WikiLeaks Revealed another Document of CIA Malware Called “ELSA” have an ability to Tracking Geo-Location information of WiFi enabled nearby Target Windows Computers based on the ESS (Extended Service Set) Data and Transfer the latitude, longitude information into 3rd Party Database.
ELSA Malware Collecting the targeted WiFi Enabled Computers Information as Metadata Format and then it transmitting the Metadata to 3rd Party databases for resolution into latitude, longitude and saves its data in 128 bit AES encrypted file.
Few Week’s Before WikiLeaks Revealed a CIA Cyber Weapon “Brutal Kangaroo” to targets closed networks by air gap jumping using thumbdrives.
To Collecting the data and location information of target machine ,This “ELSA” Malware doesn’t have Victim to be online. ELSA only need the target to be running with an enabled WiFi device.
Once Infected Windows Machine Connected to the internet then ELSA Malware Automatically Collecting the targets information longitude and latitude data along with the timestamp by using public geo-location databases from Google or Microsoft.
According to the CIA Revealed Secret Document,” The ELSA project allows the customization of the implant to match the target environment and operational objectives like sampling interval, the maximum size of the log file and invocation/persistence method.”
How Does ELSA Collect Geo-Location Information
ELSA Malware Contain 2 Major Components to perform the Operation of Tracking the Victims.
- Operator Terminal – First implant is an Operator(Attacker) Icon Attack Box.
- Windows Target- – Second implant of ELSA variant deployed on a target Windows host
ELSA Successfully initiate the Attack, targeting Windows Machine Must be WiFi enabled and deployed in an environment with WiFi access points in range.
Once ELSA persistently installed on a target machine using separate CIA exploits, the malware scans visible WiFi access points and records the ESS(Extended Service Set Identifier) identifier, MAC address and signal strength at regular intervals.
According to Document, The ELSA software system is delivered in two sets of zip files with embedded hash files containing the project name, version, and algorithm used to calculate the hash:
- elsa-v1.0.0-docs.zip
- sha1-windows.txt
- elsa-v1.0.0-windows.zip
- sha1-windows-images.txt
Based on the Schedule Done by the Attacker, implant begins collecting WiFi access point information.
ElSA Using PATCHER tool to configure ELSA for deployment and Target Machine and it specify,
- The target machine’s architecture (x86 vs. x64)
- The desired mode (dllhost, svchost, rundll32 )
- The desired geo provider (microsoft / google)
- SECRET//NOFORN
- The desired maximum log file size
- Whether or not to resolve ap lists into geo’s from the target
After Successfully Deployed the Malware into the target machine , CIA operator Fetching the log information of the Targets GEO Location as Log file by using tools that helps to Operator placed ELSA on his system.
Finally Operator Decrypt the logfile that contains the information about the Victims Geo locations and CIA using EES Geo-location databases to identify the better locations information.
