| Image Source. |
(RT) A user manual describing an alleged CIA tool known as ‘Archimedes’,
purportedly used to attack computers inside a Local Area Network (LAN),
has been released by WikiLeaks. The latest batch is the seventh in the
whistleblowing organization’s ‘Vault 7’ series.
Related ‘The Butcher Of Libya’: Assange Exposes Clinton War Crimes, Asks Sweden to Set Him Free
Source – The Daily Sheeple
by RT Staff Writer, May 5th, 2017
RELEASE: CIA ‘#Archimedes‘ system for exfiltration and browser hijacking. Includes manuals and binary signatures. https://t.co/XWr33GMGDN pic.twitter.com/TEyhABJvbO— WikiLeaks (@wikileaks) May 5, 2017
The Archimedes tool enables traffic from one computer inside the LAN to be redirected through a computer infected with this malware and controlled by the CIA, according to WikiLeaks.
The technique is used to redirect the target’s computer web browser to an exploitation server while appearing as a normal browsing session, the whistleblowing site said. In this way, the hackers gain an entry point that allows them access to other machines on that network.
The tool’s user guide, which is dated December 2012, explains that it’s used to re-direct traffic in a Local Area network (LAN) from a “target’s computer through an attacker controlled computer before it is passed to the gateway.”
This allows it to insert a false web-server response that redirects the target’s web browser to a server that will exploit their system all the while appearing as if it’s a normal browsing session.
The target of the attack is directed to a webpage that looks exactly like the original page they were expecting to be served, but which contains malware. It’s only possible to detect the attack by examining the page source.
Related The “Snowden Stopper”: WikiLeaks Exposes CIA Tool To Hunt Down Whistleblowers
Archimedes is an update to a tool called ‘Fulcrum’ and it offers several improvements on the previous system, including providing a method of “gracefully shutting down the tool on demand.”
An addendum from January 2014 shows that Archimedes was updated to support the ability to run on targets with multiple gateways, i.e. devices used to connect different networks.
WikiLeaks has also included the Fulcrum user manual in its release, explaining that this tool can direct a target machine’s HTTP client traffic to the URL of the attacker’s choice but specifying it’s not in itself an exploit or a worm.
A worm is a computer program which replicates itself in order to spread malicious code to other computers. Fulcrum will not crash applications or operating systems on the computers it affects, according to the guide.
The guide is dated May 2011 and outlines the entire process from the configuration to the shutdown of the application.
The language used in the Fulcrum user manual is bizarrely casual in contrast to the Archimedes guide.
Describing the steps in packaging applications and configuration data, the Fulcrum guide encourages officials to “Pat yourself on the back, grab a fresh caffeinated beverage of your choice and then let’s get down to it.”
Another section on preparing to use the tool opens: “So you are just itching to use Fulcrum against this target of yours and you’re ready to dive in!”
Related Vault 7 Articles and Updates
_________________________
Stillness in the Storm Editor’s note: Did you find a spelling error or grammar mistake? Do you think this article needs a correction or update? Or do you just have some feedback? Send us an email at [email protected] with the error, headline and url. Thank you for reading.
Leave a Reply