Slashdot Mirror
WikiLeaks Dump Reveals CIA Malware For Tracking Windows Devices Via WiFi Networks (bleepingcomputer.com)
WikiLeaks has published the documentation manual for an alleged CIA tool that can track users of Wi-Fi-capable Windows devices based on the Extended Service Set (ESS) data of nearby Wi-Fi networks. According to the tool's 42-page manual, the tool's name is ELSA. Bleeping Computer has an image embedded in its report that explains how the tool works. There are six steps that summarize the ELSA operation. Bleeping Computer reports: Step 1: CIA operative configures ELSA implant (malware) based on a target's environment. This is done using a tool called the "PATCHER wizard," which generates the ELSA payload, a simple DLL file.
Step 2: CIA operative deploys ELSA implant on target's Wi-Fi-enabled Windows machine. Because ELSA is an implant (malware), the CIA operator will likely have to use other CIA hacking tools and exploits to place the malware on a victim's PC.
Step 3: The implant begins collecting Wi-Fi access point information based on the schedule set by the operator. Data collection can happen even if the user is disconnected from a Wi-Fi network.
Step 4: When the target user connects to the Internet, ELSA will take the collected Wi-Fi data and query a third-party database for geolocation information.
Step 5: The CIA operative connects to the target's computer and fetches the ELSA log. This is done via the tools that allowed the operator to place ELSA on his system, or through other tools.
Step 6: The operator decrypts the log and performs further analysis on their target. Optionally, he can use the collected WiFi data to query alternate EES geo-location databases, if he feels they provide a better accuracy.
Step 2: CIA operative deploys ELSA implant on target's Wi-Fi-enabled Windows machine. Because ELSA is an implant (malware), the CIA operator will likely have to use other CIA hacking tools and exploits to place the malware on a victim's PC.
Step 3: The implant begins collecting Wi-Fi access point information based on the schedule set by the operator. Data collection can happen even if the user is disconnected from a Wi-Fi network.
Step 4: When the target user connects to the Internet, ELSA will take the collected Wi-Fi data and query a third-party database for geolocation information.
Step 5: The CIA operative connects to the target's computer and fetches the ELSA log. This is done via the tools that allowed the operator to place ELSA on his system, or through other tools.
Step 6: The operator decrypts the log and performs further analysis on their target. Optionally, he can use the collected WiFi data to query alternate EES geo-location databases, if he feels they provide a better accuracy.
CIA don't waste their time with linux?
As spying tools go, this one is pretty minor. It doesn't do anything unless you already have root access to the target computer. If you have access to the target computer, you can already probably find out pretty much everything you need anyway.
Linux FTW!
....as if we still needed one.
If you're dumb enough to allow (or make it possible for) physical access to your computer by the CIA, you're already fucked.
Looks like the CIA has completely pwned Windows and of course, now the whole world has access. Windows has never been secure and only a fool would plan to keep using Windows. Wake up, morons!
I don't read your sig. Why are you reading mine?
Is this legal ? Can a "third party" take location data from my Wifi ? What if I am outside of USA can they sell my location to CIA?
Except those come factory-installed on mobile devices.
How is this different from location services on Android or the Iphone? You -know- those are uploaded to Google and Apple regularly.
First to fail.
CIA operative performs a man in the middle attack on the currently playing youtube/twitch video stream and replaces it by let it go.
They need the genius brains of the CIA for this?
Location tracking of a machine isn't super hard, especially if you have root access to it (which is required both to install this malware and to exfiltrate data).
The mechanism here isn't super sophisticated. Apple and Google already have the means to use local wifi networks to "improve" location info, so the technique's not novel.
ShadowBrokers aren't doing their "zomg we've got all the sploits! Pay us for access!" Business any favors if this is the best teaser they can offer.
The source of all your wisdom.
Grow up already, beauhd.
And I want you all to know that we released these alleged hacks that were allegedly produced by the CIA on PURPOSE. Not in some gay ass attempt to make Trump look bad, but we did it so a friendly organization that has a time machine can use these hacks to give us information. If this post disappears, that means the CIA arranged to have one of my ancestors killed. The Terminator movies weren't about cyborgs... THEY WERE ABOUT THE CIA!!! SKYNET = CIA
With the new Windows Telemetry Apparatus, Redmond collects all this information with no additional exploitation. Additionally, the telemetry is harder to defend from than this "malware".
This is why radios and, for that matter, sensors, need hardware on/off switches.
Turn off the radios and sensors such as motion sensors, compasses, microphones, and cameras when not in use and you make it very very difficult if not impossible to track your location.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Do you mean SuSELinux?
You can play your part in this with WINE.
So what's the name of the DLL?
If you have access to the target computer, you can already probably find out pretty much everything you need anyway.
People have lives outside their computers. This is for tracking criminals' location without using GPS, which is information that isn't already stored on a target computer.
Who said anything about criminals?
My beliefs do not require that you agree with them.
So, in other words, doing what we pay them to do.