Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
UNCLASSIFIED
Cherry Bomb Program Cherry Blossom Internal Test Procedures
Pass/Fail: the test passes if the mm logging indicates that the Flytrap would
attempt an Initial Beacon at the proper time, except the IB Traffic Requirement is
not met. At this point we are only concerned that the IB attempt would be made
at the proper time, not that the IB successfully occurs.
4.1.2 IB Traffic Requirement Test
Description: Tests IB Traffic Requirement functionality. Some context: the
Traffic Requirement feature of the Beacon has two parts – first it determines if
enough ambient traffic is passing through the Flytrap to attempt a beacon;
second, if enough traffic is passing through the device, it checks that the Flytrap
has internet connectivity before sending the Beacon. We need to test both
aspects of the Traffic Requirement
Setup: Connect the Flytrap WAN to a hub that is not connected to the internet
(i.e., this will test that even if enough ambient traffic is flowing through the device,
that a beacon will not be sent because there is no internet connectivity). Connect
the Server Computer to the hub. Assign the Flytrap’s WAN a static IP of, say,
10.1.1.1. Assign the Server Computer an IP of, say, 10.1.1.2. Start the web
server on the Server Computer, and be sure it has a link to a large download file
(say, 100 Megabytes).
Run: Connect the Client Computer to the Server Computer’s web server.
Continuing from the previous test, when mm logging indicates the next IB attempt
is nearing, begin the download of the large file from the Server Computer (which
should easily meet the Traffic Requirement).
Pass/Fail: the test passes if the mm logging indicates that the IB Traffic
Requirement has been met, and the Flytrap would attempt an IB at the proper
time, except the IB Internet Connection requirement is not met.
4.1.3 IB Fast/Slow Retry Test
Description: Tests IB Fast/Slow Retry functionality.
Setup: same as 4.1.2
Run: Continuing from the previous test, repeat download of large file from the
Server Computer if necessary to keep a continuous stream of network traffic that
would meet the Traffic Requirement.
Pass/Fail: the test passes if the mm logging indicates that the proper retry
intervals (both fast and slow) have been exhausted before checking IB Traffic
Requirement and Internet Connection requirements for an IB attempt. The
firmware specifies 3 addresses to IB to, so MissionManager should cycle through
these 3, pausing fast retry (4 seconds) between each. When the third address is
UNCLASSIFIED
16