Slashdot Mirror
WikiLeaks Dump Reveals CIA Malware For Tracking Windows Devices Via WiFi Networks (bleepingcomputer.com)
WikiLeaks has published the documentation manual for an alleged CIA tool that can track users of Wi-Fi-capable Windows devices based on the Extended Service Set (ESS) data of nearby Wi-Fi networks. According to the tool's 42-page manual, the tool's name is ELSA. Bleeping Computer has an image embedded in its report that explains how the tool works. There are six steps that summarize the ELSA operation. Bleeping Computer reports: Step 1: CIA operative configures ELSA implant (malware) based on a target's environment. This is done using a tool called the "PATCHER wizard," which generates the ELSA payload, a simple DLL file.
Step 2: CIA operative deploys ELSA implant on target's Wi-Fi-enabled Windows machine. Because ELSA is an implant (malware), the CIA operator will likely have to use other CIA hacking tools and exploits to place the malware on a victim's PC.
Step 3: The implant begins collecting Wi-Fi access point information based on the schedule set by the operator. Data collection can happen even if the user is disconnected from a Wi-Fi network.
Step 4: When the target user connects to the Internet, ELSA will take the collected Wi-Fi data and query a third-party database for geolocation information.
Step 5: The CIA operative connects to the target's computer and fetches the ELSA log. This is done via the tools that allowed the operator to place ELSA on his system, or through other tools.
Step 6: The operator decrypts the log and performs further analysis on their target. Optionally, he can use the collected WiFi data to query alternate EES geo-location databases, if he feels they provide a better accuracy.
Step 2: CIA operative deploys ELSA implant on target's Wi-Fi-enabled Windows machine. Because ELSA is an implant (malware), the CIA operator will likely have to use other CIA hacking tools and exploits to place the malware on a victim's PC.
Step 3: The implant begins collecting Wi-Fi access point information based on the schedule set by the operator. Data collection can happen even if the user is disconnected from a Wi-Fi network.
Step 4: When the target user connects to the Internet, ELSA will take the collected Wi-Fi data and query a third-party database for geolocation information.
Step 5: The CIA operative connects to the target's computer and fetches the ELSA log. This is done via the tools that allowed the operator to place ELSA on his system, or through other tools.
Step 6: The operator decrypts the log and performs further analysis on their target. Optionally, he can use the collected WiFi data to query alternate EES geo-location databases, if he feels they provide a better accuracy.
CIA don't waste their time with linux?
As spying tools go, this one is pretty minor. It doesn't do anything unless you already have root access to the target computer. If you have access to the target computer, you can already probably find out pretty much everything you need anyway.
Except those come factory-installed on mobile devices.
How is this different from location services on Android or the Iphone? You -know- those are uploaded to Google and Apple regularly.
CIA operative performs a man in the middle attack on the currently playing youtube/twitch video stream and replaces it by let it go.
Geolocation is easy.
https://en.wikipedia.org/wiki/...
The Geolocation of your wifi is already well known. I know where you are, by what APs are nearby. Often, within a few meters. On your Android Phone, there is even a setting that allows better GPS Geolocation by pairing it with Wifi Signals.
Location outside of the US is just as easy as being inside. And yes, the internet works outside the US too!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
With the new Windows Telemetry Apparatus, Redmond collects all this information with no additional exploitation. Additionally, the telemetry is harder to defend from than this "malware".
This is why radios and, for that matter, sensors, need hardware on/off switches.
Turn off the radios and sensors such as motion sensors, compasses, microphones, and cameras when not in use and you make it very very difficult if not impossible to track your location.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I gladly would. They may even take all the data with them.
Provided I get to choose which computer they take from me.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'm not convinced that they need physical access. From TFS:
Step 2: CIA operative deploys ELSA implant on target's Wi-Fi-enabled Windows machine.
'Deploy' might involve other then physical access. Open an e-mailed document with embedded malware for example.
Have gnu, will travel.
If you have access to the target computer, you can already probably find out pretty much everything you need anyway.
People have lives outside their computers. This is for tracking criminals' location without using GPS, which is information that isn't already stored on a target computer.
Who said anything about criminals?
My beliefs do not require that you agree with them.