|RT | Jun 22, 2017|
Brutal Kangaroo, a tool suite for Microsoft Windows, targets closed air gapped networks by using thumb drives, according to WikiLeaks.
Air gapping is a security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks.
RELEASE: CIA 'Brutal Kangaroo' thumb drive air gap jumping virus attack suite https://t.co/dHDfcHQWIvpic.twitter.com/6zCm7mLL5X— WikiLeaks (@wikileaks) June 22, 2017
These newly released documents show how closed networks not connected to the internet can be compromised by this malware. However, the tool only works on machines with a Windows operating system.
Firstly, an internet-connected computer within the targeted organization is infected with the malware. When a user inserts a USB stick into this computer, the thumbdrive itself is infected with a separate malware.
Once this is inserted into a single computer on the air gapped network the infection jumps – like a kangaroo – across the entire system, enabling sabotage and data theft.
RELEASE: CIA air-gap jumping virus 'Emotional Simian' https://t.co/KkBnXhNtGCpic.twitter.com/w6MZFGushc— WikiLeaks (@wikileaks) June 22, 2017
Data can be returned to the CIA once again, although this does depend on someone connecting the USB used on the closed network computer to an online device.
CIA's Brutal Kangaroo air-gap jumping virus smuggles out stolen data in images on USB sticks @softwarnethttps://t.co/yXrwvEOSTLpic.twitter.com/d8QsfxX605— Julian Assange (@JulianAssange) June 22, 2017
This method is comparable to the Stuxnet virus, a cyberweapon purportedly built by the US and Israel. Stuxnet is thought to have caused substantial damage to Iran's nuclear program in 2010.
The CIA allegedly began developing the Brutal Kangaroo program in 2012 – two years after Stuxnet incident in Iran.
The most recent of these files were to intended to remain secret until at least 2035. The documents released by WikiLeaks are dated February 2016, indicating that the scheme was likely being used until that point.