CouchPotato is a remote tool for collection against RTSP/H.264 video streams. It allows the agency to collect the stream as a video file (AVI) or as still frames in the form of JPG.
Government surveillance is one of the more trying issues we’ve had to face since the advent of the digital age. The lack of transparency from government agencies has led to the rise of such organizations as Wikileaks. While it has been accused of partisanship, anti-American narrative, and much more thanks to the eccentricity of its founder, it continues to leak confidential secrets of the CIA. The latest one is a user guide on a tool called CouchPotato.
A remote tool that allows for the collection of RTSP/H.264 video streams, CouchPotato can be used to „collect either the stream as a video file (AVI) or capture still images (JPG) of frames from the stream that are of significant change from a previously captured frame“. FFmpeg and RSTP connectivity is used for encoding and decoding the streams.
They use a stripped down version of the FFmpeg software by removing unnecessary features along with various audio and video codecs. Instead, pHash, an image hashing algorithm, is incorporated to add the image change detection capabilities. This helps in reducing the binary footprint of the DLL. It relies on being launched in an ICE v3 Fire and Collect compatible loader.
The user guide consists of three sections that include an overview, prerequisites, and usage. The document strongly recommends to not launch out of a process that is critical to system stability such as services.exe as it may lead to a memory leak and open file handles. You can read the complete guide here.
