Schneier on Security

EBSR

(S//SI//REL) Multi-purpose, Pico class, tri-band active GSM base station with internal 802.11/GPS/handset capability.

(S//SI//REL) Operational Restrictions exist for equipment deployment.

(S//SI//REL) Features:

• LxT Model: 900/1800/1900MHz
• LxU Model: 850/1800/1900MHz
• Pico-class (1Watt) Base station
• Optional Battery Kits
• Highly Mobile and Deployable
• Integrated GPS, MS, & 802.11
• Voice & High-speed Data
• SMS Capability

(S//SI//REL) Enclosure:

• 1.9″H x 8.6″W x 6.3″D
• Approximately 3 lbs
• Actively cooled for extreme environments

(S//SI//REL) EBSR System Kit:

• EBSR System
• AC/DC power converter
• Antenna to support MS, GPS, WIFI, & RF
• LAN, RF, & USB cables
• Pelican Case
• (Field Kit only) Control Laptop and Accessories

(S//SI//REL) Separately Priced Options:

• 90 WH LiIon Battery Kit

(S//SI//REL) Base Station Router Platform:

• Multiple BSR units can be interconnected to form a macro network using 802.3 and 802.11 back-haul.
• Supports Landshark/Candygram capabilities.

Status:

Unit Cost: $40K

PICASSO

(S//SI//REL) Modified GSM (target) handset that collects user data, location information and room audio. Command and data exfil is done from a laptop and regular phone via SMS (Short Messaging Service), without alerting the target.

(S//SI) Target Data via SMS:

• Incoming call numbers
• Outgoing call numbers
• Recently registered networks
• Recent Location Area Codes (LAC)
• Cell power and Timing Advance information (GEO)
• Recently Assigned TMSI, IMSI
• Recent network authentication challenge responses
• Recent successful PINs entered into the phone during the power-on cycle
• SW version of PICASSO implant
• ‘Hot-mic’ to collect Room Audio
• Panic Button sequence (sends location information to an LP Operator)
• Send Targeting Information (i.e. current IMSI and phone number when it is turned on—in case the SIM has just been switched).
• Block call to deny target service.

(S//SI//REL) Handset Options

• Eastcom 760c+
• Samsung E600, X450
• Samsung C140
• (with Arabic keypad/language option)

(S//SI) PICASSO Operational Concept

(S//SI//REL) Uses include asset validation and tracking and target templating. Phone can be hot mic’d and has a “Panic Button” key sequence for the witting user.

Status: 2 weeks ARO (10 or less)

Unit Cost: approx $2000

SURLYSPAWN

(TS//SI//REL TO USA,FVEY) Data RF retro-reflector. Provides return modulated with target data (keyboard, low data rate digital device) when illuminated with radar.

(U) Capabilities
(TS//SI//REL TO USA,FVEY) SURLYSPAWN has the capability to gather keystrokes without requiring any software running on the targeted system. It also only requires that the targeted system be touched once. The retro-reflector is compatible with both USB and PS/2 keyboards. The simplicity of the design allows the form factor to be tailored for specific operational requirements. Future capabilities will include laptop keyboards.

(U) Concept of Operation
(TS//SI//REL TO USA,FVEY) The board taps into the data line from the keyboard to the processor. The board generates a square wave oscillating at a preset frequency. The data-line signal is used to shift the square wave frequency higher or lower, depending on the level of the data-line signal. The square wave, in essence, becomes frequency shift keyed (FSK). When the unit is illuminated by a CW signal from a nearby radar, the illuminating signal is amplitude-modulated (AM) with this square wave. The signal is re-radiated, where it is received by the radar, demodulated, and the demodulated signal is processed to recover the keystrokes. SURLYSPAWN is part of the ANGRYNEIGHBOR family of radar retro-reflectors.

Unit Cost: $30

Status: End processing still in development.