Engineering Development Group

Transcription

1 Engineering Develpment Grup DarkSeaSkies 1.0 User Manual Rev. New 26 January 2009 CL BY: CL REASON: 1.4(c) DECL ON: DRV FROM: COL S-06

2 Change Lg Dc Dc Rev Change Descriptin Reference Authrity/ Rev Date By Apprval Date New 11/05/2008 XXX Initial Release

3 Table f Cntents 1. SCOPE SYSTEM OVERVIEW AND DESCRIPTION ASSUMPTIONS AND CONSTRAINTS CONVENTIONS (NOT APPLICABLE) APPLICABLE DOCUMENTS SYSTEM DESCRIPTION TECHNICAL REFERENCES SYSTEM CONCEPTS AND CAPABILITIES PREREQUISITES EQUIPMENT FAMILIARIZATION OPERATION CONFIGURATION INSTALLATION AND SETUP INITIATING A SESSION STOPPING AND SUSPENDING WORK CONTINGENCIES AND ALTERNATE STATES AND MODES OF OPERATION ASSISTANCE AND PROBLEM REPORTING ADDITIONAL OPERATIONAL PROCEDURES (NOT APPLICABLE) SYSTEM BACKUP AND RESTORE (NOT APPLICABLE) TROUBLESHOOTING ERROR MESSAGES NOTES ACRONYMS/ABBREVIATIONS DEFINITIONS...6 List f Tables TABLE ACRONYMS/ABBREVIATIONS...6 TABLE DEFINITIONS...6

4 1. Scpe This dcument establishes the User Manual fr DarkSeaSkies System Overview and Descriptin DarkSeaSkies is an implant that persists in the EFI firmware f an Apple MacBk Air cmputer, installs a Mac OSX 10.5 kernel-space implant and executes a user-space implant. DarkSeaSkies cnsists f three different tls: 1. DarkMatter: An EFI driver that persists in firmware and installs the ther tw tls. 2. SeaPea: A Mac OSX kernel-space implant that executes, and prvides stealth and privilege t user-space implants. 3. NightSkies: A Mac OSX user-space implant that beacns t a listening pst and prvides cmmand and cntrl. This dcument describes the technical details DarkMatter, and that f SeaPea and NightSkies nly where they differ frm their dcumented user manuals. Refer t SeaPea User Manual fr further infrmatin n SeaPea. Refer t NightSkies User Guide fr further infrmatin n NightSkies. 1.2 Assumptins and Cnstraints It is assumed that the target system is a MacBk Air versin 1,1 running Mac OSX x with firmware versin MBA B03. It is assumed that an peratr r asset has ne-time physical access t the target system and can bt the target system t an external flash drive. A cnstraint is that the DarkSeaSkies will nt persist in the event f a firmware update. 1.3 Cnventins (Nt Applicable) 2. Applicable Dcuments The fllwing dcuments, f the exact issue shwn, frm a part f this dcument t the extent specified herein. In the event f a cnflict between the dcuments referenced herein and the cntents f this dcument, the cntents f this dcument will be cnsidered binding. The fllwing dcuments may be fund at S:\DO\IOC\EDG ALL\EDG AE\Prjects\: SeaPea User Manual, Rev. 2.0, Nvember 2008 NightSkies User Guide, Rev. 1.2, Nvember System Descriptin 3.1 Technical References 1

5 The fllwing items are either cnfigured r randmly generated fr each deplyment. Therefre the values are delivered as files rather than updated in this dcument fr each deplyment. DarkSeaSkies Installer EFI file: Name: see file installer.name. GUID: see file installer.guid. DarkSeaSkies Implant: The EFI implant name is in the file lader.name. The GUID is in the file lader.guid. The XXTEA key used t encrypt bth NightSkies and SeaPea is in the file xxtea.key. NVRAM Variables: The NVRAM variables are bfuscated by using existing variable names and generating new randm GUIDs fr each delivery. We will refer t them as the cnceptual italicized names (i.e. Status) in this dcumentatin; hwever, their true names and GUIDs n the target are dcumented belw. Status indicates the status f the paylad frm the previus bt. The name f this variable is SystemAudiVlume. The GUID f this variable is in the file status.guid. Status has the fllwing values. \0 indicates an unknwn status, fr example the first bt after install 0 indicates that the user-space paylad has been drpped 1 is reserved fr future use 2 indicates that NightSkies has failed t execute prperly. 3 indicates that the user-space paylad executed successfully 4 indicates that the user-space paylad encuntered an errr cnditin 5 indicates that DarkSeaSkies shuld uninstall itself and its paylad Any ther value is equivalent t 5. Cunt maintains a cunter used t track the number f cautius bts. A cautius bt is defined fully belw. If Cunt des nt exist then it is assumed t be zer. The name f this variable is in the file warning_cunt.name. The GUID f this variable is in the file warning_cunt.guid. Limit indicates the value f Cunt at which DarkSeaSkies will uninstall itself and its paylad. If Limit des nt exist then a pre-cnfigured value will be used. The name f this variable is in the file warning_threshld.name. The GUID f this variable is in the file warning_threshld.guid. The default value f Limit is in the file warning_threshld.value. 2

6 Cnfiguratin is the NVRAM variable that NightSkies uses t stre its cnfiguratin. The name f this variable is in the file cnfig.name. The GUID f this variable is in the file cnfig.guid. The default cnfiguratin is described in the file cnfig.plist. 3.2 System Cncepts and Capabilities DarkSeaSkies is an EFI implanted beacn (NightSkies) that is run in crdinatin with the SeaPea rt-kit. All files, netwrk cnnectins, and prcesses assciated with the NightSkies beacn are hidden by the SeaPea rt-kit. The beacn and rt-kit remain persistent acrss OS rebts, upgrades, and reinstalls. All files assciated with DarkSeaSkies remain ff disk with the fllwing exceptin: during each bt NightSkies is written t disk in the /tmp directry in rder t be executed, it is then securely deleted. Beacn transmissins by NightSkies ccur nly when a cnfigurable time has elapsed and the target user is brwsing with Safari r Firefx. The cmmand and cntrl beacn data is encrypted in an HTTP GET/POST request r respnse. 3.3 Prerequisites Refer t NightSkies User Guide. 3.4 Equipment Familiarizatin Refer t NightSkies User Guide. 4. Operatin 4.1 Cnfiguratin DarkSeaSkies has the fllwing cnfiguratin parameters. The values fr a deplyment are in the file cnfig.plist unless specified therwise. NightSkies encryptin pass phrase. This value is saved in lp.passwrd. Enable date: date after which implant is enabled. Default cautin Limit: maximum number f cautius bts befre uninstall. Beacn URL: This is the URL the beacn will attempt t dwnlad. Client ID: this is a unique identifier fr the implant. "Magic Link" String: as part f beacning, the implant will lk fr this string in the php file in rder t retrieve tasking. Uninstall Interval: Time interval since last successful LP cmmunicatin befre uninstall. Minimum Delay between beacns in secnds. Failsafe attempt: beacn with ut netwrk checks. Maximum Delay: if failsafe is enabled, this is the maximum amunt f time in secnds we wait befre attempting a failsafe beacn. Applicatins used t detect activity. 3

7 4.2 Installatin and Setup DarkSeaSkies is installed frm a btable flash drive. The fllwing instructins detail hw t make the installatin flash drive frm any Apple cmputer running Mac OSX 10.5 (Lepard). 1. Frmat flash drive: Open DiskUtility; select the flash drive; click n the Partitin tab; select 1 Partitin under Vlume Scheme ; click Optins buttn; select GUID Partitin Table radi buttn; edit Name field apprpriately; select Mac OS Extended (jurnaled) as the Frmat ; click Apply. 2. Cpy Installer EFI file t the flash drive. > cp I.efi /Vlumes/I/I.efi 3. Bless the Installer EFI file n the flash drive. > sud bless -flder /Vlumes/I/ -file /Vlumes/I/I.efi --btinf The fllwing message is expected and nt an errr. Can t lad /Vlues/I//usr/standalne/ppc/btx.btinf 4. Eject the flash drive. > diskutil eject /Vlumes/I 5. Insert the flash drive int the target. 6. Bt the target system while hlding the ptin key until the screen displays a bt drive selectin menu. Select the flash drive. Once the DarkSeaSkies installer has started the screen will blank and a : will appear in the upper left crner f the screen. Once the : has appeared the flash drive may be remved and the laptp s lid clsed. On a successful installatin a ) will fllw the :. On an unsuccessful installatin a ( will fllw the :. Once installatin is cmplete the laptp will shutdwn. If DarkSeaSkies has already been installed n the target with the same implant GUID then the implant will be updated. Fr installatin and setup f the NightSkies LP refer t NightSkies User Guide. 4.3 Initiating a Sessin Refer t NightSkies User Guide. 4.4 Stpping and Suspending Wrk Refer t NightSkies User Guide. 4.5 Cntingencies and Alternate States and Mdes f Operatin DarkSeaSkies status may be queried by checking the value f the Status variable. This can be dne with the nvram cmmand line utility as fllws: > nvram $(cat status.guid):$(cat status.name), where status.guid is the GUID f the Status variable and status.name is the name f the Status variable as defined in sectin 3.1. Valid values f the Status variable and their meanings are als described in sectin 3.1. The Cunt variable may be queried t determine the number f cntinuus cautius bts that DarkSeaSkies has encuntered. The Cunt variable is incremented during a bt in 4

8 which the Status variable des nt exist r it exists but is nt 3. The Cunt variable is independently incremented in the case f a kernel panic. Therefre, if Status is nt 3 and a kernel panic is detected, then the Cunt variable is increased by 2. Otherwise the Cunt variable is deleted. A nn-existent Cunt variable is cnsidered t have the value zer. The Status variable will nt exist in the case that the target was bted t an OS ther than Mac OSX 10.5 r t an EFI applicatin such as Refit. The Limit variable may be set t verride the limit n cntinuus cautius bts as fllws: > nvram $(cat limit.guid):$(cat limit.name)=%xx%xx%xx %xx, where limit.guid is the GUID f the Limit variable and limit.name is the name f the Limit variable as defined in sectin 3.1 and the value %xx%xx%xx%xx is a fur byte hexadecimal number in little-endian byte rder with the % character befre each byte. Fr instance %02%00%00%00 is the value 2. DarkSeaSkies is uninstalled during a bt in which the Cunt variable is greater than r equal t the Limit variable. DarkSeaSkies may be explicitly uninstalled by setting the Status variable t 5 as fllws: > nvram $(cat status.guid):$(cat status.name)=5, where status.guid is the GUID f the Status variable and $status.name is the name f the Status variable as defined in sectin 3.1. The system must then be cleanly shutdwn (nt a kernel panic and nt hlding the pwer buttn dwn fr ten secnds) s that the Status is written t NVRAM. On the next bt DarkSeaSkies will be un-installed. 4.6 Assistance and Prblem Reprting Cntact NCS/IOC/EDG/AED/UDB fr assistance. 5. Additinal Operatinal Prcedures (Nt Applicable) 6. System Backup and Restre (Nt Applicable) 7. Trubleshting In the event that the Cnfiguratin NVRAM variable becmes crrupted it can be deleted s that DarkSeaSkies will generate the default cnfiguratin. Delete the Cnfiguratin variable with the fllwing cmmand: > sud nvram d $(cat cnfig.guid):$(cat cnfig.name). This shuld be fllwed by a rebt. 8. Errr Messages The nly errr message available in DarkSeaSkies is the Status NVRAM variable. See sectin 3.1 fr mre infrmatin. 5

9 9. Ntes 9.1 Acrnyms/Abbreviatins The Acrnyms/Abbreviatins used in this dcument are shwn in Table Acrnym/Abbreviatin EFI GUID LP NVRAM Table Acrnyms/Abbreviatins Term Extensible Firmware Interface Glbally Unique Identifier Listening Pst Nn-Vlatile Randm Access Memry 9.2 Definitins Definitins f cmmn terms used within this dcument may be fund in the Engineering Develpment Grup Prgram Management Lexicn. The terms and definitins unique t this dcument are shwn in Table Term Table Definitins Definitin 6