Their track record is mixed, but North Korea’s army of more than 6,000 hackers is undeniably persistent, and undeniably improving, according to American and British security officials who have traced these attacks and others back to the North.

Amid all the attention on Pyongyang’s progress in developing a nuclear weapon capable of striking the continental United States, the North Koreans have also quietly developed a cyberprogram that is stealing hundreds of millions of dollars and proving capable of unleashing global havoc.

Unlike its weapons tests, which have led to international sanctions, the North’s cyberstrikes have faced almost no pushback or punishment, even as the regime is already using its hacking capabilities for actual attacks against its adversaries in the West.

https://www.nytimes.com/2017/10/15/world/asia/north-korea-hacking-cyber-sony.html

By Ellen Nakashima

In 2015, Israeli government hackers saw something suspicious in the computers of a Moscow-based cybersecurity firm: hacking tools that could only have come from the National Security Agency.

Israel notified the NSA, where alarmed officials immediately began a hunt for the breach, according to people familiar with the matter, who said an investigation by the agency revealed that the tools were in the possession of the Russian government.

Israeli spies had found the hacking material on the network of Kaspersky Lab, the global anti-virus firm under a spotlight in the United States because of suspicions that its products facilitate Russian espionage.

Last month, the Department of Homeland Security instructed federal civilian agencies to identify Kaspersky Lab software on their networks and remove it on the grounds that “the risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates U.S. national security.” The directive followed a decision by the General Services Administration to remove Kaspersky from its list of approved vendors. And lawmakers on Capitol Hill are considering a governmentwide ban.

https://www.washingtonpost.com/world/national-security/israel-hacked-kaspersky-then-tipped-the-nsa-that-its-tools-had-been-breached/2017/10/10/d48ce774-aa95-11e7-850e-2bdd1236be5d_story.html?

A computer virus has infected the cockpits of America's Predator and Reaper drones, logging pilots' every keystroke as they remotely fly missions over Afghanistan and other warzones.

The virus, first detected nearly two weeks ago by the military's Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech's computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military's most important weapons system.

"We keep wiping it off, and it keeps coming back," says a source familiar with the network infection, one of three that told Danger Room about the virus. "We think it's benign. But we just don't know."

https://www.wired.com/2011/10/virus-hits-drone-fleet/

Russian government hackers stole highly sensitive U.S. spying tools after a contractor brought classified material home and put it on a computer that used Kaspersky anti-virus software, a former senior intelligence official briefed on the matter told NBC News.

The details were first reported Thursday by The Wall Street Journal.

The contractor, whose name has not been made public, worked for the National Security Agency, which specializes in hacking computers and eavesdropping on communications.

The Journal said the stolen material included secret details about how the NSA penetrates foreign computer networks, the computer code it uses for such spying and how it defends networks inside the U.S.

The report also said it was unclear whether the contractor had lost his job or is facing prosecution. He is not believed to have wittingly cooperated with a foreign government.

The man took his work home in violation of NSA rules, and Russian hackers were able to identify the material and access his machine because he was using Kaspersky software, the former official said.

The case explains why the U.S. government has cracked down on Kaspersky in recent months, banning its use by government agencies, he added.

https://www.nbcnews.com/news/investigations/russian-hackers-stole-nsa-tools-contractor-who-used-kaspersky-software-n808101

THE GROWING PROPENSITY of government hackers to reuse code and computers from rival nations is undermining the integrity of hacking investigations and calling into question how online attacks are attributed, according to researchers from Kaspersky Lab.

In a paper set for release today at the Virus Bulletin digital security conference in Madrid, the researchers highlight cases in which they’ve seen hackers acting on behalf of nation-states stealing tools and hijacking infrastructure previously used by hackers of other nation-states. Investigators need to watch out for signs of this or risk tracing attacks to the wrong perpetrators, the researchers said.

Threat researchers have built an industry on identifying and profiling hacking groups in order to understand their methods, anticipate future moves, and develop methods for battling them. They often attribute attacks by “clustering” malicious files, IP addresses, and servers that get reused across hacking operations, knowing that threat actors use the same code and infrastructure repeatedly to save time and effort. So when researchers see the same encryption algorithms and digital certificates reused in various attacks, for example, they tend to assume the attacks were perpetrated by the same group. But that’s not necessarily the case.

https://theintercept.com/2017/10/04/masquerading-hackers-are-forcing-a-rethink-of-how-attacks-are-traced/

What a lot of people don't know, is that a range of classified documents from the NSA have not been attributed to Edward Snowden, which means that there was at least one other leaker inside the NSA.

Initially, this leaker was called the "second source", and although he was responsible for significant leaks, they got little attention in the US. More media coverage gained the release, since 2016, of NSA hacking tools by the mysterious "Shadow Brokers".

Now, a close look at documents published by the German magazine Der Spiegel in December 2013 provided new indications that the second source could be identical with the Shadow Brokers.

http://electrospaces.blogspot.com/2017/09/are-shadow-brokers-identical-with.html

Equifax, one of the three major consumer credit reporting agencies, said on Thursday that hackers had gained access to company data that potentially compromised sensitive information for 143 million American consumers, including Social Security numbers and driver’s license numbers.

The attack on the company represents one of the largest risks to personally sensitive information in recent years, and is the third major cybersecurity threat for the agency since 2015.

Equifax, based in Atlanta, is a particularly tempting target for hackers. If identity thieves wanted to hit one place to grab all the data needed to do the most damage, they would go straight to one of the three major credit reporting agencies.

“This is about as bad as it gets,” said Pamela Dixon, executive director of the World Privacy Forum, a nonprofit research group. “If you have a credit report, chances are you may be in this breach. The chances are much better than 50 percent.”

https://www.nytimes.com/2017/09/07/business/equifax-cyberattack.html

RELEASE: CIA 'Express Lane' system for stealing the biometric databases of its 'partner' agencies around the world. https://t.co/8FefOS2Ljl pic.twitter.com/LPwlAd0Tgr— WikiLeaks (@wikileaks) August 24, 2017

Today, August 24th 2017, WikiLeaks publishes secret documents from the ExpressLane project of the CIA. These documents show one of the cyber operations the CIA conducts against liaison services -- which includes among many others the National Security Agency (NSA), the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI).

The OTS (Office of Technical Services), a branch within the CIA, has a biometric collection system that is provided to liaison services around the world -- with the expectation for sharing of the biometric takes collected on the systems. But this 'voluntary sharing' obviously does not work or is considered insufficient by the CIA, because ExpressLane is a covert information collection tool that is used by the CIA to secretly exfiltrate data collections from such systems provided to liaison services.

ExpressLane is installed and run with the cover of upgrading the biometric software by OTS agents that visit the liaison sites. Liaison officers overseeing this procedure will remain unsuspicious, as the data exfiltration disguises behind a Windows installation splash screen.

The core components of the OTS system are based on products from Cross Match, a US company specializing in biometric software for law enforcement and the Intelligence Community. The company hit the headlines in 2011 when it was reported that the US military used a Cross Match product to identify Osama bin Laden during the assassination operation in Pakistan.

https://wikileaks.org/vault7/#ExpressLane

The Trump administration this week elevated the US Cyber Command to a Unified Combatant Command, in a long-awaited move that underscores the growing importance of cyber warfare.

The decision, announced Friday, puts the Cyber Command on par with nine other combat commands, and may lead to its separation from the National Security Agency (NSA). In a statement, President Trump said that Secretary of Defense James Mattis will examine the possibility of separating the Cyber Command and the NSA, and that he will announce recommendations “at a later date.”

https://www.theverge.com/2017/8/20/16175638/trump-cyber-command-nsa-decision

RELEASE: CIA system for intercepting video chat and security camera streams. Uses CIA "Fire and Collect" framework. https://t.co/EDqsoZKgTo pic.twitter.com/t7nR8v8qMJ— WikiLeaks (@wikileaks) August 10, 2017

Today, August 10th 2017, WikiLeaks publishes the the User Guide for the CoachPotato project of the CIA. CouchPotato is a remote tool for collection against RTSP/H.264 video streams. It provides the ability to collect either the stream as a video file (AVI) or capture still images (JPG) of frames from the stream that are of significant change from a previously captured frame. It utilizes ffmpeg for video and image encoding and decoding as well as RTSP connectivity. CouchPotato relies on being launched in an ICE v3 Fire and Collect compatible loader.

https://wikileaks.org/vault7/releases/#CouchPotato

RELEASE: CIA project 'Dumbo' to switch off security webcams and corrupt recordings to hide physical intrusions https://t.co/XucsNTcJO6 pic.twitter.com/5xFl28eEKZ— WikiLeaks (@wikileaks) August 3, 2017

Today, August 3rd 2017 WikiLeaks publishes documents from the Dumbo project of the CIA. Dumbo is a capability to suspend processes utilizing webcams and corrupt any video recordings that could compromise a PAG deployment. The PAG (Physical Access Group) is a special branch within the CCI (Center for Cyber Intelligence); its task is to gain and exploit physical access to target computers in CIA field operations.

Dumbo can identify, control and manipulate monitoring and detection systems on a target computer running the Microsoft Windows operating sytem. It identifies installed devices like webcams and microphones, either locally or connected by wireless (Bluetooth, WiFi) or wired networks. All processes related to the detected devices (usually recording, monitoring or detection of video/audio/network streams) are also identified and can be stopped by the operator. By deleting or manipulating recordings the operator is aided in creating fake or destroying actual evidence of the intrusion operation.

https://wikileaks.org/vault7/#Dumbo

RELEASE: CIA project 'Imperial'. Trojans targeting Macs, Debian, Red Hat, Solaris, FreeBSD, Centos #Vault7 #Imperial https://t.co/Bsoxd7LdiC pic.twitter.com/iACdXnaOle— WikiLeaks (@wikileaks) July 27, 2017

Today, July 27th 2017, WikiLeaks publishes documents from the Imperial project of the CIA.

Achilles is a capability that provides an operator the ability to trojan an OS X disk image (.dmg) installer with one or more desired operator specified executables for a one-time execution.

Aeris is an automated implant written in C that supports a number of POSIX-based systems (Debian, RHEL, Solaris, FreeBSD, CentOS). It supports automated file exfiltration, configurable beacon interval and jitter, standalone and Collide-based HTTPS LP support and SMTP protocol support - all with TLS encrypted communications with mutual authentication. It is compatible with the NOD Cryptographic Specification and provides structured command and control that is similar to that used by several Windows implants.

SeaPea is an OS X Rootkit that provides stealth and tool launching capabilities. It hides files/directories, socket connections and/or processes. It runs on Mac OSX 10.6 and 10.7.

https://wikileaks.org/vault7/releases/#Imperial

As Al-CIA-da become the “good guys” (again), and I-CIA-SIS starts to crumble, and the latest boogeymen fail to strike a chord of panic in a boogeyman-weary public (remember the fearsome Khorasan Group, anyone?), it is safe to say that the old Global War on Terror (GWoT) paradigm is falling by the wayside. Lucky for the multi-trillion-dollar global terror-industrial complex, then, that the spiffy new cyberterror paradigm is waiting in the wings to take its place!

But just as the fading GWoT paradigm requires a steady stream of (perceived) threats in order to justify the bloated budgets of the US intelligence and security apparatus, so, too, does this new cyberterror paradigm require a constant flow of (perceived) online threats to justify the bloated budgets of the US cybersecurity forces. And just as in the GWoT, every “failure” of cyber-intelligence and every “inadvertent” proliferation of cyber-weaponry gives the newly-created US Cyber Command an excuse to expand its role and take even bolder action in its quest to “fight the net.”

The GWoT and all of its attendant ills have been built on the back of that “catalyzing event”— our “new Pearl Harbor,” 9/11. So, naturally, the new cybersecurity establishment is waiting breathlessly for the “cyber 9/11” that will justify the complete crackdown and government takeover of the internet.

https://steemit.com/news/@corbettreport/bracing-for-cyber-9-11

WikiLeaks has today published the 16th batch of its ongoing Vault 7 leak, this time instead of revealing new malware or hacking tool, the whistleblower organisation has unveiled how CIA operatives stealthy collect and forward stolen data from compromised smartphones.

Previously we have reported about several CIA hacking tools, malware and implants used by the agency to remotely infiltrate and steal data from the targeted systems or smartphones.

However, this time neither Wikileaks nor the leaked CIA manual clearly explains how the agency operatives were using this tool.

But, since we have been covering every CIA leak from the very first day, we have understood a possible scenario and have illustrated how this newly revealed tool was being used.

http://thehackernews.com/2017/07/cia-smartphone-hacking-tool.html

RELEASE: CIA Android phone SMS proxy 'HighRise' which masquerades as 'TideCheck' to form a covert messaging network https://t.co/wyNM6dOgnp pic.twitter.com/fMIrKbFhpG— WikiLeaks (@wikileaks) July 13, 2017

Today, July 13th 2017, WikiLeaks publishes documents from the Highrise project of the CIA. HighRise is an Android application designed for mobile devices running Android 4.0 to 4.3. It provides a redirector function for SMS messaging that could be used by a number of IOC tools that use SMS messages for communication between implants and listening posts. HighRise acts as a SMS proxy that provides greater separation between devices in the field ("targets") and the listening post (LP) by proxying "incoming" and "outgoing" SMS messages to an internet LP. Highrise provides a communications channel between the HighRise field operator and the LP with a TLS/SSL secured internet communication.

https://wikileaks.org/vault7/#Highrise

.@realDonaldTrump https://t.co/6bnlziNGep— #WhiteRabbit 🐇 (@W4BB17) July 10, 2017

http://www.thegatewaypundit.com/2017/07/breaking-anon-twitter-acct-white-rabbit-just-dropped-28000-hillary-private-emails-online/

A mysterious IT specialist, who goes by the name The Forensicator, published a detailed report that appears to disprove the theory that the DNC was hacked by Russia.

As reported on Sunday at The Gateway Pundit website:

Since May, hackers have been penetrating the computer networks of companies that operate nuclear power stations and other energy facilities, as well as manufacturing plants in the United States and other countries.

Among the companies targeted was the Wolf Creek Nuclear Operating Corporation, which runs a nuclear power plant near Burlington, Kan., according to security consultants and an urgent joint report issued by the Department of Homeland Security and the Federal Bureau of Investigation last week.

The joint report was obtained by The New York Times and confirmed by security specialists who have been responding to the attacks. It carried an urgent amber warning, the second-highest rating for the sensitivity of the threat.

The report did not indicate whether the cyberattacks were an attempt at espionage — such as stealing industrial secrets — or part of a plan to cause destruction. There is no indication that hackers were able to jump from their victims’ computers into the control systems of the facilities, nor is it clear how many facilities were breached.

https://www.nytimes.com/2017/07/06/technology/nuclear-plant-hack-report.html

RELEASE: #CIA implants targeting SSH on Windows and Linux #BothanSpy #Gryfalcon #KitV #Vault7 https://t.co/OMJYH3sLmA pic.twitter.com/KYCbXwmow8— WikiLeaks (@wikileaks) July 6, 2017

Today, July 6th 2017, WikiLeaks publishes documents from the BothanSpy and Gyrfalcon projects of the CIA. The implants described in both projects are designed to intercept and exfiltrate SSH credentials but work on different operating systems with different attack vectors.

BothanSpy is an implant that targets the SSH client program Xshell on the Microsoft Windows platform and steals user credentials for all active SSH sessions. These credentials are either username and password in case of password-authenticated SSH sessions or username, filename of private SSH key and key password if public key authentication is used. BothanSpy can exfiltrate the stolen credentials to a CIA-controlled server (so the implant never touches the disk on the target system) or save it in an enrypted file for later exfiltration by other means. BothanSpy is installed as a Shellterm 3.x extension on the target machine.

https://wikileaks.org/vault7/#BothanSpy

RELEASE: #CIA 'Outlaw Country' covert kernel module for #Linux https://t.co/RnNjT8EutT #RHAT #redhat #vault7 pic.twitter.com/trdhc4VbJ2— WikiLeaks (@wikileaks) June 29, 2017

Today, June 29th 2017, WikiLeaks publishes documents from the OutlawCountry project of the CIA that targets computers running the Linux operating system. OutlawCountry allows for the redirection of all outbound network traffic on the target computer to CIA controlled machines for ex- and infiltration purposes. The malware consists of a kernel module that creates a hidden netfilter table on a Linux target; with knowledge of the table name, an operator can create rules that take precedence over existing netfilter/iptables rules and are concealed from an user or even system administrator.

https://wikileaks.org/vault7/#OutlawCountry

HOW MANY PEOPLE specifically know where you are right now? Some friends and family? Your coworkers, maybe? If you're using a Windows laptop or PC you could add another group to the list: the CIA.

New documents released on Wednesday as part of WikiLeaks' series of CIA hacking revelations detail a method the agency uses to geolocate computers, and the people using them. The agency infects target devices with malware that can then check which public Wi-Fi networks a given computer can connect to at a given moment, as well as the signal strengths of those networks. From there, the malware compares the list of available Wi-Fi options to databases of public Wi-Fi networks to figure out roughly where the device is.

https://www.wired.com/story/wikileaks-cia-wifi-location-tracking/