# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DerStarke v1.4

- 1
- 2
- 3

Immediately hold down the option key after the system turns on5.
Select the item named "EFI Boot" from the boot selection screen6.
For MacBook Air 6,x and MacBook Pros 11,x, a special unlock driver will need to be
loaded
Installer will automatically detect and load the driver, and the following text
should appear:
"Tap power after shutdown, and wait 5 secs for reboot"◊
1.
Afer the machine reboot, the flash will be unlocked2.
Once again hold the option key and select the same "EFI Boot" option3.
7.
Installation will begin immediately: You should see "INSTALLING" XX% (Steps 1 of X)
and "SUCCESS"
8.
If the screen says FAILURE start over, and be sure that the power button is held for
10 seconds
9.
Once the installation is complete, the system will turn off, and a receipt may have
been recorded to the USB device
10.
If installing from a CD instead of a USB device, one more boot, while holding option
may be necessary to remove the CD
11.
CONFIG.PLIST PARAMETERS
TRITON OPTIONS
Target ID: A number used to identify and manage the implant's files and keys•
Listening Post: The URL of the CGI script to which the implant will beacon•
Minimum Beacon Interval: The minimum number of seconds between beacon attempts. Random
jitter may increase any given beacon interval by up to 33% of the specified value.
•
Check URLs: A list of HTTP URLS that will be used to verify Internet connectivity
before communication with an LP is attempted. A random URL is selected from this list
during each beacon. It must return HTTP 200 in order for a beacon to occur.
•
Network Injection Target: Processes into which the implant may inject it's networking
bundle. The process list is scanned in the order specified. The first process found is
used until it exits.
•
Trigger Paths: Paths that create trigger events when their contents are changed. User
directory-relative paths must be begin with a tilde and must be quoted. This parameter
is only relevant for Der Starke deployments.
•
Full Authentication: Indicates whether or not the implant should use a fully
authenticated SSL connection to the LP
•
Uninstall Alert (optional): A domain name that will be queried when the implant
uninstalls.
•
Uninstall Period (optional): The number of seconds the tool waits for a successful
beacon before deciding to uninstall. The start of the wait time is either the first
time Triton is injected into OSX, or the last successful beacon.
•
EFI OPTIONS
Hibernation Period: The number of seconds after installation time EFI delays injecting
into the operating system. This check is only done at boot time. If Hibernation Period
is set for 30 days (2592000 sec), Triton will be injected into OSX after 30 days from
installation on the next reboot. If this option is set and NVRAM happens to get
cleared, installation time will be assumed at the moment NVRAM was cleared, and a full
hibernation cycle will take place before the next injection. Note that Hibernation
Period and Hibernation Date cannot both be set.
•
Hibernation Date: The UTC date after which Triton will be injected into
diskarbitrationd during boot. Note that Hibernation Period and Hibernation Date cannot
both be set.
•
Uninstall Date: The UTC date after which a system reboot will cause the implant to
uninstall or deactivate
•
Warning Threshold: The number of times the Triton portion of the implant can fail load
before the EFI portion uninstalls. Booting into an unsupported operating system and
kernel panics increment the warning count
•
Patch Firmware: A flag indicating whether or not the firmware should be unlocked to
allow the implant to be securely deleted during an uninstalled. If set false, the
implant will only deactive during an uninstall. If set true, this can add 10-45 secs
to installation time depending on laptop.
•
Make Receipt File: A flag indicating whether or not an installation receipt should be
generated.
•
Uninstall if NVRAM Cleared: A flag indicating whether or not the implant should
uninstall if the system's NVRAM is cleared. NVRAM is not cleared under normal
circumstances, so it's safe to leave this as, "NO"
•
Patch PEI for update persistence: A flag indicating whether or not to reinject the
implant during an OSX firmware update. This option will write two extra implants to
firmware and can add 15-30 secs of installation time.
•
SECRET//NOFORN

- 1
- 2
- 3