# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - Test Plan Procedures

26 January, 2009

- 1
- 2
- 3
- 4
- 5
- 6
- 7

SECRET//20340105
5. Download the test suite (testSuite v1.1) from the DarkMatter page of the UDB
Wiki site and unpack it.
(S) Testing steps
Step Action Expected Result Req
1.
Run DM_GenericTest.sh (test script) test script
to validate that the tool has not been installed.
DarkSeaSkies should not be installed
even though it is loaded to the EFI
because the activation date has not
been reached.
1, 2,
5
2. Advance the clock to a date after 3/22/2009
which is the activation date and then reboot the
machine.
After the reboot the tool will install
itself.
1, 2,
5
3. Run the test script to verify that the tool is
installed and that it has a status of 3 and a count
of 1.
A status of 3 shows that the tool is
installed and the count of 1 shows
that this is the first time the system
has been booted since its installation.
1, 2,
5
7.2 (S) Test 2 – Beaconing, File Transfer and Execution
*Note: each of the below listed steps were done separately for Safari and for Firefox and
the results were the same.
(U) This test procedure tests requirements 6.
(S) Setup steps:.
1. Run the test script to ensure that the tool is installed and running.
2. Ensure that the target machine’s clock is past the start date that was placed in the
executable (i.e.…3/22/2009).
(S) Testing steps:
Step Action Expected Result Req
1.
Open the browser and begin surfing to a web
page to activate the tool. Verify that each of the
below occur.
a. Beaconing to the LP.
b. Execute a command from the LP.
c. Place a files on the target and collect a files
from the target.
d. Execute a file on the target.
e. Delay until browser activity.
Once the browser is opened and
surfing begins the Macbook Air
should beacon out to the LP and then
receive its instructions which are to
execute a command from the LP, get
and put files, execute a command that
resides on the target.
*Note: Files collected were MD5ed to
validate that they were the same.
6
7.3 (S) Test 3 – Removal after pre-configured time
(U) This test procedure tests requirement 3.
(S) Setup Steps:
1. Run the test script to ensure that the tool is installed and running.
2. Ensure that the target machine’s clock is past the start date that was placed in the
executable (ie…3/22/2009).
SECRET//20340105
3

- 1
- 2
- 3
- 4
- 5
- 6
- 7