1. RCS on a low bandwith

2. What happens if an agent is running on a device with very slow Internet connection? An improper configuration may lead to loss of the Agent.

3. If you use all the bandwidth available, the Target will notice
If you use all the bandwidth available, the Target will notice. An Agent that produces too much evidence may be unable to transfer it.

4. EMPYRICAL TESTS

5. Test on a low bandwith
A Windows target has been infected, but the bandwith available to the agent is limited to 3 kB/s
The following modules can be freely used in a low bandwith environment:
Device
Position
Addressbook (21 contacts in few seconds)
Application
Calendar
Chat
Clipboard
Keylogger
Password
URL

6. Test on a low bandwith
The following modules need particular attention when used in a low bandwith environment:
Camera + Screenshot
Medium quality: 50 seconds to sync one evidence
Low quality: 25 seconds to sync one evidence
ADVISE: use low quality and never take more than 1 screenshot or camera per minute
Call
Quality 5: 3 minutes to sync 46 seconds of call
Quality 1: 1m50s to sync 46 seconds of call (still good quality)
CAUTION: avoid or use for a very limited period of time; use lowest quality
File
Easy calculation: the bigger the file the longer the synchronization time
12 minutes to sync a file of 1Mb
CAUTION: absolutely avoid downloading more than 3Mb in files

7. Test on a low bandwith
The following modules need particular attention when used in a low bandwith environment:
Mail
In a test mailbox, in one month 75 s have been received. Limiting the agent to collect s <=50kB in size, it took 20 minutes to synchronize all s received in the last month
ADVISE: start syncing only one day of s, then slowly increase the timeframe according to your needs. Keep a low maximum size limit.
Mic
It takes 1m50s to synchronize 1 minute of recording
CAUTION: avoid or use for a very limited period of time

8. EXAMPLE CONFIGURATIONS

9. First Configuration
This configuration is to be used for the first infection:
Device only
Sync every 15 minutes
Limit bandwith to 3kB/s
The device module will give you the basic information to understand what kind of device has been infected. A 15 minutes period between syncs will give you the chance to promptly change the configuration when needed.

10. First Configuration

11. Second Configuration
This configuration will include all evidence that is known to work without issues on a low bandwith target:
Device, Position (every 5 minutes), Addressbook, Application, Calendar, Chat, Clipboard, Keylogger, Password, URL
Sync every 30 minutes
Limit bandwith to 3kB/s
Most of the useful information that can be obtained from an infected device is collected. A 30 minutes period between syncs will prevent bandwith saturation, thus allowing to change the configuration in reasonable time.

12. Second Configuration

13. Third Configuration
This configuration adds the retrieval of s to the Second Configuration. It starts collecting s smaller than 50kB and up to 2 days old.
Device, Position (every 5 minutes), Addressbook, Application, Calendar, Chat, Clipboard, Keylogger, Password, URL, Mail
Sync every 60 minutes
Limit bandwith to 3kB/s
A longer period between syncs will minimize the use of bandwith from the agent.

14. Third Configuration

15. Third Configuration
You can evaluate to collect bigger than 50kb and in intervals longer than 2 days.
Check how many were collected for the last two days.
Configure the agent according to the following table to collect from the past:
Collected s
Days to collect
50+
1 day
30-50
2 days
15-30
3 days
1-15
5 days

16. Be very careful when configuring a new Agent!