OutlawCountry is the name of the latest CIA exploit revealed by the WikiLeaks. Unlike ELSA which was designed to target Windows systems to determine the location of a particular user, OutlawCountry targets Linux systems. According to a leaked user manual, the CIA has been using the hacking tool since June 2015 or earlier.
OutlawCountry Linux Exploit Technical Details
The tool was designed to redirect outgoing Internet traffic to other addresses allowing the agency to monitor the activity of Linux servers. However, for the tool to work properly, shell access and root privileges should be gained first.
This means that the systems targeted by the CIA need to be compromised via a different approach, and only afterwards the OutlawCountry can be deployed. It’s still unknown what other tools have been used together with OutlawCountry, but considering how Windows systems have been targeted, it’s very likely the CIA has obtained access via yet unknown vulnerabilities in Linux.
According to WikiLeaks, the first version of OutlawCountry has one kernel module for 64-bit CentOS/RHEL 6.x which only works with default kernels. It also only supports adding covert DNAT rules to the PREROUTING chain. As explained by WikiLeaks:
The malware consists of a kernel module that creates a hidden netfilter table on a Linux target; with knowledge of the table name, an operator can create rules that take precedence over existing netfilter/iptables rules and are concealed from a user or even system administrator.
CIA Can Remove All Traces of OutlawCountry
The leaked user manual published by the organization reveals how the tool works. It also reveals that the agency is able to remove all of its traces once the attack is over.
The OutlawCountry tool consists of a kernel module for Linux 2.6. The operator loads the module via shell access to the target. When loaded, the module creates a new netfilter table with an obscure name. The new table allows certain rules to be created using the iptables command. These rules take precedence over existing rules, and are only visible to an administrator if the table name is known. When the operator removes the kernel module, the new table is also removed.
As usual, Linux users are urged to update their systems to the most recent version so that exploits are avoided.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: