What happens when a secret service agency engages itself in hacking ordinary citizens?
Is it ethical? Does it have any legal sanction?
Obviously, it does not seem to be the right thing to do, but hardly anyone knew that such hacking was indeed taking place until recently.
WikiLeaks, the website which has taken it upon itself to expose the clandestine operations that go on inside the federal government of the United States, has now released the latest in its series of large volumes revealing Central Intelligence agency’s well-kept secrets.
Termed Vault 7, these exposures inform the public how the agency was performing the hacking projects, and which tools and techniques were used in the process.
Wireless Networking Devices Used as the Soft Target
The CIA’s team, according to WikiLeaks, was working on a hacking project called “Cherry Blossom” which involved penetrating the access point in any wireless networking hub they choose.
A private institution engaged in not-for-profit research activities was roped in to help the agency in this project, and the main objective was to enter and monitor two-way communications passing through the connected devices in the network.
As mentioned, the most vulnerable point in a wireless network system is its access point which, in most cases, is the Wi-Fi router.
It is easy to hack or crack the password in these devices, and the hacking team from the CIA exploited this to the hilt.
Many Router Brands Revealed, But Information is a Bit Old
The voluminous exposure by WikiLeaks includes a list of names of different brands of routers—about 200 of them.
However, analysts say that the dateline of the published hacking information could be quite old, so many of the router brands may no longer be in existence.
Some of the prominent router brands include D-Link, Linksys and 3Com.
The reaction to the leaks by some experts is that it’s quite possible that these companies have already plugged some of these vulnerabilities in the interim period until now, and possibly today’s devices might not be so easy for the hacking team to penetrate.
However, it is also possible that the agency has moved forward and developed other firmware or hacking tools to enter wireless networking devices and carry on its spying work.
Not Possible to Locate the Hack
If you are using a router to connect to the web and if the CIA’s Cherry Blossom team is hacking your network, you will have no way of knowing that your communications are being monitored.
One reason is that there is no physical access being made.
WikiLeaks has explained that the way the hacking was carried out by CIA was to replace the device’s firmware with their own systems, and this ends up converting your router into what is termed as a “flytrap.”
In this situation, the hacking team has complete control over and access to whatever is going through this flytrap.
Tomato and Surfside
The leaked information on WikiLeaks also throws up some interesting details on the styles employed by the CIA while doing this hacking.
One such area is the use of techniques with codewords like Tomato and Surfside.
Tomato is being described as the tool used to target vulnerable routers and to acquire their passwords.
If some routers are difficult to access, the agency and its research team will go back to work on the hacking table and bring out the corrected key to obtain access.
Incidentally, some of the dedicated websites which carried these WikiLeaks revelations mention that they tried getting in touch with the router manufacturers, like D-Link, but the companies failed to respond to their queries.
This set of data does not have much full information on how the Surfside tool works for the agency in this hacking process.
More Malware Used
The massive amount of information published by WikiLeaks about CIA activities run into thousands of pages, and it is revealed that what has been discussed here on the hacking tools and firmware is just the tip of the iceberg.
The agency is a past-master in this game of hacking and has already developed many such malware for use in spying on practically any individual or any organization not only in the U.S., but anywhere in the world.