Slashdot Mirror
CIA Created 'CherryBlossom' Toolkit For Hacking Hundreds of Routers Models (bleepingcomputer.com)
An anonymous reader writes: After a two-week hiatus, WikiLeaks dumped new files as part of the Vault 7 series -- documents about a CIA tool named CherryBlossom, a multi-purpose framework developed for hacking hundreds of home router models. The tool is by far one of the most sophisticated CIA malware frameworks in the CIA's possession. The purpose of CherryBlossom is to allow operatives to interact and control SOHO routers on the victim's network. The tool can sniff, log, and redirect the user's Internet traffic, open a VPN to the victim's local network, execute actions based on predefined rules, alert operators when the victim becomes active, and more. A 24-page document included with the CherryBlossom docs lists over 200 router models from 21 vendors that the CIA could hack. The biggest names on this list are Apple, D-Link, Belkin, Aironet (Cisco), Linksys, and Motorola.
After a two-week hiatus, WikiLeaks dumped new files as part of the Vault 7 series -- documents about a CIA tool named CherryBlossom, a multi-purpose framework developed for hacking hundreds of home router models.
Wow! This is one cherry I wouldn't want to pop.
Thanks wikileaks you are really helping to write malware and infect many computers. North Korea and the Russian hackers owe you again. Please keep the good flow of illegal stolen information flowing.
Can't be any worse than the factory firmware. Sounds full featured!
Defense attorneys must be salivating at this news, right? The fact that so many different router models are exploitable just screams "reasonable doubt." Hundreds of different models of routers are affected. If the CIA could find and exploit these vulnerabilities, so could other people. Anyone being charged with a computer crime that doesn't have a physical nexus (e.g. DPR getting fake passports in the mail) should point to this information and say see, my router was hackable, anyone in the world could have gotten into my network and launched that DDoS | committed credit card fraud | etc.
Dear America, american citizens and agencies.
Please fuck off, and while you're at it, die.
Regards
Most of the rest of the world
For example Tomato, DD-WRT, OpenWRT, and all the variants that are so popular on commodity hardware.
It isn't the ones Russia leaked (leaked in 7 (or more) dumps to Wikileaks, that Assange has been systematically unlocking for maximum press) it's the ones they decided not to leak.
These dumps are from a Russian hack of the CIA, their hackers keep the best stuff for themselves. So this "backdoor in everyones router" isn't the best stuff, they still have those.
What it does is give everyone a wakeup call to fix their security holes and not trust their network kit.
I didn't see anything about DD-WRT flashed routers in the manual.
So maybe I'm good.
Admiral Mikey The Navy Man (NSA) is under fire as it is, NOW THIS!
NSA creates code as this, not CIA; they (CIA) are chump change.
The CIA is run by the State Department.
Likely Obama Sandinista are unhappy and are trying to undercut Tillerson and wreak Trump.
Well boys, having THIS code out is a very good thing!
Thanks To Wikileaks!
So the CIA uses its PoP to man in the middle traffic directed at router manufacturers firmware update sites and none of them simply checked the firmware signature before applying ?
This is pretty basic exploit and pretty basic check for the router manufacturers...
Been using pfSense for years now, glad to know the FreeBSD life style is still holding up better than commercial consumer bullshit!
A long new password won't help the device.
FlyTrap then connects to CherryTree.
Mission then sends down the tasks to the device.
CherryWeb is the GUI that looks over the new network.
Windex alters the computers browsers i.e. malware.
A copy of networked data via a new VPN.
Years of access.
Domestic spying is now "Benign Information Gathering"
This is certainly "unauthorized access to a computer system". So we're going to see people going to prison for this, right? Like I would, if I did something like that? ..... right?
Stanford Research Institute. Reading about what this "non-profit" does, and has done in the past for the government, is actually more interesting than the Cherry Blossom project they created. Oh, and the CNB (?) wanted SRI to use Fedora 14 for the CB platform, which, once again, reaffirms that the Red Hat product is the preferred OS of the Deep State. Freedom and privacy loving Red Hat sw devs must be so proud.
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Useful links:
The Intel ME subsystem can take over your machine, can't be audited
REcon 2014 - Intel Management Engine Secrets
Untrusting the CPU (33c3)
Towards (reasonably) trustworthy x86 laptops
30C3 To Protect And Infect - The militarization of the Internet
30c3: To Protect And Infect Part 2 - Mass Surveillance Tools & Software
1. Introduction, what is Intel ME
Short version, from Intel staff:
Re: What Intel CPUs lack Intel ME secondary processor?
Amy_Intel Feb 8, 2016 9:27 AM
The Management Engine (ME) is an isolated and protected coprocessor, embedded as a non-optional part in all current Intel chipsets, I even checked with the engineering department and they confirmed it.
Long version:
ME: Management Engine
The Intel Management Engine (ME) is a separate computing environment physically located in the MCH chip or PCH chip replacing ICH.
The ME consists of an individual processor core, code and data caches, a timer, and a secure internal bus to which additional devices are connected, including a cryptography engine, internal ROM and RAM, memory controllers, and a direct memory access (DMA) engine to access the host operating system's memory as well as to reserve a region of protected external memory to supplement the ME's limited internal RAM. The ME also has network access with its own MAC address through the Intel Gigabit Ethernet Controller integrated in the southbridge (ICH or
You can have a high degree of local machine security running something like slackware on a corebooted thinkpad but ever since i was a kid with my first cable modem that blinking black box has always spooked me.
Routers are almost always propriety telcom supplied, a real PIA to impossible to get open firmware for. Its just obvious. If they (three letter et. al) are going to hack you they will start with your router.
Public wifi (using someones elses router temporarily) is the only way to counter this attack.
-K
Good to see ubiquiti isn't on the list
Looks like all the routers on the list are very old. This tool is outdated? Or just the list of routers?
Page 24...
"Barring guidance from the Sponsor with regards to particular devices of interest, Cherry Blossom has attempted to support wireless network devices that are ubiquitous and readily available (at least in the US)."
Why does CIA care what is "ubiquitous" and "readily available" in the United States? Who are they targeting? Why would they waste considerable sums of time and effort developing cracked firmware images based on US market availability? Is the CIA's mission spying on Americans? Isn't this supposed to be "Illegal"?
http://appleinsider.com/articl...
Sounds like some obscure porn activity.
the routers listed are overwhelmingly American brands... I think I will stay with the Taiwanese brands of routers for now, and you should do the same if you care about your computer equipment.
Lets hope the absence of Netgear from the router list means my Netgear DGN2200M isn't vulnerable...
Snowden blew the whistle on NSA wrongdoing. This isn't wrongdoing, it's the toolset of a public security agency that wasn't using them to violate the law or the rights of the people it defends, and now can't use at all.
Sorry, but many Netgear routers can be unstable due to hardware issues. I have personally replaced three different Netgear devices in the last two months. For instance, cable modems based on Intel's Puma 6 chipset
So what if the CIA was using these tools to spy on the the British, the Germans, the French, the Chinese, the Russians, the Italians, the Greeks, the Spaniards, the ...
No one really lives in those countries and cares anyway, right? Or at least they do not matter. And telling those people that they are being spied on is just wrong. As inferior people, they should expect this. It is good for them.
The U.S. is becoming itself the evil axis because it did create the massive destruction weapons in the cyberworld.
what do we expect about it? Massively more victims from untrusted routers & computers.
Did a quick scan of the attached user manual and from the table of contents, alone, I'm skeptical of its authenticity...
If the (U) and (S) of items in the table of contents refer to (Unclassified) or (Secret) classifications, then the author of the document should have their security clearance revoked.
Whenever a document contains multiple classifications, the document as a whole is classified at the strictest level; for example, if you have a document that is comprised of all Unclassified material except for one sentence that is classified Secret, the entire document is classified Secret. Looking at the table of contents, this is violated heavily. If the individual components are referred to by their security clearance, the overarching chapters are often misclassified. Any chapter containing a subelement that is (S)ecret means the chapter, as a whole should be (S)ecret, but this isn't followed (particularly for chapters 11-13).
They want to be able to say you committed any crime whenever they need to. That's all. If you have to be guilty, they'll decide it.
Another day in 1984.
See subject: AMT/Intel Mgt. Engine uses ports 16992-16995 & I only allow 80, 8080 & 443 in/out here on a SINGLE stand-alone system + be CERTAIN your router's internal ware is "solid" as well (turn off things like UPnP etc.) & check it HAS NO KNOWN BACKDOOR EXPLOITS (tons do unfortunately) - get it patched ASAP if it's KNOWN exploited & TONS of routers, ARE https://it.slashdot.org/commen...
* GOOD ROUTERS/MODEMS HAVE PORT FILTERING OPTIONS (crappy ones do not).
APK
P.S.=> Good luck - as it's the BEST DEFENSE vs. this threat by stopping it being able to communicate in/out period, outside of the INTEL chipset, & stopped external to it via a router/firewall hardware... apk
https://www.documentcloud.org/documents/3031640-05-Introduction-to-WLAN-CNE-Operations-Redacted.html
https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowden-documents-confirm/
Did not one of you nerds read Sam Biddle's leak of Snowden doc back in August 2016?
NSA BADDECISION is some kind of low level radio protocol exploit against all WiFi.
WPA2 included.
NSA SECONDDATE is when they mount BADDECISION on a prop plane. Prrsumably to record and infect all WiFi city-wide.
SECONDDATE is also described in the TAO ANT Catalogue.
In those slides it says NSA's weapon of choice to hack sysadmins is SECONDDATE. They hacked Syria's National telecom in 2006 by infecting their core backbone peer exchange. NSA had such detailed maps of the data center, they even had the names of the sysadmins on their chairs!
What is remarkable about CHERRYBLOSSOM is that apparently CIA is not trusted to get BADDECISION, i stead they get hand me downs of shitty firmware update exploits.
I can't believe they didn't just use QUANTUMINSERT which would be infinitely easier to pwn all routers which download their formware update via http.
Worst of all, Sam Biddle leaked those Snowden docs but never even mentioned the WiFi mass exploitation. He didn't read them! And nobody who read his article read the damned pdfs either!
We're all being led off the cliff by lemmings. Security and Infosec "experts" are asleep at the wheel. Cash your 6 figure paycheck, don't rock the boat, go along with the illusion of security because hey, NSA has already hacked everything anyways, so really we're all sleeping on their secure cushion and powerless to effect change ourselves, so why not just go with the flow?
Enjoy your LARPfest at Deaf-cons, tell folks you're a White Hat Ethical Hacker, get drunk in the Penthouse party on the $MegaCorp dime, and maybe even fuck a stripper in the Champagne room.
It doesn't matter because it's all fake security anyways.