How the NSA hacks PCs, phones, routers and hard disks.

It's not as bad as you thought - it's much worse

By Iain Thomson, 31st December 2013 and reprinted from The Register

A leaked NSA cyber-arms catalog has shed light on the technologies US and UK spies use to infiltrate and remotely control PCs, routers, firewalls, phones and software from some of the biggest names in IT.

The exploits, often delivered via the web, provide clandestine backdoor access across networks, allowing the intelligence services to carry out man-in-the-middle attacks that conventional security software has no chance of stopping.

And if that fails, agents can simply intercept your hardware deliveries from Amazon to install hidden gadgets that rat you out via radio communications.

The 50-page top-secret document, written by an NSA division called ANT, is part of an information dump sent to German magazine Der Spiegel, and expounded upon by journalist Jacob Appelbaum in his keynote to the 30th Chaos Communication Congress in Germany on Monday 30th December.

The dossier is a glorified shopping catalogue of technology for spies in the so-called "Five Eyes" alliance of the UK, the US, Canada, Australia, and New Zealand. It gives the clearest view yet of what the NSA, GCHQ and associated intelligence agencies can do with your private data, and how they manage it. Here's an easy-to-digest roundup of what was discussed.


Satellite and optical-fiber communications stored
According to Appelbaum, the NSA is running a two-stage data dragnet operation. The first stage is TURMOIL, which collects data traffic passively via satellite and cable taps and stores it – in some cases for up to 15 years – for future reference. The NSA does not consider this surveillance because no human operator is involved, just automatic systems.

Der Spiegel gave the example of the SEA-ME-WE-4 underwater cable system, which runs from Europe to North Africa, then on to the Gulf states to Pakistan and India before terminating in the Far East. The documents show that on February 13 this year a tap was installed on the line by the NSA that gave layer-two access to all internet traffic flowing through that busy route.

However, this passive capability is backed up by TURBINE, the active intervention side of the NSA, run by its Tailored Access Operations (TAO) hacking squad. By using a selection of hardware and software tools, not to mention physical measures as we'll see later on, the NSA promises that systems can be hacked "at the speed of light," and the staffers in Maryland even took time to build a LOLcat picture highlighting the capability:

"Tailored Access Operations is a unique national asset that is on the front lines of enabling NSA to defend the nation and its allies," the NSA said in a statement on the report, adding that TAO's "work is centred on computer network exploitation in support of foreign intelligence collection."


Windows crash reports boon for spies
On the subject of operating systems, Appelbaum said the documents revealed subversion techniques against Windows, Linux, and Solaris. In the case of Microsoft, the NSA is monitoring Windows software crash reports to gain insight into vulnerabilities on a target system and exploit them for its own ends.

“Customers who choose to use error reports send limited information about, for example, the process, application, or device driver, that may have encountered a problem," a Microsoft spokesperson told El Reg in a statement responding to Der Spiegel's report.
"Reports are then reviewed and used to improve customer experiences. Microsoft does not provide any government with direct or unfettered access to our customer’s data. We would have significant concerns if the allegations about government actions are true."


NSA buys up security exploits to attack vulnerabilities
When it comes to active penetration, the TAO team has a system dubbed QUANTUMTHEORY, an arsenal of zero-day exploits that it has either found itself or bought on the open market from operators like VUPEN. Once inside a computer, software dubbed SEASONEDMOTH is automatically secreted and used to harvest all activity by the target in a 30-day period.

For computers and networks that have firewalls and other security systems in place, the NSA uses QUANTUMNATION, a tool that will scan defenses using software dubbed VALIDATOR to find an exploitable hole, and then use it to seize control using code dubbed COMMENDEER.

A system dubbed QUANTUMCOPPER also gives the NSA the ability to interfere with TCP/IP connections and disrupt downloads to inject malicious code or merely damage fetched files. Appelbaum said such a system could be used to crash anonymizing systems like Tor by forcing an endless series of resets – and makes the designers of the Great Firewall of China look like amateurs.


The website you are visiting is really not the website you want
But it's a scheme dubbed QUANTUMINSERT that Appelbaum said was particularly concerning. The documents show that if a target tries to log onto Yahoo! servers, a subverted local router can intercept the request before it hits Meyer & Co's data center and redirect it to a NSA-hosted mirror site where all activity can be recorded and the connection tampered.

It's not just Yahoo! in the firing line: QUANTUMINSERT can be set up to automatically attack any computer trying to access all sorts of websites. The code predominantly injects malware into religious or terrorism websites to seize control of vulnerable web browsers and their PCs.

But the technology has also been spotted monitoring visits to sites such as LinkedIn and CNN.com, and will work with most major manufacturer's routers to pull off its software injection. (If you think using HTTPS will highlight any of these man-in-the-middle attacks, bear in mind it's believed that the NSA and GCHQ have penetrated the security certificate system underpinning SSL/TLS to allow the agencies' computers to masquerade as legit web servers.)

According to the catalog, Cisco hardware firewalls, such as the PIX and ASA series, and Juniper Netscreen and ISG 1000 products, can have backdoors installed in their firmware to monitor traffic flowing in and out of small businesses and corporate data centers. A boot ROM nasty exists for the Huawei Eudemon firewalls, we're told; Huawei being the gigantic Chinese telcoms electronics maker. Other BIOS-level malware is available for Juniper and and Hauawei routers, according to the dossier.

"At this time, we do not know of any new product vulnerabilities, and will continue to pursue all avenues to determine if we need to address any new issues. If we learn of a security weakness in any of our products, we will immediately address it," said Cisco in a blog post.

"As we have stated prior, and communicated to Der Spiegel, we do not work with any government to weaken our products for exploitation, nor to implement any so-called security ‘back doors’ in our products."


The cellphone network you are connected to is not the network you want
Mobile communications are also wide open, it seems. The NSA catalog offers a mobile base station called the Typhon HX (priced at $175,800) that will mimic a network provider's infrastructure and collect mobile signals to decode and study; it effectively taps cellphones.

Appelbaum said this type of hacking was spotted in action by the Ecuadorian embassy shortly after Julian Assange arrived as a house guest. The embassy's staff started getting welcome messages from Uganda Telecom on their mobile because the British intelligence services hadn't reconfigured their data slurping base-station correctly from a previous operation, apparently.

Mobile phone SIM cards can also be easily hacked, the documents claim, using a tool dubbed MONKEYCALANDER. This exploits a flaw, only recently spotted by security researchers but used by the NSA since 2007, that allows code to be installed on a SIM card that will track and monitor an individual user's calls and location.

The catalog also details an exploit called DROPOUTJEEP which claims it can gain complete control of an Apple iPhone via a back door, at least back in 2007 when the cyber weapon catalog was drawn up. The NSA says the DROPOUTJEEP exploit has a 100 per cent success rate, leading Applebaum to speculate that Cupertino may have helped the NSA out with the software. The first version of DROPOUTJEEP needed an agent to get his or her hands on the device, but remotely launched versions were promised.

Also listed is flash ROM malware for compromising satellite phones, in case you felt like using that, plus exploits to remotely control Windows Mobile handsets.

Speaking of Windows, NIGHTSTAND is a handy little box of tricks that can, with a range of 8 miles, transmit carefully crafted Wi-Fi traffic to potentially gain control of a PC running Windows XP and Internet Explorer. A tiny Linux-powered computer called SPARROW II can be fitted to drones to scope out poorly secured wireless networks from the skies.


Your hard disk is not the device you thought it was
Hard drives are also easy meat for the NSA, according to the documents. Software called IRATEMONK can be installed on the firmware in disks from Western Digital, Seagate, Maxtor, and Samsung to allow full access to the target's data and operating system. And because it's flashed onto the chips, via other remotely installed malware, the customized firmware is almost impossible to detect. This allows spies to hide and execute anything they like on the connected computer, even if the drive is wiped.

If you want to see how a reprogrammed disk firmware can silently alter files, turn to this independent, earlier research. An example target of IRATEMONK cited by the NSA is a cyber-cafe of PCs.

"Western Digital has no knowledge of, nor has it participated in the development of technology by government entities that create ‘implants’ on Western Digital hard drives, as Der Spiegel described," a WD spokesperson told El Reg in a statement.


The parcels from Amazon are not the parcels you want
On the hardware front, the TAO hacking team also has specialists in "close access operations" or "Off Net" projects where physical access is required to a target's system. This can involve intercepting laptops ordered online from Amazon and others, adding tracking hardware, and then delivering them as normal in the correct packaging, as well as breaking into private property for hardware installation.

The catalog offers a number of hardware tools that can be installed by a g-man. $200,000, for example, will buy you 50 USB cables that have a secondary radio communications system called COTTONMOUTH that allows the agency to send and collect data directly through the ether. A VGA monitor cable called RAGEMASTER intercepts video signals and beams them to a nearby government snoop using a radar-based technique. A similar device exists for keyboards.

Those cables were built by the NSA's ANT team, which also has a fondness for attacking and infiltrating the firmware on your PC: this is the low-level software that's not without its bugs, first to run, and boots your operating system. If this is compromised and reprogrammed using the ANT crew's SWAP program, then it's pretty much game over for the target as the whole system above the firmware can be remotely controlled and monitored as required. Another tool called WISTFULTOLL leaps upon Windows Management Instrumentation to access data on systems.

The NSA has also developed a set of tiny surveillance electronics dubbed HOWLERMONKEY that hides within computer hardware, such as an ordinary Ethernet port, Appelbaum said. The one pictured above, dubbed FIREWALK, looks no different to a standard RJ45 socket, but can inject data into and slurp any bytes from packets coming through the physical connection automatically, and relay the information back to base via a radio link.

Wireless communications can also be subverted by installing a separate Wi-Fi card dubbed BULLDOZER. Even if the user has wireless switched off by default, a PCI-connected BULLDOZER can be used to link into a nearly subverted router and collect metadata and content from targeted systems.

Servers built by HP and Dell were also mentioned as an easily subverted system. Hardware dubbed GODSURGE can be fitted to a JTAG debugging port in Dell's PowerEdge machines to provide full access, and the catalogue says such monitoring uses common off-the-shelf components that can't be directly attributed to the NSA.

IRONCHEF, we're told, is a BIOS-level nasty designed to target HP ProLiant kit; its PowerEdge cousin is called DEITYBOUNCE.


Where to find all the leaked information
The full document set has now been uploaded to whistleblowing website Cryptome for public perusal. Appelbaum and the Der Spiegel team have been careful to exclude the published names of NSA staff who carry out these attacks, and the names of the people and organizations the agency has targeted. An interactive infographic summarizing the leaks can be found here.

El Reg has contacted all of the companies named by Appelbaum in his presentation, but had limited response given that it’s the Christmas holidays. But if the dossier is to be believed, then there are going to be angry words between the NSA, manufacturers and hardware customers – the latter likely to be searching for more secure products.

Appelbaum said that he'd tried to talk to US legislators about the situation but was continually rebuffed. Part of the problem, he said, was that politicians don't understand the technology behind such systems, and in many cases the lawmakers don’t want to acknowledge there's a problem until a political solution has been worked out.

The leaked catalogue is roughly six years old; new technologies developed in the mean time by the NSA (estimated annual budget: $10bn) are anyone's guess, or worst nightmares. Readers may find some cheer, or not, from the suggestion that most of these techniques are used against highly targeted individuals rather than everyone en mass: NSA analysts need the help of the FBI and CIA to install the hidden hardware snoopers, for example, either by intercepting shipments or by carrying out a so-called black bag job.

The intelligence agencies argue they are combatting terrorism, a claim that is now being fought over in the US courts. Today, questions remain as to who exactly is scrutinizing these surveillance operations and to what level – and who else has their hands on these grave security vulnerabilities that the NSA is otherwise sitting on and secretly exploiting.

"The real problem is who is in charge here," Jon Callas, cofounder of the Silent Circle encrypted communications system, told The Register.


Referring to the secretive FISA court that supposedly oversees the NSA, Callas continued: "For us who are Americans we have the belief that we are ultimately in charge. Now it seems we have secret courts, with secret laws, so how do you run a free society under those kind of conditions?"
"We have a societal belief that some things are not acceptable and while Jake can be hyperbolic, I cheer him on – sunlight is the best disinfectant."


Bootnote
With the exception of SEASONEDMOTH, there's no mention of any of these exploits having a time-limited kill switch. Presumably the NSA has means of deactivating online taps, but one wonders how much kit is out there on eBay and with dealers that still contains examples of ANT's intrusive craft.
Applebaum suggests that those interested (which should include pretty much everyone in the security industry as well as IT departments purchasing on the grey market) should look for samples that use the RC6 block cipher and which emit encrypted UDP traffic.

Updated to add

Dell got in touch with us after publication to deny any involvement in the vulnerabilities exploited by the NSA:

We take very seriously any issues that may impact the integrity of our products or customer security and privacy. Should we become aware of a possible vulnerability in any of Dell’s products we will communicate with our customers in a transparent manner as we have done in the past.

Dell does not work with any government – United States or otherwise – to compromise our products to make them potentially vulnerable for exploit. This includes ‘software implants’ or so-called ‘backdoors’ for any purpose whatsoever.

In a statement, Apple echoed much of what Dell and other vendors have said:

Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. Additionally, we have been unaware of this alleged NSA program targeting our products.

Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them.

Comment

Mark Richards January 2014

I was sufficiently concerned by the content of this article to consider it worth copying and reprinting. However I would ask you to take the following into consideration – both good and not so good thoughts.

1. The paper was presented to the Annual Congress of the Chaos Computing Club which is the largest grouping of computer hackers in the world. The Club maintains that anything that its members carry out in the form of “hacking” is purely for research and highlighting purposes.
2. The policy document to which the Paper refers is now 6 years old. It is a matter of conjecture as to whether matters have become more complex and sophisticated or more transparent and accountable. After the activities of Edward Snowden, it is difficult to know what to think.

Creating a Total Overhead Recovery business model

 I have spent the majority of my working life either running my own business or in a management role in other peoples’ businesses. When I started I had little understanding of the concepts of modelling a business and in any event, before the advent of computerised spreadsheets, producing a model on paper was a laborious and difficult activity.

Thus, in the 70's when Banks and other sources of finance for a new and small business were making a decision to lend or not, the decision was often based on personality and confidence than on solid evidence.

However as spreadsheets became more accessible the canny Bank manager would ask questions that required the presentation of items such as a Business Forecast, Marketing Plan and Cash Flow Forecast. In retrospect my first presentations were based on intelligent guess work. These “guesses” pandered to the widely held belief that such Plans are just window dressing and they never work in practice.

At some stage in the mid 80s’, a series of events occurred, related to my involvement in the design of job costing, print costing and manufacturing control software systems, that made me start to grasp the concept of “Total Overhead Recovery” (TOR). The concept of TOR states that it must be possible to model every aspect of a Business in a spreadsheet and as a result be able to predict with a degree of accuracy the real progress of the business through the proper management of the resources that are utilised by the business.

An analogous situation, in which I am interested as a hobby, is the relationship between theoretical physics and cosmology where the scientists use mathematics to predict how the universe should work and then countries and their universities spend vast sums of money to construct and furnish the equipment that proves (or otherwise) the mathematical models and theories that have been conjured up, often decades before.

Let us look at the concept of TOR in action for the small information technology business in which I have the most experience. I will describe in words the process of building the spreadsheet model.

First of all we make a fundamental difference between the expenditure on resources that are directly related to or attributable to the work for that customer and those that are “indirect” or “overheads”. As an example, if the IT company was to supply a system comprising of servers, workstations and peripherals., the direct costs of the purchase for resale of the necessary equipment and software would usually represent 60% of the final invoice and contain a profit element of say 20%. In a TOR model, we do not include the monies related to the purchase and resale of the materials but we do include the profit.

It has proved reasonable to assume across the years for an IT business, that for each 100 € of billable products and services that 40% will be for materials and 60% for labour. Thus for each 100 € we may assume that 68 € is available to cover all of the expenses of the business and provide a profit. We can now discard materials and direct costs from our TOR business model.

The type of resources that we describe as “overheads” will be different from one business type to another. The traditional categorisation of business will often be a good indicator of the type of resources in use. A quarry producing stone, sand and gravel will have to purchase or obtain land, a cruise company will have to acquire a boat. In the case of a cruise company the most important overhead by value will be the boat. In an information technology business, the most important resource is experienced, professional labour.

If the information technology business is based upon the offer of available technicians for 52 weeks of the year during reasonable working hours, there must be more than one in order to provide the necessary coverage. In addition, it would be extremely unusual that a technician would be competent to provide every element of service sold by by an IT Company. An obvious example would be a difference between software programmers and hardware technicians. Most IT staff will have a cognisance of all the roles within an IT Company but will tend to specialise in one type of service provision. As a direct result of this statement, experience in the IT industry suggests that the minimum successful Technical Team size is five staff.

As this document is a discussion about TOR, we are not interested in the overall business but in the process or minutiae of the calculation. What we can say is that each of the staff must have access to a vehicle in order to visit Clients, they need to be housed in a premises, they need a workshop, storage facilities, access to shared test equipment, support by administrative and financial services, access to communications facilities such as telephone and internet. They need training, a technical library, equipment to play with and so on. Every single element of the above list and more must be taken into consideration in the TOR calculation.

Before starting on an explanation of the detail of the calculation, there is another strand to consider. The entire list of resources including the salaries and direct costs of employed staff, must be paid for with money. Logically the money is provided through the income achieved by the sales of products and services to Clients. However there is a time lag. We need the resources on day one before we can offer services to Clients. In addition there is always a time lag between negotiating a sale and receiving all of the money. There may be several ways to ameliorate the problems caused by the time lag, such as deposits and invoice factoring but fundamentally, the provision of the resource of finance has a cost, irrespective of the source of that finance – bank or other lending or introduction of capital by the proprietors of the business or shareholders. These costs must be included in the TOR and one of the classic mistakes in a TOR calculation is to forget the cost of money.

Different businesses have different models. In our IT business model, we start with a fully costed technician. In a c ruise company or hotel complex, we would start witha fully costed accomodation unit.

Experience demonstrates that the salary cost and direct employment cost of a technician is the largest element of the fully costed technician. For the purpose of explanation we would be able to research the salary levels offered in the marketplace and establish that 25k to 30k €uros per annum for Spain would be reasonable. To this we add the cost of employment in Spain and arrive at a figure of 45k €uros.

We have already identified that we need at least 5 technicians. So we can immediately say that the cost of our our productive labour force is 225k €uros. We know that our team will need administrative, secretarial and financial assistance. It is also clear that someone has to manage the contact with Clients and carry out the sales and negotiation process. Our ideal IT Business will also have an owner who should receive remuneration for his/her activity. In our small IT business, the staffing has now risen to say 10.

This additional staffing cost must be paid for by our production staff. This increases the cost of a productive technician to say 80k€ per year.

As we have said previously, the productive labour force requires an establishment from which to operate and access to all different types of facilities and assets, including an office, workshop, computers, desks and so on. In addition, we must add the cost of finance, borrowing costs and other professional and sub contract costs.

This adds at least another 20k € per technician per year. Thus for the purpose of our TOR model we have a final figure of 100k €uros per year, or 500k €uros in total for the whole business. Our 500k €uros reprsents the 68€ of our nominal 100€ billed to the Client.

Thus our ideal small IT Business needs to sell products and services to the tune of 736k €uros to generate a small profit for the year.

There are plenty of statistics about how many hours a person works in a year. For the purposes of our calculation we will assume that a technician can be productive for 200 days in a year and 7 hours in a day. This equates to 1400 productive hours in a year. We have 5 productive staff. Therefore our total productive hours is 7000 hours. If we divide the target annual turnover by the number of hours in the year for this model business, we would arrive at a requirement to charge 105 € per hour for each hour worked.

In practice the figure is a little lower than this because during our calculation process we included the profit element of the sale of equipment and software. This equates to 15€ of 105€, arriving at a final chargeable cost of 90€ per hour.

So far we have built a model. It is based on arbirary formulas which are individually correct but when one introduces values into the formula, the results are not that which we anticipated or desire. The most most important issue for the modsel of our small IT Business, is that in the current economic climate, it is not possible to sell a Technician for 90€ per hour.

Traditional micro economic theory draws a graph relating the price of an item to the demand for that item. In perfect competitive market conditions, if the item is made available at a price of zero or nearly nothing, the entire universe of potential clients for that item will make the necessary sacrifice or payment to obtain it. At the other end of the graph, where the price of the item is ridiculously high, no one in the unverse of clients will consider the benefit that they obtain from the item to be worth the cost and none will be sold. In the real world, movement along the graph is restricted to the sensible middle where the price and fluctuations in the price according to circumstances, practicalities and pressure from competitors. In our IT business, the financial management would set budgets for costs, especially salaries and the market/sales staff would undertake to obtain sufficient revenue when the chargeable hour was set at 70 € per hour.

The important thing that has been achieved by the creation of our TOR business model is that every member of the staff can now understand their role and importance in the business. Small business is stressful. If the business owner wishes to ensure that the stress falls fairly on all members of the business it is best that the owner creates a cooperative as opposed to a combatitive approach to personnel management.

Realignment of British Politics, here we come

Now we have the fascinating prospect of both Labour and Conservative Parties splitting apart between those who would countenance an alliance with the Liberal Democrats and those who would not.

Are we to be presented with the amazing prospect of a complete re-alignment of British Politics where the extremists in both Socialist and Tory are consigned to the margins and the center ground becomes the Government of the future?

Balanced Parliament

I am cheesed off by the constant references to a Hung Parliament on the News broadcasts. What we should be talking about is the serious possibility of a Balanced Parliament - a House of Commons and Government that might actually represent the majority of the people of the country and contain a selection of ideas from more than one group of people.

That is a fundamentally good thing rather than a bad thing.

The result of having a Balanced Parliament, that included the Liberal Democrats, would ensure that politics and democracy in Great Britain would be irrevocably changed by the introduction of a proportional electoral system to ensure that The Electoral Majority was always in charge of the Government which has not been the case for over thirty years.

In addition, Great Britain will take up its proper place in the centre of Europe including utilising a currency and economic system that has catapulted many European states from obscurity to success in just a few years.