Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #13763861
DTO Logging
UNCLASSIFIED//FOUO
This page describes the usage and architecture for DTOData Transfer Object logging as used by the iOS team in MDB.
(U) Project Location
(U) To check out the code, run:
git clone https://stash.devlan.net/scm/dto/dto_logger
(U) The project can be viewed at: https://stash.devlan.net/projects/DTO/repos/dto_logger/browse
(U) Usage
(U) To run the tool:
./dto_log --classification "CLASSIFICATION" --source "Source" --scan "Name of Scan Tool" --message "Commit message" file1 file2 .. file3
(U) Running the tool without any options but including the files, the tool will prompt for each option. Running the tool without any files will cause a help page to show describing proper usage of the tool; the option --help will also display that message. Note that any of the options can be abbreviated with their first letter (t in the case for scan).
(U) Architecture
(U) The tool is composed of two parts: the git repository that holds a single log file, and the shell script that pulls the log and appends the new entry to it.
(U) The Git Repository
(U//FOUO) With the exception of looking into the log to see what/when/from where/ and by whom data was transfered into the classified network (DEVLAN), the repository should only be modified by the script. It will contain one main log file and any number of log archive files. At any point, an administrator can take the log file and push all the data in it into a timestamped back up of the log. This will help decrease the amount of effort involved in looking for some particular piece of information later. The current log file must be named log.txt.
(U) The log file contains comma separated values. A single row looks like the following:
date, user, classification, source, scan tool, file name, file hash
(U) This repository can be viewed via the web at https://stash.devlan.net/projects/DTO/repos/dto_log/browse.
(U) The Shell Script
(U//FOUO) Designed to be run on Macs, it is a bash script that pushes information about a data transfer into the log and updates it. The script is designed to clean up after itself and leave the user's workstation in the same state it was in. In the course of normal operation the script will:
- Gather the information about the transfer:
- Either have the information passed into the script by the user as command arguments,
- or prompt the user for any information.
- Check out the repository with the latest version of the log.
- Create a hash of every file being transfered
- Append the information to the log file
- Note: every line in the log should correspond to a single file being transfered
- Add the change to the commit and commit to the local repository before pushing to the remote
- Clean up all temporary files
(U) Although currently the script only needs to run on Mac, it is written in a manner that should ease porting issues should another team want to use it on Windows or Linux.
UNCLASSIFIED//FOUO