Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #524297

Pterodactyl

Feature Progress Matrix

Feature	GUMSTIX	RASPBERRY PI	COTTON CANDY
Operating System	Linux (Yocto)		Linux (Android) Linux (Ubuntu)
Cross-compiler Suite	included in Ubuntu (gnueabi)	included in Ubuntu (gnueabi-hf)	included in Ubuntu (gnueabi)
USB support for external floppy	VERIFIED	verified	verified
Copy script runs successfully	verified	verified	verified
Systemd Service script	verified	verified	verified
External hardware support	GPIO	GPIO
Visual Indicator (LEDLight Emitting Diode)	verified	verified	verified
Haptic Indicator (PWM Thumper)	UNverified	verified	UNverified
On-SD card Storage	verified

Tentative EDBEmbedded Devices Branch Development Schedule

1 Jul 2013- Internal demonstration of 3 devices with pros/cons/observations
1. Candidates
  1. Gumstix
    1. Pros
      1. Form Factor very good for concealment.
    2. Cons
      1. Difficult learning curve associated with initial exposure for developers.
  2. - Raspberry Pi
    1. Pros
      1. Allowed quick prototyping of scripts with demonstration to customer.
      2. Easy to cross compile code via Ubuntu.
      3. Several GPIO ports permit use of thumper.
      4. LED control is not difficult.
    2. Cons
      1. Size and form factor not good for concealment.
      2. Customized udev rules for hub device are not well understood.
  3. - Cotton Candy
    1. Pros
      1. Internal Operating System Choices
        
        Android
        
        Ubuntu
    2. Observations
      1. External host Operating Systems (SC2 connection for uploads and updates needs to be worked/resolved to ensure no security violations occur).
        
        Mac (Works as advertised for both Android and Ubuntu Cotton Candy Operating Systems)
        
        Linux (Has not worked using Ubuntu 10, 11, or 12 CDCompact Disk Installs).
        
        Windows (Has not worked using internal Development Install Disk).
      2. Device sometimes quits unexpectedly. 1 Cotton Candy's micro USBUniversal Serial Bus connection was broken during development.
      3. Item when in use becomes fairly hot relative to human touch.
      4. Compilation
        
        Internal compiler with vi and make files creates and builds a executable "Hello World" C program.
        
        Cross Compilers (Not tested yet)
2. USB Drives
  1. TODO: Consider how to build our own drivers for new devices (cameras, external LEDs, ...) since most if not all embedded computers have these interfaces.
  2. Consider using IPADs. IPhones, and Androids as usb devices.
  3. User #77500 required Face Dancer Cards for IOSApple operating system for small devices exploitation (15 Face Dancer cards ordered via EIB(Branch) on 8 Jul 2013).
3. Need to measure power consumption.
4. Consider supply chain approach where the minicomputer is installed within the floppy drive.
8 Jul 2013- Requirements List used for evaluation
1. Requirements:
  1. Copy Floppy Disks to SD card on small miniature computer's SD card
    1. dd
      1. Raspberry Pi (Verified)
      2. Cotton Candy (Verified)
  2. Operator Feedback mechanisms
    1. Visual Indicators
      1. LEDs
        
        Raspberry Pi (Verified)
        
        Cotton Candy (Verified)
        
        Within the sys/class/leds directory are the following directories:
        
        fxi-ccandy:blue:
        
        fxi-ccandy:green:net
        
        fxi-ccandy:green:power
        
        fxi-ccandy:orange:net
        
        fxi-ccandy:red:
        
        And within each of these directories is a brightness file. Set it to 0 to shut off the led. Set it to nonzero to turn on the led.
        
        Examples:
        
        To shut off all LEDs use the following file- turnAllLedsOff.bsh
        
        To turn off all LEDS and then cycle through each one and turn them on for 2 seconds each, use the following file- flashLeds.bsh
    2. Touch/Feel Indicators
      1. Thumper (Pulse width modulation)
        
        Raspberry Pi (Verified)
        
        Cotton Candy (Not Verified)
    3. Sound/Audio Indicators
      1. Floppy Disk Drive provides some sound depending on the model/type of floppy disk drive.
  3. On Disk Encryption/Decryption
  4. Compression
    1. zlib (Raspberry Pi)
    2. gzip (Cotton Candy)
    3. Others
  5. Daemons/service for all 3 candidates to copy floppy disk to their internal SD card
    1. Systemd/systemctl
      1. Raspberry Pi (Verified)
      2. Cotton Candy (Not Verified)
    2. Scripts
      1. Raspberry Pi (Verified)
      2. Cotton Candy (Verified)
  6. Copy Time estimates:
    1. Raspberry Pi (Verified at 1 minute +/- 5 seconds per floppy disk)
    2. Cotton Candy (Verified at 1 minute +/- 5 seconds per floppy disk)
  7. Need to measure power requirements.
11 Jul 2013- User #77499- Code Review (Time TBD)
1. Systemd scripts- (User #77499)
2. C Source Code- (User #77499)
15 Jul 2013- Architecture Selection
29 Jul 2013- Final Package Selection

Gumstix Overo EarthSTORM + Pinto-TH Breakout Board

Using User #77501's unsupported Linux 3.5 image (sakoman-usb-gadget-multi-getty-image.tar.bz2),
- includes USBUniversal Serial Bus multi-gadget kernel module (g_multi.ko), which contains:
  - mass storage (g_mass_storage.ko)
  - serial console (g_serial.ko)
  - ethernet (g_ether.ko)

uses systemd for process/service management
- /etc/systemd/system/*.target.wants/ – stores links to systemd configure files for services that are enabled
- /lib/systemd/system – stores systemd configure files for all services
- /usr/lib/systemd/scripts – stores support scripts for systemd services

[Unit]
Description=Benign Service Description
After=syslog.target
 
[Service]
Type=simple
ExecStart=/path/to/script.sh
Restart=always
 
[Install]
WantedBy=multi-user.target

$ sudo systemctl enable imaged.service  # <--- creates symlinks to start imaged.service at bootup
					# equivalent to:
					#   ln -sf /lib/systemd/system/imaged.service /etc/systemd/system/basic.target.wants/imaged.service
 
$ sudo systemctl poweroff               # <--- causes system to shut down cleanly and power off

PCB30011.pdf

Building a Gumstix SD Card

Requires: factory/mlo-updated, factory/u-boot, sakoman/uImage, sakoman/images/(root_filesystem_tarball)

Controlling GPIO from User Space

# setup 
$ echo 146 > /sys/class/gpio/export
$ echo out > /sys/class/gpio/gpio146/direction
# echo to value: 1 for on, 0 for off.
$ echo 1 > /sys/class/gpio/gpio146/value

Pterodactyl Requirements

('jiraissues' missing)

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

Pterodactyl

Feature Progress Matrix

Tentative EDBEmbedded Devices Branch Development Schedule

Gumstix Overo EarthSTORM + Pinto-TH Breakout Board

Building a Gumstix SD Card

Controlling GPIO from User Space

e-Highlighter