Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #2064619
Development Tradecraft DOs and DON'Ts
SECRET//NOFORN
General (e.g. all PE/Mach-O/ELF or other binary files)
| Directive | Rationale |
|---|---|
DO remove all data that demonstrates CIA, USG, or its witting partner companies involvement in the creation or use of the binary/tool/etc. |
Attribution of binary/tool/etc by an adversary can cause irreversible impacts to past, present and future USGUS Government operations and equities. |
| DO remove all data that contains CIA cover terms or operational names. | Attribution of binary/tool/etc by an adversary can cause irreversible impacts to past, present and future USGUS Government operations and equities. |
| DO remove all "dirty words" (see dirty word list – TBD) | Dirty words, such as hacker terms, may cause unwarranted scrutiny of the binary file in question. |
|
DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory and only as they are needed. When a previously de-obfuscated value is no longer needed, it should be wiped from memory. |
String data and/or configuration data is useful to analysts and |
| DO NOT decrypt or de-obfuscate all string data or configuration data immediately upon execution. | Raises the difficulty for automated dynamic analysis of the binary to find sensitive data. |
| DO utilize a deployment-time unique key for obfuscation/de-obfuscation of sensitive strings and configuration data. | Raises the difficulty for analysis of multiple deployments of the same tool. |
Networking
Disk I/O
Encryption
SECRET//NOFORN