Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
17.1 Installing The Gibson
This procedure details the steps required to install an instance of The Gibson.
Setup C2/LP Machines
The Gibson is intended to operate on two machines, a C2 and an LP. The Gibson was
designed for and tested on Scientific Linux virtual machines.
The C2 should be configured to have no direct access to the Internet. Operators will
connect to the C2 for all normal operations.
The LP will need to access the Internet and the C2. Due to this exposure, care
should be taken to harden the LP against attack. The LP must be configured with a
web server for use by the Assassin beacon server.
Install Galleon Interfaces
The Gibson system requires two Galleon interfaces: Transport v1, Publish v1. The
Transport interface is needed on both the C2 and LP; the Publish interface is needed
on the C2.
When installing Galleon interfaces, the Galleon configuration file must be updated
with their versions and handlers.
Execute Install Script
Execute the provided The Gibson installation script with the appropriate Assassin
subsystems. See section 16.2 on The Gibson scripts for usage.
On the C2, execute install_assassin.sh with the assassin_c2 directory. On the LP,
execute install_assassin.sh with the assassin_lp directory.
TAR files are provided containing machine-appropriate installation packages.
Register with Transport, Publish
Register the Assassin components with the Transport and Publish interfaces.
The Gibson includes several Transport receivers. Their client labels and receive
handlers are described:
Location Client
Label
Handler
Queue LP
queue $INSTALL_DIR/queues_receiver.py
Queue Proxy C2
queueproxy $INSTALL_DIR/queues_proxy_receiver.py
Post
Processor
C2
postproc $INSTALL_DIR/post_processor.py --receive
Log Collector LP
logcollect $INSTALL_DIR/log_collector.py --receive
Log
Extractor
C2
logextract $INSTALL_DIR/log_extractor.py --receive
The Default Ingester must be registered with the Publish interface to ingest the
following Type Tags: assassin_beacon, assassin_result, assassin_push.
138
SECRET//ORCON//NOFORN