Entries Tagged "NSA"

Page 33 of 56

CTX4000: NSA Exploit of the Day

Today’s device—this one isn’t an implant—from the NSA’s Tailored Access Operations (TAO) group implant catalog:

CTX4000

(TS//SI//REL TO USA,FVEY) The CTX4000 is a portable continuous wave (CW) radar unit. It can be used to illuminate a target system to recover different off net information. Primary uses include VAGRANT and DROPMIRE collection.

(TS//SI//REL TO USA,FVEY) The CTX4000 provides the means to collect signals that otherwise would not be collectable, or would be extremely difficult to collect and process. It provides the following features:

  • Frequency Range: 1 – 2 GHz.
  • Bandwidth: Up to 45 MHz
  • Output Power: User adjustable up to 2 W using the internal amplifier; external amplifiers make it possible to go up to 1 kW.
  • Phase adjustment with front panel knob
  • User-selectable high- and low-pass filters.
  • Remote controllable
  • Outputs:
  • Transmit antenna
  • I and Q video outputs
  • DC bias for an external pre-amp on the Receive input connector
  • Inputs:
    • External oscillator
    • Receive antenna

Unit Cost: N/A

Status: unit is operational. However, it is reaching the end of its service life. It is scheduled to be replaced by PHOTOANGLO staring in September 2008.

Page, with graphics, is here. General information about TAO and the catalog is here.

We’ve already seen reference to VAGRANT and DROPMIRE. The first collects data off computer screens, the second from printers with “purely proximal access.”

In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Posted on January 20, 2014 at 2:20 PM • View Comments

STUCCOMONTANA: NSA Exploit of the Day

Today’s implant from the NSA’s Tailored Access Operations (TAO) group implant catalog:

STUCCOMONTANA

(TS//SI//REL) STUCCOMONTANA provides persistence for DNT implants. The DNT implant will survive an upgrade or replacement of the operating system—including physically replacing the router’s compact flash card.

(TS//SI//REL) Currently, the intended DNT Implant to persist is VALIDATOR, which must be run as a user process on the target operating system. The vector of attack is the modification of the target’s BIOS. The modification will add the necessary software to the BIOS and modify its software to execute the SIERRAMONTANA implant at the end of its native System Management Mode (SMM) handler.

(TS//SI//REL) STUCCOMONTANA must support all modern versions of JUNOS, which is a version of FreeBSD customized by Juniper. Upon system boot, the JUNOS operating system is modified in memory to run the implant, and provide persistent kernel modifications to support implant execution.

(TS//SI//REL) STUCCOMONTANA is the cover term for the persistence technique to deploy a DNT implant to Juniper T-Series routers.

Unit Cost: $

Status: (U//FOUO) STUCCOMONTANA under development and is expected to be released by 30 November 2008.

Page, with graphics, is here. General information about TAO and the catalog is here.

In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Posted on January 17, 2014 at 2:06 PM • View Comments

NSA Collects Hundreds of Millions of Text Messages Daily

No surprise here. Although we learned some new codenames:

  • DISHFIRE: The NSA’s program to collect text messages and text-message metadata.
  • PREFER: The NSA’s program to perform automatic analysis on the text-message data and metadata.

The documents talk about not just collecting chatty text messages, but vCards, SIM card changes, missed calls, roaming information indicating border crossings, travel itineraries, and financial transactions.

Posted on January 17, 2014 at 5:32 AM • View Comments

SIERRAMONTANA: NSA Exploit of the Day

Today’s implant from the NSA’s Tailored Access Operations (TAO) group implant catalog:

SIERRAMONTANA

(TS//SI//REL) SIERRAMONTANA provides persistence for DNT implants. The DNT implant will survive an upgrade or replacement of the operating system—including physically replacing the router’s compact flash card.

(TS//SI//REL) Currently, the intended DNT Implant to persist is VALIDATOR, which must be run as a user process on the target operating system. The vector of attack is the modification of the target’s BIOS. The modification will add the necessary software to the BIOS and modify its software to execute the SIERRAMONTANA implant at the end of its native System Management Mode (SMM) handler.

(TS//SI//REL) SIERRAMONTANA must support all modern versions of JUNOS, which is a version of FreeBSD customized by Juniper. Upon system boot, the JUNOS operating system is modified in memory to run the implant, and provide persistent kernel modifications to support implant execution.

(TS//SI//REL) SIERRAMONTANA is the cover term for the persistence technique to deploy a DNT implant to Juniper M-Series routers.

Unit Cost: $

Status: (U//FOUO) SIERRAMONTANA under development and is expected to be released by 30 November 2008.

Page, with graphics, is here. General information about TAO and the catalog is here.

We have already seen the codename VALIDATOR. It’s the code name for a default, or basic, NSA exploit. It’s the exploit that FOXACID defaults to using.

In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Posted on January 16, 2014 at 2:00 PM • View Comments

Today I Briefed Congress on the NSA

This morning, I spent an hour in a closed room with six members of Congress: Rep. Lofgren, Rep. Sensenbrenner, Rep. Bobby Scott, Rep. Goodlatte, Rep. Mike Thompson, and Rep. Amash. No staffers, no public: just them. Lofgren had asked me to brief her and a few Representatives on the NSA. She said that the NSA wasn’t forthcoming about their activities, and they wanted me—as someone with access to the Snowden documents—to explain to them what the NSA was doing. Of course, I’m not going to give details on the meeting, except to say that it was candid and interesting. And that it’s extremely freaky that Congress has such a difficult time getting information out of the NSA that they have to ask me. I really want oversight to work better in this country.

Surreal part of setting up this meeting: I suggested that we hold this meeting in a SCIF, because they wanted me to talk about top secret documents that had not been made public. The problem is that I, as someone without a clearance, would not be allowed into the SCIF. So we had to have the meeting in a regular room.

EDITED TO ADD: This really was an extraordinary thing.

Posted on January 16, 2014 at 12:27 PM • View Comments

Cell Phone Tracking by Non-State Actors

This is interesting:

Adding credence to the theory that Brooklyn landlord Menachem Stark was kidnapped and murdered by professionals, a law enforcement source tells the Post that the NYPD found a cell phone attached to the bottom of his car, which could have been used to track his movements.

Presumably the criminals installed one of those “track your children” apps that transmits the phone’s GPS data to some database somewhere.

Posted on January 16, 2014 at 7:29 AM • View Comments

SCHOOLMONTANA: NSA Exploit of the Day

Today’s implant from the NSA’s Tailored Access Operations (TAO) group implant catalog:

SCHOOLMONTANA

(TS//SI//REL) SCHOOLMONTANA provides persistence for DNT implants. The DNT implant will survive an upgrade or replacement of the operating system—including physically replacing the router’s compact flash card.

(TS//SI//REL) Currently, the intended DNT Implant to persist is VALIDATOR, which must be run as a user process on the target operating system. The vector of attack is the modification of the target’s BIOS. The modification will add the necessary software to the BIOS and modify its software to execute the SCHOOLMONTANA implant at the end of its native System Management Mode (SMM) handler.

(TS//SI//REL) SCHOOLMONTANA must support all modern versions of JUNOS, which is a version of FreeBSD customized by Juniper. Upon system boot, the JUNOS operating system is modified in memory to run the implant, and provide persistent kernel modifications to support implant execution.

(TS//SI//REL) SCHOOLMONTANA is the cover term for the persistence technique to deploy a DNT implant to Juniper J-Series routers.

Status: (U//FOUO) SCHOOLMONTANA completed and released by ANT May 30, 2008. It is ready for deployment.

Page, with graphics, is here. General information about TAO and the catalog is here.

In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Posted on January 15, 2014 at 2:56 PM • View Comments

HEADWATER: NSA Exploit of the Day

Today’s implant from the NSA’s Tailored Access Operations (TAO) group implant catalog:

HEADWATER

(TS//SI//REL) HEADWATER is a Persistent Backdoor (PDB) software implant for selected Huawei routers. The implant will enable covert functions to be remotely executed within the router via an Internet connection.

(TS//SI//REL) HEADWATER PBD implant will be transferred remotely over the Internet to the selected target router by Remote Operations Center (ROC) personnel. After the transfer process is complete, the PBD will be installed in the router’s boot ROM via an upgrade command. The PBD will then be activated after a system reboot. Once activated, the ROC operators will be able to use DNT’s HAMMERMILL Insertion Tool (HIT) to control the PBD as it captures and examines all IP packets passing through the host router.

(TS//SI//REL) HEADWATER is the cover term for the PBD for Huawei Technologies routers. PBD has been adopted for use in the joint NSA/CIA effort to exploit Huawei network equipment. (The cover name for this joint project is TURBOPANDA.)

STATUS: (U//FOUO) On the shelf ready for deployment.

Page, with graphics, is here. General information about TAO and the catalog is here.

This one is interesting. It basically turns the router into an eavesdropping platform.

In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Posted on January 14, 2014 at 2:10 PM • View Comments

Debunking the "NSA Mass Surveillance Could Have Stopped 9/11" Myth

It’s something that we’re hearing a lot, both from NSA Director General Keith Alexander and others: the NSA’s mass surveillance programs could have stopped 9/11. It’s not true, and recently two people have published good essays debunking this claim.

The first is from Lawrence Wright, who wrote the best book (The Looming Tower) on the lead-up to 9/11:

Judge Pauley cites the 9/11 Commission Report for his statement that telephone metadata “might have permitted the N.S.A. to notify the [F.B.I.] of the fact that al-Mihdhar was calling the Yemeni safe house from inside the United States.” What the report actually says is that the C.I.A. and the N.S.A. already knew that Al Qaeda was in America, based on the N.S.A.’s monitoring of the Hada phone. If they had told the F.B.I., the agents would have established a link to the embassy-bombings case, which “would have made them very interested in learning more about Mihdhar.” Instead, “the agents who found the source were being kept from obtaining the fruits of their work.”

The N.S.A. failed to understand the significance of the calls between the U.S. and Yemen. The C.I.A. had access to the intelligence, and knew that Al Qaeda was in the U.S. almost two years before 9/11. An investigation by the C.I.A.’s inspector general found that up to sixty people in the agency knew that Al Qaeda operatives were in America. The inspector general said that those who refused to coöperate with the F.B.I. should be held accountable. Instead, they were promoted.

The second is by Peter Bergen, another 9/11 scholar:

But is it really the case that the U.S. intelligence community didn’t have the dots in the lead up to 9/11? Hardly.

In fact, the intelligence community provided repeated strategic warning in the summer of 9/11 that al Qaeda was planning a large-scale attacks on American interests.

[…]

All of these serious terrorism cases argue not for the gathering of ever vaster troves of information but simply for a better understanding of the information the government has already collected and that are derived from conventional law enforcement and intelligence methods.

Posted on January 14, 2014 at 7:15 AM • View Comments

1 … 31 32 33 34 35 … 56

Sidebar photo of Bruce Schneier by Joe MacInnis.