CIA's 'woefully lax' security allowed the 'Vault 7' data breach

A new report into how WikiLeaks revealed the CIA's tools for hacking Macs slams the security agency's "unacceptable" lack of security over its own systems.

Following the huge 2017 "Vault 7" leak of classified data from the CIA, a government investigation has reported that it was because "day to day security practices had become woefully lax."

A redacted version of "WikiLeaks Task Force: Final Report," has been released by Senator Ron Wyden as part of a letter he has written to the Director of National Intelligence. Wyden calls for "unclassified answers"to questions raised by the report, as well as how the agency plans to act on its multiple recommendations.

"Vault 7" is the name that WikiLeaks gave to its whole collection of data from the CIA's Center for Cyber Intelligence (CCI). It included details of workable ways of exploiting older versions of macOS, as well as source code, and communications. "All of the documents reveal, to varying degrees, CIA's tradecraft in cyber operations," says the report.

An example of the Mac-hacking tools used by the CIA and revealed by WikiLeaks, includes a system called "Achilles." This 2011 system was developed for use against Snow Leopard Macs, and while there is no information about its successful use, it would have required users to install a doctored application.

Details of this and other Mac exploits were previously reported to have come from ex-CIA employee Adam Schulte, who provided WikiLeaks with the data. The report does not mention his name in any of its non-redacted text, but Schulte is reportedly still under investigation.

The report confirms that between 180GB and 34 terabytes of information were leaked, but the investigators still can't be more precise because of inadequate security on the systems involved. It notes that it's only because WikiLeaks published the data that the CIA knew it had been stolen.

"Because the stolen data resided on a mission system that lacked user activity monitoring and a robust server audit capability, we did not realize the loss had occurred until a year later, when WikiLeaks publicly announced it in March 2017," says the report.

"Had the data been stolen for the benefit of a state adversary and not published, we might still be unaware of the loss— as would be true for the vast majority of data on Agency mission systems," it continues.

The report notes that the "mission system" involved did comply with all of the Agency's security requirements at the time. "However, in a press to meet growing and critical mission needs, CCI had prioritized building cyber weapons at the expense of securing their own systems," it says.

Extract from the start of the heavily-redacted report

"Most of our sensitive cyber weapons were not compartmented, users shared systems administrator-level passwords, there were no effective removable media controls, and historical data was available to users indefinitely," it continues. "These shortcomings were emblematic of a culture that evolved over years that too often prioritized creativity and collaboration at the expense of security."

The longest redacted section of this intelligence briefing report includes recommendations for what the agency should do to address its "multiple ongoing CIA failures." It warns that "we are making educated assumptions about the scope and timing of the loss, in part because we lacked effective monitoring and auditing of this mission system."

But it also notes that the investigators have "moderate confidence" that the most confidential CIA information remains secure.

"Data in Confluence, a collaboration and communication platform, and some data in Stash, a source code repository, have been released by WikiLeaks; we assess WikiLeaks possesses all of the Confluence and Stash data. However, we now assess with moderate confidence that WikiLeaks does not possess the Gold folder of final versions of all developed tools and source code that resided on the Development Network (DevLAN), even though WikiLeaks claims it has released only a small slice of the archive it possesses. The Gold folder was better protected; WikiLeaks so far has released data in Stash despite the availability of newer, easier to exploit versions of tools in Gold; and Gold's size, several terabytes, made it harder to export."