It has been several days since WikiLeaks promised to work with technology companies to fix security patches as they described the leak to the CIA, but no steps have been taken to date.
After the WikiLeaks Vault 7 revelation, multiple files were reported by the CIA that used zero-day exploits to get into people's systems, including Android and iOS devices, Windows computers, Macs, and Linux computers. After all these files were exposed to the world, a lot of pressure was put on WikiLeaks for not going to tech companies in advance, helping them patch their systems.
In response, WikiLeaks said it would work with tech companies to secure everything. Motherboard writes, however, that WikiLeaks required the companies to patch the vulnerabilities before handing over the data, including requiring them to issue a security patch within 90 days. Depending on the size of the flaw, this may or may not be possible. There’s also the fact that companies may not want to sign anything without knowing what the vulnerabilities are.
The same sources say, however, that companies are reluctant to write patches based on WikiLeaks information because they are concerned about the origins of the leak. The CIA could not confirm this, because intelligence agencies cannot. This makes everyone worry that Russia may have been responsible for passing the information to WikiLeaks and in the process, they were fooled, and that this information could cause companies to open up their systems instead of making them more secure.
WikiLeaks has a different take on the story and says that companies like Google are taking their time because they essentially work with the US government and their relationship is hindered by creating such flaws.
