Wikileaks Snags Fly Trap + Cherry Blossom

Announcement from WikiLeaks
Cherry Blossom

15 June, 2017

Today, June 15th 2017, WikiLeaks publishes documents from the CherryBlossom project of the CIA that was developed and implemented with the help of the US nonprofit Stanford Research Institute (SRI International).

CherryBlossom provides a means of monitoring the Internet activity of and performing software exploits on Targets of interest.

In particular, CherryBlossom is focused on compromising wireless networking devices, such as wireless routers and access points (APs), to achieve these goals.
Such Wi-Fi devices are commonly used as part of the Internet infrastructure in private homes, public spaces (bars, hotels or airports), small and medium sized companies as well as enterprise offices.

Therefore these devices are the ideal spot for "Man-In-The-Middle" attacks, as they can easily monitor, control and manipulate the Internet traffic of connected users. By altering the data stream between the user and Internet services, the infected device can inject malicious content into the stream to exploit vulnerabilities in applications or the operating system on the computer of the targeted user.

The wireless device itself is compromized by implanting a customized CherryBlossom firmware on it; some devices allow upgrading their firmware over a wireless link, so no physical access to the device is necessary for a successful infection. Once the new firmware on the device is flashed, the router or access point will become a so-called FlyTrap. A FlyTrap will beacon over the Internet to a Command & Control server referred to as the CherryTree. The beaconed information contains device status and security information that the CherryTree logs to a database.
In response to this information, the CherryTree sends a Mission with operator-defined tasking. An operator can use CherryWeb, a browser-based user interface to view Flytrap status and security info, plan Mission tasking, view Mission-related data, and perform system administration tasks.
Missions may include tasking on Targets to monitor, actions/exploits to perform on a Target, and instructions on when and how to send the next beacon. Tasks for a Flytrap include (among others) the scan for email addresses, chat usernames, MAC addresses and VoIP numbers in passing network traffic to trigger additional actions, the copying of the full network traffic of a Target, the redirection of a Target’s browser (e.g., to Windex for browser exploitation) or the proxying of a Target’s network connections. FlyTrap can also setup VPN tunnels to a CherryBlossom-owned VPN server to give an operator access to clients on the Flytrap’s WLAN/LAN for further exploitation. When the Flytrap detects a Target, it will send an Alert to the CherryTree and commence any actions/exploits against the Target. The CherryTree logs Alerts to a database, and, potentially distributes Alert information to interested parties (via Catapult).

 

RELATED CONTENT

Wikileaks Alleges Years of CIA D-Link and Linksys Router Hacking Via ‘Cherry Blossom’ Program

By Tom Spring June 16, 2017 3:36 pm 

Source: https://threatpost.com 

“It should be noted, however, that the CBlossom architecture does not limit itself to wireless devices – in general, wired network devices could be implanted/compromised in the same fashion to achieve the same goals,” read the alleged CIA document.

 

June 16, 2017

WikiLeaks latest Vault 7 dump includes CherryBlossom router hacking tool

Source: https://www.scmagazine.com 

Home routers are particularly vulnerable because most are bought, installed and then never looked at again by the owner, Chris Hinkley, Armor's lead ethical hacker told SC Media.
"Most routers and WiFi access points are neglected so much by users that they are rarely ever patched and updated. In a large number of cases, the default login credentials are never changed. These facts alone make these devices quite vulnerable to attack," he said.
The malicious firmware update creates the following set up on the router. The router becomes a FlyTrap, capable of handling a variety of malicious tasks. The FlyTrap will beacon to a its command and control server, dubbed CherryTree. The hacker will then use a browser based administration panel called CherryWeb to control monitor CherryTree's status and send along missions to perform.
Some of these missions could include, WikiLeaks wrote, “scan for email addresses, chat usernames, MAC addresses and VoIP numbers in passing network traffic to trigger additional actions, the copying of the full network traffic of a Target, the redirection of a Target's browser (e.g., to Windex for browser exploitation) or the proxying of a Target's network connections.”
In addition, FlyTrap can setup VPN tunnels to a CherryBlossom-owned VPN server to give an operator access to clients on the Flytrap's WLAN/LAN for further exploitation."
While Wikileaks did not leak the tools the CIA allegedly uses, the current state of router handling across the board allows the CIA and other malicious actors to potentially infiltrate networks in a way that is not much thought about," Hinkley said.

 

Wikileaks Revealed New CIA Wireless Hacking Tool “Cherry Blossom” Compromise Your Wireless Network Devices using MITM Attack

By BALAJI N June 16, 2017

Source: https://gbhackers.com

 

“CherryBlossom” is capable of performing exploits in software and Monitoring the Internet Activities in the Targeting Victims such as commonly used WIFI Devices in private and public places including small and medium-sized companies as well as enterprise offices.

Man-in-the-Middle Attack

This Tool Compromise the wireless devices using Man-in-the-Middle Attack to monitor,  control and manipulate the Internet traffic of connected users.

Once devices have successfully infected, this tool can inject the malicious content via streaming to exploit the Vulnerabilities in the target.
It Doesn’t Require any physical access to compromise the target since it’s used implanting a customized CherryBlossom firmware in wireless devices itself and some devices allow upgrading their firmware over a wireless link.