# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide

15 October, 2014

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15

SECRET//NOFORN
Hive Engineering Development Guide Overview
Test 3
7. Set the system clock forward of the initiation time by 61 days and verify that Hive terminates
execution and leaves a .log file in the /var directory that contains a time stamp corresponding to
the time of termination.
8. Reinstall Hive, removing the .config and .log files from /var.
9. Execute Hive using a delete delay of 3 minutes by adding “-s 180” to the execution options
when Hive is started.
Test 4
10. Verify that the initiation time indicated by the last modification time on the /var/.config file
matches the current system time.
Test 5
11. Verify that Hive executes for three minutes and then self-deletes, leaving behind the .config file
and a .log file containing a time stamp corresponding to the time of termination and a matching
file modification time.
Test 6
Test 6 is designed only for testing hive on a device that has a system clock that returns to
epoch time (00:00, January 1, 1970, or there abouts) upon reboot and that also uses NTP to
set the system clock.
12. Reinstall Hive, removing the .config and .log files from /var.
13. Install a startup script to make Hive execution persist across reboots. Here is a sample startup
script that can be used with a MikroTik router. Place it in /etc/rc.d/run.d/S10hived for example.
#!/bin/bash
if [ -x /path/to/hived/hived ]; then
/path/to/hived/hived
fi
14. Configure and enable the host's NTP client so that it will connect to a server that has a valid time.
15. Verify that the host synchronizes properly with the time server.
16. Reboot the device and verify that the host clock resets to epoch time and then resynchronizes to
the NTP server's time after a short period.
17. Execute Hive, allowing it to run for 3 minutes. Verify that, after the 3 minutes, it is still running.
18. Reboot the host and verify that Hive restarts and continues to execute after the host's time is
updated by NTP.
SECRET//NOFORN//20391015 7

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15