What does the "Year Zero" and "Vault 7" stuff from Wikileaks mean?

Wikileaks has released a new set of documents they called "Year Zero". ​According to these documents, the CIA had created "its own NSA" with "even less accountability". The newly discovered hacking arsenal of the agency includes techniques that reportedly permit the CIA to go around the encryption of messaging apps like WhatsApp or Signal by hacking people's smartphones and collecting audio and message traffic before encryption is applied.​

This is not an app issue. It is relevant on the level of devices and operating systems like iOS and Android. For this reason, naming any particular app in this context is misleading.

Say what?

To put "Year Zero" into familiar terms, imagine a castle on a mountainside. That castle is a secure messaging app. The device and its OS are the mountain. Your castle can be strong, but if the mountain below is an active volcano, there's little your engineers can do.

So in the case of "Year Zero", it doesn't matter which messenger you use. No app can stop your keyboard from knowing what keys you press. No app can hide what shows up on your screen from the system. And none of this is an issue of the app.

So who can fix this?

It is now up to the device and OS manufacturers, like Apple, Google, or Samsung, to fix their volcanoes back into mountains.

Luckily, in the case of "Year Zero", the mountain isn't exactly a volcano. It's rather just a big mountain that is full of secret tunnels and passages. The tools from "Vault 7" are like a map of those tunnels. Now that device and OS manufacturers like Apple and Google will get this map, they can start filling in the holes and boarding up the passages. This will require many hours of work and many security updates, but eventually they should be able to take care of most of the problems.

Who is affected?

The good news is that for the moment all of this is irrelevant for the majority of Telegram users. If the CIA is not on your back, you shouldn't start worrying just yet. And if it is, it doesn't matter which messaging apps you use as long as your device is running iOS or Android.

The published docs did not include details on how to recreate and use the CIA cyberweapons. Wikileaks said they would hold off such publications until it becomes clear how these weapons should be "analyzed, disarmed and published."

This means that your neighbor next door won't likely get access to the newly discovered tools before they are neutralized.

What can I do?

There are some general steps you can take to increase the security of your device:

• Don't use rooted or jailbroken devices unless you're 400% sure you know what you're doing.
• Never install apps from unknown or untrusted sources.
• Keep your device up to date and always install the security updates it offers.
• Pick a manufacturer that offers long term updates for their products.
• Remember that devices that aren't supported anymore have an increased risk of being vulnerable.

These measures will only protect you from "Year Zero" exploits when your device and OS manufacturers implement the relevant fixes, but following these tips can already make you much safer against many of the known security threats you'd be otherwise exposed to.

To sum up

"Year Zero" is not an app issue. It applies to devices and operating systems and will require security updates from their respective manufacturers to mitigate the threats. Naming any particular app in this context is misleading.

Wikileaks claims that the CIA has had a map of undiscovered secret tunnels and passages in your mountain for several years. The CIA could use them to look inside your castle and read data from your phone screen, before any app gets a chance to encrypt it. It is possible that some of the tunnels from the secret maps have been or will be discovered by actors other than the CIA.

The most important news is that after this leak, the device and OS manufacturers will finally get these maps as well. And so Samsung, Apple, Google, and others will be able to get to work and make their mountains impassable for the CIA and anyone who tries to follow in their footsteps.