It seems like Wikileaks have opted to release previously not released source code from vault 7 projects under the name vault 8.

Most vendors already assessed vault 7 and searched for possibly used exploits based on the already available information - and all vendors that did release press releases did say they fixed vulns - and Wikileaks themselves said they were holding back on sources until the vulns are patched.

What is the point of releasing (and reading) the sources when the vulnerabilities are probably already fixed?

Is it just for more detailed IoCs or is it likely to contain additional vulnerabilities and be reused like for example eternal blue?

Wikileaks especially says

Digital certificates for the authentication of implants are generated by the CIA impersonating existing entities. The three examples included in the source code build a fake certificate for the anti-virus company Kaspersky Laboratory, Moscow pretending to be signed by Thawte Premium Server CA, Cape Town. In this way, if the target organization looks at the network traffic coming out of its network, it is likely to misattribute the CIA exfiltration of data to uninvolved entities whose identities have been impersonated.

Should that CA be considered untrustworthy now?

  • I think that CA should be immediately distrusted, yes. While the CIA may have other compromised CAs in their hands, removing even one is important. – forest Dec 11 '17 at 0:07
  • This shows exactly how much access the CIA had. Knowing something was vulnerable and knowing how it was vulnerable are different things.
  • The exploits may rely on assumptions that turn out to be false. I.e. to be useable the exploit might need access to something previously viewed not feasible - similar to Google having to encrypt its internal connections after the Snowden leaks.
  • This may show new approaches which may in turn be applicable to other software.
  • The vendors patching the software doesn't mean all clients have updated their running version.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.