Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #3375506
Caterpillar
Caterpillar Design
Requirements
Refer to Caterpillar v1.0 User Requirements Document (URD) IMIS: 2014-0638 Revision K January 30, 2014.
Use cases
Use Case 0: Operator exfiltrates a file.
Use Case 1: Operator exfiltrates arbitrary bytes of a file.
Use Case 2: Operator exfiltrates a glob.
Use Case 3: Operator resumes an aborted exfiltration.
Public interfaces
Low-side client
WinShell interface
TBD.
ICE interface
TBD.
High-side server
TBD.
Runtime parameters
Low-side client
A resource will convey runtime parameters.
| Name | Type | Description | Default |
|---|---|---|---|
| subject_filename | String | Fully qualified filename with globbing | C:\data.txt |
| caterpillar_chunksize | Integer | Outer Caterpillar subject chunk size (B) | 1045876 (1 MB) |
| exfiltration_rate | Integer | Bits per second | 1045876 (1 Mbps) |
| state_filename | String | Fully qualified filename to persist state | C:\state.txt |
| instance_identifier | Integer | Deconflicts concurrent sessions | 0 |
| begin_index | LongLong | Subject begin offset (modulo filesize, inclusive, B) | 0 |
| end_index | LongLong | Subject end offset (modulo filesize, inclusive, B) | -1 |
| destination_ip | String | Destination IP | 192.168.100.100 |
| ticks_per_packet | Integer | Amount to increment RTP timestamp | 1000 |
High-side server
TBD.
Exfiltration algorithm
0. Determine if this is a new mission or a resume.
1. If new mission, create an entry in the state file.
2. Open UDPUser Datagram Protocol socket to destination_ip.
3. Generate file/task metadata.
4. Prepend file/task metadata to subject file.
5. For each untransmitted chunk in enhanced subject file:
5.0. Generate chunk reassembly metadata.
5.1. Prepend chunk reassembly metadata to chunk.
5.2. Raptor the chunk, receiving one or more buffers in return.
5.3. For each buffer:
5.3.0. Generate packet reassembly data.
5.3.1. Prepend packet reassembly data to buffer.
5.3.2. Generate RTP header.
5.3.3. Prepend RTP header to enhanced buffer.
5.3.4. Determine actual exfiltration rate.
5.3.5. Pause until actual falls below provisioned exfiltration rate.
5.3.6. Send RTP packet via UDPUser Datagram Protocol socket.
5.4. Update entry in state file.
Resume algorithm
0. Search the state file for incomplete entries.
1. For each incomplete entry:
1.0. Run exfiltration algorithm.
Packet format
The Caterpillar low-side client will prepare a packet comprising an RTP header, Packet reassembly metadata and Raptored Chunk reassembly metadata, File/task metadata and subject payload.
The purpose of the RTP encapsulation is deception. We use 53 for the payload type because it is in the middle of the longest series of unassigned values. The complete list is: [20, 24], 27, 29, 30, [35, 71] and [77, 95].
Basic strategy
given SUBJECT_FILE
ENHANCED_SUBJECT_FILE = FILE_TASK_METADATA(SUBJECT_FILE) + SUBJECT_FILE
CHUNKS = CHUNK(ENHANCED_SUBJECT_FILE)
ENHANCED_CHUNKS[i] = CHUNK_REASSEMBLY_DATA(CHUNKS[i]) + CHUNKS[i]
SUB_CHUNKS[i] = RAPTOR(ENHANCED_CHUNKS[i])
ENHANCED_SUB_CHUNKS[i][j] = PACKET_REASSEMBLY_DATA(SUB_CHUNKS[i][j]) + SUB_CHUNKS[i][j]
COVERED_SUB_CHUNKS[i][j] = RTP_HEADER + ENHANCED_SUB_CHUNKS[i][j]
| subject file | ||||||||||||||
| file/task metadata | subject file | |||||||||||||
| chunk 0 | chunk k | |||||||||||||
| chunk 0 reassembly data | chunk 0 | chunk k reassembly data | chunk k | |||||||||||
| subchunk 00 | subchunk 0m | subchunk k0 | subchunk km | |||||||||||
| subchunk 00 packet reassembly data | subchunk 00 | subchunk 0m packet reassembly data | subchunk 0m | subchunk k0 packet reassembly data | subchunk k0 | subchunk km packet reassembly data | subchunk km | |||||||
| rtp header | subchunk 00 packet reassembly data | subchunk 00 | ... | rtp header | subchunk 0m packet reassembly data | subchunk 0m | ... | rtp header | subchunk k0 packet reassembly data | subchunk k0 | ... | rtp header | subchunk km packet reassembly data | subchunk km |
| Offset (b) | Length (b) | Name | Value |
|---|---|---|---|
| 0 | 2 | Version | 2 |
| 2 | 1 | Padding | 0 |
| 3 | 1 | Extension header present | 0 |
| 4 | 4 | Contributing source (CSRC) count | 0 |
| 8 | 1 | Marker | 0 |
| 9 | 7 | Payload type | 53 |
| 16 | 16 | Sequence number | 1-up counter |
| 32 | 32 | Timestamp | ticks_per_packet-up counter |
| 64 | 32 | Synchronization source (SSRC) | 0x00000000 |
| 96 | CSRC count * 32 | CSRC list | N/A |
| 96 + CSRC count * 32 | variable | Extension header | N/A |
The purpose of the packet reassembly metadata is to document the chunk reassembly. File ID is a hash of the file name.
| Offset (B) | Length (B) | Name |
|---|---|---|
| 0 | 4 | Instance ID |
| 4 | 4 | File ID |
| 8 | 4 | Chunk ID |
The purpose of the chunk reassembly metadata is to document the file reassembly.
| Offset (B) | Length (B) | Name |
|---|---|---|
| 0 | 4 | Instance ID |
| 4 | 4 | File ID |
| 8 | 8 | File size |
| 16 | 8 | Chunk begin index |
| 24 | 8 | Chunk end index |
The purpose of the file/task metadata is to document the operation.
| Offset (B) | Length (B) | Name |
|---|---|---|
| 0 | 4 | Instance ID |
| 4 | 4 | Exfiltration time (s since midnight January 1, 1970) |
| 8 | 8 | File begin index |
| 16 | 8 | File end index |
| 24 | variable | File name |
Globbing
Globbing is pattern-matching based on wildcard characters; it is not a regular expression capability. Globbing operators are not standardized: Caterpillar will use the WinAPI implementation of globbing, specifically calls to FindFirstFile() and FileNextFile().
Obfuscating the metadata
We considered symmetric-key XOR, RC4 and AESAdvanced Encryption Standard techniques for obfuscating the metadata. The first iteration will use XOR with an eight bit symmetric key, and we can upgrade to a stronger mechanism in a later iteration. This capability cannot be considered encryption because the key is present in the low-side client.