Nick P • October 11, 2014 11:35 AM

@ Markus Ottela

Thanks for the updates. Good work. Keep it up.

@ Jacob

I posted about the same scheme here in discussions Clive was referring to. Of course, the FBI and courts already have precedents where they think they can legally force you to lie about whether data has been compromised. So, that scheme won’t work here and no excuses you make change that. So, the best method is the one where there’s nothing you can do to give in. I call these the torture-proof methods.

A simple one is to send an encrypted version of the data over ahead of time on a HD, SD card, etc. You get through customs. If they check your computer, it’s got basic stuff on it and they let you through. Upon arrival, you download the decryption program and use it on the hard disk. You might even do the work from a VM on that hard disk so all the traces of application activity are contained in it. Once you’re done, re-encrypt under a new key, ship it back home, and repeat the process.

Note: You do shipping because it’s one of the fastest ways to move hundreds of GB’s or TB’s of data. Many companies and labs move HD’s through the mail for this reason. So, it might not even raise an alarm. If it’s MB’s to a few GB, you can just move it over the Internet or a dedicated line.

Modification of above keeps the data on a secure, domestic network. The data is only available if you SSH (or other VPN) into it from a certain (foreign) machine/network and have a password (yours). So, your PC will have common remote access tools but nothing past that. An expansion on this is for you to use one of the high end thin clients over such a tunnel so the whole desktop stays over there. I said high end because some are hardware accelerated to reduce latency & improve eg multimedia.

What if they subvert your PC at customs? That concern led many of us to advocate a strategy of “travel with no PC and just buy a local one.” Repeat one of the above strategies. Then sell the local PC on your way out. You can always rent it, too. This works with phones too esp if you have phone cards for air port, a service that redirects your calls from a central number, and can do most stuff through the Internet anyway. Just be sure to pick the rental stores randomly if you think they’ll target you. If I were them, I’d subvert every PC at the nearest shop or even own it for that purpose. Hitting tourists, businessmen, and spooks right out the airport the day they arrive. 😉

EDIT: Funny I say that last line then read Grauhut’s comment about CIA’s fake businessmen and shell companies. See, I know how they think haha.

@ Jacob

re NSA file

Thanks for that! Yes, Skeptical’s argument is smashed by this one line:

“details of FBI assistance with compelled and cooperative partnerships associated with WHIPGENIE”

The WHIPGENIE program subverts the whole service to give them all traffic. So, this document indicates the FBI & NSA jointly compel companies into cooperation if they don’t do it willingly. I bet those companies are more bitter than average that they had to do it anyway without making the $30+ million the co-conspirators got. :O

@ Sancho_P

Thanks for the link! Confirms what I told Skeptical that the high end capabilities, abuses, etc would be compartmented into SAP’s. It says that (minus the word ‘abuses’) right in the document. I also indicated they’d use HUMINT for coercion. Skep said they don’t have saboteurs. I pointed out they do have a joint partnership with CIA for that sort of thing. Now, this doc does one better:

“TS//SI Fact that NSA/CSS employs its own HUMINT assets (Target Exploitation TAREX) to support SIGINT operations.”

So, we have admission that they compel companies with FBI (different doc), use HUMINT on other non-cooperatives (different doc), and have their own HUMINT team that they don’t acknowledge even to people with regular TS clearances.

Additionally, this even more classified (ECI, black program) tidbit says:

“(TS//SI//ECI SOL) Facts related to NSA personnel (under cover), operational meetings, specific operations, specific technology, specific locations and covert communications related to SIGINT enabling with specific commercial entities (A/B/C).”

“(TS//SI//ECI SOL) Fact that NSA/CSS works with specific named US commercial entities (A/B/C) and operational details (devices/products) to make them exploitable for SIGINT.”

“(TS//SI//ECI SOL) Fact that NSA/CSS works with specific foreign partners (X/Y/Z) and foreign commercial industry entities (M/N/O) and operational details (devices/products) to make them exploitable for SIGINT.”

So, yes, NSA is weakening stuff all over the place and has undercover spies in specific organizations.

Nick P • October 11, 2014 5:52 PM

@ Jacob

The answer is in the document: the Executive Order allows strong crypto so long as an escrow method is built in. As in, they backdoor it somehow. So, if it’s American product, assume Five Eyes can get the data. That’s why foreign companies are right to boycott US goods and try to get stuff from less subversive sources.

Of course, that’s just as challenging, ain’t it? 😉

Nick P • October 11, 2014 6:07 PM

Re NSAKEY

Actually, CIA document is our smoking gun on that when combined with this Microsoft statement:

“Microsoft said that the key’s symbol was “_NSAKEY” because the NSA is the technical review authority for U.S. export controls, and the key ensures compliance with U.S. export laws.”

It’s for export compliance. Key escrow was a rule for compliance per CIA. And the simplest, safe escrow method I came up with long ago was sending a copy of the key to NSA’s EKMS via a public key they supply. EKMS already does this for FIREFLY and NSAKEY is a public key.

So, close to open and shut as one can get. The law required a backdoor for approval. Common method was public key. They got approved, had a secondary public key for compliance, and its name was NSA. The last part doesn’t surprise me given Microsoft programmer quality (read: no quality) in that time period.

Nick P • October 12, 2014 12:15 AM

Working through claims of several documents to illustrate activities and layers of truth/lies (part 1)

I appreciate the reference to the TAREX documents. I’m going from this one:

http://cryptome.org/2014/10/nsa-tarex-the-intercept-14-1010.pdf

It’s classified at SECRET//SI//NOFORN. So, naturally any Top Secret, codeword, or especially ECI stuff is removed from this document. That’s why it doesn’t reference the TAREX activities from the Top Secret or recent ECI/SAP-related documents: the recipients don’t have clearance to know they exist. So, at best, it provides a limited view into the activities of the TAREX group. The importance of this is illustrated in the very first section: unclassified official use only people are told that TAREX only conducts overt surveillance, while SECRET clearance holders are told they conduct clandestine surveillance. The layers of the onion hide so many truths with so many lies and denials.

Analysis of TAREX Group from this SECRET-level perspective.

The group works with INSCOM, the parent of the Army ISA. That tells me what I need to know right away. A lesser known TLA when I learned of them, I found they have in recent times a decent Wikipedia page. Very versatile operators who do everything from SIGINT to black bag jobs, do fieldwork with likes of Delta/SEAL6, and got positive mention in Richard Marcinko’s books for talent at black bag jobs.

Next fact is that collection is classified in a typical SIGINT way. But, the details of how they did the collection is up to INSCOM. If INSCOM’s clandestine operators do it, especially at SCI/SAP level, then neither Snowden nor NSA would even have the docs on it unless INSCOM shared specifics of it in a TS/SCI document.

Next fact is that, although S.B.U. release says they do overt collection, the B.3 section tells SECRET personnel that ‘the TAREX program does not conduct overt SIGINT collection.’ Clearly shows how willing they are to lie to those at lower rungs of classification levels. That they do it with claims only pages apart in the same document is hilarious. That people trust their claims in the TS documents knowing about this pattern & existence of higher levels is not hilarious.

Next fact is that TAREX focuses on physical subversion including “close access-enabling, exploitation, or operations; off net-enabling, exploitation, or operations; supply chain-enabling, exploitation, or intervention operations; and/or hardware implant-enabling.” Combined with their ISA or SOCOM partners, this represents one hell of a clandestine capability for forcing SIGINT collection into unwitting or unknowing organizations. They also have a presence in Washington and embassies, which I assumed.

Final fact is they have personnel “integrated into the HUMINT operations at CIA, DIA/DOD, and/or FBI.” Interesting enough, these are the three organizations that opponents (or targets) of NSA programs keep getting hit by. The CIA runs covert and clandestine operations, plus the extraordinary rendition program that can be used against U.S. citizens. FBI has a pattern of doing awful shit without real consequence and can do indefinite detention. The DIA has similar clandestine capabilities to CIA and focuses on anything DOD considers enemy weapons (“cyber”weapons?). Integration with these organizations might be how parallel construction and other highly sensitive sharing take place.

So, if TAREX targets American companies to force compliance, they’d probably succeed in their goal. Especially if TAREX had more capabilities or purview than in this document. Let’s hope that’s not the case. So, now lets go to the SENTRY EAGLE document to find out.

I’ll start by saying that, in the first 7 points, the different impressions a SECRET and TOPSECRET clearance holder receives is quite significant. Matter of fact, I’m going to focus on these differences as I look through it. Let’s start with SENTRY OWL.

In SENTRY OWL, the public is told NSA works with industry as technical advisors on its products. Implies they’re helping us be safe. TS/SI level knows that NSA does SIGINT enabling operations in U.S. industry, that this involves HUMINT agencies, it also has FISA operations with industry (imply separate things), and works with foreign partners. So, the public things one thing is going on while TS/SI group finds out opposite is true. Then, TS/ECI finds out we have specific partnerships to make U.S. devices vulnerable, partnerships to make foreign devices vulnerable, undercover NSA people, and “human asset(s) cooperating with NSA” in U.S. or foreign companies.

In SENTRY RAVEN, the public is told NSA works to break foreign ciphers. All up to TS/SI community are told the same. The TS/SI/ECI group is given more detail on that which matches main claim. However, they’re also told that “NSA/CSS works with specific U.S. commercial entities to modify U.S. manufactured encryption systems to make them exploitable for SIGINT.” Quite a difference between “we break foreign ciphers” and “we make U.S. made equipment vulnerable so we can maybe hit it later.” Quite the difference.

In SENTRY HAWK, the public and S.B.U. communities are told NSA works with FBI and CIA on the SIGINT side. SECRET/SI are told that NSA gets up close and personnel (eg TAREX) on everything from computers to networks. TS/SI gets more knowledge of the specific weaknesses they exploit. TS/SI/ECI SHK get more specific details of exploits/operations, the knowledge that NSA works with foreign/commercial entities, and information on clandestine access to world-wide fiber optic cables.

In SENTRY OSPREY, the public gets to know the NSA/CSS works with CIA’s National Clandestine Service, which can do covert (deniable) operations. S.B.U. are told it’s SIGINT support. TOPSECRET/SI/NF learns it’s for high priority target internal foreign communications. TS/SI learns NSA has its own internal HUMINT (TAREX) assets for this. TS//SI//NF//ECI learn specific targets and details of NCS operations. So far, this document doesn’t indicate that TAREX group targets American companies: just foreign. However, as we see above, it can’t be used to prove they don’t hit domestic companies as that could be another codeword or ECI program. Just foreign… so far.

Alright, now let’s look at the WHIPGENIE document at TS/SI/NOFORN. This involves relationships with “U.S. partners.” It’s distinct from, probably working with, the above program that does this.

The public can hear the codeword alone. S.B.U. knows it involves corporations. CONFIDENTIAL knows its SIGINT-related and unconventional in its methods. TS/COMINT knows WHIPGENIE is about domestic wire access or US transiting communication. TS/COMINT know it’s a combination of NSA and private sector that includes domestic access and FBI assists with compelled partnerships. Note that “parternships” suddenly includes non-cooperative parties & remember this in other documents. Only TS/COMINT-ECI WPG people get to know how FBI gets the cooperation or forces them. This is telling because the existence of the basic warrants and orders Skeptical references certainly aren’t ECI. The methods NSA and FBI are using to get “domestic” companies to do SIGINT enabling are ECI. The evil stuff is likely in there.

Being tired from a long day, I’ll leave it at this raw data for now. An analysis might come next.

Nick P • October 12, 2014 12:13 PM

@ name.withheld

I’m not sure I’d call it a failure in mission. It’s mission is to try to spy as much as possible on SIGINT to get intelligence for other TLA’s. It’s been doing that plenty. It’s only been failing if we assume their goal is information on terrorists rather than so many other targets of interest. Far as what Binney saw, that’s typical of DOD organizations in having bad character and being more about money flowing around than anything else. That’s systemic in our system with Congress being a part of it too, esp benefiting from DOD waste.

So, they need their criminal immunity removed, accountability increased, and mission scope narrowed.

re NSA on a fee basis

They’d probably look like a combination of Cygnacom, Matasano, and Hacking Team.

@ A Blunt

Lmao. Nah I don’t work for U.S.G. although I’ve often been accused of knowing too much for my own safety. Of course, if I did black program work, I’d be required to lie about it and deliver a cover story. So, I guess everyone will continue to wonder while I laugh at the various guesses. I will say, though, that it’s doubtful NSA would sacrifice their SIGINT capabilities just to develop a double. And anyone following what I’ve posted here could destroy most of their SIGINT capabilities.

Hopefully, if the Revolution happens, that will be in my favor if I’m put under scrutiny. 😉

@ Grauhut

I didn’t know about Tron. His work sounded very smart, esp how he kept costs down. Too bad he died before finishing it. Least we have some smart solutions on the way. I’m funding JackPair as I think it’s the best concept & similar to recommendation of blog’s old hardware guru, RobertT. He ended up being right about best approach, at least for short term. I plan to beat him in the end by delivering a secure, general-purpose, mobile TCB.

Nick P • October 13, 2014 12:29 PM

@ Skeptical

“This is a bridge too far, I’m afraid. “Details” would include descriptions of the actual collection, how and where the FBI collects the data (or if the company does so for him), etc. Note, for example, that street addresses of sites that are used for collection are also classified as ECI.”

That part might be true.

“In general, the tenor of your analysis seems driven by an assumption that classifications are being made to conceal illegal acts.”

My analysis here is driven by the observation that there’s deception by U.S. government at every level. People at Unclassified level fund these programs thinking one thing is going on (eg overt warranted metadata collection). People at Secret level know they’re being lied to (clandestine collection) and keep the lies going. People at TS/SCI level know the public and Secret clearance holders are being lied to (compelled backdoors in US products with mass collection of data & metadata). Then, TS/ECI level continues that process. As we go up, the details of what they’re actually doing diverge considerably from what the public and Congress authorized. That the public and many in Congress said so after the leaks substantiates that further.

So, I’m saying these organizations are pervasively deceptive, scheming, and possibly unlawful in what they do. The further up you go, the more of this you see. Whether they’ve done the dirty deeds now or might later, it’s already evident that they might be and need to be reigned in now.

Of course, SmokingHot’s list shows that my presumption of covert ops community continually scheming up crimes and ops for their own purposes is quite justified. Hoover’s use of blackmail to control Congress and Presidents with less surveillance/power than NSA justifies putting high effort into preventing history from repeating. And that CIA is already hacking their Congressional oversight tells us plenty. That Congress is blocked from getting evidence of this or prosecuting them says even more. The corruption and rogue behavior, along with immunity to it, is thoroughly baked into our current system.

And now Alexander is apparently doing exactly what the whistleblowers were charged with doing. Except he’s doing it for profit. That’s when it’s OK. 😉

@ SmokingHot

Excellent list!

@ thevoid

To be clear, I did brief research into Gladio that showed no evidence of the U.S. sponsoring terror. What I found was that the Italian Gladio group was doing false flag operations, we had blackops groups worldwide doing who knows what, they operate outside of military/civilian/international law, it remained secret for decades, it was admitted (without much detail) decades later, and they presumably continue to do whatever they’re doing. It’s probably a USAP given its secrecy, criminality, and the fact that many of the 50+ politicians authorizing SAP’s would probably oppose it as an unnecessary risk. A USAP just takes 3 that almost always give in to military and intelligence requests.

It’s also a great counterexample to any claim that a conspiracy involving many people can’t last decades without the insiders blowing it. Even when just one group confessed, the rest of the operation is largely in the shadows and intact. Clearly, they compartmentalized it into cells much like terrorists do. No surprise as terrorists learned that trick from the CIA long ago. 😉 And CIA NCS is the only one authorized to execute a mission like this. (Pause) That we at the Unclassified level know of… (sighs)

@ Adjuvant

Thanks for links, especially. I might try to read them to see if there’s any more reliable information about what U.S. operatives were doing. Given Cold War era thinking, the base theory of “armies staying behind just in case” is by itself believable. Congress would’ve gone with that as a regular SAP given their paranoia. Additionally, Italian criminal culture (eg P2) is very prone to wild conspiracies happening in practice. That their operatives started doing false flags to boost military and police power wouldn’t necessarily imply what ours would do. Many web sites seem to make the fallacy of jumping right from Italian ops to American ops as if they’re the same.

So, before I even go through the links, is there any information from very reputable (to courts or American people) sources that U.S. end engaged in false flag operations under this program? Otherwise, it isn’t worth reading except as historical data of black ops.

Nick P • October 14, 2014 9:18 AM

@ Figureitout

“not admit you’re a voter (or at least a member of public) and thus part of the problem. I’m not a voter anymore so I’m not your enemy anymore..? :P”

I don’t vote. I provide voters information they need and hope they make a good call. The problem is they’ve disqualified all the good candidates by the time the main election hits. Voting there means I have to vote a bad guy into office. Many do in name of damage control. Myself, given two bad options, I take option three: the middle finger to the situation.

George Carlin had a skit on this. He said people often claim if someone didn’t vote they can’t gripe about the situation. He replies that the scumbags wouldn’t be in office if people didn’t vote for them. He didn’t vote so he had nothing to do with it. (paraphrased) “It’s all you other assholes that did this so YOU have no right to gripe about it.” Haha.

“Get put on list, subject to employment issues and other pointless attacks. ”

Exactly… And would I add to that in the name of offering products to an apathetic people? (sigh) I’ve honestly been considering just starting over in a new country where people care a bit more and most of this stuff doesn’t happen. One of those nice European or Nordic democracies. They tend to be SIGINT allies so risk to U.S. is minimal from their perspective. Thing is, I’m not sure if I’m safe getting on a plane. So, I continue to look for options here.

@ sena kavote

It’s not going to be one exploit. They have hundreds to thousands of them. A recent Chrome vulnerability strung together 5-6 bugs to produce one exploit. The guy said it was easy and took less than a week. You have two vanilla pieces of software that aren’t designed for security. If they get the binary or code, they’ll get in. If not, then you’ve basically obfuscated things. That kind of protection works or doesn’t.

“And for some tasks, there are separate software that are internally completely different but work the same way with regard to input and output, although not always with same speed.”

That’s a good thing. Security by diversity, I call it.

“Could it be that if firefox or elinks or some pdf reader is compiled with LLVM / Clang instead of GCC, and with different settings, the vulnerabilities would be different?”

It’s possible. The way to test is to disassemble and compare the output of the compilers. Different isn’t all that matters, though. It has to be different in a way that makes one vulnerable and one not. If the problem is a buffer, the buffer overflow attack might work on both even though they used different assembler codes. There’s an active line of research right now of automating this process of making meaningful differences during compilation.

“If a process crashes in NUC because of attack, is it possible to immediately send a message about that event to some other computer before malware has any chance to prevent that sending? ”

You could, but MINIX 3 shows they crash plenty from mere errors. A crash != an attack. Treating it like one means you loose availability. See how tricky the stuff is? It’s why I try to use trusted, minimal appliances like guards so I can ignore as much of this stuff as possible.

@ Wael

“Still not 100% because, among other reasons, dormant malware may wait for a command which may not occurs during the observation period.”

The classic threat: subversion! Of course, I’ll add that the input itself might not look strange at all: a vanilla looking chunk of data might crash or exploit the machine. There will be patterns looking like crypto or code, though. Probably. Unless it’s disguised as a web access, esp HTTPS.

I wonder if anyone is hiding malware as DNSSEC requests yet. I’d try that if I was still in the business. I’d use DNS for covert channels at the least.

Nick P • October 19, 2014 8:34 PM

@ Wael

“When it comes to state level adversaries, one is out engineered, out funded, and possibly outlawed 🙂 ”

That’s what I eventually said. (sighs)

“No chance of beating an adversary of such capabilities. I remember RobertT disagreed a while back…”

I agreed with him, too, as he and I both did it on more than one occasion. His methods were better potentially just because they cleverly relied on skills almost nobody has. Less every year, actually. I’ll add that one must beat them across the board to win and each person’s winning criteria (eg compromises) is different. A person willing to build in backdoors, share design info, restrict business relationships, etc might not come under too much scrutiny. A U.S. company selling high assurance, on-chip crypto to the Chinese will probably have a TAREX team up their ass in no time.

Varies. That’s why I like the obfuscation approach best. What they don’t know can’t help them. Obfuscate relationships, methods, suppliers, configuration, and so on. Good INFOSEC & COMSEC on top of a policy of mainly referencing vague terms representing things discussed in person. The same stuff CIA used to do. That we are still vague on details of some of their illegal activities shows tradecraft and obfuscation are the best methods if done right. Meanwhile, crypto and FOSS didn’t do shit to stop NSA. Like I predicted. 😉

Oh yeah, and keep one’s person and business out of the Five Eye’s countries. That’s also a lesson to learn from RobertT, who intentionally didn’t do business in U.S. to avoid its issues. He also, like me, used physical compartmentalization of his systems to separate personal, main business, more critical projects, etc. Not sure if his data moving methods were strong, but extensive air gaps put him ahead of NSA remote capabilities a bit.

“Is this blog under a DDOS attack? I noticed some silence for a few days…”

Anytime it goes down, I email Bruce to see if it’s under maintenance. He usually straight up says that. Was more vague this time. So, might be an attack or just an unusual system/service reliability issue. They run a Perl-based web application on top of a regular server far as I know. Plenty of room there for non-NSA problems. They resolved whatever it is so not our concern past that.

Nick P • October 19, 2014 9:45 PM

@ Adjuvant

Corbett himself is of questionable reliability. That adds to the problem. He’ll certainly cite some good information and present it well. He’ll also throw in stuff that’s questionable or even downright misleading. This was evident in his “9/11 A conspiracy theory” video. Minus the questionable stuff, it was an entertaining start at getting people thinking about the official theory. But he didn’t publish it minus that stuff, did he?