{"id":94046,"date":"2017-06-19T12:00:43","date_gmt":"2017-06-19T11:00:43","guid":{"rendered":"https:\/\/www.transcend.org\/tms\/?p=94046"},"modified":"2017-06-17T19:40:56","modified_gmt":"2017-06-17T18:40:56","slug":"vault-7-cherry-blossom","status":"publish","type":"post","link":"https:\/\/www.transcend.org\/tms\/2017\/06\/vault-7-cherry-blossom\/","title":{"rendered":"Vault 7: Cherry Blossom"},"content":{"rendered":"

\"\"<\/a>Today, June 15th 2017, WikiLeaks publishes documents from the CherryBlossom<\/em> project of the CIA that was developed and implemented with the help of the US nonprofit Stanford Research Institute (SRI International)<\/a>.<\/p>\n

CherryBlossom<\/em> provides a means of monitoring the Internet activity of and performing software exploits on Targets<\/em> of interest. In particular, CherryBlossom<\/em> is focused on compromising wireless networking devices, such as wireless routers and access points (APs), to achieve these goals. Such Wi-Fi devices are commonly used as part of the Internet infrastructure in private homes, public spaces (bars, hotels or airports), small and medium sized companies as well as enterprise offices. Therefore these devices are the ideal spot for “Man-In-The-Middle” attacks, as they can easily monitor, control and manipulate the Internet traffic of connected users. By altering the data stream between the user and Internet services, the infected device can inject malicious content into the stream to exploit vulnerabilities in applications or the operating system on the computer of the targeted user.<\/p>\n

The wireless device itself is compromized by implanting a customized CherryBlossom<\/em> firmware on it; some devices allow upgrading their firmware over a wireless link, so no physical access to the device is necessary for a successful infection. Once the new firmware on the device is flashed, the router or access point will become a so-called FlyTrap<\/em>. A FlyTrap<\/em> will beacon over the Internet to a Command & Control server referred to as the CherryTree<\/em>. The beaconed information contains device status and security information that the CherryTree<\/em> logs to a database. In response to this information, the CherryTree<\/em> sends a Mission<\/em> with operator-defined tasking. An operator can use CherryWeb<\/em>, a browser-based user interface to view Flytrap<\/em> status and security info, plan Mission<\/em> tasking, view Mission<\/em>-related data, and perform system administration tasks.<\/p>\n

Missions<\/em> may include tasking on Targets<\/em> to monitor, actions\/exploits to perform on a Target<\/em>, and instructions on when and how to send the next beacon. Tasks for a Flytrap<\/em> include (among others) the scan for email addresses<\/em>, chat usernames<\/em>, MAC addresses<\/em> and VoIP numbers<\/em> in passing network traffic to trigger additional actions, the copying of the full network traffic of a Target<\/em>, the redirection of a Target<\/em>\u2019s browser (e.g., to Windex for browser exploitation) or the proxying of a Target<\/em>\u2019s network connections. FlyTrap<\/em> can also setup VPN tunnels to a CherryBlossom<\/em>-owned VPN server to give an operator access to clients on the Flytrap<\/em>\u2019s WLAN\/LAN for further exploitation. When the Flytrap<\/em> detects a Target<\/em>, it will send an Alert<\/em> to the CherryTree<\/em> and commence any actions\/exploits against the Target<\/em>. The CherryTree<\/em> logs Alerts<\/em> to a database, and, potentially distributes Alert<\/em> information to interested parties (via Catapult<\/em>).\"\"<\/a><\/p>\n

Leaked Documents:<\/h2>\n

CherryBlossom — System Req Spec (CDRL-10) <\/a><\/p>\n

CherryBlossom — Quick Start Guide <\/a><\/p>\n

WiFi Devices <\/a><\/p>\n

CherryBlossom — Installation Guide <\/a><\/p>\n

CherryBlossom — Operating Environment (S\/\/NF) <\/a><\/p>\n

______________________________________________<\/p>\n

All Releases:<\/strong><\/em><\/p>\n

Vault 7: Pandemic<\/a> \u2013 1 Jun 2017<\/em><\/p>\n

Vault 7: Athena<\/a> \u2013 19 May 2017<\/em><\/p>\n

Vault 7: AfterMidnight & Assassin Frameworks<\/a> \u2013 12 May 2017<\/em><\/p>\n

Vault 7: Archimedes \u2013<\/a> 5 May 2017<\/em><\/p>\n

Vault 7: Scribbles Project<\/a> \u2013 28 Apr 2017<\/em><\/p>\n

Vault 7: Weeping Angel<\/a> \u2013 21 Apr 2017<\/em><\/p>\n

Vault 7: Hive Project<\/a> \u2013 14 Apr 2017<\/em><\/p>\n

Vault 7: Grasshopper Framework<\/a> \u2013 7 Apr 2017<\/em><\/p>\n

Vault 7: Marble Framework<\/a> \u2013 31 Mar 2017<\/em><\/p>\n

Vault 7: Project Dark Matter<\/a> \u2013 23 Mar 2017<\/em><\/p>\n

Vault 7: CIA Hacking Tools Revealed<\/a> \u2013 7 Mar 2017<\/em><\/p>\n

Go to Original \u2013 wikileaks.org<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Today, June 15th 2017, WikiLeaks publishes documents from the CherryBlossom project of the CIA that was developed and implemented with the help of the US nonprofit Stanford Research Institute (SRI International). CherryBlossom provides a means of monitoring the Internet activity of and performing software exploits on Targets of interest. In particular, CherryBlossom is focused on compromising wireless networking devices, such as wireless routers and access points (APs), to achieve these goals.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[60],"tags":[],"class_list":["post-94046","post","type-post","status-publish","format-standard","hentry","category-whistleblowing-surveillance"],"_links":{"self":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts\/94046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/comments?post=94046"}],"version-history":[{"count":0,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts\/94046\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/media?parent=94046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/categories?post=94046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/tags?post=94046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}