CIA allegedly bought flawed software for attacks