Your browser does not support the HTML5 canvas tag.
Εγχειρίδιο χειρισμού κρίσεων λόγω πολιτικών ΔΝΤ από τη CIA! / Already confirmed: Civil liberties under attack! / Greece's creditors gone completely insane! / How the global financial mafia sucked Greece's blood / ECB's economic hitmen / Η Μέρκελ επιβεβαιώνει τα σχέδια των γραφειοφασιστών! /Greece: the low-noise collapse of an entire country/ How the neoliberal establishment tricked the masses again, this time in France / Ενώ η Γερμανία προετοιμάζεται για τα χειρότερα, η Ελλάδα επιμένει στο ευρώ! / Ένας παγκόσμιος "proxy" πόλεμος κατά της ελευθερίας έχει ξεκινήσει! / McCarthyism 2.0 against the independent information / Ο επικεφαλής του "σκιώδους συμβουλίου" της ΕΚΤ επιβεβαιώνει ότι η ευρωζώνη είναι μια χρηματοπιστωτική δικτατορία! / Venezuela case as an emphatic example of why the mainstream media propaganda in the West was so successful in previous decades / Δημοψήφισμα για Grexit: η τελευταία ευκαιρία να σωθεί η Ελλάδα και η τιμή της Αριστεράς / Populism as the new cliche of the elites to stigmatize anyone not aligned with the establishment / Δεν γίνεται έτσι "σύντροφοι" ... / Panama Papers: When mainstream information wears the anti-establishment mask / The Secret Bank Bailout / The head of the ECB “shadow council” confirms that eurozone is a financial dictatorship! / A documentary by Paul Mason about the financial coup in Greece / The ruthless neo-colonialists of 21st century / First cracks to the establishment by the American people / Clinton emails - The race of the Western neo-colonialist vultures over the Libyan corpse / Επιχείρηση Panama Papers: Το κατεστημένο θέλει το μονοπώλιο και στις διαρροές; / Operation "looting of Greece" reaches final stage / Varoufakis describes how Merkel sacrificed Greece to save the Franco-German banks / France officialy enters the neo-Feudal era! / The US establishment just gave its greatest performance so far ... / A significant revelation by WikiLeaks that the media almost ignored / It's official: the US is funding Middle-East jihadists! / Οι αδίστακτοι νεο-αποικιοκράτες του 21ου αιώνα / How to handle political unrest caused by IMF policies! / Πώς το νεοφιλελεύθερο κατεστημένο ξεγέλασε τις μάζες, αυτή τη φορά στη Γαλλία / Οι Γάλλοι νεοαποικιοκράτες επιστρέφουν στην Ελλάδα υπό 'ιδανικές' συνθήκες

22 June, 2017

Brutal Kangaroo

WikiLeaks

Today, June 22nd 2017, WikiLeaks publishes documents from the Brutal Kangaroo project of the CIA. Brutal Kangaroo is a tool suite for Microsoft Windows that targets closed networks by air gap jumping using thumbdrives. Brutal Kangaroo components create a custom covert network within the target closed network and providing functionality for executing surveys, directory listings, and arbitrary executables.

The documents describe how a CIA operation can infiltrate a closed network (or a single air-gapped computer) within an organization or enterprise without direct access. It first infects a Internet-connected computer within the organization (referred to as "primary host") and installs the BrutalKangaroo malware on it. When a user is using the primary host and inserts a USB stick into it, the thumbdrive itself is infected with a separate malware. If this thumbdrive is used to copy data between the closed network and the LAN/WAN, the user will sooner or later plug the USB disk into a computer on the closed network. By browsing the USB drive with Windows Explorer on such a protected computer, it also gets infected with exfiltration/survey malware. If multiple computers on the closed network are under CIA control, they form a covert network to coordinate tasks and data exchange. Although not explicitly stated in the documents, this method of compromising closed networks is very similar to how Stuxnet worked.

The Brutal Kangaroo project consists of the following components: Drifting Deadline is the thumbdrive infection tool, Shattered Assurance is a server tool that handles automated infection of thumbdrives (as the primary mode of propagation for the Brutal Kangaroo suite), Broken Promise is the Brutal Kangaroo postprocessor (to evaluate collected information) and Shadow is the primary persistence mechanism (a stage 2 tool that is distributed across a closed network and acts as a covert command-and-control network; once multiple Shadow instances are installed and share drives, tasking and payloads can be sent back-and-forth).

The primary execution vector used by infected thumbdrives is a vulnerability in the Microsoft Windows operating system that can be exploited by hand-crafted link files that load and execute programs (DLLs) without user interaction. Older versions of the tool suite used a mechanism called EZCheese that was a 0-day exploit until March 2015; newer versions seem use a similar, but yet unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system.

Links, documents:

No comments:

Post a Comment