Vault 7. The CIA Can’t Read Your Encrypted Messages!

WikiLeaks has just dumped some 9,000 files belonging to the CIA onto the internet. These files, labeled “Vault 7” by WikiLeaks, clearly show the breath-taking scope of the CIA’s surveillance ambitions. The timing of their release is likely to benefit an embattled Donald Trump in his fight against the CIA over alleged improper ties with the Russian government.

Startling revelations highlighted by WikiLeaks’ accompanying press release include:

The CIA Collects Zero-day Vulnerabilities

It uses these to hack into systems. The US government has in the past insisted that it does not do this, and that it instead reports any discovered vulnerabilities to companies so that they can be patched in order to protect customers.

The Vault 7 documents date to mid-2016, and many of the vulnerabilities discussed have now been patched. These vulnerabilities allowed the CIA to hack into devices running iOS 9.0 and older, and into Android devices via older versions of Chrome.

Whether this problem remains ongoing is unclear. Although most of the vulnerabilities listed in the leaked documents have now been patched, there is no reason whatsoever to think that the CIA has simply stopped collecting new vulnerabilities!

On the other hand, cybersecurity expert Will Strafach told Cult of Mac that,

I do not believe any iOS user running iOS 10+ has any cause for concern by this.

I am very unclear, however, on what basis Strafach makes this claim.

The CIA Hacked into Samsung Smart TVs to Spy on People

“Weeping Angel” is perhaps named after the terrifying monsters from Dr. Who. It refers to malware designed to allow the CIA (and the UK’s MI5) to spy on targets, even when the victim thought their TV was turned off. According to one of the leaked documents,

Weeping Angel already hooks key presses from the remote (or TV goes to sleep) to cause the system to enter Fake-Off rather than Off. Since the implant is already hooking these events, the implant knows when the TV will be entering Fake-Off mode.”

This is rather alarming, but it is clear that the software was developed for use against a specific target. It may well then have been deployed more widely, but it still requires a targeted attack. Samsung has so far declined to comment.

Of course, the threat posed to privacy by smart TVs has been understood for quite some time. Samsung set alarm bells ringing in 2015 when its privacy policy stated:

Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of voice recognition.”

Is Your TV Spying on You?

If you are of a particularly paranoid disposition, you can check to see if your Samsung TV is spying on you when (you think) it is turned off. If the blue LED at the back of the TV remains on when the TV should be off, then you may be victim of a Weeping Angel attack.

Affected models mentioned in the leaked documents all date from 2012 (UNES8000F, E8000GF plasma, and UNES7550F), and 2013 (UNF8000 series, F8500 plasma, UNF7500 series, and UNF7000 series).

The hack also only affects outdated firmware versions 1111, 1112, and 1116. Updating to a newer version of firmware should disable Weeping Angel. You can do this by going to main menu -> Support -> Software Update.

Since the documents date from mid-2016, however, it is possible that Weeping Angel has been modified to remove the tell-tale blue light, or updated to affect newer firmware versions…

The CIA Can Bypass Encrypted Messaging Apps Such as Signal and WhatsApp

Now… this is the most alarming, but also the most alarmist “revelation” from the files. It has received considerable attention in the mainstream press. This misconception is not helped by the fact that the WikiLeaks editors are not themselves cybersecurity experts.

[Zero day exploits] permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the “smart” phones that they run on and collecting audio and message traffic before encryption is applied.”

The thing is, though, that this is hardly news. Of course, if an adversary has complete control of your phone, then they can do pretty much whatever they want with it! This includes accessing your text messages before and after they are encrypted.

But accessing your phone is a non-trivial and very highly targeted attack. And most importantly, it in no way undermines or invalidates the encryption used. Wired offers a great analogy:

That makes saying the CIA can “bypass” encryption apps like WhatsApp akin to saying Jimmy Stewart could have bypassed his neighbor’s blinds in Rear Window by breaking into the guy’s house and hiding in his closet. Sure, that’s one way to do it. But it doesn’t make the blinds any less effective.

“It’s an important distinction.

Indeed it is. Against all but the most invasive and specific attack, end-to-end encrypted apps will keep your messages private and prevent you being spied upon.

A very real danger of the way in which these documents are being reported is that it could undermine peoples’ confidence in encrypted products. This will likely make people more reluctant to bother using them, which makes everyone less safe.


The Vault 7 documents are interesting, and demonstrate just how many pies modern intelligence services have their fingers in. However, most of the information in them is old news and, in the case of encrypted apps, has been widely misunderstood.

As always, the best defense against government surveillance is encryption, encryption, encryption. Nothing has changed.

Image credit: By Festa/

Douglas Crawford I am a freelance writer, technology enthusiast, and lover of life who enjoys spinning words and sharing knowledge for a living. Find me on Google+

Related Coverage


2 responses to “Vault 7. The CIA Can’t Read Your Encrypted Messages!

  1. Isn’t Vault 7 just 1% of the total and also a bit dated? Cybersecurity “experts” making any proclamations, as well as companies insisting their devices are *almost* completely patched (like saying “just a little bit pregnant”), are just speculating for their personal agendas.

    Apple, in particular, as well as their fanboy experts, were quick to dismiss the severity of this data leak. It’s always about sales and telling their users what they want to hear. Google, for it’s part (as far as I’m aware), has made no such statement. As an Android user (rooted, flashed, ad-blocked, etc), it’s probably because security on Android is a complete disaster in general.

    1. Hi james,

      I believe I make your point re. iOS devies in the article. And yes, you are probably right about Android.

Leave a Reply

Your email address will not be published. Required fields are marked *