WikiLeaks Releases Source Code CIA Tool For Watermarking Office Documents

WikiLeaks has republished CIA files from the Vault 7 collection. The current dump includes the source code and manual of the so-called Scribbles tool, with which Office documents can be watermarked.

In this way, for example, it is possible to track documents and to check whether they originate from your own organization. According to WikiLeaks, the tool provides documents with a ‘web beacon’. The manual shows that a modified document connects to a server when opened, allowing the owner to “track” the document. By also publishing the source code, WikiLeaks hopes that researchers will find out more about how Scribbles works.

The manual also shows that the software works with Office 2013 and documents from Office 97 through 2016. Scribbles can be used to watermark the documents offline, if necessary in large quantities. The manual shows a warning not to leave the Scribbles files on a target’s PC or otherwise let them fall into the hands of ‘an opponent’.

A second warning at the end of the manual states that the files only work with Microsoft Office. If a target opens the files with another program such as OpenOffice or LibreOffice, “there is a possibility that the watermark and the corresponding images and URLs will become visible.” In addition, ‘Protected Mode’ would prevent the document from connecting until the target indicates that it wants to edit the document.

WikiLeaks has been publishing documents from the Vault 7 dump for some time now. Last week, the organization published the manual for the so-called Weeping Angel tool, with which certain Samsung smart TVs can be used as eavesdropping devices by means of physical access.

The Scribbles parameters to adjust