities could have been responsibly disclosed and patched. This leak proves the inherent digital risk of stockpiling vulnerabilities rather than fixing them.

On 8 March 2017, Lee Mathews, a contributor to Forbes, wrote that most of the hacking techniques described in Vault 7 were already known to many cybersecurity experts. On 8 March 2017, some noted that the revealed techniques and tools are most likely to be used for more targeted surveillance revealed by Edward Snowden.

On 8 April 2017, Ashley Gorski, an American Civil Liberties Union staff attorney called it "critical" to understand that "these vulnerabilities can be exploited not just by our government but by foreign governments and cyber criminals around the world." Justin Cappos, professor in the Computer Science and Engineering department at New York University asks "if the government knows of a problem in your phone that bad guys could use to hack your phone and have the ability to spy on you, is that a weakness that they themselves should use for counterterrorism, or for their own spying capabilities, or is it a problem they should fix for everyone?"

On 8 April 2017, Cindy Cohn, executive director of the San Francisco-based international non-profit digital rights group Electronic Frontier Foundation, said: "If the C.I.A. was walking past your front door and saw that your lock was broken, they should at least tell you and maybe even help you get it fixed." "And worse, they then lost track of the information they had kept from you so that now criminals and hostile foreign governments know about your broken lock." Furthermore, she stated that the CIA had "failed to accurately assess the risk of not disclosing vulnerabilities. Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans." "The freedom to have a private conversation – free from the worry that a hostile government, a rogue government agent or a competitor or a criminal are listening – is central to a free society".

On 12 May 2017 Microsoft president Brad Smith wrote that both NSA and CIA had stockpiled vulnerabilities, which were stolen from them and published on Wikileaks, resulting in security breaches for Microsoft customers. Smith requested, for a second time, a "digital Geneva Convention" which would require governments to report vulnerabilities to vendors.