CIA developed tools to spy on Mac computers: WikiLeaks
The CIA developed tools to spy on Mac computers by injecting software into the chips that control the computers’ fundamental operations, according to the latest cache of classified government documents published on Thursday by WikiLeaks.
Apple said in a statement Thursday evening that its preliminary assessment of the leaked information indicated that the Mac vulnerabilities described in the disclosure were previously fixed in all Macs launched after 2013.
However, the documents also indicated that the Central Intelligence Agency was developing a new version of one tool last year to work with current software.
The leaked documents were the second batch recently released by WikiLeaks, which said it obtained a hoard of information on the agency’s cyberweapons programs from a former government worker or contractor. The first group of documents, published March 7, suggested that the CIA had found ways to hack Apple iPhones and Android smartphones, Microsoft Windows computers, Cisco routers and Samsung smart televisions.
Since the initial release of the CIA documents, which the agency has not confirmed are authentic, major technology companies have been scrambling to assess whether the security holes exploited by the CIA still exist and to patch them if they do.
All of the surveillance tools that have been disclosed were designed to be installed on individual phones or computers. But the effects could be much wider. Cisco Systems, for example, warned customers this week that many of its popular routers, the backbone of computer networks, could be hacked using the CIA’s techniques.
Julian Assange, the founder of WikiLeaks, has offered to share the precise software code used by the CIA’s cyberweapons with the affected companies. But major tech companies have been reluctant to directly engage with him for fear of violating American laws governing the receipt of classified information.
At a news conference Thursday, Assange criticised the government policies that restricted such communications but said that Apple had nonetheless been willing to work with representatives of his anti-secrecy organization.
Google and Microsoft, he said, had simply pointed WikiLeaks to its existing channels for anyone to report a security flaw.
In its statement, Apple denied negotiating with WikiLeaks. “We have given them instructions to submit any information they wish through our normal process under our standard terms,” the company said. “Thus far, we have not received any information from them that isn’t in the public domain. We are tireless defenders of our users’ security and privacy, but we do not condone theft or coordinate with those that threaten to harm our users.”
The spy software described in the latest documents was designed to be injected into a Mac’s firmware, a type of software preloaded in the computer’s chips. It would then act as a “listening post,” broadcasting the user’s activities to the CIA whenever the machine was connected to the internet.
A similar tool called NightSkies was developed in 2009 to spy on iPhones, the documents said, with the agency figuring out how to install it undetected before a new phone was turned on for the first time. (Apple said that flaw affected only the iPhone 3G and was fixed in all later models.)
Although most of the tools targeted outdated versions of the Apple devices’ software, the CIA’s general approach raises new security concerns for the industry, said Eric Ahlm, who studies cybersecurity at Gartner, a research firm. By rewriting the most basic software of a computer or a phone, tools that operate at the chip level can hide their existence and avoid being wiped out by routine software updates.
Under an agreement struck during the Obama administration, intelligence agencies were supposed to share their knowledge of most security vulnerabilities with tech companies so they could be fixed. The CIA documents suggest that some key vulnerabilities were kept secret for the government’s use. The CIA declined to comment Thursday, pointing reporters to its earlier statement about the leaks, in which it defended its use of “innovative, cuttingedge” techniques to protect the country from foreign threats and criticized WikiLeaks for sharing information that could help the country’s enemies.