3 New CIA-developed Hacking Tools For MacOS & Linux Exposed

3 New CIA-developed Hacking Tools For MacOS & Linux Exposed

Achilles — Tool to Backdoor Mac OS X Disk Images

Dubbed Achilles, the hacking tool allows CIA operators to combine malicious Trojan applications with a legitimate Mac OS app into a disk image installer (.DMG) file.

The binding tool, the shell script is written in Bash, gives the CIA operators "one or more desired operator specified executables" for a one-time execution.

As soon as an unsuspecting user downloads an infected disk image on his/her Apple computer, opens and installs the software, the malicious executables would also run in the background.

Afterwards, all the traces of the Achilles tool would be "removed securely" from the downloaded application so that the file would "exactly resemble" the original legitimate app, un-trojaned application, making it hard for the investigators and antivirus software to detect the initial infection vector.

Achilles v1.0, developed in 2011, was only tested on Mac OS X 10.6, which is Apple's Snow Leopard operating system that the company launched in 2009.

SeaPea — Stealthy Rootkit For Mac OS X Systems

The second hacking tool, called SeaPea, is a Mac OS X Rootkit that gives CIA operators stealth and tool launching capabilities by hiding important files, processes and socket connections from the users, allowing them to access Macs without victims knowledge.

Developed in 2011, the Mac OS X Rootkit works on computers running then-latest Mac OS X 10.6 (Snow Leopard) Operating System (32- or 64-bit Kernel Compatible) and Mac OS X 10.7 (Lion) Operating System.

The rootkit requires root access to be installed on a target Mac computer and cannot be removed unless the startup disk is reformatted or the infected Mac is upgraded to the next version of the operating system.

Aeris — An Automated Implant For Linux Systems

The third CIA hacking tool, dubbed Aeris, is an automated implant written in C programming language that is specifically designed to backdoor portable Linux-based Operating Systems, including Debian, CentOS, Red Hat — along with FreeBSD and Solaris.

Aeris is a builder that CIA operators can use to generate customised impacts, depending upon their covert operation.

"It supports automated file exfiltration, configurable beacon interval and jitter, stand-alone and Collide-based HTTPS LP support and SMTP protocol support — all with TLS encrypted communications with mutual authentication," 

"It's compatible with the NOD Cryptographic Specification and provides structured command and control that's similar to that used by several Windows implants."

Adobe is Finally Killing FLASH — At the End of 2020!

Adobe is Finally Killing FLASH — At the End of 2020!



Adobe announced Tuesday that the company would stop providing updates and stop distributing Flash Player at the end of 2020.

The move has been applauded by many, as Adobe Flash has been infamous for frequent zero-day attacks, which is why it has long been one of the favourite tools for hackers and cyber criminals.



To put a full stop on Flash, many major tech companies like Apple, Facebook, Youtube, Google Chrome, Firefox had been magnetised towards the new substitutor - HTML 5.

• Microsoft just announced its plans to disable Flash Player by default in Edge and Internet Explorer in 2019, with a full removal from all supported versions of Windows by 2020.
• Google will continue phasing out Flash over the next few years by blocking auto-playing of Flash ads by default on its browser.
• In January last year, YouTube moved away from Flash for delivering videos.
• Mozilla also blocked the Flash plugin entirely from Firefox and will allow Firefox Extended Support Release (ESR) users to keep using Flash until the end of 2020.
• Apple's Safari currently requires explicit permission on each website even when Mac users opt to install Flash.

Critical Code Injection Flaw In Gnome File Manager Leaves Linux Users Open to Hacking

Critical Code Injection Flaw In Gnome File Manager Leaves Linux Users Open to Hacking





Dubbed Bad Taste, the vulnerability (CVE-2017-11421) code injection vulnerability resides in "gnome-exe-thumbnailer" — a tool to generate thumbnails from Windows executable files (.exe/.msi/.dll/.lnk) for GNOME, which requires users to have Wine application installed on their systems to open it.

Moskopp discovered that while navigating to a directory containing the .msi file, GNOME Files takes the filename as an executable input and run it in order to create an image thumbnail.

For successful exploitation of the vulnerability, an attacker can send a crafted Windows installer (MSI) file with malicious VBScript code in its filename, which if downloaded on a vulnerable system would compromise the machine without further user interaction.

"Instead of parsing an MSI file to get its version number, this code creates a script containing the filename for which a thumbnail should be shown and executes that using Wine," Moskopp explains while demonstrating his PoC. 

"The script is constructed using a template, which makes it possible to embed VBScript in a filename and trigger its execution."

Moskopp advised users to:

• Delete all files in /usr/share/thumbnailers.
• Do not use GNOME Files.
• Uninstall any software that facilitates automatically execution of filenames as code.

Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

Discovered by Tavis Ormandy of Google Project Zero and Cris Neckar of Divergent Security, the remote code execution flaw (CVE-2017-6753) is due to a designing defect in the WebEx browser extension.

To exploit the vulnerability, all an attacker need to do is trick victims into visiting a web page containing specially crafted malicious code through the browser with affected extension installed.

Successful exploitation of this vulnerability could result in the attacker executing arbitrary code with the privileges of the affected browser and gaining control of the affected system.

Chrom & Firefox were affected.

Wikileaks Reveals CIA Malware that Hacks & Spy On Linux Computers

Wikileaks Reveals CIA Malware that Hacks & Spy On Linux Computers



The OutlawCountry Linux hacking tool consists of a kernel module, which the CIA hackers load via shell access to the targeted system and create a hidden Netfilter table with an obscure name on a target Linux user.

"The new table allows certain rules to be created using the "iptables" command. These rules take precedence over existing rules, and are only visible to an administrator if the table name is known. When the Operator removes the kernel module, the new table is also removed," CIA's leaked user manual reads.