Wikileaks: RELEASE: CIA malware for Windows "Grasshopper"-which includes its own language

twitter ^ | April 7, 2017

[maggief]

https://wikileaks.org/vault7/?g#Grasshopper

Grasshopper
7 April, 2017
Today, April 7th 2017, WikiLeaks releases Vault 7 “Grasshopper” — 27 documents from the CIA’s Grasshopper framework, a platform used to build customized malware payloads for Microsoft Windows operating systems.

Grasshopper is provided with a variety of modules that can be used by a CIA operator as blocks to construct a customized implant that will behave differently, for example maintaining persistence on the computer differently, depending on what particular features or capabilities are selected in the process of building the bundle. Additionally, Grasshopper provides a very flexible language to define rules that are used to “perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration”. Through this grammar CIA operators are able to build from very simple to very complex logic used to determine, for example, if the target device is running a specific version of Microsoft Windows, or if a particular Antivirus product is running or not.

Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The requirement list of the Automated Implant Branch (AIB) for Grasshopper puts special attention on PSP avoidance, so that any Personal Security Products like ‘MS Security Essentials’, ‘Rising’, ‘Symantec Endpoint’ or ‘Kaspersky IS’ on target machines do not detect Grasshopper elements.

One of the persistence mechanisms used by the CIA here is ‘Stolen Goods’ - whose “components were taken from malware known as Carberp, a suspected Russian organized crime rootkit.” confirming the recycling of malware found on the Internet by the CIA. “The source of Carberp was published online, and has allowed AED/RDB to easily steal components as needed from the malware.”. While the CIA claims that “[most] of Carberp was not used in Stolen Goods” they do acknowledge that “[the] persistence method, and parts of the installer, were taken and modified to fit our needs”, providing a further example of reuse of portions of publicly available malware by the CIA, as observed in their analysis of leaked material from the italian company “HackingTeam”.

The documents WikiLeaks publishes today provide an insights into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise

[Dr.Deth]

[Whenifhow]

PING!!!

Article and comments, esp #2

Personal Security Products like ‘MS Security Essentials’, ‘Rising’, ‘Symantec Endpoint’ or ‘Kaspersky IS’ on target machines do not detect Grasshopper elements.

Thanks, maggief

[Protect the Bill of Rights]

Patience, Grasshopper

had to get it out of my system :-)

[Protect the Bill of Rights]

LMAO, you too!

[Protect the Bill of Rights]

The Vault7 releases are Greek to me. I have to rely on expertise on others.

Programming morons are people, too! We need more emails! :-)

[Delta 21]

Hey Laz.

Whats the low-down on this? You been working on stuff and not telling US ?!!?

[Lazamataz]

This is some fascinating stuff.

[Lazamataz]

This is some fascinating stuff.

[ryderann]

C.J. Box’s new novel “Off the Grid” gives the down-and-dirty on our government’s collection and storage of ALL of our information, including our incoming and outgoing communications.

Last month I spent a few days in the hospital. They asked about my family’s medical history which I told them. Then they asked for my parents, brother and sister names. I told them that they didn’t need their names and stopped anymore non-medical questions. I have lived a fairly reclusive lifestyle for the past 25 years and was stunned that things have gone so far.

[TennesseeGirl]

Good for you! There’s a growing list of questions the medical community is asking that I refuse to answer - one being do you own a gun or is there one in your home. The states we live in & the FBI/ATF, et al, already have this information in their records; let them cross-reference and look it up. It’s none of my health provider’s business. We’ll probably be “fired” by our doctors/nurse practitioners more & more in the future because we refuse to accept their canned “Standards of Health” (rules they have which are set by bureaucrats in “healthcare”), patient compliance rates (which is tied directly to their bonuses), and any other invasive queries they ask.

[Delta 21]

Is Bill Gates scratching his head or just cashing another govt check?

[ryderann]

Heeheehee...I was fired by my last GP because I wouldn’t go in every six months for a routine check up, wouldn’t get flu and pneumonia vaccines, etc.

[Dr.Deth]

” Be not seduced by the allure of fine menswear, Grasshopper. For, with each season, fashions change. Trust not your fate to gay Italians, Grasshopper. “

[SgtHooper]

Nah. He’s been working on the next version called “Hooters”.