Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

touch ..kjwefk/hfs99_open
Explanation: Since ‘touch’ is the executing process, we use a leading ‘..’ to ensure that the parent process (bash) and not the
current process (‘touch’) is elevated to elite status.
Hide any file or directory with the name asdfg
touch ..ijrwifowfe/asdfg.sparseimg_open
Make all instances of the process usbmond elite as soon as they launch
touch ..wwllksf/usbmond.machport_lock
LIMITATIONS / ISSUES
The kernel implant is not loaded on single user mode. Therefore, in single user mode files/directories, ports, and processes are
not hidden.
If a user were to mount the file system using a different OS, the rootkit will not hide associated files/directories
SECRET//NOFORN
Rev 07/08/2011 4

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh