WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 27
- 28
- 29
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Appendix B: Release Notes
8 (U) Appendix B: Release Notes
For readability, this appendix is not portion marked,
but is classified SECRET//NOFORN in its entirety.
V2.9.1 (11/09/2015)
• Fixes a bug whereby a response failure to a DNS look-up causes Hive to stop beaconing.
• Adds support for AVTech Network Video Recorders (NVRs) that use the ARMv7 architecture
(older ARMv5 architectures are not supported).
V2.9 (07/01/2015)
• Adds a user-defined directory path for the .config and .log files to avoid read-only memory.
• Adds support for MikroTik 6.x.
V2.8.1 (03/03/2015)
• Fixes missing beacon data in MikroTik MIPS and x86 architectures.
V2.8 (02/02/2015)
• Updates the PolarSSL library used for network communications from version 0.14 to 1.1.8.
• Adds an AES encryption layer above SSL to the command and control channel used for
issuing commands between the command post and the implant. NOTE: The ILM client “shell
open” still uses the Twofish encryption algorithm exclusively; it does not use AES over SSL.
• Adds support for Ubiquiti routers. [CAVIOT: Tested only on Ubiquiti PicoStation M2-HP with
airOS 5.5.]
V2.7.1 (04/03/2014)
• Fixes a bug in the implant that may terminate execution due to a corrupted trigger payload.
V2.7 (03/10/2014)
• An ID key was added to prevent implants from being discovered by replaying a trigger to
selected hosts on a network. The key can be made unique for one implant or a set of
implants.
• Deprecates the architectural nomenclatures MIPSBE and MIPSLE in favor of the more
common MIPS and MIPSEL, respectively.
• Support for ICMP and DNS triggers has been removed, as these triggers now require
additional network overhead (packets) to cause an implant to trigger and, consequently,
increase the risk of discovery.
• More (unsupported) Windows code and references within the documentation have been
removed.
V2.6.2 (01/13/2014)
• Uses Polarssl Havege code to produce random numbers versus /dev/random or
/dev/urandom because at reboot, MikroTik devices exhibited similar random number
sequences. This resolves the issue of the LP seeing what it believes to be a TCP replay attack
for MikroTik devices by properly seeding the random number generator in the implant for all
architectures.
SECRET//NOFORN//20401109 29

- 1
- 2
…
- 27
- 28
- 29
- 30
- 31