Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
•
touch ..kjwefk/hfs99_open
•
Explanation: Since ‘touch’ is the executing process, we use a leading ‘..’ to ensure that the parent process (bash) and not the
current process (‘touch’) is elevated to elite status.
•
Hide any file or directory with the name asdfg
•
touch ..ijrwifowfe/asdfg.sparseimg_open
•
Make all instances of the process usbmond elite as soon as they launch
•
touch ..wwllksf/usbmond.machport_lock
LIMITATIONS / ISSUES
•
The kernel implant is not loaded on single user mode. Therefore, in single user mode files/directories, ports, and processes are
not hidden.
•
If a user were to mount the file system using a different OS, the rootkit will not hide associated files/directories
SECRET//NOFORN
Rev 07/08/2011 4