Today WikiLeaks released another set of Vault 7 documents, this time on "Weeping Angel" - an implant designed for Samsung F Series Smart Televisions. This would be the second major CIA tool which notably references the British television show, Dr. Who, alongside "Sonic Screwdriver" in Dark Matter.
The tools in Weeping Angel allow the CIA to record audio from the built-in microphones of these TVs in addition to exfiltrating and storing data on their memory. Weeping Angel was derived from yet another tool called "Extending" which was originally developed by the British intelligence agency, MI5.
The classification marks of the User Guide, namely "UK EYES ONLY", hint that is was originally written by the MI5/BTSS and later shared with the CIA. Both agencies collaborated on the further development of the malware and coordinated their work in Joint Development Workshops.
This article will break down Weeping Angel bit by bit, but the original documents from WikiLeaks can be found here.
Other parts to this series include:
- Part I: The CIA and NyanCat: The hackers and tools of Vault 7's "Year Zero"
- Part II: "Dark Matter" - All your Macintosh are belong to CIA
- Part III: Marble Framework - The CIA's cloaking device for hackers
- Part IV: Grasshopper and more research challenges!
- Part V: HIVE, Longhorn and the CIA's reign of cyberterror
Extending
As mentioned earlier the entirety of Weeping Angel was based on British spyware known as Extending. Extending is configured on a Linux PC, and then deployed onto the TV using a USB stick. Audio files can then be extracted using a USB stick or setting up a Wi-Fi hotspot with-in range of the TV. It is also possible to listen to audio exfiltration live, using the Live Listen Tool, designed for use on a Windows OS. The implant can be uninstalled by inserting a USB stick into the TV or configuring a Death Date.
Essentially the operative must have "close access" to the TV system itself in order to physically load the malware. Afterwards, however, audio and data exfiltration can be accessed remotely. One particularly unnerving feature of Extending was its ability to "fake-off record":
EXTENDING will continue to record audio, even whilst the TV appears to be off. This is achieved by intercepting the command for the TV to switch-off and turning off the TV screen, leaving the processor running.
Methods of detection and weaknesses
Documentation for Extending includes several "known issues" and bugs which make the operation of Extending apparent to the target or hinder Extending's functions:
Microphone Sharing
The current implant cannot share the microphone with other applications. Therefore if Voice Recognition is turned on, or if an application such as Skype is started, our application will close its access to the microphone. When the other application stops using the microphone again, EXTENDING will start recording again. In future releases of the implant we will be able to record from the microphone simultaneously with other applications.
Fake-off – TV Communications
When the TV is in Fake-off mode the processor functionality has not been limited. Practically, this means that the TV will still flash the LEDs on USB drives when they are inserted and continue to send packets on the network. Many Smart TVs do this as part of their functionality; however Samsung TVs do not normally. As an improvement for the next release of the implant we hope to reduce the processor functionality when the implant enters Fake-off mode. This will involve just recording from the TV, and only connecting to the SSIDs set in the implant Settings file.
Fake-off – LED
When the TV is in Fake-off mode the “Samsung” LED at the front and centre of the TV remains on.
Wi-Fi Interference
The EXTENDING implant will interrupt a user’s use of the wireless card on the TV. If a target is
connected to their home wireless network, then EXTENDING will break this connection when it detects the presence of the SSID it wishes to connect to.
audioRecordingMode=0
When operating in audioRecordingMode=0 (not recording any audio) the implant will stop running when fake-off mode is entered. The source of this problem has been located and will be fixed in the next release.
Lag before application starts
The implant is started by the TV when the TV powers on. It can take up to 30 seconds from the user turning the TV on for EXTENDING to start running. As the exploit relies on being started by the TV then there is no way to avoid this.
A Side-effect of this is that if the user turns the TV on and then off quickly and before EXTENDING has started up, then the TV does not enter Fake-off mode. The next time the TV is turned on, the implant will still start as normal, however we will have missed a period of Fake-off recording.
Smart HUB setup
To install our application the Smart HUB needs to be setup and the license agreements accepted. It is only possible to do this with an internet connection.
Smart HUB Storage Available
When on the Smart Hub “More Apps” page the available storage space is shown in the bottom right hand corner. If the implant is configured to record audio to the “mtd_rwcommon” folder area, then this storage will appear fuller as the implant records audio. However it is impossible to discover what is using this storage without exploiting the TV to gain command line access. Limiting the “storageFoldermaxStorage” setting has reduced the potential impact of this.
