nc.sh - scripted netcat listener to emulate listening post until LP is set up
skipped 34 lines
38
39
39
40
Example:
40
41
./hived-solaris-sparc-dbg -a 10.3.2.76 -p 9999 -i 100000 -I hme0
42
+
```
43
+
44
+
45
+
***
46
+
**From WikiLeaks**:
47
+
>Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware.
48
+
49
+
>Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a target computer is useless if there is no way for it to communicate with its operators in a secure manner that does not draw attention. Using Hive even if an implant is discovered on a target computer, attributing it to the CIA is difficult by just looking at the communication of the malware with other servers on the internet. Hive provides a covert communications platform for a whole range of CIA malware to send exfiltrated information to CIA servers and to receive new instructions from operators at the CIA.
50
+
51
+
>Hive can serve multiple operations using multiple implants on target computers. Each operation anonymously registers at least one cover domain (e.g. "perfectly-boring-looking-domain.com") for its own use. The server running the domain website is rented from commercial hosting providers as a VPS (virtual private server) and its software is customized according to CIA specifications. These servers are the public-facing side of the CIA back-end infrastructure and act as a relay for HTTP(S) traffic over a VPN connection to a "hidden" CIA server called 'Blot'.
Charlie Root
committed
1 year ago
1 parent ce78fa6c