Vault 7 wikileaks docs hint cia could bypass 21 security products

[Solarquest]

One of the hidden gems included in the Vault 7 data, dumped yesterday by WikiLeaks, is a document detailing bypass techniques for 21 security software products.

The document is part of a data dump of nearly 9,000 other files, all documentation files and manuals for various hacking tools, which WikiLeaks claims belong to the CIA.

One particular document, labeled "Personal Security Products (PSPs)" lists 21 security products, each linking to a separate document, containing descriptions of various exploits and techniques that could be used to bypass the named security tools.

The list covers almost all major antivirus vendors, including Comodo, Avast, Kaspersky, AVG, ESET, Symantec, and others.

For most security products included in this list, the bypass/exploit technique has been redacted. Yesterday, when it announced the Vault 7 leak, WikiLeaks said it made 70,875 redactions in total, mainly to remove any harmful code and personal details, such as names and IP addresses.

Bypass and exploit techniques were only listed for three vendors: F-Secure, Avira, and AVG (partial info).

More details in the link above

 

[Deleted member 178]

Oh look at all those big names

 

[giants8058]

https://wikileaks.org/ciav7p1/cms/files/2014_EN_BreakingAVSoftware_JoxeanKoret.pdf
https://wikileaks.org/ciav7p1/cms/files/BypassAVDynamics.pdf

I know these are from 2014 but I wonder how many more vulnerabilities were discovered that haven't been patched yet. Bitdefender was mentioned 16 times and at one point mocked "security service my ass". This also effects any 3rd party companies that use their engine along with other engines. Being an Emsisoft customer, I won't lie, it's got me kind of worried.

I also saw that they are able to push out backdoors via Windows Update. Crazy..Just crazy. How is that possible unless Microsoft gave them their private key/s. Which actually wouldn't surprise me in the least bit.

 

[Dean Winchestere]

I wonder how effective VooDooShield and others would be at stopping these cyber crooks. Would anyone know?

 

[Deleted member 178]

I also saw that they are able to push out backdoors via Windows Update. Crazy..Just crazy. How is that possible unless Microsoft gave them their private key/s. Which actually wouldn't surprise me in the least bit.

Do you believe that such a huge company deploying OSes all over the world , won't help its country intelligence agencies? i don't think so, and those reports just confirmed what my old "acquaintances" told me decades ago.

I wonder how effective VooDooShield and others would be at stopping these cyber crooks. Would anyone know?

if the attacker targets you specifiacally , and in topof that have the tools and resources for it , no products will save you; the attacker will use a kernel exploit and then disable every softs you have since they dont run at kernel level.

 

[HarborFront]

AppGuard, ReHIPS, VoodooShield, Deep Armor, Cylance etc not mentioned. So must be safe to use

 

[Deleted member 178]

Cylance is funded by CIA so sure you won't have risks

 

[bunchuu]

https://wikileaks.org/ciav7p1/cms/files/2014_EN_BreakingAVSoftware_JoxeanKoret.pdf
https://wikileaks.org/ciav7p1/cms/files/BypassAVDynamics.pdf

I know these are from 2014 but I wonder how many more vulnerabilities were discovered that haven't been patched yet. Bitdefender was mentioned 16 times and at one point mocked "security service my ass". This also effects any 3rd party companies that use their engine along with other engines. Being an Emsisoft customer, I won't lie, it's got me kind of worried.

I also saw that they are able to push out backdoors via Windows Update. Crazy..Just crazy. How is that possible unless Microsoft gave them their private key/s. Which actually wouldn't surprise me in the least bit.

and dual engine wont help either, 2 engine=more vulnerability

 

[bunchuu]

Cylance is funded by CIA so sure you won't have risks

do you have reference for this claim?
however, clyance is just giving up your security configuration to their IT team

 

[509322]

https://wikileaks.org/ciav7p1/cms/files/2014_EN_BreakingAVSoftware_JoxeanKoret.pdf
https://wikileaks.org/ciav7p1/cms/files/BypassAVDynamics.pdf

I know these are from 2014 but I wonder how many more vulnerabilities were discovered that haven't been patched yet. Bitdefender was mentioned 16 times and at one point mocked "security service my ass". This also effects any 3rd party companies that use their engine along with other engines. Being an Emsisoft customer, I won't lie, it's got me kind of worried.

I also saw that they are able to push out backdoors via Windows Update. Crazy..Just crazy. How is that possible unless Microsoft gave them their private key/s. Which actually wouldn't surprise me in the least bit.

The agencies harvest open-source stuff just like everybody else and build upon it. That's why you see references to documents.

Vulnerabilities are essentially a never-ending thing.

 

[Dean Winchestere]

Here's a thought: Imagine all these tools the gov has at their disposal and the ability to hack through the sophisticated security defenses commercially available.. Does our gov hack the banks, stock exchange, etc for fraudulent purposes? And assuming ONLY the govt has these tools heaven forbid lets hope.

Honestly i am starting to think bitcoin and ether are the future now. Blockchain is the future.

 

[giants8058]

Do you believe that such a huge company deploying OSes all over the world , won't help its country intelligence agencies? i don't think so, and those reports just confirmed what my old "acquaintances" told me decades ago.

Yes I believe they would and without a valid warrant (not the ones presented to the rubber stamp FISA Court), it is a complete and total violation to the 4th amendment of the constitution making it illegal.

 

[509322]

AppGuard, ReHIPS, VoodooShield, Deep Armor, Cylance etc not mentioned. So must be safe to use

Every security soft - that is systematically targeted - will eventually be bypassed in one way or another. What form any bypass takes could be anything. It might range from mundane social engineering to an overlooked\unfixed bug to some form of very sophisticated attack.

Just because those products aren't in the Vault 7 leak, it is completely wrong to assume they have absolutely no vulnerabilities or that they offer CIA-unbreakable protection.

 

[509322]

In the U.S., you have no online rights. An there is no protections against any government agency from hacking your system.

Just because they can do it, doesn't automatically mean that they will do it to you. At the same time, history has shown that government officials and employees screw-up all the time and do things that they should not. So there are valid arguments for both points of view - but most users do not need to fret over it.

 

[509322]

I'm a privacy advocate, but here we go...

"Nonsense once again prevails on the security soft forums. It will never end."

 

[HarborFront]

Every security soft - that is systematically targeted - will eventually be bypassed in one way or another. What form any bypass takes could be anything. It might even be mundane social engineering to some sophisticated attack.

Just because those products aren't in the Vault 7 leak, it is completely wrong to assume they have no vulnerabilities or that they offer CIA-unbreakable protection.

But users have an alternative not to buy those listed products

 

[509322]

But users have an alternative not to buy those listed products

If you avoided every security soft that could be bypassed, then you wouldn't use a single one. In fact, you might as well throw all of your digital devices into the trash bin because every one of them can be "bypassed."

Just because the list is incomplete, doesn't mean the products haven't been targeted and studied by the CIA. They might not have documented their findings, might not have gotten around to pen-testing and documenting it before the document-grab, pen-tested products might be selected upon some minimum market share, plus a whole lot of reasons why they aren't there.

 

[HarborFront]

If you avoided every security soft that could be bypassed, then you wouldn't buy a single one. In fact, you might as well throw all of your digital devices into the trash bin.

Just because the list is incomplete, doesn't mean the products not on the list are more capable. They might not have documented their findings, might not have gotten to pen-testing them yet, pen-tested products based upon some minimum market share, plus a whole lot of reasons why they aren't there.

Well, can use those not on the list

 

[509322]

I also saw that they are able to push out backdoors via Windows Update.

Show where it explicitly states this - as I cannot find it in the Vault 7 leak.

 

[509322]

Well, can use those not on the list

You've obviously been logic-bombed, but of course, you should use AppGuard. You're absolutely correct in that regard.