WikiLeaks - Vault 7: Projects

# Vault 7: Projects

### Dark Matter

# DarkSeaSkies v1.0 - TDR

26 January, 2009

- 1
- 2
- 3
- 4
- 5
- 6
- 7
…
- 11
- 12

IOC ERB: 26
Jan 2009
5
SECRET//NOFORN
SECRET//NOFORN
Capabilities and Limitations

Supported Target:

MacBook Air 1,1

Mac OSX 10.5.2-6

MBA11.00BB.B03

Requires physical access for installation

Persists in EFI firmware (cannot persist over firmware update)

Delayed operation

Self-delete to avoid forensic examination

Delivers SeaPea: Mac OSX kernel-space implant

Provides privileged execution

Hides user-space implants

Delivers NightSkies: Mac OSX user-space implant

Beacon + Command & Control

Masquerades as standard HTTP protocol for communications

Uses XXTEA block encryption to provide secure communications

Hidden & encrypted configuration stored in NVRAM variable

- 1
- 2
- 3
- 4
- 5
- 6
- 7
…
- 11
- 12