Dark Matter reveals that Apple devices and software are vulnerable to CIA attacks at every level. Making this possible is the fact that these devices were designed at their most basic components to be vulnerable. Manufacturers such as Broadcom would even provide the CIA's Embedded Development Branch (EBD) the software tools and drivers necessary to allow these kinds of intrusions.

WikiLeaks also has released that the CIA directly manipulated supply chains with implanted devices from the factory, meaning that an agent isn't always required to physically access to the target device.(1) Stranger still it appears that the CIA would also "gift" infected devices to targets.(2)

Vulnerable implants, hardware and firmware give hackers the ability to monitor and control a target device even if the entire system is re-flashed and a new operating system installed. Basically, nothing can be done to stop this vulnerability unless the implants or hardware are removed, but as we will see, some of these are critical components necessary to the function of the device.

This leaves us with the grim reality that the manufacturers themselves have been in on this since the start, but more realistically this means there is little to no hope of protecting oneself from attacks and surveillance regardless of software and anonymizing capabilities. These are not your everyday Trojan Horses.

Here I'll sum up and briefly analyze the technical content of Dark Matter so hopefully we can begin to realize the truly severe nature of the Vault 7 releases.

Sonic Screwdriver

Many nerds will recognize this beloved Dr. Who reference, but unfortunately in this case it's not quite the tool of time-travel justice the Doctors would approve of.

Sonic Screwdriver is a tool targeting Mac laptops that manipulates the deep-level vulnerabilities of Mac OS from within the firmware of the Thunderbolt-to-Ethernet adapter. Better yet, these manipulations can take place as the device is booting, and thus almost completely covertly AND they can bypass a firmware password.

It seems that all Thunderbolt-to-Ethernet adapters are technically vulnerable, as all it requires is a CD of some provided, pre-configured Broadcom software which is loaded and installed onto the adapter and can be done through any Windows machine or virtual Windows environment. If this has been done at manufacture as part of some standard operation, perhaps every Thunderbolt-to-Ethernet adapter is vulnerable.

I won't copy them here, but there's pretty much only five relatively simple steps to activate the adapter. Needless to say, if you had remote access to someone's Mac you could just as easily remotely activate their adapter against them from their own machine. All in all the process is disturbingly simple for what is essentially complete and total access.

Here are a list of the Mac laptop models which were tested for these attacks:

MBA = MacBook Air, MBP = MacBook Pro

• MBA5,1 (Mid 2012 - 11”)
• MBA5,2 (Mid 2012 - 13”)
• MBA4,1 (Mid 2011 - 11”)
• MBA4,2 (Mid 2011 - 13”)
• MBP10,1 (Mid 2012 - 15” Retina)
• MBP10,2 (Late 2012 - 13” Retina)
• MBP9,1 (Mid 2012 - 15”)
• MBP9,2 (Mid 2012 - 13”)
• MBP8,1 (Late 2011 - 13”)
• MBP8,2 (Late 2011 - 15”)

DerStarke 2.0

Many will remember DerStarke from the first Vault 7 release, Year Zero, which I broke down in an earlier article and podcast.

DerStarke is a suite of tools for discretely and persistently monitoring a target device, allowing the attacker to discretely connect to the Internet and thus beacon back to the attacker's device and was developed for Mac OSX Mavericks.(3)

Project Dark Matter introduces DerStarke version 2.0, which WikiLeaks believes to still be in development (4) which has some notable enhancements, most notably darkmatter features. "darkmatter" appears to be a codeword for "extensible firmware interface (EFI) persistence". While previous versions of DerStarke were primarily concerned with remotely and discretely affecting operating system functions, darkmatter capabilities essentially allow further manipulation of the very firmware and BIOS structure that controls hardware function and communications.

For the technically curious, see also Unified Extensible Firmware Interface (UEFI)

Triton/DarkMallet

Triton appears to be the original DerStarke and is far more sophisticated at the expense of being essentially more complicated to set up. Triton has to be installed on a Mac OS X system disk, but it comes packaged with tools, such as DarkMallet to make this as simple as three steps.

Once installed Triton can be remotely accessed to perform directory walks, execute further scripts and even delete files. The tools can be set up with sophisticated methods for uninstalling themselves when they have lost communication with the attacker or been discovered.

DarkSeaSkies, NightSkies and SeaPea

DarkSeaSkies is an implant installed easily from a flash drive that persists in the EFI firmware of an Apple MacBook Air computer, installs a Mac OSX 10.5 kernel-space implant and executes a user-space implant.

It is assumed that an operator or asset has one-time physical access to the target system and can boot the target system to an external flash drive

DarkSeaSkies can then be used to manage and install SeaPea and NightSkies. DarkSeaSkies also contains intricate methods for masking it's presence from the operating system in case the implants cause a system failure.

SeaPea is a Mac OSX kernel-space implant that executes, and provides stealth and privilege to user-space implants. NightSkies, then, is the Mac OSX user-space implant that can beacon to a listening post and provide command and control.

Things start getting pretty scary here. NightSkies, then, is able to then embed itself into the target's iTunes to intrude and gain access to their iPhone whenever it next syncs.(5) Now the attacker can listen and command-control the target's laptop AND phone.

Conclusion

WikiLeaks states that there is evidence that as late as 2016 these tools were still being updated.(6)

At this point it seems that just about every major Apple device and product has been targeted and successfully exploited, including adapters:

• Mac OS
  • iMac
  • Macbook/Macbook Air
• iOS/iPhone
• Time Capsule
• Airport Extreme
• Thunderbolt-to-Ethernet adapter
• iTunes

I'm not exactly a legal or trade expert, so I'm not sure just how many legal violations are going on here, but I can tell you this much:

I will never own another Apple device or install an Apple program again.