WikiLeaks Released Another Batch of Information on CIA Surveillance

Julian Assange’s whistleblowing service revealed the CIA is still able to hack consumer devices, which has already raised many questions for users and tech firms alike. Apparently, the agency targets all everyday consumer devices including smartphones, computers, and even smart TVs.

The Wikileaks’ release shows that the CIA maintains the technical capability to hack all popular consumer devices, as the agency’s documents contain a description of thousands of the vulnerabilities, including the flaws which were discovered by independent security researchers and published to encourage the manufacturers to fix them, as well as the vulnerabilities discovered by the CIA itself or by partner organizations like the UK’s GCHQ.

The leak dates to mid-2016, and the vendors have since patched many of the mentioned hacking tools. This means that if your device were fully up-to-date, it would be safe from such attacks. However, some flaws, including the attacks on version 9.0 of iOS, have been unfixed at the time the documents were made.

In the meantime, the US government has denied discovering and stockpiling the flaws, saying that it just reports such vulnerabilities to manufacturers for fixing, but the CIA appears likely to have similarly up-to-date hacking tools today, which would enable it to break into even fully-patched devices.

For example, the recent release (dubbed “Vault 7”) details the iOS exploit known as “Earth/Eve”, apparently purchased by the NSA from an unnamed researcher. This flaw only works on iPhones and iPads running iOS versions 7 and 8 and was fixed in the release of iOS 9 in September 2015. The leak also describes flaws that had not been fixed by the time of the leak. They are called “zero days”, as the vendors have had zero days to fix them before they are used, and have likely been replaced by more zero-days if fixed by the vendors.

It also turned out that the CIA used the techniques to bypass the encryption of popular encrypted chat apps like WhatsApp and Signal – without hacking the apps themselves. In simple words, the agency used “endpoint attacks”, which simply waited until the message is decrypted to be displayed on your screen – like someone waiting for you to open your letter before reading it over your shoulder.