Skip to main content

Apple responds to Wikileaks’ ‘Dark Matter’ release revealing CIA efforts to infect Macs

Cancillería del Ecuador/Flickr
Wikileaks isn’t done with its Vault 7 release of CIA hacking documents, which has already created quite a stir by outlining various exploits that the CIA created for a variety of platforms. While Wikileaks has not revealed sufficient detail to allow the exploits to be easily used by cybercriminals, it has pointed nefarious parties in the right directions.

Now, Wikileaks has released another bundle of documents, dubbed “Dark Matter.” This time, the organization turned an eye to Apple’s Mac, with a number of exploits that are both insidious and persistent, MacRumors reports.

The leak highlights a specific CIA program, “Sonic Screwdriver,” that was created by the agency’s innocuous-sounding Embedded Development Branch. The exploit uses infected USB drives to inject code that attacks a Mac while it’s starting up and bypasses a user password to instead “boot its attack software.” Allegedly, the code has even been installed to modified firmware on Apple’s own Thunderbolt-Ethernet adapter.

Get your weekly teardown of the tech behind PC gaming
Check your inbox!

Sonic Screwdriver isn’t the only exploit contained in the Dark Matter leak:

“DarkSeaSkies” is an implant that persists in the EFI firmware of an Apple MacBook Air computer and consists of “DarkMatter,” “SeaPea” and “NightSkies,” which are ,respectively, EFI, kernel-space and user-space implants.

Documents on the “Triton” MacOSX malware, its infector “Dark Mallet,” and its EFI-persistent version “DerStake” are also included in this release. While the DerStake1.4 manual released Thursday dates to 2013, other Vault 7 documents show that as of 2016, the CIA continues to rely on and update these systems and is working on the production of DerStarke2.0.”

As MacRumors points out, Dark Matter also has iOS in its sights, with a number of iPhone-related exploits that are injected into target devices during the actual manufacturing process. These exploits have allegedly been underway since 2008, or soon after the iPhone was first released:

“While CIA assets are sometimes used to physically infect systems in the custody of a target, it is likely that many CIA physical access attacks have infected the targeted organization’s supply chain, including by interdicting mail orders and other shipments (opening, infecting, and resending) leaving the United States or otherwise.”

You can check out the Wikileaks source documents here. We’re likely to see additional leaks going forward, which, along with efforts to understand the documents that have already been leaked to date, will keep security analysts and the companies that make affected machines busy.

Apple has been quick to respond to the WikiLeaks Vault 7 leaks, and this one is no different. Apple provided a statement to Techcrunch, both about the Mac and iPhone exploits and Apple’s response to WikiLeaks in general:

“We have preliminarily assessed the Wikileaks disclosures … Based on our initial analysis, the alleged iPhone vulnerability affected iPhone 3G only and was fixed in 2009 when iPhone 3GS was released. Additionally, our preliminary assessment shows the alleged Mac vulnerabilities were previously fixed in all Macs launched after 2013.

“We have not negotiated with Wikileaks for any information. We have given them instructions to submit any information they wish through our normal process under our standard terms. Thus far, we have not received any information from them that isn’t in the public domain. We are tireless defenders of our users’ security and privacy, but we do not condone theft or coordinate with those that threaten to harm our users.”

Updated on 3-24-2017 by Mark Coppock: Added Apple’s statement.

Editors' Recommendations

Mark Coppock
Mark has been a geek since MS-DOS gave way to Windows and the PalmPilot was a thing. He’s translated his love for…
This critical macOS flaw may leave your Mac defenseless
A close-up of a MacBook illuminated under neon lights.

Apple’s macOS operating system has such a strong reputation for security that many people mistakenly believe Macs simply aren’t affected by malware. Well, Microsoft has served up a reminder that that’s not true, as the company has identified a serious vulnerability that affects one of macOS’s most important lines of defense.

According to Bleeping Computer, the bug was first reported by Jonathan Bar Or, Microsoft’s principal security researcher, who named the flaw Achilles. It is now tracked as CVE-2022-42821.

Read more
Apple Security Research website launches to protect your Mac
Apple Seurity Research website has resources for bug bounty hunters.

Apple just launched a new website that's dedicated to macOS and iOS security and there are already two blog posts that provide examples of what to expect, one providing a deep dive into memory allocation within the XNU kernel at the heart of all Apple devices, and another discussing the improved security bounty process.

The new website will undoubtedly become a critical resource for Apple security researchers, both providing information and serving as a hub for submitting bounties. The Apple Security Research website is also where you can apply for an official Apple Security Research Device (SRD) to help with identifying vulnerabilities by providing special access to what are normally protected areas of iOS.

Read more
Apple could launch a Frankenstein iPad Pro that runs macOS
ipad pro 2021.

People have been complaining for years that Apple should just merge its mobile and desktop operating systems, and they might finally see their wish come true -- sort of. That’s because a new rumor claims Apple is working on bringing macOS to the M2 iPad Pro, but it could be nothing more than a tall tale.

The rumor comes from leaker Majin Bu on Twitter, who claims their sources have told them Apple is working on a “smaller” version of macOS that would be exclusively for the M2 iPad Pro, which Apple has only just released.

Read more