Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20350112
Has Initial
Beacon Been Sent
Successfully
?
Y
N
Retrieve from non-volatile memory:
Power-Cycle Wait
Periodic Beacon Traffic Requirement
Periodic Beacon Traffic Timeout
Sleep for
Power-Cycle Wait
updating powered-on time
periodically in non-volatile memory
Wait until the Flytrap has been
powered-on for Initial Beacon Interval,
updating powered-on time
periodically in non-volatile memory
Traffic
Requirement Met
OR Traffic Timeout
Exceeded?
Short Sleep
N
Y
Attempt Beacon
Mission
Retrieved?
N
Execute Mission and write Periodic Beacon
Configuration to non-volatile memory
Y
Time
for next Periodic
Beacon?
Y
Initial Beacon or
Periodic/Power-Cycle Beacon
Retry Logic
Tumbleweed
List
Figure 60: Beacon Logic
(S) It should be noted that the Beacon scheduling mechanism periodically writes elapsed
time information to non-volatile memory to keep track of the approximate total time the
Flytrap has been powered-on. Furthermore, Flytraps do not necessarily include time
synchronization clients, so Initial Beacon scheduling time is relative to the amount of
time that a Flytrap has been powered-on. For example, say the device has been implanted
with CB firmware that has been configured to wait 72 hours before sending the Initial
Beacon (with Traffic Requirement = NONE). The Initial Beacon will be sent once the
device has been powered-on for 72 hours, which could take longer than 72 hours, for
example, if the device is powered-down each night.
(S) The “Initial Beacon or Periodic/Power-Cycle Beacon Retry Logic” box needs further
clarification. If no Mission is received in response to a Beacon attempt, the Flytrap will
follow Beacon retry logic. The retry logic is slightly different for the Initial Beacon and
for a Periodic or Power-Cycle Beacon.
(S) For the Initial Beacon, the following firmware image parameters are used in the retry
logic (see 15.3): Initial Beacon “Fast Retry Pause”, “Number of Fast Retries”, and “Slow
Retry Pause”. The PoP List is composed of the PoP addresses stored in the firmware
image (see 15.3). A “fast retry” is attempted “Number of Fast Retries” times, with each
retry pausing “Fast Retry Pause” before cycling to the next entry in the PoP List. After
132
SECRET//20350112

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh