WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Infrastructure Installation and Configuration Guide

11 November, 2012

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 17
- 18

SECRET//NOFORN
Hive Infrastructure Configuration Guide (U) Overview
1 (U) Overview
(S//NF) Pictured below is an example of the Hive operating environment.
(S//NF) Beacons from an implanted host enter a commercial VPS server that has been configured as a
redirector for the given domain (domainA.com or domainB.com). Traffic for these domains is redirected
into a VPN tunnel to a Blot proxy. Each VPS redirector modifies the destination port number to one that
corresponds to the domain that it is servicing. So, for example, beacons and other web traffic entering
the VPS redirector servicing domain A would have port 80 traffic changed to port 8001 before being sent
on to the Blot proxy. The Blot proxy looks at the redirected traffic and, if it finds a valid beacon,
forwards it to the tool handler (Honeycomb in this case); all other traffic is forwarded to the cover
server. The cover server uses the destination port number to determine what web pages it will display,
domain A or domain B.
(S//NF) Each section below covers the installation and configuration of the key components making up
this infrastructure, starting with the cover server and working out to the VPS redirectors. All servers are
assumed to be running a CentOS distribution of Linux.
November 2012 SECRET//NOFORN//20371105 1

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 17
- 18