Wikileaks recently released a trove of information regarding the CIA's hacking abilities. This has been dubbed "Vault 7". This includes targeting of Linux systems. Apple has apparently previously patched some of the vulnerabilities, and has promised to patch the rest. Samsung are "urgently looking into the matter".

How does Vault 7 affect Linux systems? Are there base vulnerabilities that have been identified, or does the malware rely on things like physical access or trojans? If there are vulnerabilities, have the relevant developers released any statements?

  • Two votes to close: one is "too broad" and the other is "primarily opinion based". However, I'm asking a very specific question. Which specific vectors relate to Linux? How do these specific vectors work? Have the related developers released statements? – Sparhawk Mar 9 '17 at 0:30
  • “I’m asking a very specific question” — I count three questions there ;-). And using the word “specific” in a question doesn’t make it specific; I‘d say the first question could be considered quite broad since “relate to Linux” can be interpreted in a variety of ways. – Stephen Kitt Mar 9 '17 at 7:53
  • @Sparhawk U&L is not a discussion forum. One of the generic question patterns that are suitable for U&L is I want X, I tried Y, I got Z, what do I need to do to get X? Your question, however, is not easily answerable here. It is too broad since it covers things that are too many to capture by one answer and that are by nature highly speculative; moreover, the ramifications of Vault 7 are not yet understood. Thus, what answer do you expect here? – countermode Mar 9 '17 at 8:33
  • @Sparhawk What are base vulnerabilities? Who are relevant developers? – countermode Mar 9 '17 at 8:36
  • @StephenKitt Hmm, okay fair call with the first two points. As for the last point, I meant that in the broadest sense possible… which I still feel is not too broad. It's been widely reported that Vault 7 affects Linux. However, I haven't seen any specific vulnerabilities listed. In contrast, there must have been specific vulnerabilities reported in Apple products, since these were supposedly fixed or being fixed. A pertinent answer to the first part should just say something like "Vault 7 mentions Linux components A and B, which are affected in their interaction with C and D." – Sparhawk Mar 9 '17 at 9:11

Linux was targeted, as it is a widely-proliferated operating system. However, it's large community and open-source development should help its developers address the vulnerabilities more easily than closed-source platforms.

Here's an official statement about Vault 7 from Nicko van Someren, Chief Technology Officer at The Linux Foundation:

While it is not surprising that Linux would find itself a target, the open source project has a very fast release cycle, meaning that kernel updates are released every few days to address issues that are found. Linux is an incredibly active open source project. Thousands of professional developers and volunteers - including many of the most talented in the world - are constantly contributing improvements and fixes to the project. This allows the kernel team to release updates every few days -- one of the fastest release cycles in the industry. Rapid release cycles enable the open source community to fix vulnerabilities and release those fixes to users faster.

He goes on to say:

Further, The Linux Foundation's Core Infrastructure Initiative (CII), which has the backing of many leading technology companies, is working to actively assist open source projects globally to help them develop their code using best practices proven to yield more secure results. Decades of software development tell us software will never be bug free. Through the work of open source communities, assistance from programs like CII and engagement with a vast pool of talent and support from contributing companies, we can enable open source software communities to continue producing some of the most secure software on the planet.

Anecdotally, what I mostly saw when I read about Vault 7 was Windows being targeted, along with Samsung phones and smart TVs. The moral of the story is, keep your systems updated and keep an eye on CVE bulletins, no matter what you are running.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.