WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide

15 October, 2014

- 1
- 2
…
- 6
- 7
- 8
- 9
- 10
…
- 14
- 15

SECRET//NOFORN
Network Resignaturing Hive Engineering Development Guide
2 Network Resignaturing
2.1 Overview
IOC/ECG's Advanced Forensic Division (AFD) performed an analysis of Hive version 2.5 network
communications to assess its likelihood of detection.The results of this analysis are found in document
AFD-2012-0973-2. In summary, AFD was able to create signatures for DNS, ICMP, and TFTP triggers;
found that the TCP and UDP triggers did not adhere to their respective protocol standards; and further
found that the TCP and UDP triggers each had consistent packet sizes.
To address these issues, EDG modified the ICMP, TCP, and UDP triggers in Hive 2.6. The DNS and
TFTP triggers were found to be problematic because each protocol is composed largely of text strings,
providing virtually no fields where coded trigger packages might be hidden. Consequently, these were
not addressed.
2.2 ICMP
Forensic analysts were able to discover and accurately describe the first six bytes of a common trigger
within the ICMP packets. That actual trigger in its entirety is twelve bytes long and has the following
format (Figure 1).
This trigger was obfuscated by a simple negation. The report, however, assumed that the first byte was
an XOR key for the remaining bytes in the key. As it turns out, the first byte was an opcode that was
never used in Hive. Because that opcode was always zero, it negated to 0xFF.
To resignature this common trigger, the same key format was used and the first byte was randomized
and then XORed with each of the remaining bytes. (Future implementations should probably use longer
keys of random data.) The trigger location within the ICMP packet (bytes 4 and 5 of the timestamp)
remains unchanged. The trigger is transmitted two bytes at a time in six successive ping packets.
2.3 Raw TCP and UDP
Forensic analysis of the raw TCP and UDP triggers was unable to extract a common signature for either
protocol, but did note that there were identical 9-packet sequences have byte lengths of 74-74-66-70-66-
466-66-66-54. While most of these lengths are typical of the protocol, what isn't typical is the
unchanging 466-byte length of the trigger packet. Analysis also noted that these triggers could raise
attention because they do not conform to their respective protocol specifications. However, no attempts
were made to address this issue, as substantial work would be requirred to conform to upper level
2 SECRET//NOFORN//20391015
Figure 1: Hive 2.6 Common Trigger Format

- 1
- 2
…
- 6
- 7
- 8
- 9
- 10
…
- 14
- 15