WikiLeaks: CIA's CouchPotato tool grabs footage from remote video streams
The latest addition to WikiLeaks' Vault 7 cache of CIA documents and tools is a user guide for CouchPotato. This project is designed to capture RTSP/H.264 video streams, typically from networked cameras.
This is rather different to the approach taken with the Dumbo project which required physical access to a computer. The CouchPotato documentation is relatively recent, only dating back to February 14, 2014.
See also:
- 'Censorship is for losers': WikiLeaks offers fired Google engineer a job
- WikiLeaks: CIA's Dumbo project can hack webcams and corrupt recordings
- WikiLeaks reveals CIA's Imperial hacking project targeting Mac and Linux
The leaked documents relate to the first version of CouchPotato, and it’s not clear if further versions have been produced that iron out problems. CouchPotato 1.0, for instance, uses a massive amount of CPU time, meaning there is a risk that the activity would be noticed by a target.
The documentation explains:
CouchPotato is a remote tool for collection against RTSP/H.264 video streams. It provides the ability to collect either the stream as a video file (AVI) or capture still images (JPG) of frames from the stream that are of significant change from a previously captured frame. CouchPotato utilizes ffmpeg for video and image encoding and decoding as well as RTSP connectivity. In order to minimize size of the DLL binary, many of the audio and video codecs along with other unnecessary features have been removed from the version of ffmpeg that CouchPotato is built with. pHash, an image hashing algorithm, has been incorporated into ffmpeg’s image2 demuxer to provide image change detection capabilities. CouchPotato relies on being launched in an ICE v3 Fire and Collect compatible loader.
WikiLeaks says:
Today, August 10th 2017, WikiLeaks publishes the the User Guide for the CoachPotato project of the CIA. CouchPotato is a remote tool for collection against RTSP/H.264 video streams. It provides the ability to collect either the stream as a video file (AVI) or capture still images (JPG) of frames from the stream that are of significant change from a previously captured frame. It utilizes ffmpeg for video and image encoding and decoding as well as RTSP connectivity. CouchPotato relies on being launched in an ICE v3 Fire and Collect compatible loader.
More information about CouchPotato is available on the WikiLeaks website.
Image credit: ZaZa Studio / Shutterstock