Home Security Vault 7: CIA uses common malware code to build exploits

The CIA does not only depend on its in-house hackers to craft exploits for use in its spying activities. It also borrows code from malware that is in the wild, judging by the Vault 7 dump by WikiLeaks overnight.

One collection is named UMBRAGE, housing application development techniques borrowed from malware that already exists.

There are components for data collection, data destruction, persistence, stealth, privilege escalation, and others.

The goal of maintaining this repository is to provide snippets of code that can be used for building custom solutions.

Among the snippets in the UMBRAGE collection is a DirectInput Keylogger, described as using the Microsoft DirectX API to collect keystrokes from any running application.

There is code from Microsoft itself; a Microsoft-supported method of collecting keystrokes from applications either running at the same or lower privilege levels.

Code from Shamoon, a well-known Windows malware, is present and is described as dropping "a signed driver (with an easily abused licence key) that provides raw disk access to the file system".

There is plenty more in this collection. And there are numerous collections like this.


Did you know: Key business communication services may not work on the NBN?

Would your office survive without a phone, fax or email?

Avoid disruption and despair for your business.

Learn the NBN tricks and traps with your FREE 10-page NBN Business Survival Guide

The NBN Business Survival Guide answers your key questions:

· When can I get NBN?
· Will my business phones work?
· Will fax & EFTPOS be affected?
· How much will NBN cost?
· When should I start preparing?


Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.






Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities