https://www.newyorker.com/magazine/2022/06/13/the-surreal-case-of-a-cia-hackers-revenge
Long read…but wild story.
Quote:
"O.S.B. was focussed on what we referred to as 'physical-access operations,' " a senior developer from the unit, Jeremy Webera pseudonymexplained. This is not dragnet mass surveillance of the kind more often associated with the National Security Agency. These are hacks, or "exploits," designed for individual targets. Sometimes a foreign terrorist or a finance minister is too sophisticated to be hacked remotely, and so the agency is obliged to seek "physical access" to that person's devices. Such operations are incredibly dangerous: a C.I.A. officer or an asset recruited to work secretly for the agencya courier for the terrorist; the finance minister's personal chefmust surreptitiously implant the malware by hand. "It could be somebody who was willing to type on a keyboard for us," Weber said. "It often was somebody who was willing to plug a thumb drive into the machine." In this manner, human spies, armed with the secret digital payloads designed by the Operations Support Branch, have been able to compromise smartphones, laptops, tablets, and even TVs: when Samsung developed a set that responded to voice commands, the wizards at the O.S.B. exploited a software vulnerability that turned it into a listening device.
Quote:
On March 7, 2017, the Web site WikiLeaks launched a series of disclosures that were catastrophic for the C.I.A. As much as thirty-four terabytes of datamore than two billion pages' worthhad been stolen from the agency. The trove, billed as Vault 7, represented the single largest leak of classified information in the agency's history. Along with a subsequent installment known as Vault 8, it exposed the C.I.A.'s hacking methods, including the tools that had been developed in secret by the O.S.B., complete with some of the source code. "This extraordinary collection . . . gives its possessor the entire hacking capacity of the C.I.A.," WikiLeaks announced. The leak dumped out the C.I.A.'s toolbox: the custom-made techniques that it had used to compromise Wi-Fi networks, Skype, antivirus software. It exposed Brutal Kangaroo and AngerQuake. It even exposed McNugget.
Quote:
Schulte could get "a little off the hinge," Sean remembered. At one point, agency officials decided to assign a contractor a project, Almost Meat, that was based in part on Schulte's code. "Josh was offended," Weber recalled. He protested that his hard work would be handed to a third party, then sold back to the government at a markup. He threatened to file a complaint with the C.I.A.'s inspector general, claiming "fraud, waste, and abuse." Frank Stedman, who worked on Almost Meat, felt that the episode illustrated Schulte's tendency to react with a "disproportionate response." The man known as Bad Ass and Voldemort accrued another office nickname: the Nuclear Option.
Long read…but wild story.