Wikileaks: CIA Malware For Windows “Grasshopper”

RELEASE: CIA malware for Windows “Grasshopper” — which includes its own language

Wikileaks: CIA Malware For Windows "Grasshopper"

Grasshopper basically allows the Deep State to do anything it wants remotely to a Windows machine. It doesn’t seem to matter if it is Windows XP, Windows 7, Windows 8, or Windows Server versions 2003 or 2008. Almost all the attacks and hijacks bypassed the major intrusion detection systems (MS Security, Symantec, Kapersky, and Rising). No matter how locked down or safe you thought your Windows install was, you were wrong.

Oh even better. It looks like these were designed specifically to avoid the major security programs.

From Wikileaks:

Grasshopper

7 April, 2017

Today, April 7th 2017, WikiLeaks releases Vault 7 “Grasshopper” — 27 documents from the CIA’s Grasshopper framework, a platform used to build customized malware payloads for Microsoft Windows operating systems.

Grasshopper is provided with a variety of modules that can be used by a CIA operator as blocks to construct a customized implant that will behave differently, for example maintaining persistence on the computer differently, depending on what particular features or capabilities are selected in the process of building the bundle. Additionally, Grasshopper provides a very flexible language to define rules that are used to “perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration”. Through this grammar CIA operators are able to build from very simple to very complex logic used to determine, for example, if the target device is running a specific version of Microsoft Windows, or if a particular Antivirus product is running or not.

Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The requirement list of the Automated Implant Branch (AIB) for Grasshopper puts special attention on PSP avoidance, so that any Personal Security Products like ‘MS Security Essentials’, ‘Rising’, ‘Symantec Endpoint’ or ‘Kaspersky IS’ on target machines do not detect Grasshopper elements.

One of the persistence mechanisms used by the CIA here is ‘Stolen Goods’ – whose “components were taken from malware known as Carberp, a suspected Russian organized crime rootkit.” confirming the recycling of malware found on the Internet by the CIA. “The source of Carberp was published online, and has allowed AED/RDB to easily steal components as needed from the malware.”. While the CIA claims that “[most] of Carberp was not used in Stolen Goods” they do acknowledge that “[the] persistence method, and parts of the installer, were taken and modified to fit our needs”, providing a further example of reuse of portions of publicly available malware by the CIA, as observed in their analysis of leaked material from the italian company “HackingTeam”.

The documents WikiLeaks publishes today provide an insights into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise.

Leaked Documents

Grasshopper-v2_0_2-UserGuide
Grasshopper-v1_1-AdminGuide
StolenGoods-2_1-UserGuide
GH-Run-v1_1-UserGuide
GH-ServiceProxy-v1_1-UserGuide

 

“Grasshopper” re-installs itself every 22 hours by corrupting Windows Update… even if is disabled.


 

 

Joke Of The Day: The Great Writer

Rubber Chicken There was once a young man who, in his youth, professed his desire become a great writer.

When asked to define “great” he said, “I want to write stuff that the whole world will read, stuff that people will react to on a truly emotional level, stuff that will make them scream, cry, howl in pain and anger!”

He now works for Microsoft, writing error messages.

 

 

 

Life Without Email

Life Without EmailAn unemployed man goes to apply for a job with Microsoft as a janitor. The manager there arranges for him to take an aptitude test (Section: Floors, sweeping and cleaning).

After the test, the manager says, “You will be employed at minimum wage, $7.25 an hour. Let me have your e-mail address, so that I can send you a form to complete and tell you where to report for work on your first day.”

Taken aback, the man protests that he has neither a computer nor an e-mail address. To this the Microsoft manager replies, “Well then, that means that you virtually don’t exist and can therefore hardly expect to be employed.”

Stunned, the man leaves. Not knowing where to turn and having only $10 in his wallet, he decides to buy a 25 LB flat of tomatoes at the supermarket.

Within less than 2 hours, he sells all the tomatoes individually at 100% profit. Repeating the process several times more that day,he ends up with almost $100 before going to sleep that night.

And thus it dawns on him that he could quite easily make a living selling tomatoes. Getting up early every day and going to bed late, he multiplies his profits quickly.

After a short time he acquires a cart to transport several dozen boxes of tomatoes, only to have to trade it in again so that he can buy a pickup truck to support his expanding business. By the end of the second year, he is the owner of a fleet of pickup trucks and manages a staff of a hundred former unemployed people, all selling tomatoes.

Planning for the future of his wife and children, he decides to buy some life insurance. Consulting with an insurance adviser, he picks an insurance plan to fit his new circumstances. At the end of the telephone conversation, the adviser asks him for his e-mail address in order to send the final documents electronically.

When the man replies that he has no e-mail, the adviser is stunned, “What! You don’t have e-mail? How on earth have you managed to amass such wealth without the Internet, e-mail and e-commerce? Just imagine where you would be now, if only you had been connected to the Internet from the very start!”

After a moment of thought, the tomato millionaire replied, “Why, of course! I would be a floor cleaner at Microsoft!”

 

Load More