# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide

15 October, 2014

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
- 14
- 15

SECRET//NOFORN
Hive Engineering Development Guide Overview
Given these possibilities, there is generally no good way of knowing which environment may apply to a
Hive installation. At the time of this writing, the current version of Hive (2.5.2) uses the initial time
stamp of the .config file to govern the decision to self-delete. If the system clock changes significantly
from the time at which Hive is first executed, then Hive may remain in the system longer than desired
(the system clock gets set back from the time of original execution) or it may delete immediately (the
system clock gets set forward by more than the delete delay).
3.4 Proposed Algorithm
This algorithm was proposed as one possible way of dealing with changes in the system clock,
but was not implemented.
This self-delete algorithm attempts to deal with any aberrant behavior of the host's system clock. Ideally,
the system clock would be set by an NTP client, but many small router devices (e.g. MikroTik) may
never have NTP configured. In such cases, each reboot of the device sets the system clock back to epoch
time (00:00:00, January 1, 1970). And, even if NTP is configured, there is a period of time after reboot
and prior to network time synchronization when the system is running on epoch time. Consideration was
given to incorporating an NTP client that would be used to create accurate time stamps, but for this
revision of code it was thought to be too involved. Furthermore, if NTP is blocked by a firewall or other
network device, an alternative is still needed.
There are two pieces to the algorithm: one that tries to address the system clock, and the other that tracks
connection with the LP (beacon) or command post (trigger) using the configuration file modification
time. This algorithm is embedded in the check_timer function and is called by TriggerListen whenever
packets are available from the network to process.
3.4.1 Time Check
1. last_time = 0 [This is the initial condition.]
Set last_time to current time.
2. If current time > (last_time + CHECK_INTERVAL) AND (current time - last_time) ≤ MAX_TIME_DIFF
(1 minute), then the system time is OK.
If the time anomaly counter > 0, decrement it by 1, otherwise, check the file configuration time
Set last_time to current time.
3. If current time > (last_time + CHECK_INTERVAL) AND (current time - last_time) > MAX_TIME_DIFF,
then the system time changed.
Increment time anomaly counter.
Set last_time to current time.
4. If the current time < last_time, then the system time changed.
Increment time anomaly counter.
Set last_time to current time.
5. If the time anomaly counter > TIME_ANOMALY_LIMIT, then self delete.
SECRET//NOFORN//20391015 5

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
- 14
- 15