CIA Malware Can Steal SSH Credentials, Session Traffic

itman · Jul 6, 2017

WikiLeaks dumped today the documentation of two CIA hacking tools codenamed BothanSpy and Gyrfalcon, both designed to steal SSH credentials from Windows and Linux systems, respectively.

Both tools are "implants," a term the CIA uses to describe malware payloads. Once installed through various means on a target's computer, these two implants hook into SSH-related processes and steal credentials or session traffic, where possible.
Click to expand...

https://www.bleepingcomputer.com/ne...re-can-steal-ssh-credentials-session-traffic/

itman · Jul 7, 2017

A document dated March 2015 describes BothanSpy as a tool that steals credentials for active SSH sessions from Xshell, an SSH, telnet, and rlogin terminal emulator for Windows.

Using a mode dubbed by its developers “Fire and Collect,” BothanSpy collects SSH credentials and sends them to the attacker’s server without writing any data to the compromised machine’s disk. If the mode “Fire and Forget” is used, the stolen credentials are written to a file on the disk.

Gyrfalcon is a library loaded into the OpenSSH client process address space. It collects OpenSSH session traffic, including usernames and passwords, compresses and encrypts the data, and stores it in a file. A third-party application is required to exfiltrate the file.
Click to expand...

http://www.securityweek.com/cia-tools-stealing-ssh-credentials-exposed-wikileaks

compleo · Jul 27, 2017

Security researchers from Symantec have tied the CIA hacking tools leaked by WikiLeaks last month to a cyber-espionage group responsible for at least 40 hacks in 16 countries.

Log in or Sign up

CIA Malware Can Steal SSH Credentials, Session Traffic

itman Registered Member

itman Registered Member

compleo Registered Member

Log in or Sign up

CIA Malware Can Steal SSH Credentials, Session Traffic

itman Registered Member

itman Registered Member

compleo Registered Member

Useful Searches