WikiLeaks - Vault 7: Projects

# Vault 7: Projects

### Dark Matter

# Sonic Screwdriver

29 November, 2012

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8

1. (U) Introduction
(S//NF) Sonic Screwdriver is a mechanism for executing code on peripheral devices while a Mac laptop
or desktop is booting. Normally, an Apple Firmware Password prevents alterations of the boot path.
Sonic Screwdriver’s mechanism for executing code will allow a user to boot to a USB thumb stick, DVD/
CD, or external hard drive even when a firmware password is enabled.
(S//NF) The code for Sonic Screwdriver is stored on the firmware of an Apple Thunderbolt-to-Ethernet
adapter (see Figure 1.1). The implant code will scan all internal and external media devices for a device
with a specific volume name. This includes USB thumb drives, CD/DVD disc, and hard drives. If the
specific volume name is found, it will execute a UEFI boot of that device.
(U) Figure 1.1: Apple Thunderbolt-to-Ethernet adapter
(S//NF) The intended CONOP for Sonic Screwdriver is to be able to install EDG/AED tools on a Mac
even if a firmware password was enabled. EDG/AED tools usually requires an operator to boot to a
specific device. If a firmware password is enabled, the operator will see a password prompt as in Figure
1.2 instead the list of bootable devices. If such a screen appears during the operation, the operator would
then need to reboot the machine with the implanted adapter plugged into the Thunderbolt port, and
continue with installation of the EDG tool. See Section 4.2 for specific details.
(U) Figure 1.2: Apple Firmware Password Prompt
1.1. (S) Notes About Implanted Adapter
(U) Please note the following:
o
(S//NF) Once an adapter has been implanted, preboot functionality of the device will be
lost. Currently, the only preboot functionality an Apple ethernet adapter serves is for a
machine to do a netboot.
o
(S//NF) An implanted adapter will function normally as an ethernet adapter once OSX is
booted.
o
(S//NF) It has been observed that when an EFI shell is loaded from an implanted adapter,
not all hard drive partitions are visible due to how early the code gets loaded. Note that if
a Linux distro is being loaded from the implanted adapter, Linux will initialize the hard
drive itself and all partitions will be visible to inspect or image.
SECRET//NOFORN
Sonic Screwdriver User’s Guide – Nov 2012 4
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8