Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

IOC ERB: 11
5
SECRET//NOFORN//20340511
SECRET//NOFORN//20340511
A Biometric system upgrade program included in ExpressLane
v3.1.1
User configurable installation time
Upgrade program drops the ExpressLane service and initiates a
collection
ExpressLane is installed as a system service that runs when
Windows boots (MOBSLangSvc).
Collection is delayed by 30 seconds due to Windows drive
recognition issue.
Collected files are compressed, encrypted, and saved to the
covert partition on the USB drive.
Collection occurs even if no one is logged in.
Kill date is modified by inserting a watermarked USB drive.
Checks current date when the service starts and corrupts the
license files if on or past the kill date.
Capabilities and Limits

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh