# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide

15 October, 2014

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
- 15

SECRET//NOFORN
Self-Delete Hive Engineering Development Guide
The time anomaly counter gives time for anomalies to settle out before updating the configuration file. If
the time anomaly counter exceeds the TIME_ANOMALY_LIMIT, it is assumed that the time is too
unstable to be usable and self-delete is executed.
3.4.2 Configuration File Check
1. If (current time - file modification time) > delete delay,
If there were time anomalies detected, and the counter turns zero, update the file time.
If there were no time anomalies, self delete.
2. If 0 ≤ (current time - file modification time) < delete delay
Continue
3. If (current time - file modification time) < 0, then the system time changed.
If the time anomaly counter is zero, update the configuration file time stamp.
3.5 Suggested Testing Methodology
The following testing methodology is used to test the proper operation of self-delete only.
Test Preparation
Testing self-delete functionality requires that the implanted target host be receiving data so that
it loops through the code that listens for a trigger. The data need not be related to hive (i.e. it
need not be a trigger). An easy way to accomplish this is to constantly send echo requests to the
interface with an interval of 0.2 seconds or less. That is,
ping -i 0.2 192.168.1.1
where of course 192.168.1.1 is replaced with the address of the target host.
1. Determine the state of NTP on the device. If an NTP client is configured and enabled, disable it.
2. Verify that the /var/.config file does not exist. Install hived on the target host and execute. The
default self-deletion time is 60 days.
3. Note the time of the system clock; this is the initiation time.
4. The /var/.config file should appear with a file date corresponding to the system time at the time it
was written (which may be epoch time).
Test 1
5. Set the system clock back by more than the default delay (60 days) and verify that Hive
continues to execute.
Test 2
6. Set the system clock forward of the initiation time by 59 days and verify that Hive continues to
execute.
6 SECRET//NOFORN//20391015

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
- 15