BREAKING: Wikileaks Releases ‘Vault 7’ Part 1 – ‘Year Zero’21st Century Wire says WikiLeaks has released its largest ever publication of confidential documents on the Central Intelligence Agency. Entitled  Vault 7  and containing a password that echoed the alleged JFK quote  splinter the CIA into a thousand pieces and scatter it into the winds,  this leak comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA s Center for Cyber Intelligence in Langley, Virginia. Year Zero , which is part one of the leak and conveniently named after a  zero day  exploit used by intelligence agencies, was gathered throughout 2016 and is said to be the  largest intelligence publication in history .Whilst a lot of the information and methodology outlined in  Year Zero  is of no surprise to security analysts and researchers since the Edward Snowden (image, left) revelations, once again the public has explicit confirmation of how one of the most powerful intelligence agencies in the world, aided by their international counterparts like GCHQ, have been infiltrating and scooping vast quantities of private information from Apple and Android devices right up to Samsung  Smart TV  technology where false  stand-by  modes and live microphones can be executed to record information and send it back to the appropriate servers.This document dump is a game changer, because not only does the world know what they ve done, we now know how they ve done it.Based on the CIA s own documents, how do we know it wasn t the CIA themselves behind various  Russian  hacking conspiracies circling around Trump? The questions are proliferating as we speak.More on this report from Wikileaks  Wikileaks  Today, Tuesday 7 March 2017, WikiLeaks begins its new series of leaks on the U.S. Central Intelligence Agency. Code-named  Vault 7  by WikiLeaks, it is the largest ever publication of confidential documents on the agency.The first full part of the series,  Year Zero , comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA s Center for Cyber Intelligence in Langley, Virgina. It follows an introductory disclosure last month of  CIA targeting French political parties and candidates in the lead up to the 2012 presidential election.Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized  zero day  exploits, malware remote control systems and associated documentation. This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive. Year Zero  introduces the scope and direction of the CIA s global covert hacking program, its malware arsenal and dozens of  zero day  weaponized exploits against a wide range of U.S. and European company products, include Apple s iPhone, Google s Android and Microsoft s Windows and even Samsung TVs, which are turned into covert microphones.Since 2001 the CIA has gained political and budgetary preeminence over the U.S. National Security Agency (NSA). The CIA found itself building not just its now infamous drone fleet, but a very different type of covert, globe-spanning force   its own substantial fleet of hackers. The agency s hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA s hacking capacities.By the end of 2016, the CIA s hacking division, which formally falls under the agency s Center for Cyber Intelligence (CCI), had over 5000 registered users and had produced more than a thousand hacking systems, trojans, viruses, and other  weaponized  malware. Such is the scale of the CIA s undertaking that by 2016, its hackers had utilized more code than that used to run Facebook. The CIA had created, in effect, its  own NSA  with even less accountability and without publicly answering the question as to whether such a massive budgetary spend on duplicating the capacities of a rival agency could be justified.In a statement to WikiLeaks the source details policy questions that they say urgently need to be debated in public, including whether the CIA s hacking capabilities exceed its mandated powers and the problem of public oversight of the agency. The source wishes to initiate a public debate about the security, creation, use, proliferation and democratic control of cyberweapons.Once a single cyber  weapon  is  loose  it can spread around the world in seconds, to be used by rival states, cyber mafia and teenage hackers alike.Julian Assange, WikiLeaks editor stated that  There is an extreme proliferation risk in the development of cyber  weapons . Comparisons can be drawn between the uncontrolled proliferation of such  weapons , which results from the inability to contain them combined with their high market value, and the global arms trade. But the significance of  Year Zero  goes well beyond the choice between cyberwar and cyberpeace. The disclosure is also exceptional from a political, legal and forensic perspective. Wikileaks has carefully reviewed the  Year Zero  disclosure and published substantive CIA documentation while avoiding the distribution of  armed  cyberweapons until a consensus emerges on the technical and political nature of the CIA s program and how such  weapons  should analyzed, disarmed and published.Wikileaks has also decided to redact and anonymise some identifying information in  Year Zero  for in depth analysis. These redactions include ten of thousands of CIA targets and attack machines throughout Latin America, Europe and the United States. While we are aware of the imperfect results of any approach chosen, we remain committed to our publishing model and note that the quantity of published pages in  Vault 7  part one ( Year Zero ) already eclipses the total number of pages published over the first three years of the Edward Snowden NSA leaks.CIA malware and hacking tools are built by EDG (Engineering Development Group), a software development group within CCI (Center for Cyber Intelligence), a department belonging to the CIA s DDI (Directorate for Digital Innovation). The DDI is one of the five major directorates of the CIA (see this  organizational chart of the CIA for more details).The EDG is responsible for the development, testing and operational support of all backdoors, exploits, malicious payloads, trojans, viruses and any other kind of malware used by the CIA in its covert operations world-wide.The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell s 1984, but  Weeping Angel , developed by the CIA s Embedded Devices Branch (EDB), which infests smart TVs, transforming them into covert microphones, is surely its most emblematic realization.The attack against Samsung smart TVs was developed in cooperation with the United Kingdom s MI5/BTSS. After infestation, Weeping Angel places the target TV in a  Fake-Off  mode, so that the owner falsely believes the TV is off when it is on. In  Fake-Off  mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server.As of October 2014 the CIA was also looking at  infecting the vehicle control systems used by modern cars and trucks. The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations.The CIA s Mobile Devices Branch (MDB) developed  numerous attacks to remotely hack and control popular smart phones. Infected phones can be instructed to send the CIA the user s geolocation, audio and text communications as well as covertly activate the phone s camera and microphone.Despite iPhone s minority share (14.5%) of the global smart phone market in 2016, a specialized unit in the CIA s Mobile Development Branch produces malware to infest, control and exfiltrate data from iPhones and other Apple products running iOS, such as iPads. CIA s arsenal includes numerous local and remote  zero days  developed by CIA or obtained from GCHQ, NSA, FBI or purchased from cyber arms contractors such as Baitshop. The disproportionate focus on iOS may be explained by the popularity of the iPhone among social, political, diplomatic and business elites.A similar unit targets Google s Android which is used to run the majority of the world s smart phones (~85%) including Samsung, HTC and Sony. 1.15 billion Android powered phones were sold last year.  Year Zero  shows that as of 2016 the CIA had 24  weaponized  Android  zero days  which it has developed itself and obtained from GCHQ, NSA and cyber arms contractors.These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the  smart  phones that they run on and collecting audio and message traffic before encryption is applied.The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware. This includes multiple local and remote weaponized  zero days , air gap jumping viruses such as  Hammer Drill  which infects software distributed on CD/DVDs,  infectors for removable media such as USBs, systems to  hide data in images or in covert disk areas (  Brutal Kangaroo ) and to keep its malware infestations going.Many of these infection efforts are pulled together by the CIA s Automated Implant Branch (AIB), which has developed several attack systems for automated infestation and control of CIA malware, such as  Assassin  and  Medusa .Attacks against Internet infrastructure and webservers are developed by the CIA s Network Devices Branch (NDB).The CIA has developed automated multi-platform malware attack and control systems covering Windows, Mac OS X, Solaris, Linux and more, such as EDB s  HIVE  and the related  Cutthroat  and  Swindle  tools, which are described in the examples section below.In the wake of Edward Snowden s leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis   rather than hoard   serious vulnerabilities, exploits, bugs or  zero days  to Apple, Google, Microsoft, and other US-based manufacturers.Serious vulnerabilities not disclosed to the manufacturers places huge swathes of the population and critical infrastructure at risk to foreign intelligence or cyber criminals who independently discover or hear rumors of the vulnerability. If the CIA can discover such vulnerabilities so can others.The U.S. government s commitment to the  Vulnerabilities Equities Process came after significant lobbying by US technology companies, who risk losing their share of the global market over real and perceived hidden vulnerabilities. The government stated that it would disclose all pervasive vulnerabilities discovered after 2010 on an ongoing basis. Year Zero  documents show that the CIA breached the Obama administration s commitments. Many of the vulnerabilities used in the CIA s cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals.As an example, specific CIA malware revealed in  Year Zero  is able to penetrate, infest and control both the Android phone and iPhone software that runs or has run presidential Twitter accounts. The CIA attacks this software by using undisclosed security vulnerabilities ( zero days ) possessed by the CIA but if the CIA can hack these phones then so can everyone else who has obtained or discovered the vulnerability. As long as the CIA keeps these vulnerabilities concealed from Apple and Google (who make the phones) they will not be fixed, and the phones will remain hackable.The same vulnerabilities exist for the population at large, including the U.S. Cabinet, Congress, top CEOs, system administrators, security officers and engineers. By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable.Cyber  weapons  are not possible to keep under effective control.While nuclear proliferation has been restrained by the enormous costs and visible infrastructure involved in assembling enough fissile material to produce a critical nuclear mass, cyber  weapons , once developed, are very hard to retain.Cyber  weapons  are in fact just computer programs which can be pirated like any other. Since they are entirely comprised of information they can be copied quickly with no marginal cost.Securing such  weapons  is particularly difficult since the same people who develop and use them have the skills to exfiltrate copies without leaving traces   sometimes by using the very same  weapons  against the organizations that contain them. There are substantial price incentives for government hackers and consultants to obtain copies since there is a global  vulnerability market  that will pay hundreds of thousands to millions of dollars for copies of such  weapons . Similarly, contractors and companies who obtain such  weapons  sometimes use them for their own purposes, obtaining advantage over their competitors in selling  hacking  services.Over the last three years the United States intelligence sector, which consists of government agencies such as the CIA and NSA and their contractors, such as Booze Allan Hamilton, has been subject to unprecedented series of data exfiltrations by its own workers.A number of intelligence community members not yet publicly named have been arrested or subject to federal criminal investigations in separate incidents.Most visibly, on February 8, 2017 a U.S. federal grand jury indicted Harold T. Martin III with 20 counts of mishandling classified information. The Department of Justice alleged that it seized some 50,000 gigabytes of information from Harold T. Martin III that he had obtained from classified programs at NSA and CIA, including the source code for numerous hacking tools.Once a single cyber  weapon  is  loose  it can spread around the world in seconds, to be used by peer states, cyber mafia and teenage hackers alike.In addition to its operations in Langley, Virginia the CIA also uses the U.S. consulate in Frankfurt as a covert base for its hackers covering Europe, the Middle East and Africa.CIA hackers operating out of the Frankfurt consulate (  Center for Cyber Intelligence Europe  or CCIE) are given diplomatic ( black ) passports and State Department cover.  The instructions for incoming CIA hackers make Germany s counter-intelligence efforts appear inconsequential:  Breeze through German Customs because you have your cover-for-action story down pat, and all they did was stamp your passport Your Cover Story (for this trip) Q: Why are you here? A: Supporting technical consultations at the Consulate.Two earlier WikiLeaks publications give further detail on CIA approaches to customs and secondary screening procedures.Once in Frankfurt CIA hackers can travel without further border checks to the 25 European countries that are part of the Shengen open border area   including France, Italy and Switzerland.A number of the CIA s electronic attack methods are designed for physical proximity. These attack methods are able to penetrate high security networks that are disconnected from the internet, such as police record database. In these cases, a CIA officer, agent or allied intelligence officer acting under instructions, physically infiltrates the targeted workplace. The attacker is provided with a USB containing malware developed for the CIA for this purpose, which is inserted into the targeted computer. The attacker then infects and exfiltrates data to removable media. For example, the CIA attack system Fine Dining, provides 24 decoy applications for CIA spies to use. To witnesses, the spy appears to be running a program showing videos (e.g VLC), presenting slides (Prezi), playing a computer game (Breakout2, 2048) or even running a fake virus scanner (Kaspersky, McAfee, Sophos). But while the decoy application is on the screen, the underlaying system is automatically infected and ransacked.In what is surely one of the most astounding intelligence own goals in living memory, the CIA structured its classification regime such that for the most market valuable part of  Vault 7    the CIA s weaponized malware (implants + zero days), Listening Posts (LP), and Command and Control (C2) systems   the agency has little legal recourse.The CIA made these systems unclassified.Why the CIA chose to make its cyberarsenal unclassified reveals how concepts developed for military use do not easily crossover to the  battlefield  of cyber  war .To attack its targets, the CIA usually requires that its implants communicate with their control programs over the internet. If CIA implants, Command & Control and Listening Post software were classified, then CIA officers could be prosecuted or dismissed for violating rules that prohibit placing classified information onto the Internet. Consequently the CIA has secretly made most of its cyber spying/war code unclassified. The U.S. government is not able to assert copyright either, due to restrictions in the U.S. Constitution. This means that cyber  arms  manufactures and computer hackers can freely  pirate  these  weapons  if they are obtained. The CIA has primarily had to rely on obfuscation to protect its malware secrets.Conventional weapons such as missiles may be fired at the enemy (i.e into an unsecured area). Proximity to or impact with the target detonates the ordnance including its classified parts. Hence military personnel do not violate classification rules by firing ordnance with classified parts. Ordnance will likely explode. If it does not, that is not the operator s intent.Over the last decade U.S. hacking operations have been increasingly dressed up in military jargon to tap into Department of Defense funding streams. For instance, attempted  malware injections  (commercial jargon) or  implant drops  (NSA jargon) are being called  fires  as if a weapon was being fired. However the analogy is questionable.Unlike bullets, bombs or missiles, most CIA malware is designed to live for days or even years after it has reached its  target . CIA malware does not  explode on impact  but rather permanently infests its target. In order to infect target s device, copies of the malware must be placed on the target s devices, giving physical possession of the malware to the target. To exfiltrate data back to the CIA or to await further instructions the malware must communicate with CIA Command & Control (C2) systems placed on internet connected servers. But such servers are typically not approved to hold classified information, so CIA command and control systems are also made unclassified.A successful  attack  on a target s computer system is more like a series of complex stock maneuvers in a hostile take-over bid or the careful planting of rumors in order to gain control over an organization s leadership rather than the firing of a weapons system. If there is a military analogy to be made, the infestation of a target is perhaps akin to the execution of a whole series of military maneuvers against the target s territory including observation, infiltration, occupation and exploitation.A series of standards lay out CIA malware infestation patterns which are likely to assist forensic crime scene investigators as well as Apple, Microsoft, Google, Samsung, Nokia, Blackberry, Siemens and anti-virus companies attribute and defend against attacks. Tradecraft DO s and DON Ts  contains CIA rules on how its malware should be written to avoid fingerprints implicating the  CIA, US government, or its witting partner companies  in  forensic review . Similar secret standards cover the  use of encryption to hide CIA hacker and malware communication (pdf), describing targets & exfiltrated data (pdf) as well as  executing payloads (pdf) and  persisting (pdf) in the target s machines over time.CIA hackers developed successful attacks against most well known anti-virus programs. These are documented in AV defeats, Personal Security Products, Detecting and defeating PSPs and PSP/Debugger/RE Avoidance. For example, Comodo was defeated by CIA malware placing itself in the Window s  Recycle Bin . While Comodo 6.x has a  Gaping Hole of DOOM .CIA hackers discussed what the NSA s  Equation Group  hackers did wrong and how the CIA s malware makers could avoid similar exposure.The CIA s Engineering Development Group (EDG) management system contains around 500 different projects (only some of which are documented by  Year Zero ) each with their own sub-projects, malware and hacker tools.The majority of these projects relate to tools that are used for penetration, infestation ( implanting ), control, and exfiltration.Another branch of development focuses on the development and operation of Listening Posts (LP) and Command and Control (C2) systems used to communicate with and control CIA implants; special projects are used to target specific hardware from routers to smart TVs.Some example projects are described below, but see  the table of contents for the full list of projects described by WikiLeaks   Year Zero .The CIA s hand crafted hacking techniques pose a problem for the agency. Each technique it has created forms a  fingerprint  that can be used by forensic investigators to attribute multiple different attacks to the same entity.This is analogous to finding the same distinctive knife wound on multiple separate murder victims. The unique wounding style creates suspicion that a single murderer is responsible. As soon one murder in the set is solved then the other murders also find likely attribution.The CIA s Remote Devices Branch s UMBRAGE group collects and maintains a substantial library of attack techniques  stolen  from malware produced in other states including the Russian Federation.With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the  fingerprints  of the groups that the attack techniques were stolen from.UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques.Fine Dining comes with a standardized questionnaire i.e menu that CIA case officers fill out. The questionnaire is used by the agency s OSB (Operational Support Branch) to transform the requests of case officers into technical requirements for hacking attacks (typically  exfiltrating  information from computer systems) for specific operations. The questionnaire allows the OSB to identify how to adapt existing tools for the operation, and communicate this to CIA malware configuration staff. The OSB functions as the interface between CIA operational staff and the relevant technical support staff.Among the list of possible targets of the collection are  Asset ,  Liaison Asset ,  System Administrator ,  Foreign Information Operations ,  Foreign Intelligence Agencies  and  Foreign Government Entities . Notably absent is any reference to extremists or transnational criminals. The  Case Officer  is also asked to specify the environment of the target like the type of computer, operating system used, Internet connectivity and installed anti-virus utilities (PSPs) as well as a list of file types to be exfiltrated like Office documents, audio, video, images or custom file types. The  menu  also asks for information if recurring access to the target is possible and how long unobserved access to the computer can be maintained. This information is used by the CIA s  JQJIMPROVISE  software (see below) to configure a set of CIA malware suited to the specific needs of an operation. Improvise  is a toolset for configuration, post-processing, payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender), MacOS (JukeBox) and Linux (DanceFloor). Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from  Fine Dining  questionnaires.HIVE is a multi-platform CIA malware suite and its associated control software. The project provides customizable implants for Windows, Solaris, MikroTik (used in internet routers) and Linux platforms and a Listening Post (LP)/Command and Control (C2) infrastructure to communicate with these implants.The implants are configured to communicate via HTTPS with the webserver of a cover domain; each operation utilizing these implants has a separate cover domain and the infrastructure can handle any number of cover domains.Each cover domain resolves to an IP address that is located at a commercial VPS (Virtual Private Server) provider. The public-facing server forwards all incoming traffic via a VPN to a  Blot  server that handles actual connection requests from clients. It is setup for optional SSL client authentication: if a client sends a valid client certificate (only implants can do that), the connection is forwarded to the  Honeycomb  toolserver that communicates with the implant; if a valid certificate is missing (which is the case if someone tries to open the cover domain website by accident), the traffic is forwarded to a cover server that delivers an unsuspicious looking website.The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer, so the toolserver acts as a C2 (command and control) server for the implant.Similar functionality (though limited to Windows) is provided by the RickBobby project.See the classified user and developer guides for HIVE.WikiLeaks published as soon as its verification and analysis were ready.In February the Trump administration has issued an Executive Order calling for a  Cyberwar  review to be prepared within 30 days.While the review increases the timeliness and relevance of the publication it did not play a role in setting the publication date Continue this story at WikileaksREAD MORE WIKILEAKS AT: 21st Century Wire WIKILEAKS FilesSUPPORT OUR WORK BY SUBSCRIBING & BECOMING A MEMBER @21WIRE.TVUS_News
breaking wikileaks releases vault part year zero century wire says wikileaks released largest ever publication confidential documents central intelligence agency entitled vault containing password echoed alleged jfk quote splinter cia thousand pieces scatter winds leak comprises documents files isolated network situated inside cia center cyber intelligence langle virginia year zero part one leak conveniently named zero day exploit used intelligence agencies gathered throughout said largest intelligence publication history lot information methodology outlined year zero surprise security analysts researchers since edward snowden image left revelations public explicit confirmation one powerful intelligence agencies world aided international counterparts like ch infiltrating scoring vast quantities private information apple android devices right samsung smart tv technology false modes live microphones executed record information send back appropriate document dump game changer world know done know done cia documents know cia behind various russian hacking conspiracies circling around trump the questions proliferation report wikileaks wikileaks today tuesday march wikileaks begins new series leaks central intelligence agency vault wikileaks largest ever publication confidential documents first full part series year zero comprises documents files isolated network situated inside cia center cyber intelligence langle virgin it follows introductory disclosure last month cia targeting french political parties candidates lead presidential cia lost control majority hacking arsenal including malware viruses trojans weaponized zero day exploits malware remote control systems associated documentation this extraordinary collection amounts several hundred million lines code gives possession entire hacking capacity cia the archive appears circulated among former government hackers contractors unauthorized manner one provided wikileaks portions archive year zero introduces scope direction cia global covert hacking program malware arsenal dozens zero day weaponized exploits wide range european company products include apple iphone google android microsoft windows even samsung tvs turned covert cia gained political budgetary prominence national security agency nsa the cia found building infamous drone fleet different type covert force substantial fleet hackers the agency hacking division freed disclose often controversial operations nsa primary bureaucratic rival order draw nsa hacking end cia hacking division formally falls agency center cyber intelligence cci registered users produced thousand hacking systems trojans viruses weaponized malware such scale cia undertaking hackers utilized code used run facebook the cia created effect nsa even less accountability without publicly answering question whether massive budgetary spend duplicating capacities rival agency could statement wikileaks source details policy questions say urgently need debated public including whether cia hacking capabilities exceed mandated powers problem public oversight agency the source wishes initiate public debate security creation use proliferation democratic control single cyber weapon loose spread around world seconds used rival states cyber mafia teenage hackers passage wikileaks editor stated there extreme proliferation risk development cyber weapons comparisons drawn uncontrolled proliferation weapons results inability contain combined high market value global arms trade but significance year zero goes well beyond choice hyperwar cyberspace the disclosure also exceptional political legal forensic perspective wikileaks carefully reviewed year zero disclosure published substantive cia documentation avoiding distribution armed cyberweapons consensus emerges technical political nature cia program weapons analyzed disarmed also decided react anonymity identifying information year zero depth analysis these reactions include ten thousands cia targets attack machines throughout latin america europe united states while aware imperfect results approach chosen remain committed publishing model note quantity published pages vault part one year zero already eclipses total number pages published first three years edward snowden nsa malware hacking tools built ed engineering development group software development group within cci center cyber intelligence department belonging cia doi directorate digital innovation the doi one five major directorate cia see organizational chart cia details ed responsible development testing operational support backdoor exploits malicious payloads trojans viruses kind malware used cia covert operations increasing sophistication surveillance techniques drawn comparisons george orwell weeping angel developed cia embedded devices branch edb invests smart tvs transforming covert microphones surely emblematic attack samsung smart tvs developed cooperation united kingdom after infestation weeping angel places target tv mode owner falsely believes tv in mode tv operates bug recording conversations room sending internet covert cia october cia also looking infecting vehicle control systems used modern cars trucks the purpose control specified would permit cia engage nearly detectable cia mobile devices branch mdb developed numerous attacks remotely hack control popular smart phones infected phones instructed send cia user relocation audio text communications well covertly activate phone camera iphone minority share global smart phone market specialized unit cia mobile development branch produces malware invest control infiltrate data phones apple products running ios pads cia arsenal includes numerous local remote zero days developed cia obtained ch nsa fbi purchased cyber arms contractors bishop the disproportionate focus ios may explained popularity iphone among social political diplomatic business similar unit targets google android used run majority world smart phones including samsung htc sony billion android powered phones sold last year year zero shows cia weaponized android zero days developed obtained ch nsa cyber arms techniques permit cia bypass encryption whatsapp signal telegram weibo confides cloackman hacking smart phones run collecting audio message traffic encryption cia also runs substantial effort infect control microsoft windows users malware this includes multiple local remote weaponized zero days air gap jumping viruses hammer drill infects software distributed investors removable media uses systems hide data images covert disk areas brutal kangaroo keep malware infestation infection efforts pulled together cia automated implant branch air developed several attack systems automated infestation control cia malware assassin medusa internet infrastructure observers developed cia network devices branch ndb cia developed automated malware attack control systems covering windows mac os x solar linux edb hive related cutthroat spindle tools described examples section wake edward snowden leaks nsa technology industry secured commitment obama administration executive would disclose ongoing basis rather hoard serious vulnerabilities exploits bugs zero days apple google microsoft vulnerabilities disclosed manufacturers places huge states population critical infrastructure risk foreign intelligence cyber criminals independently discover hear rumors vulnerability if cia discover vulnerabilities government commitment vulnerabilities entities process came significant lobbying us technology companies risk losing share global market real perceived hidden vulnerabilities the government stated would disclose pervasive vulnerabilities discovered ongoing basis year zero documents show cia breached obama administration commitments many vulnerabilities used cia cyber arsenal pervasive may already found rival intelligence agencies cyber example specific cia malware revealed year zero able penetrate invest control android phone iphone software runs run presidential twitter accounts the cia attacks software using undisclosed security vulnerabilities zero days possessed cia cia hack phones everyone else obtained discovered vulnerability as long cia keeps vulnerabilities concealed apple google make phones fixed phones remain vulnerabilities exist population large including cabinet congress top ceo system administrators security officers engineers by hiding security flaws manufacturers like apple google cia ensures hack everyone mdash expense leaving everyone weapons possible keep effective nuclear proliferation restrained enormous costs visible infrastructure involved assembling enough missile material produce critical nuclear mass cyber weapons developed hard weapons fact computer programs pirated like since entirely comprised information copied quickly marginal weapons particularly difficult since people develop use skills infiltrate copies without leaving traces sometimes using weapons organizations contain there substantial price incentives government hackers consultants obtain copies since global vulnerability market pay hundreds thousands millions dollars copies weapons similarly contractors companies obtain weapons sometimes use purposes obtaining advantage competitors selling hacking last three years united states intelligence sector consists government agencies cia nsa contractors book allan hamilton subject unprecedented series data exfiltrations number intelligence community members yet publicly named arrested subject federal criminal investigations separate visibly february federal grand jury indicted harold martin iii counts mishandling classified information the department justice alleged seized gigabytes information harold martin iii obtained classified programs nsa cia including source code numerous hacking single cyber weapon loose spread around world seconds used peer states cyber mafia teenage hackers addition operations langle virginia cia also uses consulate frankfurt covert base hackers covering europe middle east hackers operating frankfurt consulate center cyber intelligence europe cie given diplomatic black passports state department cover the instructions incoming cia hackers make germany efforts appear inconsequential breeze german customs story pat stamp passport your cover story trip q why a supporting technical consultations earlier wikileaks publications give detail cia approaches customs secondary screening frankfurt cia hackers travel without border checks european countries part sheen open border area including france italy number cia electronic attack methods designed physical proximity these attack methods able penetrate high security networks disconnected internet police record database in cases cia officer agent allied intelligence officer acting instructions physically infiltrates targeted workplace the attacker provided usb containing malware developed cia purpose inserted targeted computer the attacker infects infiltrates data removable media for example cia attack system fine dining provides decoy applications cia spies use to witnesses spy appears running program showing videos lc presenting slides prezi playing computer game even running fake virus scanner kaspersky cafe solos but decoy application screen underlying system automatically infected surely one astounding intelligence goals living memory cia structured classification regime market valuable part vault cia weaponized malware implants zero days listening posts lp command control systems agency little legal cia made systems cia chose make cyberarsenal unclassified reveals concepts developed military use easily crossover battlefield cyber war attack targets cia usually requires implants communicate control programs internet if cia implants command control listening post software classified cia officers could prosecuted dismissed violating rules prohibit placing classified information onto internet consequently cia secretly made cyber code unclassified the government able assert copyright either due restrictions constitution this means cyber arms manufactures computer hackers freely pirate weapons obtained the cia primarily rely obfuscation protect malware weapons missiles may fired enemy secured area proximity impact target detonated ordnance including classified parts hence military personnel violate classification rules firing ordnance classified parts ordnance likely explode if operator last decade hacking operations increasingly dressed military jargon tap department defense funding streams for instance attempted malware injections commercial jargon implant drops nsa jargon called fires weapon fired however analogy bullets bombs missiles cia malware designed live days even years reached target cia malware explode impact rather permanently invests target in order infect target device copies malware must placed target devices giving physical possession malware target to infiltrate data back cia await instructions malware must communicate cia command control systems placed internet connected servers but servers typically approved hold classified information cia command control systems also made successful attack target computer system like series complex stock maneuvers hostile bid careful planting rumors order gain control organization leadership rather firing weapons system if military analogy made infestation target perhaps akin execution whole series military maneuvers target territory including observation infiltration occupation series standards lay cia malware infestation patterns likely assist forensic crime scene investigators well apple microsoft google samsung nokia blackberry siemens companies attribute defend attacks tradecraft do don ts contains cia rules malware written avoid fingerprints implications cia us government sitting partner companies forensic review similar secret standards cover use encryption hide cia hacker malware communication pdf describing targets infiltrated data pdf well executing payloads pdf persistent pdf target machines hackers developed successful attacks well known programs these documented av defeats personal security products detecting defeating psp avoidance for example comedy defeated cia malware placing window recycle bin while comedy gaming hole doom hackers discussed nsa equation group hackers wrong cia malware makers could avoid similar cia engineering development group ed management system contains around different projects documented year zero malware hacker majority projects relate tools used penetration infestation planting control branch development focuses development operation listening posts lp command control systems used communicate control cia implants special projects used target specific hardware routers smart example projects described see table contents full list projects described wikileaks year zero cia hand crafted hacking techniques pose problem agency each technique created forms fingerprint used forensic investigators attribute multiple different attacks analogous finding distinctive knife wound multiple separate murder victims the unique wounding style creates suspicion single murderer responsible as soon one murder set solved murders also find likely cia remote devices branch embrace group collects maintains substantial library attack techniques stolen malware produced states including russian embrace related projects cia increase total number attack types also indirect attribution leaving behind fingerprints groups attack techniques stolen components cover keyloggers password collection webcam capture data destruction persistence privilege escalation stealth psp avoidance survey dining comes standardized questionnaire menu cia case officers fill the questionnaire used agency os operational support branch transform requests case officers technical requirements hacking attacks typically infiltrating information computer systems specific operations the questionnaire allows os identify adapt existing tools operation communicate cia malware configuration staff the os functions interface cia operational staff relevant technical support list possible targets collection asset liaison asset system administrator foreign information operations foreign intelligence agencies foreign government entities notably absent reference extremists transnational criminals the case officer also asked specify environment target like type computer operating system used internet connectivity installed utilities psp well list file types infiltrated like office documents audio video images custom file types the menu also asks information recurring access target possible long observed access computer maintained this information used cia jqjimprovise software see configure set cia malware suited specific needs operation improvise tools configuration payload setup execution vector selection tools supporting major operating systems like windows bartender marcos jukebox linux dancefloor its configuration utilities like margaret allows noc network operation center customize tools based requirements fine dining cia malware suite associated control software the project provides customizable implants windows solar mikrotik used internet routers linux platforms listening post lp control infrastructure communicate implants configured communicate via https observer cover domain operation utilizing implants separate cover domain infrastructure handle number cover cover domain resolves ip address located commercial vs virtual private server provider the server forwards incoming traffic via vpn bot server handles actual connection requests clients it setup optional ssl client authentication client sends valid client certificate implants connection forwarded honeycomb toolserver communicates implant valid certificate missing case someone tries open cover domain website accident traffic forwarded cover server delivers suspicious looking honeycomb toolserver receives infiltrated information implant operator also task implant execute jobs target computer toolserver acts command control server functionality though limited windows provided rickbobby classified user developer guides published soon verification analysis february trump administration issued executive order calling hyperwar review prepared within review increases timelines relevance publication play role setting publication date continue story wikileaksread more wikileaks at century wire wikileaks filessupport our work by subscribing becoming a member
Your task is to classify the provided input as real or fake news. Label 0 is meant for fake news, Label 1 is for real news. TEXT: BREAKING: Wikileaks Releases ‘Vault 7’ Part 1 – ‘Year Zero’21st Century Wire says WikiLeaks has released its largest ever publication of confidential documents on the Central Intelligence Agency. Entitled  Vault 7  and containing a password that echoed the alleged JFK quote  splinter the CIA into a thousand pieces and scatter it into the winds,  this leak comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA s Center for Cyber Intelligence in Langley, Virginia. Year Zero , which is part one of the leak and conveniently named after a  zero day  exploit used by intelligence agencies, was gathered throughout 2016 and is said to be the  largest intelligence publication in history .Whilst a lot of the information and methodology outlined in  Year Zero  is of no surprise to security analysts and researchers since the Edward Snowden (image, left) revelations, once again the public has explicit confirmation of how one of the most powerful intelligence agencies in the world, aided by their international counterparts like GCHQ, have been infiltrating and scooping vast quantities of private information from Apple and Android devices right up to Samsung  Smart TV  technology where false  stand-by  modes and live microphones can be executed to record information and send it back to the appropriate servers.This document dump is a game changer, because not only does the world know what they ve done, we now know how they ve done it.Based on the CIA s own documents, how do we know it wasn t the CIA themselves behind various  Russian  hacking conspiracies circling around Trump? The questions are proliferating as we speak.More on this report from Wikileaks  Wikileaks  Today, Tuesday 7 March 2017, WikiLeaks begins its new series of leaks on the U.S. Central Intelligence Agency. Code-named  Vault 7  by WikiLeaks, it is the largest ever publication of confidential documents on the agency.The first full part of the series,  Year Zero , comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA s Center for Cyber Intelligence in Langley, Virgina. It follows an introductory disclosure last month of  CIA targeting French political parties and candidates in the lead up to the 2012 presidential election.Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized  zero day  exploits, malware remote control systems and associated documentation. This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive. Year Zero  introduces the scope and direction of the CIA s global covert hacking program, its malware arsenal and dozens of  zero day  weaponized exploits against a wide range of U.S. and European company products, include Apple s iPhone, Google s Android and Microsoft s Windows and even Samsung TVs, which are turned into covert microphones.Since 2001 the CIA has gained political and budgetary preeminence over the U.S. National Security Agency (NSA). The CIA found itself building not just its now infamous drone fleet, but a very different type of covert, globe-spanning force   its own substantial fleet of hackers. The agency s hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA s hacking capacities.By the end of 2016, the CIA s hacking division, which formally falls under the agency s Center for Cyber Intelligence (CCI), had over 5000 registered users and had produced more than a thousand hacking systems, trojans, viruses, and other  weaponized  malware. Such is the scale of the CIA s undertaking that by 2016, its hackers had utilized more code than that used to run Facebook. The CIA had created, in effect, its  own NSA  with even less accountability and without publicly answering the question as to whether such a massive budgetary spend on duplicating the capacities of a rival agency could be justified.In a statement to WikiLeaks the source details policy questions that they say urgently need to be debated in public, including whether the CIA s hacking capabilities exceed its mandated powers and the problem of public oversight of the agency. The source wishes to initiate a public debate about the security, creation, use, proliferation and democratic control of cyberweapons.Once a single cyber  weapon  is  loose  it can spread around the world in seconds, to be used by rival states, cyber mafia and teenage hackers alike.Julian Assange, WikiLeaks editor stated that  There is an extreme proliferation risk in the development of cyber  weapons . Comparisons can be drawn between the uncontrolled proliferation of such  weapons , which results from the inability to contain them combined with their high market value, and the global arms trade. But the significance of  Year Zero  goes well beyond the choice between cyberwar and cyberpeace. The disclosure is also exceptional from a political, legal and forensic perspective. Wikileaks has carefully reviewed the  Year Zero  disclosure and published substantive CIA documentation while avoiding the distribution of  armed  cyberweapons until a consensus emerges on the technical and political nature of the CIA s program and how such  weapons  should analyzed, disarmed and published.Wikileaks has also decided to redact and anonymise some identifying information in  Year Zero  for in depth analysis. These redactions include ten of thousands of CIA targets and attack machines throughout Latin America, Europe and the United States. While we are aware of the imperfect results of any approach chosen, we remain committed to our publishing model and note that the quantity of published pages in  Vault 7  part one ( Year Zero ) already eclipses the total number of pages published over the first three years of the Edward Snowden NSA leaks.CIA malware and hacking tools are built by EDG (Engineering Development Group), a software development group within CCI (Center for Cyber Intelligence), a department belonging to the CIA s DDI (Directorate for Digital Innovation). The DDI is one of the five major directorates of the CIA (see this  organizational chart of the CIA for more details).The EDG is responsible for the development, testing and operational support of all backdoors, exploits, malicious payloads, trojans, viruses and any other kind of malware used by the CIA in its covert operations world-wide.The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell s 1984, but  Weeping Angel , developed by the CIA s Embedded Devices Branch (EDB), which infests smart TVs, transforming them into covert microphones, is surely its most emblematic realization.The attack against Samsung smart TVs was developed in cooperation with the United Kingdom s MI5/BTSS. After infestation, Weeping Angel places the target TV in a  Fake-Off  mode, so that the owner falsely believes the TV is off when it is on. In  Fake-Off  mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server.As of October 2014 the CIA was also looking at  infecting the vehicle control systems used by modern cars and trucks. The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations.The CIA s Mobile Devices Branch (MDB) developed  numerous attacks to remotely hack and control popular smart phones. Infected phones can be instructed to send the CIA the user s geolocation, audio and text communications as well as covertly activate the phone s camera and microphone.Despite iPhone s minority share (14.5%) of the global smart phone market in 2016, a specialized unit in the CIA s Mobile Development Branch produces malware to infest, control and exfiltrate data from iPhones and other Apple products running iOS, such as iPads. CIA s arsenal includes numerous local and remote  zero days  developed by CIA or obtained from GCHQ, NSA, FBI or purchased from cyber arms contractors such as Baitshop. The disproportionate focus on iOS may be explained by the popularity of the iPhone among social, political, diplomatic and business elites.A similar unit targets Google s Android which is used to run the majority of the world s smart phones (~85%) including Samsung, HTC and Sony. 1.15 billion Android powered phones were sold last year.  Year Zero  shows that as of 2016 the CIA had 24  weaponized  Android  zero days  which it has developed itself and obtained from GCHQ, NSA and cyber arms contractors.These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the  smart  phones that they run on and collecting audio and message traffic before encryption is applied.The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware. This includes multiple local and remote weaponized  zero days , air gap jumping viruses such as  Hammer Drill  which infects software distributed on CD/DVDs,  infectors for removable media such as USBs, systems to  hide data in images or in covert disk areas (  Brutal Kangaroo ) and to keep its malware infestations going.Many of these infection efforts are pulled together by the CIA s Automated Implant Branch (AIB), which has developed several attack systems for automated infestation and control of CIA malware, such as  Assassin  and  Medusa .Attacks against Internet infrastructure and webservers are developed by the CIA s Network Devices Branch (NDB).The CIA has developed automated multi-platform malware attack and control systems covering Windows, Mac OS X, Solaris, Linux and more, such as EDB s  HIVE  and the related  Cutthroat  and  Swindle  tools, which are described in the examples section below.In the wake of Edward Snowden s leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis   rather than hoard   serious vulnerabilities, exploits, bugs or  zero days  to Apple, Google, Microsoft, and other US-based manufacturers.Serious vulnerabilities not disclosed to the manufacturers places huge swathes of the population and critical infrastructure at risk to foreign intelligence or cyber criminals who independently discover or hear rumors of the vulnerability. If the CIA can discover such vulnerabilities so can others.The U.S. government s commitment to the  Vulnerabilities Equities Process came after significant lobbying by US technology companies, who risk losing their share of the global market over real and perceived hidden vulnerabilities. The government stated that it would disclose all pervasive vulnerabilities discovered after 2010 on an ongoing basis. Year Zero  documents show that the CIA breached the Obama administration s commitments. Many of the vulnerabilities used in the CIA s cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals.As an example, specific CIA malware revealed in  Year Zero  is able to penetrate, infest and control both the Android phone and iPhone software that runs or has run presidential Twitter accounts. The CIA attacks this software by using undisclosed security vulnerabilities ( zero days ) possessed by the CIA but if the CIA can hack these phones then so can everyone else who has obtained or discovered the vulnerability. As long as the CIA keeps these vulnerabilities concealed from Apple and Google (who make the phones) they will not be fixed, and the phones will remain hackable.The same vulnerabilities exist for the population at large, including the U.S. Cabinet, Congress, top CEOs, system administrators, security officers and engineers. By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable.Cyber  weapons  are not possible to keep under effective control.While nuclear proliferation has been restrained by the enormous costs and visible infrastructure involved in assembling enough fissile material to produce a critical nuclear mass, cyber  weapons , once developed, are very hard to retain.Cyber  weapons  are in fact just computer programs which can be pirated like any other. Since they are entirely comprised of information they can be copied quickly with no marginal cost.Securing such  weapons  is particularly difficult since the same people who develop and use them have the skills to exfiltrate copies without leaving traces   sometimes by using the very same  weapons  against the organizations that contain them. There are substantial price incentives for government hackers and consultants to obtain copies since there is a global  vulnerability market  that will pay hundreds of thousands to millions of dollars for copies of such  weapons . Similarly, contractors and companies who obtain such  weapons  sometimes use them for their own purposes, obtaining advantage over their competitors in selling  hacking  services.Over the last three years the United States intelligence sector, which consists of government agencies such as the CIA and NSA and their contractors, such as Booze Allan Hamilton, has been subject to unprecedented series of data exfiltrations by its own workers.A number of intelligence community members not yet publicly named have been arrested or subject to federal criminal investigations in separate incidents.Most visibly, on February 8, 2017 a U.S. federal grand jury indicted Harold T. Martin III with 20 counts of mishandling classified information. The Department of Justice alleged that it seized some 50,000 gigabytes of information from Harold T. Martin III that he had obtained from classified programs at NSA and CIA, including the source code for numerous hacking tools.Once a single cyber  weapon  is  loose  it can spread around the world in seconds, to be used by peer states, cyber mafia and teenage hackers alike.In addition to its operations in Langley, Virginia the CIA also uses the U.S. consulate in Frankfurt as a covert base for its hackers covering Europe, the Middle East and Africa.CIA hackers operating out of the Frankfurt consulate (  Center for Cyber Intelligence Europe  or CCIE) are given diplomatic ( black ) passports and State Department cover.  The instructions for incoming CIA hackers make Germany s counter-intelligence efforts appear inconsequential:  Breeze through German Customs because you have your cover-for-action story down pat, and all they did was stamp your passport Your Cover Story (for this trip) Q: Why are you here? A: Supporting technical consultations at the Consulate.Two earlier WikiLeaks publications give further detail on CIA approaches to customs and secondary screening procedures.Once in Frankfurt CIA hackers can travel without further border checks to the 25 European countries that are part of the Shengen open border area   including France, Italy and Switzerland.A number of the CIA s electronic attack methods are designed for physical proximity. These attack methods are able to penetrate high security networks that are disconnected from the internet, such as police record database. In these cases, a CIA officer, agent or allied intelligence officer acting under instructions, physically infiltrates the targeted workplace. The attacker is provided with a USB containing malware developed for the CIA for this purpose, which is inserted into the targeted computer. The attacker then infects and exfiltrates data to removable media. For example, the CIA attack system Fine Dining, provides 24 decoy applications for CIA spies to use. To witnesses, the spy appears to be running a program showing videos (e.g VLC), presenting slides (Prezi), playing a computer game (Breakout2, 2048) or even running a fake virus scanner (Kaspersky, McAfee, Sophos). But while the decoy application is on the screen, the underlaying system is automatically infected and ransacked.In what is surely one of the most astounding intelligence own goals in living memory, the CIA structured its classification regime such that for the most market valuable part of  Vault 7    the CIA s weaponized malware (implants + zero days), Listening Posts (LP), and Command and Control (C2) systems   the agency has little legal recourse.The CIA made these systems unclassified.Why the CIA chose to make its cyberarsenal unclassified reveals how concepts developed for military use do not easily crossover to the  battlefield  of cyber  war .To attack its targets, the CIA usually requires that its implants communicate with their control programs over the internet. If CIA implants, Command & Control and Listening Post software were classified, then CIA officers could be prosecuted or dismissed for violating rules that prohibit placing classified information onto the Internet. Consequently the CIA has secretly made most of its cyber spying/war code unclassified. The U.S. government is not able to assert copyright either, due to restrictions in the U.S. Constitution. This means that cyber  arms  manufactures and computer hackers can freely  pirate  these  weapons  if they are obtained. The CIA has primarily had to rely on obfuscation to protect its malware secrets.Conventional weapons such as missiles may be fired at the enemy (i.e into an unsecured area). Proximity to or impact with the target detonates the ordnance including its classified parts. Hence military personnel do not violate classification rules by firing ordnance with classified parts. Ordnance will likely explode. If it does not, that is not the operator s intent.Over the last decade U.S. hacking operations have been increasingly dressed up in military jargon to tap into Department of Defense funding streams. For instance, attempted  malware injections  (commercial jargon) or  implant drops  (NSA jargon) are being called  fires  as if a weapon was being fired. However the analogy is questionable.Unlike bullets, bombs or missiles, most CIA malware is designed to live for days or even years after it has reached its  target . CIA malware does not  explode on impact  but rather permanently infests its target. In order to infect target s device, copies of the malware must be placed on the target s devices, giving physical possession of the malware to the target. To exfiltrate data back to the CIA or to await further instructions the malware must communicate with CIA Command & Control (C2) systems placed on internet connected servers. But such servers are typically not approved to hold classified information, so CIA command and control systems are also made unclassified.A successful  attack  on a target s computer system is more like a series of complex stock maneuvers in a hostile take-over bid or the careful planting of rumors in order to gain control over an organization s leadership rather than the firing of a weapons system. If there is a military analogy to be made, the infestation of a target is perhaps akin to the execution of a whole series of military maneuvers against the target s territory including observation, infiltration, occupation and exploitation.A series of standards lay out CIA malware infestation patterns which are likely to assist forensic crime scene investigators as well as Apple, Microsoft, Google, Samsung, Nokia, Blackberry, Siemens and anti-virus companies attribute and defend against attacks. Tradecraft DO s and DON Ts  contains CIA rules on how its malware should be written to avoid fingerprints implicating the  CIA, US government, or its witting partner companies  in  forensic review . Similar secret standards cover the  use of encryption to hide CIA hacker and malware communication (pdf), describing targets & exfiltrated data (pdf) as well as  executing payloads (pdf) and  persisting (pdf) in the target s machines over time.CIA hackers developed successful attacks against most well known anti-virus programs. These are documented in AV defeats, Personal Security Products, Detecting and defeating PSPs and PSP/Debugger/RE Avoidance. For example, Comodo was defeated by CIA malware placing itself in the Window s  Recycle Bin . While Comodo 6.x has a  Gaping Hole of DOOM .CIA hackers discussed what the NSA s  Equation Group  hackers did wrong and how the CIA s malware makers could avoid similar exposure.The CIA s Engineering Development Group (EDG) management system contains around 500 different projects (only some of which are documented by  Year Zero ) each with their own sub-projects, malware and hacker tools.The majority of these projects relate to tools that are used for penetration, infestation ( implanting ), control, and exfiltration.Another branch of development focuses on the development and operation of Listening Posts (LP) and Command and Control (C2) systems used to communicate with and control CIA implants; special projects are used to target specific hardware from routers to smart TVs.Some example projects are described below, but see  the table of contents for the full list of projects described by WikiLeaks   Year Zero .The CIA s hand crafted hacking techniques pose a problem for the agency. Each technique it has created forms a  fingerprint  that can be used by forensic investigators to attribute multiple different attacks to the same entity.This is analogous to finding the same distinctive knife wound on multiple separate murder victims. The unique wounding style creates suspicion that a single murderer is responsible. As soon one murder in the set is solved then the other murders also find likely attribution.The CIA s Remote Devices Branch s UMBRAGE group collects and maintains a substantial library of attack techniques  stolen  from malware produced in other states including the Russian Federation.With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the  fingerprints  of the groups that the attack techniques were stolen from.UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques.Fine Dining comes with a standardized questionnaire i.e menu that CIA case officers fill out. The questionnaire is used by the agency s OSB (Operational Support Branch) to transform the requests of case officers into technical requirements for hacking attacks (typically  exfiltrating  information from computer systems) for specific operations. The questionnaire allows the OSB to identify how to adapt existing tools for the operation, and communicate this to CIA malware configuration staff. The OSB functions as the interface between CIA operational staff and the relevant technical support staff.Among the list of possible targets of the collection are  Asset ,  Liaison Asset ,  System Administrator ,  Foreign Information Operations ,  Foreign Intelligence Agencies  and  Foreign Government Entities . Notably absent is any reference to extremists or transnational criminals. The  Case Officer  is also asked to specify the environment of the target like the type of computer, operating system used, Internet connectivity and installed anti-virus utilities (PSPs) as well as a list of file types to be exfiltrated like Office documents, audio, video, images or custom file types. The  menu  also asks for information if recurring access to the target is possible and how long unobserved access to the computer can be maintained. This information is used by the CIA s  JQJIMPROVISE  software (see below) to configure a set of CIA malware suited to the specific needs of an operation. Improvise  is a toolset for configuration, post-processing, payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender), MacOS (JukeBox) and Linux (DanceFloor). Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from  Fine Dining  questionnaires.HIVE is a multi-platform CIA malware suite and its associated control software. The project provides customizable implants for Windows, Solaris, MikroTik (used in internet routers) and Linux platforms and a Listening Post (LP)/Command and Control (C2) infrastructure to communicate with these implants.The implants are configured to communicate via HTTPS with the webserver of a cover domain; each operation utilizing these implants has a separate cover domain and the infrastructure can handle any number of cover domains.Each cover domain resolves to an IP address that is located at a commercial VPS (Virtual Private Server) provider. The public-facing server forwards all incoming traffic via a VPN to a  Blot  server that handles actual connection requests from clients. It is setup for optional SSL client authentication: if a client sends a valid client certificate (only implants can do that), the connection is forwarded to the  Honeycomb  toolserver that communicates with the implant; if a valid certificate is missing (which is the case if someone tries to open the cover domain website by accident), the traffic is forwarded to a cover server that delivers an unsuspicious looking website.The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer, so the toolserver acts as a C2 (command and control) server for the implant.Similar functionality (though limited to Windows) is provided by the RickBobby project.See the classified user and developer guides for HIVE.WikiLeaks published as soon as its verification and analysis were ready.In February the Trump administration has issued an Executive Order calling for a  Cyberwar  review to be prepared within 30 days.While the review increases the timeliness and relevance of the publication it did not play a role in setting the publication date Continue this story at WikileaksREAD MORE WIKILEAKS AT: 21st Century Wire WIKILEAKS FilesSUPPORT OUR WORK BY SUBSCRIBING & BECOMING A MEMBER @21WIRE.TVUS_News
Your task is to classify the provided input as real or fake news. Label 0 is meant for fake news, Label 1 is for real news. TEXT: breaking wikileaks releases vault part year zero century wire says wikileaks released largest ever publication confidential documents central intelligence agency entitled vault containing password echoed alleged jfk quote splinter cia thousand pieces scatter winds leak comprises documents files isolated network situated inside cia center cyber intelligence langle virginia year zero part one leak conveniently named zero day exploit used intelligence agencies gathered throughout said largest intelligence publication history lot information methodology outlined year zero surprise security analysts researchers since edward snowden image left revelations public explicit confirmation one powerful intelligence agencies world aided international counterparts like ch infiltrating scoring vast quantities private information apple android devices right samsung smart tv technology false modes live microphones executed record information send back appropriate document dump game changer world know done know done cia documents know cia behind various russian hacking conspiracies circling around trump the questions proliferation report wikileaks wikileaks today tuesday march wikileaks begins new series leaks central intelligence agency vault wikileaks largest ever publication confidential documents first full part series year zero comprises documents files isolated network situated inside cia center cyber intelligence langle virgin it follows introductory disclosure last month cia targeting french political parties candidates lead presidential cia lost control majority hacking arsenal including malware viruses trojans weaponized zero day exploits malware remote control systems associated documentation this extraordinary collection amounts several hundred million lines code gives possession entire hacking capacity cia the archive appears circulated among former government hackers contractors unauthorized manner one provided wikileaks portions archive year zero introduces scope direction cia global covert hacking program malware arsenal dozens zero day weaponized exploits wide range european company products include apple iphone google android microsoft windows even samsung tvs turned covert cia gained political budgetary prominence national security agency nsa the cia found building infamous drone fleet different type covert force substantial fleet hackers the agency hacking division freed disclose often controversial operations nsa primary bureaucratic rival order draw nsa hacking end cia hacking division formally falls agency center cyber intelligence cci registered users produced thousand hacking systems trojans viruses weaponized malware such scale cia undertaking hackers utilized code used run facebook the cia created effect nsa even less accountability without publicly answering question whether massive budgetary spend duplicating capacities rival agency could statement wikileaks source details policy questions say urgently need debated public including whether cia hacking capabilities exceed mandated powers problem public oversight agency the source wishes initiate public debate security creation use proliferation democratic control single cyber weapon loose spread around world seconds used rival states cyber mafia teenage hackers passage wikileaks editor stated there extreme proliferation risk development cyber weapons comparisons drawn uncontrolled proliferation weapons results inability contain combined high market value global arms trade but significance year zero goes well beyond choice hyperwar cyberspace the disclosure also exceptional political legal forensic perspective wikileaks carefully reviewed year zero disclosure published substantive cia documentation avoiding distribution armed cyberweapons consensus emerges technical political nature cia program weapons analyzed disarmed also decided react anonymity identifying information year zero depth analysis these reactions include ten thousands cia targets attack machines throughout latin america europe united states while aware imperfect results approach chosen remain committed publishing model note quantity published pages vault part one year zero already eclipses total number pages published first three years edward snowden nsa malware hacking tools built ed engineering development group software development group within cci center cyber intelligence department belonging cia doi directorate digital innovation the doi one five major directorate cia see organizational chart cia details ed responsible development testing operational support backdoor exploits malicious payloads trojans viruses kind malware used cia covert operations increasing sophistication surveillance techniques drawn comparisons george orwell weeping angel developed cia embedded devices branch edb invests smart tvs transforming covert microphones surely emblematic attack samsung smart tvs developed cooperation united kingdom after infestation weeping angel places target tv mode owner falsely believes tv in mode tv operates bug recording conversations room sending internet covert cia october cia also looking infecting vehicle control systems used modern cars trucks the purpose control specified would permit cia engage nearly detectable cia mobile devices branch mdb developed numerous attacks remotely hack control popular smart phones infected phones instructed send cia user relocation audio text communications well covertly activate phone camera iphone minority share global smart phone market specialized unit cia mobile development branch produces malware invest control infiltrate data phones apple products running ios pads cia arsenal includes numerous local remote zero days developed cia obtained ch nsa fbi purchased cyber arms contractors bishop the disproportionate focus ios may explained popularity iphone among social political diplomatic business similar unit targets google android used run majority world smart phones including samsung htc sony billion android powered phones sold last year year zero shows cia weaponized android zero days developed obtained ch nsa cyber arms techniques permit cia bypass encryption whatsapp signal telegram weibo confides cloackman hacking smart phones run collecting audio message traffic encryption cia also runs substantial effort infect control microsoft windows users malware this includes multiple local remote weaponized zero days air gap jumping viruses hammer drill infects software distributed investors removable media uses systems hide data images covert disk areas brutal kangaroo keep malware infestation infection efforts pulled together cia automated implant branch air developed several attack systems automated infestation control cia malware assassin medusa internet infrastructure observers developed cia network devices branch ndb cia developed automated malware attack control systems covering windows mac os x solar linux edb hive related cutthroat spindle tools described examples section wake edward snowden leaks nsa technology industry secured commitment obama administration executive would disclose ongoing basis rather hoard serious vulnerabilities exploits bugs zero days apple google microsoft vulnerabilities disclosed manufacturers places huge states population critical infrastructure risk foreign intelligence cyber criminals independently discover hear rumors vulnerability if cia discover vulnerabilities government commitment vulnerabilities entities process came significant lobbying us technology companies risk losing share global market real perceived hidden vulnerabilities the government stated would disclose pervasive vulnerabilities discovered ongoing basis year zero documents show cia breached obama administration commitments many vulnerabilities used cia cyber arsenal pervasive may already found rival intelligence agencies cyber example specific cia malware revealed year zero able penetrate invest control android phone iphone software runs run presidential twitter accounts the cia attacks software using undisclosed security vulnerabilities zero days possessed cia cia hack phones everyone else obtained discovered vulnerability as long cia keeps vulnerabilities concealed apple google make phones fixed phones remain vulnerabilities exist population large including cabinet congress top ceo system administrators security officers engineers by hiding security flaws manufacturers like apple google cia ensures hack everyone mdash expense leaving everyone weapons possible keep effective nuclear proliferation restrained enormous costs visible infrastructure involved assembling enough missile material produce critical nuclear mass cyber weapons developed hard weapons fact computer programs pirated like since entirely comprised information copied quickly marginal weapons particularly difficult since people develop use skills infiltrate copies without leaving traces sometimes using weapons organizations contain there substantial price incentives government hackers consultants obtain copies since global vulnerability market pay hundreds thousands millions dollars copies weapons similarly contractors companies obtain weapons sometimes use purposes obtaining advantage competitors selling hacking last three years united states intelligence sector consists government agencies cia nsa contractors book allan hamilton subject unprecedented series data exfiltrations number intelligence community members yet publicly named arrested subject federal criminal investigations separate visibly february federal grand jury indicted harold martin iii counts mishandling classified information the department justice alleged seized gigabytes information harold martin iii obtained classified programs nsa cia including source code numerous hacking single cyber weapon loose spread around world seconds used peer states cyber mafia teenage hackers addition operations langle virginia cia also uses consulate frankfurt covert base hackers covering europe middle east hackers operating frankfurt consulate center cyber intelligence europe cie given diplomatic black passports state department cover the instructions incoming cia hackers make germany efforts appear inconsequential breeze german customs story pat stamp passport your cover story trip q why a supporting technical consultations earlier wikileaks publications give detail cia approaches customs secondary screening frankfurt cia hackers travel without border checks european countries part sheen open border area including france italy number cia electronic attack methods designed physical proximity these attack methods able penetrate high security networks disconnected internet police record database in cases cia officer agent allied intelligence officer acting instructions physically infiltrates targeted workplace the attacker provided usb containing malware developed cia purpose inserted targeted computer the attacker infects infiltrates data removable media for example cia attack system fine dining provides decoy applications cia spies use to witnesses spy appears running program showing videos lc presenting slides prezi playing computer game even running fake virus scanner kaspersky cafe solos but decoy application screen underlying system automatically infected surely one astounding intelligence goals living memory cia structured classification regime market valuable part vault cia weaponized malware implants zero days listening posts lp command control systems agency little legal cia made systems cia chose make cyberarsenal unclassified reveals concepts developed military use easily crossover battlefield cyber war attack targets cia usually requires implants communicate control programs internet if cia implants command control listening post software classified cia officers could prosecuted dismissed violating rules prohibit placing classified information onto internet consequently cia secretly made cyber code unclassified the government able assert copyright either due restrictions constitution this means cyber arms manufactures computer hackers freely pirate weapons obtained the cia primarily rely obfuscation protect malware weapons missiles may fired enemy secured area proximity impact target detonated ordnance including classified parts hence military personnel violate classification rules firing ordnance classified parts ordnance likely explode if operator last decade hacking operations increasingly dressed military jargon tap department defense funding streams for instance attempted malware injections commercial jargon implant drops nsa jargon called fires weapon fired however analogy bullets bombs missiles cia malware designed live days even years reached target cia malware explode impact rather permanently invests target in order infect target device copies malware must placed target devices giving physical possession malware target to infiltrate data back cia await instructions malware must communicate cia command control systems placed internet connected servers but servers typically approved hold classified information cia command control systems also made successful attack target computer system like series complex stock maneuvers hostile bid careful planting rumors order gain control organization leadership rather firing weapons system if military analogy made infestation target perhaps akin execution whole series military maneuvers target territory including observation infiltration occupation series standards lay cia malware infestation patterns likely assist forensic crime scene investigators well apple microsoft google samsung nokia blackberry siemens companies attribute defend attacks tradecraft do don ts contains cia rules malware written avoid fingerprints implications cia us government sitting partner companies forensic review similar secret standards cover use encryption hide cia hacker malware communication pdf describing targets infiltrated data pdf well executing payloads pdf persistent pdf target machines hackers developed successful attacks well known programs these documented av defeats personal security products detecting defeating psp avoidance for example comedy defeated cia malware placing window recycle bin while comedy gaming hole doom hackers discussed nsa equation group hackers wrong cia malware makers could avoid similar cia engineering development group ed management system contains around different projects documented year zero malware hacker majority projects relate tools used penetration infestation planting control branch development focuses development operation listening posts lp command control systems used communicate control cia implants special projects used target specific hardware routers smart example projects described see table contents full list projects described wikileaks year zero cia hand crafted hacking techniques pose problem agency each technique created forms fingerprint used forensic investigators attribute multiple different attacks analogous finding distinctive knife wound multiple separate murder victims the unique wounding style creates suspicion single murderer responsible as soon one murder set solved murders also find likely cia remote devices branch embrace group collects maintains substantial library attack techniques stolen malware produced states including russian embrace related projects cia increase total number attack types also indirect attribution leaving behind fingerprints groups attack techniques stolen components cover keyloggers password collection webcam capture data destruction persistence privilege escalation stealth psp avoidance survey dining comes standardized questionnaire menu cia case officers fill the questionnaire used agency os operational support branch transform requests case officers technical requirements hacking attacks typically infiltrating information computer systems specific operations the questionnaire allows os identify adapt existing tools operation communicate cia malware configuration staff the os functions interface cia operational staff relevant technical support list possible targets collection asset liaison asset system administrator foreign information operations foreign intelligence agencies foreign government entities notably absent reference extremists transnational criminals the case officer also asked specify environment target like type computer operating system used internet connectivity installed utilities psp well list file types infiltrated like office documents audio video images custom file types the menu also asks information recurring access target possible long observed access computer maintained this information used cia jqjimprovise software see configure set cia malware suited specific needs operation improvise tools configuration payload setup execution vector selection tools supporting major operating systems like windows bartender marcos jukebox linux dancefloor its configuration utilities like margaret allows noc network operation center customize tools based requirements fine dining cia malware suite associated control software the project provides customizable implants windows solar mikrotik used internet routers linux platforms listening post lp control infrastructure communicate implants configured communicate via https observer cover domain operation utilizing implants separate cover domain infrastructure handle number cover cover domain resolves ip address located commercial vs virtual private server provider the server forwards incoming traffic via vpn bot server handles actual connection requests clients it setup optional ssl client authentication client sends valid client certificate implants connection forwarded honeycomb toolserver communicates implant valid certificate missing case someone tries open cover domain website accident traffic forwarded cover server delivers suspicious looking honeycomb toolserver receives infiltrated information implant operator also task implant execute jobs target computer toolserver acts command control server functionality though limited windows provided rickbobby classified user developer guides published soon verification analysis february trump administration issued executive order calling hyperwar review prepared within review increases timelines relevance publication play role setting publication date continue story wikileaksread more wikileaks at century wire wikileaks filessupport our work by subscribing becoming a member