HighRise: WikiLeaks published today the user guide of another CIA hacking tool in the Vault 7 leak series.
This tool is internally called the CIA's HighRise and is an Android application for monitoring and redirecting SMS messages to a remote server.
According to the leaked manual (PDF), HighRise only works on Android versions 4.0 to 4.3 (Android Ice Cream Sandwich and Jelly Bean), but as of December 2013, the tool has likely been updated to support newer versions of the Android OS released in the past four years.
HighRise tool also known as TideCheck
The actual HighRise tool is packaged inside an application called TideCheck (tidecheck-2.0.apk, MD5: 05ed39b0f1e578986b1169537f0a66fe).
The tool was not designed for social engineering attacks. CIA agents must install the application on the victim's own device and then run it manually at least for the first time.
When launching the tool for the first time, CIA agents must enter a special code to access its settings. This default code is the word “inshallah” (Arabic word meaning “the will of God”).
Once the code is entered, the tool reveals its control panel, which consists of three buttons. The first will start the tool, the second will display/edit the tool's configuration file, and a third will allow its operator to send an SMS from the phone to a remote CIA server.
According to the HighRise manual, the main features of the tool are as follows:
- Sending a copy of all incoming SMS messages to a server that exists on the Internet and is controlled by the CIA.
- Sending SMS messages from the victim's smartphone.
- A communication channel is provided between the HighRise operator and the LP.
- TLS/SSL secure Internet communications.
According to the two latest features, HighRise is not necessarily a tool to be installed only on a target's phone, but an application that can be installed on the phones of CIA employees and provide a secondary, encrypted communication channel between employees and supervisors.
Let us recall that Wikileaks has been releasing documents in the Vault 7 series since March 7, 2017, exposing more and more tools of CIA hackers.
“Year Zero: CIA exploits popular hardware and software.
Weeping Angel: the spying tool the agency uses to infiltrate smart TVs, turning them into covert microphones.
Dark Matter” exploits targeting iPhones and Macs.
Marble” the source code of a secret anti-forensic framework. Essentially an obfuscator used by the CIA to hide the true source of malware.
Grasshopper” a framework that allows the intelligence agency to easily create custom malware to compromise Microsoft Windows and bypass any virus protection.
Archimedes:– a MitM attack tool allegedly created by the CIA to target computers within a local area network (LAN).
Scribbles: a software designed to add 'web beacons' to classified documents, to allow the intelligence agency to control leaks.
Athena:designed to take complete control of infected Windows computers, allowing the CIA to perform a variety of operations on the target machine, such as deleting data or installing malware, stealing data and sending it to CIA servers.
CherryBlossom: a tool that monitors a target's online activity, redirects the browser, detects email addresses and phone numbers, and more, via the router.
Brutal Kangaroo: a tool that can be used to infect air-gapped computers with malware.
ELSA Windows malware used by the CIA to determine the location of a specific user using their computer's Wi-Fi.
OutlawCountry: Linux malware used by the CIA to determine the location of a specific user using their computer's Wi-Fi.
BothanSpy – Gyrfalcon: for stealing SSH credentials from Windows and Linux respectively
HighRise, the CIA's tool for monitoring and redirecting SMS messages to a remote server
