"Dolphin Attack": Hackers μπορούν να καταλάβουν τη συσκευή σας με... υπέρηχους - Wikileaks, Project "Protego": A secret CIA Missile Control System Project

Ερευνητές από το Πανεπιστήμιο Zhejiang της Κίνας κατάφεραν να “μιλήσουν” σε ψηφιακούς βοηθούς χρησιμοποιώντας υπέρηχους, εκμεταλλευόμενοι ένα κενό ασφαλείας, που συναντάται σε όλους τους ψηφιακούς βοηθούς. (Siri, Google Assistant, Cortana κ.λ.π). Η επίθεση έλαβε την ονομασία "Dolphin Attack" και επιτρέπει τον απομακρυσμένο έλεγχο των ψηφιακών βοηθών μέσω εντολών που εκπέμπονται σε συχνότητες υψηλότερες από αυτές που μπορεί να συλλάβει το ανθρώπινο αυτί.  Όσο για το τι μπορεί να επιτευχθεί με μία τέτοια πρακτική, ας πούμε απλά ότι κάποιος θα μπορούσε να ζητήσει από τον προεγκατεστημένο  στην συσκευή σας "βοηθό", να ανοίξει μια ιστοσελίδα μολυσμένη με malware και στη συνέχεια να επιτρέψει την εγκατάστασή του.

"DolphinAttack could inject covert voice commands at 7 state-of-the-art speech recognition systems (e.g., Siri, Alexa) to activate always-on system and achieve various attacks, which include activating Siri to initiate a FaceTime call on iPhone, activating Google Now to switch the phone to the airplane mode, and even manipulating the navigation system in an Audi automobile."

Επίδειξη της τεχνικής σε βίντεο: https://www.youtube.com/watch?v=21HjF4A3WE4

Η δημοσίευση της έρευνας σε αρχείο PDF, εδώ: https://endchan.xyz/.media/50cf379143925a3926298f881d3c19ab-applicationpdf.pdf

Another week, another batch of CIA Vault7 leaks was published by Wikileaks. This time the documents provide details about the Project Protego, a CIA Secret Missile Control System. WikiLeaks published four secret documents from the Project Protego, along with 37 related documents about proprietary hardware/software manuals from Microchip Technology Inc.). The project was maintained between 2014 and 2015.

The Project Protego is a PIC-based missile control system that was developed by Raytheon, one of major U.S. defence contractors, and maintained between 2014 and 2015. The system is installed on-board a Pratt&Whitney aircraft (PWA) equipped with missile launch systems (air-to-air and/or air-to-ground). According to the documents, it could be used to hit air-to-air and air-to-ground targets. Protego is composed of separate micro-controller units that exchange data and signals over encrypted and authenticated channels. The encrypted channels are:
» On-board TWA are the ‘Master Processor’ (MP) and the ‘Deployment Box’. Both systems are layed-out with master/slave redundancy.
» The missle system has micro-controllers for the missle itself (‘Missle Smart Switch’, MSS), the tube (‘Tube Smart Switch’, TSS) and the collar (which holds the missile before and at launch time).


Leaked documents include the projects’ scheme, description, a guide on how to configure and build Protego images, and other related data. A missile could be launched only after the Master Processor (MP) receives three specific valid signals from a beacon (‘In Border,’ ‘Valid GPS,’ and ‘No End of Operational Period’). “Similary safeguards are in place to auto-destruct encryption and authentication keys for various scenarios (like ‘leaving a target area of operation’ or ‘missing missle‘).” states Wikileaks. It is unclear if the project the Protego Protego was part of the Vault 7 dump, which mostly contains malware, hacking tools, and relevant documentation. According to Wikileaks, the project was maintained between 2014 and 2015. “The missile system has micro-controllers for the missile itself (‘Missile Smart Switch’, MSS), the tube (‘Tube Smart Switch’, TSS) and the collar (which holds the missile before and at launch time).” continues Wikileaks.

Raytheon, who was also mentioned in a previous CIA leak, it was tasked by the US intelligence agency for analyzing TTPs used by threat actors in the wild. Likely the name Protego has been inspired from the magical Shield Charm used in Harry Potter movies, which creates a magical barrier to deflect physical entities and spells, in order to protect a certain person or area. This means that the project Protego was mainly designed for defensive purposes.

Below the list of release published by Wikileaks since March:
Project Protego – 07 September, 2017
AngelFire – 31 August, 2017
ExpressLane – 24 August, 2017
Couchpotato – 10 August, 2017
Dumbo– 03 August, 2017
Imperial – 27 July, 2017
UCL/RAYTHEON – 19 July, 2017
HighRise – 13 July, 2017
BothanSpy and Gyrfalcon – 06 July, 2017
OutlawCountry – 30 June, 2017
ELSA malware – 28 June, 2017
Cherry Blossom – 15 June, 2017
Pandemic – 1 June, 2017
Athena – 19 May, 2017
AfterMidnight – 12 May, 2017
Archimedes – 5 May, 2017
Scribbles – 28 April, 2017
Weeping Angel – 21 April, 2017
Hive – 14 April, 2017
Grasshopper – 7 April, 2017
Marble Framework – 31 March, 2017
Dark Matter – 23 March, 2017

Pierluigi Paganini