Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
Cytolysis-1h HG v3.1.6 Delivery
HG v3.1.6 was delivered for Cytolysis on 1/12/16 for SUP720. Testing scope will include ACE, SMITE and Tunnel.
CONOP will be:
- Hop through 3 flux nodes - 1 internet, 1 osmo subnet, 1 admin mgmt subnet - and IACInternational Access Code attack VLANVirtual Local Area Network 1 IP of target - XXX.XXX.X.XXX (TOPWAY-NET[CN])
- Trigger port will be UDPUser Datagram Protocol 161, host to impersonate will be explicitly set to a host not on VLANVirtual Local Area Network 10 or VLANVirtual Local Area Network 2
- Establish CTCounter Terrorism session over HTTPSHypertext Transfer Protocol Secure back through flux node 4
- Use ACEApplication Control Engine (Module) commands to verify state of the device
- Use socket get_arp_survey_data and output of "show ip nat trans" to survey traffic from VLANVirtual Local Area Network 19
- SMITE hosts on target customer network - VLANVirtual Local Area Network 19
- Use Tunnel to appear as if Operator is on VLANVirtual Local Area Network other than VLANVirtual Local Area Network 19 or VLANVirtual Local Area Network 2, and from there, nmap VLANVirtual Local Area Network 19.
Testing Summary
- Note in test report that module 2 is in state PwrDown and should be verified before proceeding
- Trigger packets that go through the target due to HG trigger sequence mis match will be caught and logged by outbound customer ACLs potentially - we will trigger to IP of device on port UDPUser Datagram Protocol 161
- Comms packets are SSLv3 - need to consider if this is noticeable on this network
- Hardware difference between test device and target - daughter card on 4 port 10G line card. This hardware difference has been accepted.