Wikileaks 0day — StealthVPN (@StealthVPN) April 7, 2018 The leaked files were first spotted by WikiLeaks, which said that the documents may be a “global catalog” of CIA-developed hacking tools. WikiLeaks founder Julian Assange noted that a “global release is in preparation.” The list, however, was hosted on the “Terrorists Exploiting GNU/Linux” website, hosted by the Shadow Brokers. Shadow Brokers’ ‘Terrorists Exploiting Linux’ Hacking Tool List (Source: https://t.co/2hq8WwMd1U) via @zvelo pic.twitter.com/yK2g6wZoHp — WikiLeaks (@wikileaks) April 7, 2018 It’s unclear what the documents mean for current hacking programs, but the leak will likely further stoke tensions between the US and Russia, which has repeatedly denied any involvement in hacking attacks and allegations of influencing the 2016 presidential election. WikiLeaks founder Assange previously claimed to have “insurance files” ready in case of Hillary Clinton’s victory in November 2016. There are many other similar leaks, but I want to ask once again for attention about @Wikileaks new "insurance files" mentioned in the 2016 WL C4 & published in @GUPTV account to get some support from other people and journalists regarding the importance of this topic?https://t.co/GzTlGqw2jr — Julian Assange (@JulianAssange) October 22, 2017 If this leak is real then this could be huge. If that’s true I can only imagine the outrage from Trump supporters now that the truth is coming out. https://t.co/J0eNhRcUYj — Jack Allaway (@Jack_Allaway) April 7, 2018 The leaked file is available online. It contains a list of CIA files. The leak reveals “Vault7” – the name of the collection of CIA documents obtained by WikiLeaks. All files are encrypted with a PGP key. According to WikiLeaks, it appears that the files were taken from the agency’s Center for Cyber Intelligence’s Virtual Collection Service, which is a tool that offers a way to “extract data in bulk from endpoint machines” used by CIA operatives. The CIA said that the software was intended for personnel to use on a “non-mission critical machine.” It did not disclose what type of machines they were, or whether they included Apple devices. However, several people reported that the files have been cracked using brute-force attacks. Security experts believe that the CIA could have put some vulnerabilities in the programs so that they can monitor such attacks and learn how to better protect itself. As early as last October, WikiLeaks was threatening to release such cyber weapons unless the US stopped its “witch-hunt” of Assange. “To reiterate a longstanding warning: WikiLeaks has found and read, the CIA's 'secret anti-forensics' manual for computer hackers,” the whistleblowing platform said in a statement. “It details how to tamper with forensic evidence so that CIA can cheat investigations and escape justice.” Since the WikiLeaks and Edward Snowden revelations, the NSA has come up with its own malware named “HiveMine,” which is used by the agency to monitor cyber attackers, according to a report by The Intercept. In April, researchers from Microsoft Research and the Weizmann Institute of Science found a security flaw on an implant that the CIA used to break into their targets’ computers, which allowed them to take control of a computer. Some of the files in the leak do not contain names. But WikiLeaks said that there is “more than one Vault 7” file, and it will continue to post the files that contain “names, descriptions, and compromised documents” in the coming weeks. A report by Bloomberg suggests that the CIA may have hacked as many as 79,000 computers in the past decade. According to a new WikiLeaks tweet, the CIA was allegedly using Macs, which seems to imply that the agency is using Apple devices for cyber spying operations. One tweet links to a file named “Vault7-Part1-Win.exe,” which could mean “Vault 7 part 1,” with a reference to Apple’s Mac operating system. One user on Twitter who goes by the handle of “Ran” who has cracked some of the files, said that the documents relate to Apple’s OS X Mountain Lion, OS X Mavericks, OS X Yosemite, OS X El Capitan, iOS, and Linux. However, it’s not clear which versions of MacOS those refer to. While WikiLeaks doesn’t specify which program the leaked documents are related to, one of the files refers to the Windows system, and one describes a program called “mimikatz.” One file contains information on exploits against different versions of Mac OS X that were reportedly used to hack different computers. For instance, the file named ‘Vault7-Part1-Sierra.plist’ was used to hack the computers running MacOS Sierra. This file also mentions the use of ‘Tiger-Team1’, which was apparently a group that tried to get access to a computer running Mac OS X Tiger. The CIA has denied claims that the documents could provide useful information about the agency’s hacking activities. A statement provided to Bloomberg by the agency has the following quote from spokesperson Eric Pelofzer: "We do not comment on the authenticity or content of purported intelligence documents." Some security experts and users have confirmed that they’ve found at least one of the exploits in the leaked files and that it worked in the recent days, as ArsTechnica has confirmed that Apple patched the flaw two months ago. Update: According to cyber-security expert and former NSA contractor Edward Snowden, the CIA could have been spying on its own tools to steal their intelligence. So this is what we meant when we said the Vault7 revelations were going to be big... — Edward Snowden (@Snowden) April 7, 2018 Update 2: The Guardian reports that The files were allegedly from a CIA effort to spy on users of popular privacy tools such as Tor, Wifiphisher, I2P, and Tor2web. But most of the documents seem to refer to Microsoft’s “Tahoe,” a secretive tool that the agency uses to install malware on machines.