Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20350112
Has default
gateway been
configured for
device
?
N
Y
Flytrap Power-Cycle
Do not
enable DGD
Enable DGD and
wait for first
Beacon time
Has default
gateway been
configured for
device
?
N
Y
Disable DGD
Poll DGD for
DHCP and ARP
discovered
default gateways
Add default gateway
entry to routing table
and cache in special
key in nvram
Has DHCP
technique found
a default gateway
?
Y
N
Has ARP
technique found
a default gateway
?
Y
Has DGD
cached a default
gateway in special
key in nvram
?
N
Y
Add default gateway
entry to routing table
Have
Internet
Connectivity
?
Y
Disable DGD
N
N
Remove
gateway
entry from
routing
table
and from
nvram
Figure 64: DGD Flowchart
When Mission Manager starts after a power-cycle, it determines if a default
gateway has been configured for the device, by checking the nvram settings for
the device, and by examining the routing table for a default gateway entry. If no
gateway is found, DGD is enabled; otherwise, it is disabled, and it is assumed that
the configured gateway is correct.
Once enabled, DGD begins collecting ARP and DHCP information that will lead
to the discovery of the default gateway’s IP address. Note that the discovery is
completely passive, and is done in the kernel.
When Mission Manager determines it is time to send the first Beacon after a
power-cycle, it checks again if a default gateway has been configured by the user
(in some cases it could be many days between Mission Manager starting and the
time to send the first Beacon). If none has been configured, it polls DGD to see if
it has discovered the default gateway IP either through DHCP or ARP techniques.
The DHCP technique is given preference. The discovered default gateway IP
address is then set as the default gateway in the routing table (using a system call
like “route add default gateway a.b.c.d”). This default gateway IP is also cached
in a special key in nvram. It is important to note that if the default gateway is
incorrect, Mission Manager will not be able to undo the default gateway until the
device is power-cycled (see next bullet).
141
SECRET//20350112

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh