Vault 7: 'Dark Matter'

Dark Matter contains manuals and test documentation for several projects of the CIA's Embedded Development Branch aimed at Apple devices. I said they showed techniques for gaining 'persistence' on Macs and iPhones through EFI/UEFI firmware, so that an infection would survive reinstallation of the operating system.

Projects described include 'Sonic Screwdriver', a means of running code from a peripheral device – a modified Apple Thunderbolt-to-Ethernet adapter – while a Mac boots, even with a firmware password enabled; 'DarkSeaSkies', an implant for the MacBook Air; the 'Triton' macOS malware and its EFI-persistent version 'DerStarke'; and 'NightSkies 1.2', an iPhone tool that I said was designed to be installed on factory-fresh phones and had reached that version by 2008. I inferred that the CIA had been infecting the iPhone supply chain of its targets; that is our interpretation.

The tools generally required physical access to the device. Apple said its preliminary analysis showed that the iPhone vulnerability affected only the iPhone 3G and was fixed in 2009, and that the Mac vulnerabilities had been fixed in all Macs launched after 2013 (SecurityWeek).

I published Dark Matter on 23 March 2017 as the second Vault 7 release.

The US Department of Justice has stated, on the basis of evidence at trial, that Joshua Schulte, a software developer in the CIA's Center for Cyber Intelligence from 2012 to 2016, used a secret administrator session on 20 April 2016 to copy the centre's entire tool-development archives and then transmitted them to WikiLeaks. He was found guilty at trial on 9 March 2020 of contempt of court and making false statements, and on 13 July 2022 of eight counts including the illegal gathering and transmission of national defence information and unauthorised computer access; after a further conviction for child sexual abuse material offences on 13 September 2023, he was sentenced to 40 years in prison on 1 February 2024. The department described the theft as 'the largest data breach in CIA history' and counted 26 Vault 7 and Vault 8 disclosures between March and November 2017. The CIA itself declined to comment on the authenticity of the documents when they were published.