OutlawCountry Exploit, CIA's Tool to Compromise Linux Systems

OutlawCountry Exploit, CIA’s Tool to Compromise Linux Systems

OutlawCountry is the name of the latest CIA exploit revealed by the WikiLeaks. Unlike ELSA which was designed to target Windows systems to determine the location of a particular user, OutlawCountry targets Linux systems. According to a leaked user manual, the CIA has been using the hacking tool since June 2015 or earlier.

OutlawCountry Linux Exploit Technical Details

The tool was designed to redirect outgoing Internet traffic to other addresses allowing the agency to monitor the activity of Linux servers. However, for the tool to work properly, shell access and root privileges should be gained first.

This means that the systems targeted by the CIA need to be compromised via a different approach, and only afterwards the OutlawCountry can be deployed. It’s still unknown what other tools have been used together with OutlawCountry, but considering how Windows systems have been targeted, it’s very likely the CIA has obtained access via yet unknown vulnerabilities in Linux.

Related Story: Athena Surveillance Tool Designed to Spy on Windows XP – Windows 10

According to WikiLeaks, the first version of OutlawCountry has one kernel module for 64-bit CentOS/RHEL 6.x which only works with default kernels. It also only supports adding covert DNAT rules to the PREROUTING chain. As explained by WikiLeaks:

The malware consists of a kernel module that creates a hidden netfilter table on a Linux target; with knowledge of the table name, an operator can create rules that take precedence over existing netfilter/iptables rules and are concealed from a user or even system administrator.

CIA Can Remove All Traces of OutlawCountry

The leaked user manual published by the organization reveals how the tool works. It also reveals that the agency is able to remove all of its traces once the attack is over.

The OutlawCountry tool consists of a kernel module for Linux 2.6. The operator loads the module via shell access to the target. When loaded, the module creates a new netfilter table with an obscure name. The new table allows certain rules to be created using the iptables command. These rules take precedence over existing rules, and are only visible to an administrator if the table name is known. When the operator removes the kernel module, the new table is also removed.

As usual, Linux users are urged to update their systems to the most recent version so that exploits are avoided.

Related Story: WikiLeaks Has Demands for Tech Companies to Patch Zero-Days

Milena Dimitrova

An inspired writer, focused on user privacy and malicious software. Enjoys 'Mr. Robot' and fears '1984'.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.