Leak Of CIA Hacking Secrets Serves As Alert To Close Security Gaps

The fact that Google is rapidly fixing the Android vulnerabilities may not do you much good. That’s because in the Android world, each mobile carrier has to decide whether to release a given Android update and if so, when to release it.

Many Android devices simply don’t get updates for a variety of reasons, including that the device maker didn’t enable updates that come directly from Google. Instead the maker may have decided not to pass along the updates to users because it’s time consuming and costs money.

Whether the ability to receive updates matters to you depends on what your company does with its devices. But even if you’re not a target of the CIA or some other intelligence agency, it should still give you some serious concerns.

Cybersecurity concerns

Now that the tools are available, somebody besides government spies can use these tools and that means that they can attack your organization for something besides state secrets.

For example, if you process credit card payments or medical records on mobile devices, they’re suddenly vulnerable to cyber-criminals. Hackers, who by now have seen the tools on WikiLeaks, are probably already working with them to start new types of cyber-crime. If you thought your iPhone or Galaxy was safe, now you know it might not be.

Fortunately, there are some steps you can take to make sure you’re not vulnerable to hacking based on the information from WikiLeaks.

First, make sure all of your devices can be updated. If they can’t, then you really need to dispose of them and get devices that can be updated. You will also need to audit your devices to confirm that the latest updates have been applied and that they continue to be applied as soon as they’re available.

The reason for the focus on updates is that each of the hacking tools described in the Vault 7 release depends on a specific vulnerability and those vulnerabilities can be closed during the update process. In fact, this is where the information in the WikiLeaks dump is most useful because you can go through each chart, see what equipment you have and in general what the vulnerabilities are.

Essentially, the CIA records in the WikiLeaks dump provide you with a pathway to making your environment is secure. It will also show you which devices aren’t secure and likely can’t be made secure. You should take those devices out of service.

For now, at least, you may need to limit your device selection to the newest model of Galaxy devices from Samsung, devices from Apple that can support iOS 10 and the Nexus and Pixel devices from Google that get direct updates. You will also need to make sure that your Windows and Mac devices are kept up to date. If your carrier isn’t passing along updates in a timely manner, you may want to change carriers.

Protecting yourself and your organization against hackers that use the best cyber-attack tools in the industry is possible, but it will require you to pay attention to all of your devices.

Originally published on eWeek