WikiLeaks #Vault7 confirms CIA can effectively bypass Signal + Telegram + WhatsApp + Confide encryption https://wikileaks.org/ciav7p1
The link in that tweet takes you to a WikiLeaks’ press release, where the organization details their latest leak, “Vault 7”: 8,761 documents supposedly outlining a vast number of secret C.I.A. hacking tools and methods. The data dump covers 2013 to 2016, and WikiLeaks is calling it, “the largest ever publication of confidential documents on the agency.”
From this dump, the most reported bits are related to dozens of exploits and malware the C.I.A. is claimed to have used in targeting smart devices and operating systems. To start, there’s “Weeping Angel”, an attack aimed at Samsung smart TVs:
After infestation, Weeping Angel places the target TV in a ‘Fake-Off’ mode, so that the owner falsely believes the TV is off when it is on. In ‘Fake-Off’ mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server.
That’s another hard hit against smart TVs, which only seem to get press for creepy privacy violations. Last month, VIZIO agreed to settle charges that unauthorized tracking of user’s watching habits violated the law. Next month, I can only assume we’ll read about smart TVs that secretly analyze the best times for telemarketers to robocall you.
Also heavily reported in the leak were details about C.I.A.-created malware that was used to infect iOS and Android devices:
These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the “smart” phones that they run on and collecting audio and message traffic before encryption is applied.
The above pull quote, coupled with the aforementioned @WikiLeaks’ tweet, are where I want to focus for the moment.
There’s nothing insignificant about the information WikiLeaks released, but it’s deceiving to say the C.I.A. “can effectively bypass Signal + Telegram + WhatsApp + Confide encryption”. The named apps, and their underlying encryption, were not compromised; the device itself was. Encrypted messaging app Telegram detailed the difference in a blog post, emphasis theirs:
This is not an app issue. It is relevant on the level of devices and operating systems like iOS and Android. For this reason, naming any particular app in this context is misleading.
Even the New York Times failed to clarify this distinction, and deleted the original tweet to their story, in order to “provide more context”. The deleted tweet:
WikiLeaks release said CIA managed to bypass encryption on popular services such as Signal, WhatsApp, and Telegram
The new one, emphasis mine:
WikiLeaks release said CIA managed to bypass encryption in mobile apps by compromising the entire phone
Greg Miller and Ellen Nakashima, of the Washington Post, got it right:
In a statement, WikiLeaks said the files enable the agency to bypass popular encryption-enabled applications — including WhatsApp, Signal and Telegram — used by millions of people to safeguard their communications.
But experts said that rather than defeating the encryption of those applications, the CIA’s methods rely on exploiting vulnerabilities in the devices on which they are installed, a method referred to as “hacking the endpoint.”
This distinction might appear to be an issue of semantics. If my “phone” is compromised, what does it matter if it’s the OS or the apps? However, understanding the difference between a compromised device and broken encryption is important. Encryption is hard, if not impossible, to break. The fact that the C.I.A. is now resorting to and focusing on device-level attacks only indicates the strength of our current encryption methods.
That said, a phone running malware-infested iOS or Android offers the same protection as letting a stranger use your device unlocked; encryption matters little if the attacker can see every keypress before it’s been encrypted. WikiLeaks noted multiple of these device-level exploits, 14 for iOS alone, classifying them as undisclosed vulnerabilities or “zero days”.
This all seems incredibly serious, but how authentic are these documents? Yesterday, the New York Times asked the C.I.A., but a spokesman, Dean Boyd, said, “We do not comment on the authenticity or content of purported intelligence documents.” However, also yesterday, when asked about the leak, Apple provided a statement to April Glaser at Recode, indicating that some of the noted iOS vulnerabilities did exist:
While our initial analysis indicates that many of the issues leaked today were already patched in the latest iOS, we will continue work to rapidly address any identified vulnerabilities. We always urge customers to download the latest iOS to make sure they have the most recent security updates.
8,761 documents is a lot of data to dig through, so expect the reverberations of this leak to continue for a while. However, if the documents are genuine, it appears the C.I.A. has been slowly strengthening its ability to gain unauthorized access to any number of smartphones and devices, with intent to capture private data before it’s been encrypted. Unless you’re a journalist, work in government, or are simply unlucky, there’s a chance you haven’t been targeted. At this point though, it’s hard to say with any certainty to what extent or how often these tools have been used.
In the meantime, basic security advice still stands: update all your software and operating systems to the latest versions, enable two-factor authentication for your primary email address and important online accounts, and continue to rely on encrypted messaging apps for communicating sensitive information. These steps might not stop the C.I.A., but taking simple security seriously makes it harder on anyone without the resources of the United States government.