How the CIA infects air-gapped networks

Sprawling “Brutal Kangaroo“ spreads malware using booby-trapped USB drives.

Documents published Thursday purport to show how the Central Intelligence Agency has used USB drives to infiltrate computers so sensitive they are severed from the Internet to prevent them from being infected.

More than 150 pages of materials published by WikiLeaks describe a platform code-named Brutal Kangaroo that includes a sprawling collection of components to target computers and networks that aren't connected to the Internet. Drifting Deadline was a tool that was installed on computers of interest. It, in turn, would infect any USB drive that was connected. When the drive was later plugged into air-gapped machines, the drive would infect them with one or more pieces of malware suited to the mission at hand. A Microsoft representative said none of the exploits described work on supported versions of Windows.

The infected USB drives were at least sometimes able to infect computers even when users didn't open any files. The so-called EZCheese exploit, which was neutralized by a patch Microsoft appears to have released in 2015, worked any time a malicious file icon was displayed by the Windows explorer. A later exploit known as Lachesis used the Windows autorun feature to infect computers running Windows 7. Lachesis didn't require Explorer to display any icons, but the drive letter the thrumbdrive was mounted on had to be included in a malicious link. The RiverJack exploit, meanwhile, used the Windows library-ms function to infect computers running Windows 7, 8, and 8.1. Riverjack worked only when a library junction was viewed in Explorer.

In a statement, a Microsoft official wrote: "Our investigation confirmed that customers on supported versions of Windows are not impacted. For the best defense against modern security threats, we recommend Windows 10, which is updated automatically by default."

Microsoft didn't say when it patched the vulnerabilities exploited by Lachesis and RiverJack. Interestingly, Microsoft earlier this month patched a critical vulnerability that allowed so-called .LNK files stored on removable drives and remote shares to execute malicious code. Microsoft said in its advisory that the vulnerability was being actively exploited but didn't elaborate.

From simians to kangaroos

The documents appear to suggest that the "primary host" that gets compromised by Drifting Deadline or earlier versions, known as Shattered Assurance and Emotional Simian, must be manually infected. If that's the case, Brutal Kangaroo isn't nearly as effective as the pure USB exploits used in the Stuxnet and Flame attacks, which are both widely attributed to the National Security Agency. The CIA manuals, however, provide extremely limited context. There seems to be no reason Drifting Deadline can't be transmitted by a USB. If that's the case, it means a booby-trapped USB would be all that's needed to infect the air-gapped networks of interest.

The Brutal Kangaroo documents are the latest installment in the Vault7 series, which WikiLeaks says are the result of the CIA losing control of the majority of its hacking arsenal. Agency officials have never confirmed or refuted the authenticity of the documents, but both the volume and details of the leaks to date leave little doubt they are real. Virtually all of the exploits revealed so far are standard for spy agencies.