Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #13763861
DTO Logging
UNCLASSIFIED//FOUO
This page describes the usage and architecture for DTOData Transfer Object logging as used by the iOS team in MDB.
(U) Usage
(U) To run the tool:
./dto_log --classification "CLASSIFICATION" --source "Source" --scan "Name of Scan Tool" file1 file2 .. file3
(U) Running the tool without any options but including the files, the tool will prompt for each option. Running the tool without any files will cause a help page to show describing proper usage of the tool; the option --help will also display that message.
(U) Architecture
(U) The tool is composed of two parts: the git repository that holds a single log file, and the shell script that pulls the log and appends the new entry to it.
(U) The Git Repository
(U//FOUO) With the exception of looking into the log to see what/when/from where/ and by whom data was transfered into the classified network (DEVLAN), the repository should only be modified by the script. It will contain one main log file and any number of log archive files. At any point, an administrator can take the log file and push all the data in it into a timestamped back up of the log. This will help decrease the amount of effort involved in looking for some particular piece of information later.
(U) The Shell Script
(U//FOUO) Designed to be run on Macs, it is a bash script that pushes information about a data transfer into the log and updates it. The script is designed to clean up after itself and leave the user's workstation in the same state it was in. In the course of normal operation the script will:
- Gather the information about the transfer:
- Either have the information passed into the script by the user as command arguments,
- or prompt the user for any information.
- Check out the repository with the latest version of the log.
- Create a hash of every file being transfered
- Append the information to the log file
- Note: every line in the log should correspond to a single file being transfered
- Add the change to the commit and commit to the local repository before pushing to the remote
- Clean up all temporary files
UNCLASSIFIED//FOUO