Slashdot Mirror
WikiLeaks Reveals A CIA LAN-Attacking Tool From 'Vault 7' (betanews.com)
An anonymous reader quotes BetaNews:
WikiLeaks continues to release revealing documents from its Vault 7 cache. This time around the organization introduces us to a CIA tool called Archimedes -- previously known as Fulcrum. As before, there is little to confirm whether or not the tool is still in active use -- or, indeed, if it has actually ever been used -- but the documentation shows how it can be installed on a LAN to perform a man-in-the-middle attack.
The manual itself explains how Archimedes works: "Archimedes is used to redirect LAN traffic from a target's computer through an attacker controlled computer before it is passed to the gateway. This enables the tool to inject a forged web server response that will redirect the target's web browser to an arbitrary location. This technique is typically used to redirect the target to an exploitation server while providing the appearance of a normal browsing session."
HotHardware notes that WikiLeaks "also provided the full documentation for Fulcrum, which goes into much greater detail about how the man-in-the-middle operation is conducted" -- including this instruction in the guide's "Management" section. "If you are reading this then you have successfully delivered the Fulcrum packages and provided the binaries with code execution. Hoorah! At this stage, there is not much to do other than sit back and wait."
The manual itself explains how Archimedes works: "Archimedes is used to redirect LAN traffic from a target's computer through an attacker controlled computer before it is passed to the gateway. This enables the tool to inject a forged web server response that will redirect the target's web browser to an arbitrary location. This technique is typically used to redirect the target to an exploitation server while providing the appearance of a normal browsing session."
HotHardware notes that WikiLeaks "also provided the full documentation for Fulcrum, which goes into much greater detail about how the man-in-the-middle operation is conducted" -- including this instruction in the guide's "Management" section. "If you are reading this then you have successfully delivered the Fulcrum packages and provided the binaries with code execution. Hoorah! At this stage, there is not much to do other than sit back and wait."
Putin is in the midst of a man in the middle attack on America. Trump's the Middle Man.
W00h00, they reinvented ettercap: /192.168.111.1/ /192.168.111.2/
# ettercap -i eth0 -T -M arp
What makes you think that Trump would want to stop this?
That shit about people projecting their own values onto Trump is the real deal, all right.
If this tool cannot support forging a response such that it appears to have come from the requested server then it would seem to have limited use. One of the reasons why X.509 certificates, which are the sort commonly used for SSL and HTTPS, are signed is to prevent a MITM from successfully impersonating the response by introducing a third party co-signer of the original certificate, namely the certificate authority. The situation could be complicated still further by the use of an encrypted point-to-point or site-to-site connection through SSH or VPN. This is the sort of tool that might work on a naive or unsophisticated target, but against an well informed and equipped adversary it would probably not suffice, unless it has the capability to punch through the security measures described above too, which would be impressive to say the least.
The hero of the people.
I was messing about with MSN session on the local lan well before this.
It's amazing how you can fuck up a conversation between two people by using regexps to replace the occasional word 'Hi' with 'Dude' and 'LOL' with 'fuck me'
Didn't Chuck beat Fulcrum in season 4?
Trump said he was going to stop this.
This sounds like a simple ARP poisoning attack? No big deal?
Almost every corporation in America uses the exact same technique to snoop and log employees' browsing habits. SSL MITM injection is nothing new at all.
IMHO as a none-expert.
Track and flag certificates, a certificate that's been seen all the time for a site is trusted, one that suddenly appears is untrusted. Indicate this to the user.
Remove the "valid-to" date. It defines a date where the certificate can legitimately be discarded and replaced. That is a date known to an attacker, it tells them when they can man in the middle attack. All certificates forward need to be issued with certs into the far distance. Neither party can change the cert without breaking the trust.
Self signed is not evil. If it's time that ultimately confirms the certificate, not the certificate authority.
Side note: I assume SNI was introduced for when servers run multiple virtual sites on the same IP address?? That won't change anytime soon given the limited IP addresses.
He also said Trumpcare was going to cover everyone.
You are welcome on my lawn.
Is this the sort of thing that allows them to turn anyone into a terrorist or pedophile, by sending whatever they want no matter what the actual request had been?
Perhaps not new to IT admins but quite new to the vast majority of computer users who were likely unaware such things were possible, being done by the US government, and possibly affecting their non-work Internet access. Documentation like this and the Snowden revelations also help put a quick stop to anyone trying to minimize the importance of the news, particularly by making fun of the critique along the 'tin-foil hat' line. It's critically important that people know what's being done in their name. As other WikiLeaks documents show governments do pernicious things (including mass surveillance and extrajudicial murder).
Digital Citizen
I am not surprised of this LAN tools and attacks within my LAN.
At home my old machines are being attacked by new Android devices which joins my network. I was always wondering why those newly bought Android devices keeps on attacking other endpoints on my LAN. This happened around 5 years ago, and I don't trust all devices on my LAN since then, even if they were newly bought and have default factory apps. I know something fishy with those android and Win7 machines in my LAN.
So if the tool is called Archimedes, does it use a bath-overflow exploit?
Yes, ettercap, ARP poisoning, etc... technically this is something that has been done before with other tools.
The importance of the publication is for detection/protection and for attribution. A lot of people will know who is/was after them, messing with their systems, etc.
Since we are talking about murderers, it is very good to know.
Where is the public benefit to this leak? If these tools were not being misused, isn't this just harming public security?
I'm not an American, but I'm not really sure 'Trumpcare' is what I'd like covering me under any circumstances.
Sure did
https://www.washingtonpost.com/politics/trump-vows-insurance-for-everybody-in-obamacare-replacement-plan/2017/01/15/5f2b1e18-db5d-11e6-ad42-f3375f271c9c_story.html?hpid=hp_hp-top-table-main_trump-interview-822pm%3Ahomepage%2Fstory&utm_term=.947feeb07e26