CIA’s zero-day exploits

On 7 Mar., WikiLeaks released documents reportedly stolen from the Central Intelligence Agency of the United States (CIA) which provide evidence the CIA knows of, and uses, zero-day exploits in iOS and Android operating systems, as well as other platforms. The agency has chosen to leave their citizens vulnerable to hackers and spies so they may use these exploits to hack and spy.

Of particular importance to understand, as regards GenWeb.Io, is that these vulnerabilities and weaponized software to exploit them were stolen from the CIA. This means the digital thieves already have, have had for some time, and are likely using these tools. The CIA hired firms and individuals to develop these weapons in some cases, and in others developed them in-house or in collaboration with other US intelligence services such as the FBI and the NSA.

WikiLeaks chose to suppress the release of the source code and compiled tools, but did release information describing at least some of the exploits, presumably in the interest of forcing a response from the producers of the vulnerable platforms and devices.

What we did about it

We had previously instituted what we believe to be best practices for an amateur managed server. We are monitoring, on an ongoing basis, server security communications channels and querying software providers for guidance, if they have any.

What does this mean for GenWeb.io sites?

  • We use encryption, primarily to provide visitors with protection from man-in-the-middle attacks. We cannot guarantee, now or in the near future, that our ssl is protecting visitors because their device may have been compromised.
  • If you host on GenWeb.io, there is little other change from prior to the confirmation of these actions by the CIA. However, it is likely many platforms, including those used in the stack of the GenWeb.io servers, will receive expedited security-related updates. This may possibly involve brief service outages for unplanned maintenance; we just do not know.

We will keep you posted if there are developments.