Wikileaks has been releasing CIA sensitive documentation of Hacking Tools as part of their Vault 7 series, this time it made a public documentation by releasing two more hacking tools called Elsa and OutLawCountry.
OutLawCountry
OutLawCountry is a tool that allows CIA to hack into Linux-based systems and perform a cyberespionage on the victims. According to leaked documents this tool allows CIA to hack into victim linux by manipulating the network traffic.
Working of OutLawCountry
The tool works by injecting a Kernel module into the target system through accessing the shell and subsequently creating a Netfilter table that contains rules. The table is created using the iptables command, and these rules can only be seen if the administrator of the affected device knows the table name.
However, since the table name is already hidden, the administrator of the victim has no means to know the name. Furthermore, the CIA uses usual backdoor exploits to infiltrate the system with the tool.
Once installed, the tool simply redirects outbound network traffic to CIA’s computers and allows the CIA operator to extract and perform analysis on the data.
Limitations
The documentation released also reveal certain limitations of the tool. Primarily, OutlawCountry’s Kernel modules only work with compatible Linux Kernels. These kernels are usually the default ones since the tool works with the 64-bit CentOS/RHEL 6.x module.
ELSA
ELSA is tool which could track down the exact location of the person using Windows PC through public Wi-Fi or hotspots even if they are not connected to it.
The documents show that ELSA works by firstly getting into the system through certain exploits and then scans the infected computer’s Wi-Fi hardware to see if there are any Wi-Fi hot spots nearby, along with the MAC address and the signal strength.
It then stores the information in an encrypted form. The CIA operator can then download these files using further exploits and decrypt them for further analysis.
Essentially, once the CIA operator has the data, he/she can run a quick search on Google’s database using back-end software to see all the locations of Wi-Fi hotspots and match the hotspot extracted from the data to filter out its exact address.
As such, the CIA can know your exact location even if you are not connected to the internet per say.
More about Vault 7
