WikiLeaks has revealed new tools that the CIA is allegedly using in its cyber-operations. The new tools can shut down surveillance cameras so that the agency's agents can carry out their missions without being recorded on video.
A set of tools called Dumbo can not only block cameras, microphones, and surveillance software, but can also detect audio and video recordings and destroy files in a way that makes them unrecoverable.
The manuals published by WikiLeaks were last updated in June 2015 and reveal that Dumbo is at version 3.0, offering support for all versions of Windows on the market, starting with Windows XP, although 64-bit versions of this particular version are not supported.
“Dumbo is a feature to suspend processes using webcams and destroy any video recordings that could compromise PAG development. The PAG (Physical Access Group) is a special division within the CCI (Center for Cyber Intelligence). Its task is to gain physical access to target computers in CIA operations,” WikiLeaks reports.
What is important to note is that compared to other malicious tools used by the CIA, Dumbo requires physical access to the victim's computer, as the application is contained on a USB stick that must be connected to the machine.
Administrator privileges are required to avoid detection by security software, although we learned from previous WikiLeaks revelations that obtaining root privileges is something that intelligence agencies can easily do.
Once installed on a system, Dumbo offers tools to shut down all connected monitoring devices and software, but also searches for additional devices that are part of the network. It searches for specific processes and records, offering access even to files that have been deleted but have left traces.
If disabling the surveillance system doesn't work, CIA agents can cause a BSOD on the connected Windows system. So with the system offline, the surveillance cameras are useless.
Let us recall that Wikileaks has been releasing documents in the Vault 7 series since March 7, 2017, exposing more and more tools of CIA hackers.
Year Zero: CIA exploits popular hardware and software.
Weeping Angel: the spying tool the agency uses to infiltrate smart TVs, turning them into covert microphones.
Dark Matter: exploits targeting iPhones and Macs.
Marble: the source code of a secret anti-forensic framework. Essentially an obfuscator used by the CIA to hide the true source of malware.
Grasshopper: a framework that allows the intelligence agency to easily create custom malware to compromise Microsoft Windows and bypass any virus protection.
Archimedes: a MitM attack tool allegedly created by the CIA to target computers within a local area network (LAN).
Scribbles: a software designed to add 'web beacons' to classified documents, to allow the intelligence agency to control leaks.
Athena:designed to take complete control of infected Windows computers, allowing the CIA to perform a variety of operations on the target machine, such as deleting data or installing malware, stealing data and sending it to CIA servers.
CherryBlossom: a tool that monitors a target's online activity, redirects the browser, detects email addresses and phone numbers, and more, via the router.
Brutal Kangaroo:a tool that can be used to infect air-gapped computers with malware.
ELSA: Windows malware used by the CIA to determine the location of a specific user using their computer's Wi-Fi.
OutlawCountry: Linux malware used by the CIA to determine the location of a specific user using their computer's Wi-Fi.
BothanSpy – Gyrfalcon: for stealing SSH credentials from Windows and Linux respectively
HighRise: the CIA's tool for monitoring and redirecting SMS messages to a remote server.
Achilles, Aeris and SeaPea: malicious software that intercepts and transfers data from MacOS and Linux systems.
Dumbo: blocks cameras, microphones and surveillance software.
