WikiLeaks has released a news batch of documents detailing a man-in-the-middle (MitM) attack tool dubbed Archimedes allegedly used by the CIA to target local networks.
The leaked documents, dated between 2011 and 2014, provide details about a tool initially codenamed Fulcrum and later renamed Archimedes by the development team.
The CIA hacking tool that allows the operators to redirect LAN traffic from a targeted computer through a machine controlled by the attackers before it is routed to the gateway.
“Archimedes is an update to Fulcrum 0.6.1.” reads the Archimedes Tool Documentation. “Archimedes is used to redirect LAN traffic from a target’s computer through an attacker controlled computer before it is passed to the gateway. This enables the tool to inject a forged webserver response that will redirect the target’s web browser to an arbitrary location. This technique is typically used to redirect the target to an exploitation server while providing the appearance of a normal browsing session. For more tool information please refer to the original Fulcrum 0.6.1 documentation.”
According to the SANS instructor Jake Williams who analyzed the leaked documents, the Archimedes tool seems to be a repackaged version of popular MitM tool Ettercap.
The new dump by @wikileaks, FULCRUM, appears to be nothing more than a repackaged ettercap. Honestly nothing to write home about 1/n
— Jake Williams (@MalwareJake) May 5, 2017
CIA alleged targets can use the leaked information about the Archimedes tool to check if their systems had been compromised by the US Intelligence.
Potential victims can search for these hashes on their systems.
Archimedes introduced several improvements respect the Fulcrum tool such as:
The tool itself is not sophisticated, it could be interesting to understand how CIA agents did use it in targeted attacks.
(Security Affairs – Data Leak, AMP)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.