NyanCat may never be looked at the same way again.

This article is meant to comprehensively break down the enormous material of Vault7's "Year Zero" into something more meaningful to readers less familiar with this technical material. Some highlights include the ability to manipulate cars, TVs, and your computer without you ever noticing and having your passwords stored on a "NyanCat".

Vault 7 is a series of WikiLeaks releases on the CIA and the methods and means they use to hack, monitor, control and even disable systems ranging from smartphones, to TVs, to possibly even dental implants. The Vault7 leaks themselves can be found on WikiLeaks.

More Vault 7 research can also be found on the Pizzagate Wiki's Vault 7 page.

Branches

The following are the different branches or departments of the CIA Information Operations Center and their purpose as well as the relevant tools or projects they are credited with developing or participating in.

Embedded Development Branch (EDB)

Mission:

To be the premiere development shop for customized hardware and software solutions for Information Operations: utilizing operating system knowledge, hardware design, software craftsmanship, and network expertise to support the IOC Mission.

Source: WikiLeaks

• DerStarke
• YarnBall
• SnowyOwl
• HarpyEagle
• Weeping Angel
• Gyrfalcon
• HIVE
• Sparrowhawk
• MaddeningWhispers
• Bee Sting

Remote Development Branch (RDB)

• UMBRAGE

Operational Support Branch (OSB)

• Flash Bang
• Fight Club/RickyBobby
• Taxman
• Improvise
• Fine Dining
• HammerDrill v2.0

Automated Implant Branch (AIB)

• Assassin
• Frog Prince
• Grasshopper

Network Devices Branch (NDB)

• JQJSTEPCHILD
• Perseus/MikroTik

Mobile Development Branch (MDB)

Technical Advisory Council (TAC)

CCI Europe Engineering

Tools and projects

The following are software tools released in Vault7 and used by the CIA along with descriptions of their methods, reasons and implications for employment. They have been organized by the branch of which developed them.

EDB

Weeping Angel

Weeping Angel is a complex suite of software which gives the user multiple tools and vectors for attacking, monitoring and listening to a target machine, including Smart TVs.(1)

Weeping Angel is able to:(2)

• Extract browser credentials or history
• Extract WPA/WiFi credentials
• Insert Root CA cert to facilitate MitM of browser, remote access, or Adobe application
• Investigate the Remote Access feature
• Investigate any listening ports & their respective services
• Attempt to override /etc/hosts for blocking Samsung updates without DNS query and iptables (referred to by SamyGo)
• Add ntpclient update calls to startup scripts to sync implant's system time for accurate audio collection timestamps

Gyrfalcon

Gyrfalcon is a Linux tool that ptraces an OpenSSH client collecting username, password, TCP/IP connections, and session data.(3)

HIVE

HIVE is a multi-platform CIA malware suite and its associated control software. The project provides customizable implants for Windows, Solaris, MikroTik (used in internet routers) and Linux platforms and a Listening Post (LP)/Command and Control (C2) infrastructure to communicate with these implants.

The implants are configured to communicate via HTTPS with the webserver of a cover domain; each operation utilizing these implants has a separate cover domain and the infrastructure can handle any number of cover domains.

Each cover domain resolves to an IP address that is located at a commercial VPS (Virtual Private Server) provider. The public-facing server forwards all incoming traffic via a VPN to a 'Blot' server that handles actual connection requests from clients. It is setup for optional SSL client authentication: if a client sends a valid client certificate (only implants can do that), the connection is forwarded to the 'Honeycomb' toolserver that communicates with the implant; if a valid certificate is missing (which is the case if someone tries to open the cover domain website by accident), the traffic is forwarded to a cover server that delivers an unsuspicious looking website.

The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer, so the toolserver acts as a C2 (command and control) server for the implant.

Similar functionality (though limited to Windows) is provided by the RickBobby project.

Source: WikiLeaks

Sparrowhawk

Sparrowhawk's goal was to collect user-entered keystrokes from any system terminal, and collate in a unified format across multiple Unix platforms.(4)

HarpyEagle

HarpyEagle is a tool designed to gain root access on an Apple Airport Extreme and Time Capsule via local and/or remote means to install a persistent rootkit into the flash storage of the devices.(5)

Facedancer21, a component of HarpyEagle, is a client for keyboard emulation. You are able to send keystrokes to the host computer as if you were typing them into a keyboard.(6)

DerStarke

DerStarke appears to be a suite for discretely and persistently monitoring a target device, allowing the attacker to discretely connect to the Internet and thus beacon back to the attacker's device. Unlike typical Windows packages which do similar things, DerStarke was developed for Mac OSX Mavericks.(7)

YarnBall

YarnBall is a client for intercepting USB keyboard traffic for keylogging purposes on primarily Apple devices. The user can then move this data to a discrete storage device curiously labeled as, NyanCat:

Investigate on communication with NyanCat through USB Async/Sync data methods (Would allow larger than 64 byte commands to NyanCat)

Source: WikiLeaks

SnowyOwl

SnowyOwl is a Mac OS X tool that injects a pthread into an OpenSSH client process creating a surreptitious sub-channel to the remote computer.(8)

Bee Sting

Bee Sting is a discrete tool for injecting data in to iFrame media.(9) This would be coupled with something like Flash Bang to deliver a payload discretely through iFrame media (embedded videos, games, etc.).

MaddeningWhispers

MaddeningWhispers is a peculiar set of tools that allow the user to remotely access and beacon a target "Vanguard-based" device. The user is then able to run a command-line client on the target machine and use it as a beacon/listening post and can also manipulate USB devices on the same bus.(10)

RDB

UMBRAGE

The CIA's hand crafted hacking techniques pose a problem for the agency. Each technique it has created forms a "fingerprint" that can be used by forensic investigators to attribute multiple different attacks to the same entity.

This is analogous to finding the same distinctive knife wound on multiple separate murder victims. The unique wounding style creates suspicion that a single murderer is responsible. As soon one murder in the set is solved then the other murders also find likely attribution.

The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation.

With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the "fingerprints" of the groups that the attack techniques were stolen from.

UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques.

Source: WikiLeaks

OSB

Flash Bang

Flash Bang is a tool designed to be able to migrate from a browser process (using sandbox breakout), escalate privileges, and memory load a NOD Persistence Spec dll.(11) This basically hacks target system and sets up persistent backdoor through iframe media (embedded videos, games, etc.).

Fight Club/RickyBobby

Fight Club is loaded onto sections of the target system where a set of future actions can be taken. RickyBobby then allows constant monitoring of the network Fight Club is loaded on and performs persistent tasks.(12)

Agents would load a customized malware payload with Fight Club on USB for physical delivery. Software would be loaded onto target's system discretely by disguising itself as WinRAR, VLC Media Player, and more. Nicknames for each, customized payload included MelomyDropkick (TrueCrypt), MelomyRoundhouse (VLC Player), MelomyLeftHook (Shamela) and MelomyKarateChop (WinRar).(13)

Taxman

Taxman is awesome. 'Nuff said.

Source: WikiLeaks

Improvise

'Improvise' is a toolset for configuration, post-processing, payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender), MacOS (JukeBox) and Linux (DanceFloor). Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies.

Source: WikiLeaks

Fine Dining

Fine Dining comes with a standardized questionnaire i.e menu that CIA case officers fill out. The questionnaire is used by the agency's OSB (Operational Support Branch) to transform the requests of case officers into technical requirements for hacking attacks (typically "exfiltrating" information from computer systems) for specific operations. The questionnaire allows the OSB to identify how to adapt existing tools for the operation, and communicate this to CIA malware configuration staff. The OSB functions as the interface between CIA operational staff and the relevant technical support staff.

Among the list of possible targets of the collection are 'Asset', 'Liason Asset', 'System Administrator', 'Foreign Information Operations', 'Foreign Intelligence Agencies' and 'Foreign Government Entities'. Notably absent is any reference to extremists or transnational criminals. The 'Case Officer' is also asked to specify the environment of the target like the type of computer, operating system used, Internet connectivity and installed anti-virus utilities (PSPs) as well as a list of file types to be exfiltrated like Office documents, audio, video, images or custom file types. The 'menu' also asks for information if recurring access to the target is possible and how long unobserved access to the computer can be maintained. This information is used by the CIA's 'JQJIMPROVISE' software to configure a set of CIA malware suited to the specific needs of an operation.

Source: WikiLeaks

HammerDrill v2.0

HammerDrill is a CD/DVD collection tool that collects directory walks and files to a configured directory and filename pattern as well as logging CD/DVD insertion and removal events. v2.0 adds a gap jumping capability that Trojans 32-bit executables as they are being burned to disc by Nero. Additionally, v2.0 adds an status, termination and an on-demand collection feature controlled by HammerDrillStatus.dll, HammerDrillKiller.dll and HammerDrillCollector.dll. The logging now also fingerprints discs by hashing the first two blocks of the ISO image, which enables unique identification of multi-sessions discs even as data is added and removed. The log also logs anytime a HammerDrill trojaned binary is seen on a disc.(14)

AIB

Assassin

The exact purpose of this tool is yet unknown, but it was listed under the hacking tools for Automated Implants Branch.(15)

Frog Prince

A tool for testing and manipulating FI implants. Values can also be get and set through Frog Prince, thus the system can be overridden, manipulated and even disabled.(16)

Grasshopper

Grasshopper is a modular tool used to install software IO tools on targets running Microsoft Windows operating systems. Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). Installers may be configured with rules that will be evaluated on target to determine whether to conduct an install.(17)

NDB

JQJSTEPCHILD

JQJSTEPCHILD appears to be either a tool or a project to discretely exploit and take over Cisco 2911 routers.(18)

Perseus/MikroTik

The NDB appears to have been involved in trying to exploit vulnerabilities in MikroTik's Hotspot and Paywall networking features and MikroTik routers.(19) It appears these are in use in Latvia and other European countries.(20)

The software tool used to do this appears to have been primarily Perseus.(21)