Security News CIA Created Toolkit for Hacking Hundreds of Routers Models

[LASER_oneXM]

........some quotes from the article above:

After a two-week hiatus, WikiLeaks dumped new files as part of the Vault 7 series that supposedly contains CIA-made hacking tools the organization claims it received from hackers and agency insiders.

Today's dump includes the documentation for a CIA tool named CherryBlossom, a multi-purpose framework developed for hacking hundreds of home router models.

The tool is by far one of the most sophisticated CIA malware frameworks in the CIA's possession. The purpose of CherryBlossom is to allow operatives to interact and control SOHO routers on the victim's network.

CherryBlossom installed via tainted firmware updates
The most complex part of using CherryBlossom is by far deploying the tool on a target's routers. This can be done by a field operative, or remotely using a router flaw that allows CIA operators to install new firmware on the targeted device.

Internally, CherryBlossom is made up of different components, each with a very precise role:

FlyTrap - beacon (compromised firmware) that runs on compromised device
CherryTree - command and control server where FlyTrap devices report
CherryWeb - web-based admin panel running on CherryTree
Mission - a set of tasks sent by the C&C server to infected devices

CherryBlossom supports over 200 router models
According to the CIA docs, FlyTraps can be installed on both WiFi routers and access points. There is a separate document that lists over 200 router models that CherryBlossom can target, most of which are older models. This 24-page document is not dated, but the rest of the CherryBlossom manuals are — between 2006 and 2012.

You'll find a list of all WiFi equipment vendors that were included in this document at the bottom of this article. For the full vendor-series list, please refer to the original WikiLeaks document here.

 

[S3cur1ty 3nthu5145t]

Thanks for the share, my Router is not listed...

 

[ElectricSheep]

Now why doesn't this surprise me, especially in light of the recent WannaCry fiasco... At least the code wasn't dumped for all and sundry to grab and exploit...

 

[kamla5abi]

802.11 abg routers only on the list? no N?

and its not just wifi routers, its also wifi adapters, cameras & audio too.
So no need to plant a bug in the target's house, can use their own wifi camera/mic against them lol
ex,
Asus WL-160g Wireless USB 2.0 Adapter
D-Link DCS-3220G Securicam Network High Speed 2.4GHz (802.11g) Wireless 2-Way Audio Internet Camera

//edit
my current router, netgear, doesn't seem to have any products on the list maybe thats a good thing lol

 

[ForgottenSeer 58943]

Thanks for the share, my Router is not listed...

I believe one shouldn't be concerned if ones actual MODEL isn't listed. What you should pay attention to is if your BRAND is listed which likely means an active TAO on your brand is in place despite this document which appears fairly dated in relation to models no longer shipping. (which would have zero TAO benefit) The key here is the mention of 'supply chain interception', which to me indicates these are ongoing operations regardless of the models, and are focused on the brands themselves.

Modern consumer router firmware tends to be similar between models of devices (and sometimes identical) with minor alterations which make TAO operations EASIER today than they were 5--10 years ago. So you should be concerned if your brand is listed. If ASUS is on the list then if you are a betting man I would put that bet on the fact they've already nailed the current gen ASUS line. If Merlin can do it, so can CIA, DISA, NSA, their contractors, partners, overseas agents, criminal cartels and probably anyone else.

If you can afford it, I'd recommend a commercial solution (Fortigate is a good start). If not, then you should be looking into PfSense, ClearOS, Untangle, OPNsense or whatever fairly soon. IMO.

 

[woodrowbone]

I did not test this yet, but it looks good on paper, the Untangle firmware to install on a Linksys WRT1900ACS router.

Firmware | Untangle

Normally I build a box and slap Untangle on it, but this could be much more convenient.
You buy a home grade router and turn it into a high grade with a single firmware change, (plus a USB stick for Untangle’s advanced monitoring features)
And as ForgottenSeer 58943 already mentioned, you get the full protection pack at 49$ a year, a bargain.

The newer versions of Untangle 12 and newer, are very light on the hardware, this leads me to believe that the Linksys with it´s 1.6Ghz dual core cpu will cope really well.

If someone would set this up, I would very interested in the results and opinions coming out the other side.

By the way, regarding Fortinet, was it not our dear cruelsister who said even her cat could hack them

/W

 

[ForgottenSeer 58943]

I did not test this yet, but it looks good on paper, the Untangle firmware to install on a Linksys WRT1900ACS router.

Firmware | Untangle

Normally I build a box and slap Untangle on it, but this could be much more convenient.
You buy a home grade router and turn it into a high grade with a single firmware change, (plus a USB stick for Untangle’s advanced monitoring features)
And as ForgottenSeer 58943 already mentioned, you get the full protection pack at 49$ a year, a bargain.

The newer versions of Untangle 12 and newer, are very light on the hardware, this leads me to believe that the Linksys with it´s 1.6Ghz dual core cpu will cope really well.

If someone would set this up, I would very interested in the results and opinions coming out the other side.

By the way, regarding Fortinet, was it not our dear cruelsister who said even her cat could hack them

/W

Untangle is quite a bit lighter now with the 12 and 13 version sets. Remember Untangle as a primary router has a very near 450Mbps limitation unless you toss it on server grade hardware. If you are under that then you can pretty much run it on anything with the basic UTM set.

I don't know who cruelsister is, but Fortinet consistently scores in the top quadrants for all of the industry certifications. Also it's by far the best gateway antivirus, which uses an extended subset of what the fairly good rated Forticlient runs. In proxy it's amazing, in flow it's still in the industry top quadrant and very very fast. With the Fortisandbox enabled, it's far and wide the top gateway AV/APT UTM. I'd challenge anyone to prove to me they can hack a Fortinet that is properly configured using industry best practice and not left wide open on purpose.

For those not aware, Fortinet is a policy based router with a default-deny system of operation. Everything is denied unless you tell it otherwise. Period. That in and of itself is very strong. However as with anything, the knowledge of the person setting it up is crucial. The basics here - turn SSH off AND set SSH to a non-standard port. Don't roll HTTP into HTTPS, disable HTTP and assign a non-standard HTTPS port. Close off 113 in the CLI. Disable FortiMGR access if you don't have a FTM. Simple stuff, but a lot of IT misses it. I've setup/configured around 2,500 Fortinets ranging from a 30D for a 2 person office to a 3000D for a data center. I've configured them for secure installations, PCI and HIPPA compliancy, etc. For pentest PCI compliance you can't even have remote admin enabled. You need to create a VPN to a laptop sitting next to the Fortnet with a console cable plugged in and SSH into the local LAN with a single authorized IP address. If someone has a method to hack a Fortinet, let me know and we can put it to the test with my public virtualized test Fortinet and see how you do. Fortinet NSE5 engineer here by the way.

Fortinet is a beast to configure if you haven't been gone through the classes or worked on a lot of it. Untangle is best for most people as it's incredibly straight forward and 'just works'.. But Fortinet kills Untangle in every category - throughput, processing power, AV, IPS, Web Filtration etc.