# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# NightSkies v1.2 - User Guide

1 December, 2008

- 1
- 2
- 3
- 4
- 5
- 6
- 7
…
- 15
- 16

SECRET//20330530
(U) Components
(S) NightSkies is composed of 3 main components: the implant, the Listening Post (LP), and the Post-
processing program. The Marathon droppoint proxy is also supported, but not required by NS.
(S) Implant
(S) The implant will run on the Apple iPhone. Its functionality includes beaconing, file
upload/download, and command execution. It runs in the background and does not exhibit alerting
behavior. NightSkies will attempt to use any available Internet connection to beacon. NightSkies will
wait for user activity before attempting to beacon. There are several options available to the user to
alter this timing (details provided in installation section).
(S) Listening Post
(S) The Listening Post provides tasking to and will accept packages from the implant. The LP is not
allowed to decrypt or process the received packages. It serves only as a drop box for packages. This
was designed to maximize security in the case that the LP was compromised. Package processing is
done at a later stage in a secure environment.
(S) The LP is composed of PHP files hosted by Apache and PHP server. The PHP files are generated
by a sitecreator program which reads a configuration plist file.
(S) The LP is unchanged from version 1.1
(S) Post-processing
(S) Post processing is intended to occur in a secure environment by the ResponseProcessor program.
This program will decrypt, decompress, and process the payload returned from the implant. It extracts
files contained in the payload and displays results of any commands executed on the target phone.
(S) Files and Locations
(S) Installed on iPhone
• /usr/sbin/phoned: binary implant file
• /System/Library/PreferenceBundles/CommCenter.plist: (configfile) stores
information needed by NS to beacon. It is encrypted and compressed on
disk.
• /System/Library/LaunchDaemons/com.apple.mobile.phoned.plist: provides
persistence for the phoned. This file is not encrypted and appears as a
normal launchd configuration file.
The name of binaries can be altered during installation.
(S) Listening Post
• pkgcreator: generates the LP PHP files, tasking packages, and configuration
file for the implant
SECRET//20330530
2

- 1
- 2
- 3
- 4
- 5
- 6
- 7
…
- 15
- 16