WikiLeaks has dumped more leaked CIA documents with its latest Vault 7 disclosures, this time publishing materials from a tool suite called Brutal Kangaroo that allows attackers to indirectly infiltrate a closed network or air-gapped computer using a compromised flash drive., Security
WikiLeaks has dumped more leaked CIA documents with its latest Vault 7 disclosures, this time publishing materials from a tool suite called Brutal Kangaroo that allows attackers to indirectly infiltrate a closed network or air-gapped computer using a compromised flash drive. WikiLeaks on Thursday dumped more leaked CIA documents with its latest Vault 7 disclosures, this time publishing materials from a tool suite called Brutal Kangaroo that allows attackers to indirectly infiltrate a closed network or air-gapped computer using a compromised flash drive. The documents, dated between August 2012 and February 2016, reveal how CIA hackers would use the toolset to create a “custom covert network” within infected networks in order to conduct surveillance and launch executables. A Brutal Kangaroo infection requires several steps: First, attackers have to infect an internet-connected computer operated by the target organisation. When a user at that organisation inserts a thumb drive into the infected machine, the USB stick becomes infected as well. Finally, this compromised flash drive infects the ultimate target when it is used on a closed network or air-gapped machine. According to WikiLeaks, infected thumb drives use one of two Microsoft Windows vulnerabilities to execute malware: Older versions of Brutal Kangaroo leverage an exploit called EzCheese, while newer iterations use a “similar, but yet known vulnerability.” The tool suite’s components consist of various components including Drifting Deadline, a USB-stick infection tool; Shattered Assurance, a server tool responsible for automated infection of USB drives) , Broken Promise, a post processor that evaluates collected information; and Shadow, the main persistence mechanism.
