NSA Documents from the Spiegel Story

There are more source documents from the recent Spiegel story on the NSA than I realized. Here is what I think is the complete list:

Here are the news articles: Three English articles. Spy catalog interactive graphic. Two articles in German.

This is all really important information for those of us trying to defend against adversaries with these sorts of capabilities.

Tags: , , , ,

Posted on January 3, 2014 at 2:23 PM • 34 Comments

Comments

Jon • January 3, 2014 2:36 PM

I feel like the media is going overboard now with these NSA news releases. I think we all get the point by now and don’t need these constant reminders that the NSA is massively spying on us. One of the problems is no change is happening currently so the constant drips on NSA news are just being accepted and people are moving on with their lives…

Bruce Schneier • January 3, 2014 2:53 PM

“I feel like the media is going overboard now with these NSA news releases. I think we all get the point by now and don’t need these constant reminders that the NSA is massively spying on us. One of the problems is no change is happening currently so the constant drips on NSA news are just being accepted and people are moving on with their lives…”

Agreed.

Stories like this one are really for the techies — who need details — and not the general populace. This is why the popular media fixates on minor details like iPhone hacking.

Lou • January 3, 2014 3:00 PM

“Stories like this one are really for the techies — who need details — and not the general populace. This is why the popular media fixates on minor details like iPhone hacking.”

Sadly, it seems like in many circles techies don’t get any respect. When I pointed out your point of view and expertise to someone in the intelligence circle, you were dismissed with “Bruce is a techie. What the hell does he know.”

eyesoars • January 3, 2014 3:09 PM

Given that this is all now public, one might suppose that some of the U.S.’s major adversaries have had this information for a while.

How many of these installed bits of h/w and s/w have already been discovered, reverse-engineered, and subverted and/or re-engineered by China, Russia, Iran, Saudi Arabia, &c?

Bruce Schneier • January 3, 2014 3:21 PM

“Sadly, it seems like in many circles techies don’t get any respect. When I pointed out your point of view and expertise to someone in the intelligence circle, you were dismissed with ‘Bruce is a techie. What the hell does he know.'”

Well, there’s some truth to that. This is inherently a political problem. And while I can comment on the technology and its effectiveness, I am much less qualified to comment on the politics.

High Beam • January 3, 2014 3:25 PM

There must be an analogous catalog of psychological exploits, filled with devices and techniques to target the human mind.

For example, I was told by someone with a top secret clearance that the government had developed a simple device for crowd control. It was a light that blinked a certain frequency, able to trigger epileptic fits in a small segment of the population. The idea was that if say 5% of a crowd was having epileptic seizures, then the rest of crowd would be demoralized.

Let’s hope whistleblowers keep empowering individuals with the facts they need to restore the rule of law.

Daniel • January 3, 2014 3:44 PM

@ High Beam

These type of “psych ops” are vastly overrated. The biggest problem is that they are rarely an efficient use of resources expect in isolated cases. Governments who want to engage in psychological command and control have much more potent tools at their disposal, propaganda being the major one. The first line of defense is always a good offensive and so the best solution is to convince people to behave in the way you want them to. Technical interventions like TAO and its interdictions are directed at targets on whom such propaganda has failed or believed to have failed.

The real value of metadata to the government doesn’t lie in its ability to single people out for further investigation. The real value of the metadata is that it makes propaganda techniques more effective because messages can be targeted more directly. There is a interesting article about how Netflix uses metadata to target its customers.

http://www.theatlantic.com/technology/archive/2014/01/how-netflix-reverse-engineered-hollywood/282679/

If anyone doesn’t understand why metadata matters, this article should clear that ignorance away.

AlanS • January 3, 2014 4:19 PM

@Bruce Schneier

“This is inherently a political problem.”

And a legal problem. The judges and legal scholars are forever struggling with how the 4th Amendment is interpreted in light of technological change. See for example: http://www.volokh.com/author/orin/

robin • January 3, 2014 4:24 PM

Jon wrote:

“I feel like the media is going overboard now with these NSA news releases. I think we all get the point by now and don’t need these constant reminders that the NSA is massively spying on us. One of the problems is no change is happening currently so the constant drips on NSA news are just being accepted and people are moving on with their lives…”

Speak for yourself, and consider consuming different “media”.

If anything there needs to be more light shed on this material, and it needs to be as widely disseminated as possible.

Otherwise people WILL “move on” and forget the NSA like they do most things.

Momentum is building. Let’s maintain the trajectory.

Also, this material can be successfully used at all levels – technical, semi-technical or non-technical.

Another Kevin • January 3, 2014 5:48 PM

“This is inherently a political problem. And while I can comment on the technology and its effectiveness, I am much less qualified to comment on the politics.”

The underlying remark, “Bruce is a techie. What the hell does he know?” suggests strongly that the speaker believes the political decision making should be reserved to those ignorant of the technology: that is, those who can be baffled, bamboozled, or cowed into submission. If that is the be-all and end-all of the political process, then there is no hope left for the techies.

Andy • January 3, 2014 6:56 PM

The Spiegel article is a bit odd. It makes no mention of Snowden, Greenwald, The Guardian etc. It just talks about documents, internal documents, etc.

From what I recall all articles before they alwaysmade short mention of the document origin, a nod of the head if you will. Are they negligent now about it or is there a new leak(er)?

npcomplete • January 3, 2014 6:57 PM

Bruce, I was wondering what you thought of BadBIOS in light of the recent revelations? Do you think Ruiu could’ve had a machine infected with one of these NSA programs? I did not think it was a hoax, and I believed he encountered such symptoms, but I was very skeptical about his analysis, especially when that conventional speakers can’t produce ultrasonic audio (only very high end home theater ones can). And mics even less so to pick them up. But now I’m not so sure. I’m thinking that since the frequency response of speakers is not an absolute cutoff, the very weak response can still be used for transmission, essentially substituting as RF. Instead of a mic, maybe it was something else implanted. Who knows. Perhaps the details on the “how” are still off in badBios, but how it’s possible seems more plausible now.

Peter Barnhart • January 3, 2014 7:04 PM

Dec 2001 Nature article reported quantum computer factorization of 15 (=3*5) using 7 qubits and NMR. Per Wikipedia, 2012 record was 21 (I’m guessing maybe 8-9 qubits?). Spiegel docs say NSA was spending $73 Mil to try to demonstrate entanglement with 2 qubits. Sounds like the spooks are trying real hard to catch up with real scientists. Good to know.

Clive Robinson • January 3, 2014 10:23 PM

@ Bruce,

    “This is inherently a political problem. And while I can comment on the technology and its effectiveness, I am much less qualified to comment on the politics.”

There is politics as you understand it and politics as some others understand it and they are most definatly not the same. Further it is in some peoples interests to paint their politics to look like the politics you understand.

As has been mentioned before the US “paints it’s self as a democracy” where it is actualy quite easy to see that it is at best a plutocracy. And thus US politics as a first order aproximation is well aligned with the Hawk-Dove model.

But further it should be noted that perhaps unsurprisingly most of those plutocrats are in fact psychopaths.

Thus the comment,

    “Bruce is a techie. What the hell does he know?”

should be regarded as having been made by a person who contrary to what they say actualy sees you as a threat that can destroy the picture they are trying to paint to hide behind, and thus you will reveal the very unpleasent “real politics” they practice for their own benifit at the significant cost of the majority, not just to the few but to the many.

Benni • January 4, 2014 12:10 AM

Hi Bruce, several months ago, the German Computerjournal C’t raised concerns that the authroot update mechanism of Windows CryptoAPI for security certificates may contain a security problem. http://www.heise.de/ct/artikel/Microsofts-Hintertuer-1921730.html

Everytime, Microsoft stumbles across a previously unknown certificate, it updates the certificate list authroot.cab from Microsoft’s servers and installes the new certificates automatically without noticing anyone.

On these new spiegel articles, it is shown that NSA even intercepts error messages from windows. It is furthermore shown that NSA makes man on side and man in the middle attacks by faking entire websites.

With this in mind, the question arises whether NSA can also send a faked certificate list to windows that is then installed via authroot mechanism?

Also, I think one should reassess these old results, that Windows Crypto API contains a Key with the name NSAKEY (see this english article: http://www.heise.de/tp/artikel/5/5263/1.html ), in view of the recent articles on NSA’s quantum insert methods:

To quote from the excellent article above:

Fernandes reported his re-discovery of the two CAPI keys, and their secret meaning, to “Advances in Cryptology, Crypto’99” conference held in SantaBarbara. According to those present at the conference, Windows developers attending the conference did not deny that the “NSA” key was built intotheir software. But they refused to talk about what the key did, or why it had been put there without users’ knowledge.

But according to two witnesses attending the conference, even Microsoft’s top crypto programmers were astonished to learn that the version ofADVAPI.DLL shipping with Windows 2000 contains not two, but three keys. Brian LaMachia, head of CAPI development at Microsoft was “stunned” to learn of these discoveries, by outsiders.

Within the Microsoft organisation, access to Windows source code is said to be highly compartmentalized, making it easy for modifications to beinserted without the knowledge of even the respective product managers.

According to Fernandez of Cryptonym, the result of having the secret key inside your Windows operating system “is that it is tremendously easier for the NSA to load unauthorized security services on all copies ofMicrosoft Windows, and once these security services are loaded, they can effectively compromise your entire operating system”. The NSA key is contained inside all versions of Windows from Windows 95 OSR2 onwards.

Does one have to regard Windows CryptoAPI as compromised now?
Should browsers, like google chrome, or internet explorer use an own crypto library?

Darwin • January 4, 2014 12:18 AM

We are learning new things all the time from these Snowden leaks. Why people act like its the same old thing is beyond me unless you have a really short attention span. It sounds like much more is yet to come.

Xyz • January 4, 2014 12:43 AM

Do we know if QUANTUM INSERT resets the original session back to service provider(yahoo, etc)? If not, then the client sees actually two responses. Im sure there is a Snort rule for that. If not, then why not?

Benni • January 4, 2014 1:57 AM

One could perhaps update a browser such that it collects statistics, most importantly on websites using ssl. The browser could collect, e.g which IP’s they usually have, and even how much time it would take to load them. That way, the browser could warn the user, if, for example, a site like linkedIn in comes 99% of the time from an IP X and now it suddenly comes from an entirely different IP. And of course, the browser could notice, if a second copy of the page arrives a few miliseconds later, containing similar html code, but from a different IP. The browser could then warn the user. Once, a user sees a quantum Insert site, his system is compromised, of course, but the browser could still warn the user of a likely security risk.

Jello Biafra • January 4, 2014 2:38 AM

So the NSA uses IBM BladeCenter H2 servers, VMware vSphere Hypervisor (ESXi) and Fedora for their internal infrastructure as of Jan 2013 according to the latest doc here. Wonder if IBM gives them full hardware documentation for custom blobless drivers and BIOS. Must be nice, wish we could all get that.

The FOXACID injection system won’t work if you have an encrypted tunnel with pinned certs (Twitter Android app is an example, Chromium (not chrome) browser another example) or fast connection, the NSA relies on beating the orig server to feed you a false ACK so if you’re using terrorist dialup in Somalia chances are you’re getting the fake ACK.

That they can exploit FreeBSD is no surprise
http://www.openbsd.org/papers/ru13-deraadt/ (rucon 2013). Most of these backdoors are run before the OS even loads but that’s only for physically altered equipment, remote access requires exploitation first then flashing the hardware.

That they exploit firmware/BIOS and other closed source blobs of code is no surprise. Stallman warned against this decades ago.

The OTA update using STK to backdoor phones and network air cards also no surprise. Turbosim should defeat this, or something similar that can act as a firewall and look for an OTA update request and reject it. Sadly the Baseband is wide open to attack and I’m sure they’ve had a field day with 1990s gigantic GSM stacks running in ARM supervisor mode loaded on every Qualcomm chipset. You could also use your phone or tablet without a SIM, just use wireless with a VPN connection for encrypted VoIP (Redphone/Ostel). No idea what the quality would be like.

They really seem to like interdiction as a method of filling your hardware with surprises. They also like radar reflection, like that super james bond tiny device that hides in a LCD cable they can illuminate to watch everything on your screen. Anybody know how this ilumination happens? I have to read http://www.radartutorial.eu/index.en.html don’t know anything about radar.

Benni • January 4, 2014 3:48 AM

@Jello,
Fast connection would not work, as they sit, according to Bruce Schneier, in the internet backbones, having their contracts with telecommunication companys. This is what gives NSA the speed advantage, since these companies get your request first.

I do not know much about these security certificates. But I believe that companies make errors, and I therefore only trust files whose installation I have approved personally. With Windows CryptoAPI, I get apparently certificates installed without my approval.

NSA has faked linkedIn pages, these pages use ssl. In the situation that NSA does man in the middle attacks on an almost industrial scale, I personally can not thrust browsers that use the Windows CryptoAPI which, on top of that all, contains a key with the name nsakey.

I think all web-browsers should come with their own crypto engine, which should be open source, of course. Today’s browsers should not rely on some closd source CryptoAPI that could contain all sorts of unknown flaws. I see that for onlinebanking, I must use my linux box…

derf • January 4, 2014 4:06 AM

They prob stopped using all this against terrorists years ago and now just do industrial espionage and spy on politicians for blackmail.

Wait until this is all automated, which what seems the quantum computer the NSA bought is for.

Benni • January 4, 2014 4:26 AM

@Jello: You ask how the tiny device can send information on monitors? Well, it just modulates the incoming wave. This is a very old technique, first used by russians to spy on americans. They are versions of Theremin’s “Great Seal” cavity resonator. Google for “Great Seal bug”. http://en.wikipedia.org/wiki/Thing_(listening_device), the thechnique dates back to 1945.

As the signal from the bug is weak, the nsa must use a very efficient radar detector, to see it. So they need to have a car nearby the location of the victim. Works for embassies, on closed, large industrial areas, it is qustionable that this could do anything.

Peter Barnhart • January 4, 2014 7:19 PM

My apologies.
My comment above was referring to a very different NSA program I read about on Washington Post, called “Penetrating Hard Targets” and describing an effort to build a quantum computer. Links:
http://www.washingtonpost.com/world/national-security/nsa-seeks-to-build-quantum-computer-that-could-crack-most-types-of-encryption/2014/01/02/8fff297e-7195-11e3-8def-a33011492df2_story.html
and
http://apps.washingtonpost.com/g/page/world/a-description-of-the-penetrating-hard-targets-project/691/

Gop • January 4, 2014 10:30 PM

@xyz

Doesn’t necessarily work like that. If there is at least one stateful device between the injection point and your computer, then the second response would be blocked before it ever reached your computer.

Me • January 5, 2014 9:39 PM

I’m not sure I can take these “leaks” serious. First, they look pretty infantile (naming of programs, cartoons, etc.), something you would expect from an adolescent with a bad balance of hormones. Then, by trying to go further and take things serious, focusing only on the HTTP hacking tools, from a technical point of view the diagrams are not consistent without having the attacker acting as a SSL Proxy, thus breaking the SSL flow between the provider and the end user – which would promote him as a man in the middle. The flows presented in the diagrams are more appropriate to be called automated DoS attacks, things already known and used for quite some time.
The toys for boys section (gadgets) is a normal set of tools for any decent spooks factory.
As long as the Computers are built for multitasking and multiuser environments and the Internet standards created through the RFC processes, there will be no decent security requirements and second thoughts about failure management / communication consistency. The other communication standards are subject of economic competition and patents, where security is not imperative. That’s what we are able to provide ATM, hope all these “revelations” will push us to do some improvements for the future.
And a personal opinion, the only security devices that can be considered and maybe have a future are the HW ones, everything SW can and will be abused/corrupted.

fdvbdbdbf • January 5, 2014 10:11 PM

Just a reminder: If you mentioned anything Snowden has revealed before the leaks, you were called a nut-job and in some places even attacked or called communist, or more diplomatically have your claim labeled as a “conspiracy”, even though the word has nothing to do with the context of unproven theory which is commonly used..

derp • January 6, 2014 1:09 AM

@Me – January 5, 2014 9:39 PM

“I’m not sure I can take these “leaks” serious.”

The burden of proof lies with you.

65535 • January 6, 2014 1:12 AM

Congrats. This is one of the most inclusive posts I have read on the TAO, Quantum, Ant, and QFire in any US website. The implications are enormous.

I don’t think this granular information will be shown in any major American “news” outlet. The NSA and their K-street team has the big new outlets on the pad or intimidated.

I feel violated. I am sure others do also. And, some politicians probably feel the same.

Lou • January 6, 2014 9:20 AM

@Another Kevin
@Clive Robinson

You two pretty much hit it on the head. The guy in question is a relatively well-known blogger on intelligence matters and former NSA employee (I’ll say who he is if asked — it’s all public, but I don’t want to start a cross-blog flame war or anything). Even if he isn’t an NSA shill (and I’ll give him the benefit of the doubt here), he still apparently has an inherent bias towards the NSA given his own personal history.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.