Seva
06-03-2017, 06:16 AM
https://1.bp.blogspot.com/-_mTBKptLydg/WTEalUsIXSI/AAAAAAAAs94/MTsBHtTA46g1b8hJtIBsG5SgLNRkDCo4QCLcB/s1600/cia-windows-hacking-tool.png
WikiLeaks has published a new batch of the ongoing Vault 7 leak, this time detailing an alleged CIA project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network.
Codenamed Pandemic, the tool is a persistent implant for Microsoft Windows machines that share files with remote users on a local network.
The documents leaked by the whistleblower organisation date from April 2014 to January 2015.
According to WikiLeaks, Pandemic infect networks of Windows computers through the Server Message Block (SMB) file sharing protocol by replacing application code on-the-fly with a trojanized version of the software.
"Pandemic is a tool which is run as kernel shellcode to install a file system filter driver," a leaked CIA manual reads. "The filter will 'replace' a target file with the given payload file when a remote user accesses the file via SMB (read-only, not write)."
'Pandemic' Turns File Servers into 'Patient Zero'
Once compromised, the infected Windows file server acts as a "Patient Zero" – the first identified carrier of any communicable disease during an outbreak – which is then used to deliver infections on machines inside the network.
Now, whenever any targeted computer attempts to access a file on the compromised server, Pandemic intercepts the SMB request and secretly delivers a malicious version of the requested file, which is then executed by the targeted computer.
According to the user manual, Pandemic takes only 15 seconds to be installed on a target machine and can replace up to 20 legitimate files (both 32-bit and 64-bit files) at a time with a maximum file size of 800MB.
Since the tool has been specifically designed to infect corporate file sharing servers and turns them into a secret carrier for delivering malware to other persons on the target network, it has been named Pandemic.
However, the leaked documents do not explain precisely how Pandemic gets installed on a targeted file server.
Former National Security Agency (NSA) employee Jake Williams also questioned whether the leaked documents by the whistleblower group required to take advantage of the Pandemic tool had been released.
"When you examine the #pandemic @wikileaks dump, ask yourself: Where are the rest of the docs? Compared this dump to any of the others you'll see that there is far less data than we got with GRASSHOPPER, etc. Do they not have the other files? Seems unlikely," Williams said.Last week, WikiLeaks dumped a CIA's spyware framework, dubbed Athena – which "provides remote beacon and loader capabilities on target computers" – that works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.
Information provided GREENDUMP24.COM (https://greendumps24.com/)
WikiLeaks has published a new batch of the ongoing Vault 7 leak, this time detailing an alleged CIA project that allowed the agency to turn Windows file servers into covert attack machines that can silently infect other computers of interest inside a targeted network.
Codenamed Pandemic, the tool is a persistent implant for Microsoft Windows machines that share files with remote users on a local network.
The documents leaked by the whistleblower organisation date from April 2014 to January 2015.
According to WikiLeaks, Pandemic infect networks of Windows computers through the Server Message Block (SMB) file sharing protocol by replacing application code on-the-fly with a trojanized version of the software.
"Pandemic is a tool which is run as kernel shellcode to install a file system filter driver," a leaked CIA manual reads. "The filter will 'replace' a target file with the given payload file when a remote user accesses the file via SMB (read-only, not write)."
'Pandemic' Turns File Servers into 'Patient Zero'
Once compromised, the infected Windows file server acts as a "Patient Zero" – the first identified carrier of any communicable disease during an outbreak – which is then used to deliver infections on machines inside the network.
Now, whenever any targeted computer attempts to access a file on the compromised server, Pandemic intercepts the SMB request and secretly delivers a malicious version of the requested file, which is then executed by the targeted computer.
According to the user manual, Pandemic takes only 15 seconds to be installed on a target machine and can replace up to 20 legitimate files (both 32-bit and 64-bit files) at a time with a maximum file size of 800MB.
Since the tool has been specifically designed to infect corporate file sharing servers and turns them into a secret carrier for delivering malware to other persons on the target network, it has been named Pandemic.
However, the leaked documents do not explain precisely how Pandemic gets installed on a targeted file server.
Former National Security Agency (NSA) employee Jake Williams also questioned whether the leaked documents by the whistleblower group required to take advantage of the Pandemic tool had been released.
"When you examine the #pandemic @wikileaks dump, ask yourself: Where are the rest of the docs? Compared this dump to any of the others you'll see that there is far less data than we got with GRASSHOPPER, etc. Do they not have the other files? Seems unlikely," Williams said.Last week, WikiLeaks dumped a CIA's spyware framework, dubbed Athena – which "provides remote beacon and loader capabilities on target computers" – that works against every version of Microsoft's Windows operating systems, from Windows XP to Windows 10.
Information provided GREENDUMP24.COM (https://greendumps24.com/)