Smartphones, PCs and TVs: the everyday devices targeted by the CIA

The trove of information on alleged CIA hacking tools released by Julian Assange’s WikiLeaks organisation, which reveals that the agency maintains the capability to hack consumer devices, will raise many questions for users and technology companies alike.

Everyday consumer devices including smartphones running iOS and Android operating systems, Windows and Mac computers, and even smart TVs made by manufacturers such as Samsung have all being targeted by the CIA.

The release, dubbed “Vault 7” by Wikileaks, shows that the agency ensures it maintains the technical capability to hack as many popular devices as it can. The vulnerabilities described in the thousands of published documents come in all shapes and sizes: some, such as an attack which can be used to take control of older iPhones, were discovered by independent security researchers and published to encourage technology firms to fix weaknesses; others, such as one which takes control of Android phones via older versions of the Chrome browser, were apparently discovered by the intelligence agency itself, or by partner organisations such as GCHQ.

Many of the hacking tools detailed by the leak, which appears to date to mid-2016, have since been patched by the vendors, meaning that a user with a fully up-to-date device would be safe from those avenues of attack. But some, such as attacks on version 9.0 of iOS, the operating system for iPhones and iPads, seem to have been unfixed at the time the documents were made.

If the CIA has continued to discover and stockpile vulnerabilities (something the US government has denied doing, insisting that it reports such software flaws to manufacturers for fixing), the agency appears likely to have similarly up-to-date hacking tools today, which would leave it able to break into even fully-patched devices.

The fixed weaknesses detailed in the Vault 7 leak include many of the iOS exploits, such as one known as “Earth/Eve”, apparently purchased by the NSA from an unnamed researcher, and shared with the CIA, as well as GCHQ. The Earth/Eve exploits only work on iPhones and iPads running iOS versions 7 and 8, and were fixed when iOS 9 was released in September 2015.

Other exploits described in the release had not been fixed by the time of the leak. These unpatched vulnerabilities, known as “zero days” (named for the amount of time vendors have had to fix them before they are used), may have since been fixed by software updates, but have likely been in turn replaced by still more zero-days.

WikiLeaks took the decision to redact the specific exploits, leaving security researchers unable to match the descriptions of the exploits, known by codenames such as “Moon”, with actually fixed errors. Similar to “Earth/Eve” and “Moon”, the iOS exploits, WikiLeaks also describes zero days stockpiled by the CIA’s team for hacking Android devices.

The amount of access an attacker can have to a smartphone hacked in such a way can be staggering.

In a press release, WikiLeaks described the CIA using the techniques “to bypass the encryption” of a number of popular encrypted chat apps such as WhatsApp and Signal. The apps themselves, however, have not been hacked. Security researchers point out that so-called “endpoint attacks” work not by defeating the encryption directly, but by waiting until the content is decrypted to be displayed on screen – the high-tech equivalent of waiting for someone to open their letter before reading it over their shoulder.

Other zero days described in the dataset, which totals around a gigabyte of publicly released files, include one which allows the agency to turn a popular brand of smart TV into a remote bug, spying on the user. Dubbed “Weeping Angel”, after a villain in BBC TV series Doctor Who, the malware was apparently developed in conjunction with British intelligence service MI5 and could be used to take control of TVs made by Korean firm Samsung and listen to conversations while appearing to be switched off.

The vulnerability with Samsung TVs was not publicly known until the release of the WikiLeaks documents. It is not known if the zero-day attack still works or if the hole has since been fixed by a software update.

Weeping Angel dates from 2014, but a year later Samsung Smart TVs were embroiled in a spying scandal of their own making: the company’s privacy policy warned owners that they should not discuss sensitive topics in their living room, in case the information was recorded by the TV and sent to the company’s voice-recognition partner.