Jacob Applebaum's talk at the Chaos Communications Congress

[Magda Hassan]

Worth a watch ! But best watched with a stiff drink at hand. Mmmm...that could be worded better. Anyway, enjoy the learning.

[Magda Hassan]

http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf

[Magda Hassan]

Privacy advocate exposes NSA spy gear at gathering

By RAPHAEL SATTER


Dec. 30, 2013 4:18 PM EST

You are here

Home » Edward Snowden » Privacy advocate exposes NSA spy gear at gathering

Don't miss

• Snowden: NSA's indiscriminate spying 'collapsing'
  
• Report: NSA can access most smartphone data
  

LONDON (AP) A well-known privacy advocate has given the public an unusually explicit peek into the intelligence world's tool box, pulling back the curtain on the National Security Agency's arsenal of high-tech spy gear.
Independent journalist and security expert Jacob Appelbaum on Monday told a hacker conference in Germany that the NSA could turn iPhones into eavesdropping tools and use radar wave devices to harvest electronic information from computers, even if they weren't online.
Appelbaum told hundreds of computer experts gathered at Hamburg's Chaos Communications Conference that his revelations about the NSA's capabilities "are even worse than your worst nightmares."
"What I am going to show you today is wrist-slittingly depressing," he said.
Even though in the past six months there have been an unprecedented level of public scrutiny of the NSA and its methods, Appelbaum's claims supported by what appeared to be internal NSA slideshows still caused a stir.
One of the slides described how the NSA can plant malicious software onto Apple Inc.'s iPhone, giving American intelligence agents the ability to turn the popular smartphone into a pocket-sized spy.
Another slide showcased a futuristic-sounding device described as a "portable continuous wave generator," a remote-controlled device which when paired with tiny electronic implants can bounce invisible waves of energy off keyboards and monitors to see what is being typed, even if the target device isn't connected to the Internet.
A third slide showcased a piece of equipment called NIGHTSTAND, which can tamper with wireless Internet connections from up to 8 miles (13 kilometers) away.
An NSA spokeswoman, Vanee Vines, said that she wasn't aware of Appelbaum's presentation, but that in general should would not comment on "alleged foreign intelligence activities."
"As we've said before, NSA's focus is on targeting the communications of valid foreign intelligence targets not on collecting and exploiting a class of communications or services that would sweep up communications that are not of bona fide foreign intelligence interest to the U.S. government."
The documents included in Appelbaum's presentation were first published by German magazine Der Spiegel on Sunday and Monday.
Appelbaum and Der Spiegel have both played an important role in the disclosures of NSA leaker Edward Snowden, but neither has clarified whether the most recent set of slides came from Snowden.
http://bigstory.ap.org/article/hacker-pu...a-spy-gear

[Magda Hassan]

Internet freedom activist, hacker, and independent journalist Jake Appelbaum was on the team of Der Spiegel reporters that published explosive stories last weekend about the NSA's 'Tailored Access Operations' division, a group of hackers dedicated to finding innovative ways to implant malware on machines and in computer networks. In hacker language, they are the masters of pwnage.
Shortly after publishing the stories on TAO, Appelbaum delivered the above talk at the Chaos Communications Congress, a hacker conference held annually in Hamburg, Germany. Appelbaum describes in detail how the NSA's smartest hackers and engineers devise technologies and solutions to get inside the most heavily protected computers and networks, all over the world. (Here's a PDF file containing images Appelbaum showed in the talk, which come from an internal NSA catalog which advertises spygear for use by US government agents.)
But Appelbaum's contribution to the subject is only part of the story. Security researchers Claudio Guarnieri and Morgan Marquis-Boire, who have done extensive research on the Gamma corporation and its FinFisher malware product line, gave part one of the talk. Their session is the video at the very top of this page.
If you care about privacy in the digital world, find a couple of hours to watch these essential contributions, from practitioners doing the most cutting-edge, public research in the field of internet security and privacy. What you'll learn will shock and disturb you.
While you're watching, keep this in mind:

The NSA/TAO brochure revealing their cool hacking/surveillance products is from 2007. Imagine what they have now.
Christopher Soghoian (@csoghoian) December 30, 2013

[Magda Hassan]

2013-1829.htm Omniquad Exposes You Online December 30, 2013
2013-1828.zip NSA ANT Catalog (Following 11 ANT files) December 30, 2013 (16.2MB)
2013-1827.htm NSA Snowden Releases Tally Update - 916 Pages December 30, 2013
2013-1826.pdf NSA ANT Bildschirm 30C3 @ioerror 11/Series December 30, 2013 (1.6MB)
2013-1825.pdf NSA ANT W-Lan 30C3 @ioerror 10/Series December 30, 2013 (1.6MB)

2013-1824.pdf NSA ANT USB 30C3 @ioerror 9/Series December 30, 2013 (1.6MB)
2013-1823.pdf NSA ANT Tastatu 30C3 @ioerror 8/Series December 30, 2013
2013-1822.pdf NSA ANT Server 30C3 @ioerror 7/Series December 30, 2013 (1.2MB)
2013-1821.pdf NSA ANT Router 30C3 @ioerror 6/Series December 30, 2013 (1.8MB)
2013-1820.pdf NSA ANT Rechner 30C3 @ioerror 5/Series December 30, 2013 (3.4MB)

2013-1819.pdf NSA ANT Raumüberwachung 30C3 @ioerror 4/Series December 30, 2013 (2.3MB)
2013-1818.pdf NSA ANT Mobilfunk 30C3 @ioerror 3/Series December 30, 2013 (3.5MB)
2013-1817.pdf NSA ANT Handys 30C3 @ioerror 2/Series December 30, 2013 (2.5MB)
2013-1816.pdf NSA ANT Firewalls 30C3 @ioerror 1/Series December 30, 2013 (2.1MB)
2013-1815.pdf (above) NSA Catalog Video Slides by Jacob Appelbaum December 30, 2013 (4.2MB)

2013-1814.htm NSA Snowden Releases Tally Update - 866 Pages December 30, 2013
2013-1813.pdf NSA QUANTUM Tasking December 30, 2013 (5.7MB)
2013-1812.pdf NSA QUANTUMTHEORY December 30, 2013 (2.5MB)
2013-1811.pdf NSA TAO ANT COTTONMOUTH (DE Original) December 29, 2013
2013-1810.pdf NSA TAO ANT COTTONMOUTH December 29, 2013

2013-1809.htm NSA Snowden Releases Tally Update - 803 Pages December 29, 2013

[Magda Hassan]

Some more good videos from the conference here
https://www.youtube.com/user/albertveli/...=0&sort=dd

[Peter Lemkin]

Worth a watch ! But best watched with a stiff drink at hand. Mmmm...that could be worded better. Anyway, enjoy the learning.

Holy Moly! And I thought I knew about the NSA's capabilities....I learned a lot! and now fear my nation [and the NSA!] even more than ever before!!!! That talk was brilliant and FRIGHTENING, both! I only hope those with the skills to can find a way of defeating this enemy - but since they have compromised the entire internet and can compromise any device one chooses to use and is already using [and you can bet most of us who do Deep Political research, such as about JFK assassination or 911 et al., already have our devices and living places 'compromised'] we really are no longer in Kansas, Toto! Total Information Awareness! and electronic Fascism, for sure!::::pullhairout::::captain::::lilgreenman::

That radar-frequency penetration device that can be cranked up to 1kWatt [them's a LOT a power] certainly could induce cancer. This I know from my environmental studies. In the past, some people were 'eliminated' by taking them to an airbase and given them a 'tour' of the new fighter aircraft. They'd be told to stand near the front radar antenna [that spear-like nose on all fighter planes] and the radar turned on secretly and silently.....they usually died a few weeks later, or less. So Hugo Chaves may have been correct all along....

[Peter Lemkin]

12/29/201309:18 AM

InsideTAO

DocumentsReveal Top NSA Hacking Unit

BySPIEGEL Staff
TheNSA's TAO hacking unit is considered to be the intelligence agency'stop secret weapon. It maintains its own covert network, infiltratescomputers around the world and even intercepts shipping deliveries toplant back doors in electronics ordered by those it is targeting.
InJanuary 2010, numerous homeowners in San Antonio, Texas, stoodbaffled in front of their closed garage doors. They wanted to driveto work or head off to do their grocery shopping, but their garagedoor openers had gone dead, leaving them stranded. No matter how manytimes they pressed the buttons, the doors didn't budge. The problemprimarily affected residents in the western part of the city, aroundMilitary Drive and the interstate highway known as Loop 410.
Inthe United States, a country of cars and commuters, the mysteriousgarage door problem quickly became an issue for local politicians.Ultimately, the municipal government solved the riddle. Fault for theerror lay with the United States' foreign intelligence service, theNational Security Agency, which has offices in San Antonio. Officialsat the agency were forced to admit that one of the NSA's radioantennas was broadcasting at the same frequency as the garage dooropeners. Embarrassed officials at the intelligence agency promised toresolve the issue as quickly as possible, and soon the doors beganopening again.
Itwas thanks to the garage door opener episode that Texans learned justhow far the NSA's work had encroached upon their daily lives. Forquite some time now, the intelligence agency has maintained a branchwith around 2,000 employees at Lackland Air Force Base, also in SanAntonio. In 2005, the agency took over a former Sony computer chipplant in the western part of the city. A brisk pace of constructioncommenced inside this enormous compound. The acquisition of theformer chip factory at Sony Place was part of a massive expansion theagency began after the events of Sept. 11, 2001.
On-CallDigital Plumbers
Oneof the two main buildings at the former plant has since housed asophisticated NSA unit, one that has benefited the most from thisexpansion and has grown the fastest in recent years -- the Office ofTailored Access Operations, or TAO. This is the NSA's top operativeunit -- something like a squad of plumbers that can be called in whennormal access to a target is blocked.
Accordingto internal NSA documents viewed by SPIEGEL, these on-call digitalplumbers are involved in many sensitive operations conducted byAmerican intelligence agencies. TAO's area of operations ranges fromcounterterrorism to cyber attacks to traditional espionage. Thedocuments reveal just how diversified the tools at TAO's disposalhave become -- and also how it exploits the technical weaknesses ofthe IT industry, from Microsoft to Cisco and Huawei, to carry out itsdiscreet and efficient attacks.
Theunit is "akin to the wunderkind of the US intelligencecommunity," says Matthew Aid, a historian who specializes in thehistory of the NSA. "Getting the ungettable" is the NSA'sown description of its duties. "It is not about the quantityproduced but the quality of intelligence that is important," oneformer TAO chief wrote, describing her work in a document. The paperseen by SPIEGEL quotes the former unit head stating that TAO hascontributed "some of the most significant intelligence ourcountry has ever seen." The unit, it goes on, has "accessto our very hardest targets."
AUnit Born of the Internet
Definingthe future of her unit at the time, she wrote that TAO "needs tocontinue to grow and must lay the foundation for integrated ComputerNetwork Operations," and that it must "support ComputerNetwork Attacks as an integrated part of military operations."To succeed in this, she wrote, TAO would have to acquire "pervasive,persistent access on the global network." An internaldescription of TAO's responsibilities makes clear that aggressiveattacks are an explicit part of the unit's tasks. In other words, theNSA's hackers have been given a government mandate for their work.During the middle part of the last decade, the special unit succeededin gaining access to 258 targets in 89 countries -- nearly everywherein the world. In 2010, it conducted 279 operations worldwide.
Indeed,TAO specialists have directly accessed the protected networksof democraticallyelected leaders ofcountries. They infiltrated networks of European telecommunicationscompanies and gained access to and read mails sent over Blackberry'sBES email servers, which until then were believed to be securelyencrypted. Achieving this last goal required a "sustained TAOoperation," one document states.
ThisTAO unit is born of the Internet -- created in 1997, a time when noteven 2 percent of the world's population had Internet access and noone had yet thought of Facebook, YouTube or Twitter. From the timethe first TAO employees moved into offices at NSA headquarters inFort Meade, Maryland, the unit was housed in a separate wing, setapart from the rest of the agency. Their task was clear from thebeginning -- to work around the clock to find ways to hack intoglobal communications traffic.
Recruitingthe Geeks
Todo this, the NSA needed a new kind of employee. The TAO workersauthorized to access the special, secure floor on which the unit islocated are for the most part considerably younger than the averageNSA staff member. Their job is breaking into, manipulating andexploiting computer networks, making them hackers and civil servantsin one. Many resemble geeks -- and act the part, too.
Indeed,it is from these very circles that the NSA recruits new hires for itsTailored Access Operations unit. In recent years, NSA Director KeithAlexander has made several appearances at major hacker conferences inthe United States. Sometimes, Alexander wears his military uniform,but at others, he even dons jeans and a t-shirt in his effort tocourt trust and a new generation of employees.
Therecruitment strategy seems to have borne fruit. Certainly, few if anyother divisions within the agency are growing as quickly as TAO.There are now TAO units in Wahiawa, Hawaii; Fort Gordon, Georgia; atthe NSA's outpost at Buckley Air Force Base, near Denver, Colorado;at its headquarters in Fort Meade; and, of course, in San Antonio.
Onetrail also leads to Germany. According to a document dating from 2010that lists the "Lead TAO Liaisons" domestically and abroadas well as names, email addresses and the number for their "SecurePhone," a liaison office is located near Frankfurt -- theEuropean Security Operations Center (ESOC) at the so-called "DaggerComplex"at a US military compound in the Griesheim suburb of Darmstadt.
Butit is the growth of the unit's Texas branch that has been uniquelyimpressive, the top secret documents reviewed by SPIEGEL show. Thesedocuments reveal that in 2008, the Texas Cryptologic Center employedfewer than 60 TAO specialists. By 2015, the number is projected togrow to 270 employees. In addition, there are another 85 specialistsin the "Requirements & Targeting" division (up from 13specialists in 2008). The number of software developers is expectedto increase from the 2008 level of three to 38 in 2015. The SanAntonio office handles attacks against targets in the Middle East,Cuba, Venezuela and Colombia, not to mention Mexico, just 200kilometers (124 miles) away, where the government has fallen into theNSA's crosshairs.
TargetingMexico
Mexico'sSecretariat of Public Security, which was folded into the newNational Security Commission at the beginning of 2013, wasresponsible at the time for the country's police, counterterrorism,prison system and border police. Most of the agency's nearly 20,000employees worked at its headquarters on Avenida Constituyentes, animportant traffic artery in Mexico City. A large share of the Mexicansecurity authorities under the auspices of the Secretariat aresupervised from the offices there, making Avenida Constituyentes aone-stop shop for anyone seeking to learn more about the country'ssecurity apparatus.
OperationWHITETAMALE
Thatconsidered, assigning the TAO unit responsible for tailoredoperations to target the Secretariat makes a lot of sense. After all,one document states, the US Department of Homeland Security and theUnited States' intelligence agencies have a need to know everythingabout the drug trade, human trafficking and security along theUS-Mexico border. The Secretariat presents a potential "goldmine"for the NSA's spies, a document states. The TAO workers selectedsystems administrators and telecommunications engineers at theMexican agency as their targets, thus marking the start of what theunit dubbed Operation WHITETAMALE.
Workersat NSA's target selection office, which also had Angela Merkel in itssights in 2002 before she became chancellor, sent TAO a list ofofficials within the Mexican Secretariat they thought might makeinteresting targets. As a first step, TAO penetrated the targetofficials' email accounts, a relatively simple job. Next, theyinfiltrated the entire network and began capturing data.
Soonthe NSA spies had knowledge of the agency's servers, including IPaddresses, computers used for email traffic and individual addressesof diverse employees. They also obtained diagrams of the securityagencies' structures, including video surveillance. It appears theoperation continued for years until SPIEGEL firstreported on it in October.
Thetechnical term for this type of activity is "Computer NetworkExploitation" (CNE). The goal here is to "subvert endpointdevices," according to an internal NSA presentation that SPIEGELhas viewed. The presentation goes on to list nearly all the types ofdevices that run our digital lives -- "servers, workstations,firewalls, routers, handsets, phone switches, SCADA systems, etc."SCADAs are industrial control systems used in factories, as well asin power plants. Anyone who can bring these systems under theircontrol has the potential to knock out parts of a country's criticalinfrastructure.
Themost well-known and notorious use of this type of attack was thedevelopment of Stuxnet, the computer worm whose existence wasdiscovered in June 2010. The virus was developed jointly by Americanand Israeli intelligence agencies to sabotage Iran's nuclear program,and successfully so. The country's nuclear program was set back byyears after Stuxnet manipulated the SCADA control technology used atIran's uranium enrichment facilities in Natanz, rendering up to 1,000centrifuges unusable.
Thespecial NSA unit has its own development department in which newtechnologies are developed and tested. This division is where thereal tinkerers can be found, and their inventiveness when it comes tofinding ways to infiltrate other networks, computers and smartphonesevokes a modern take on Q, the legendary gadget inventor in JamesBond movies.
HavingFun at Microsoft's Expense
Oneexample of the sheer creativity with which the TAO spies approachtheir work can be seen in a hacking method they use that exploits theerror-proneness of Microsoft's Windows. Every user of the operatingsystem is familiar with the annoying window that occasionally pops upon screen when an internal problem is detected, an automatic messagethat prompts the user to report the bug to the manufacturer and torestart the program. These crash reports offer TAO specialists awelcome opportunity to spy on computers.
WhenTAO selects a computer somewhere in the world as a target and entersits unique identifiers (an IP address, for example) into thecorresponding database, intelligence agents are then automaticallynotified any time the operating system of that computer crashes andits user receives the prompt to report the problem to Microsoft. Aninternal presentation suggests it is NSA's powerful XKeyscore spyingtool that is used to fish these crash reports out of the massive seaof Internet traffic.
Theautomated crash reports are a "neat way" to gain "passiveaccess" to a machine, the presentation continues. Passive accessmeans that, initially, only data the computer sends out into theInternet is captured and saved, but the computer itself is not yetmanipulated. Still, even this passive access to error messagesprovides valuable insights into problems with a targeted person'scomputer and, thus, information on security holes that might beexploitable for planting malware or spyware on the unwitting victim'scomputer.
Althoughthe method appears to have little importance in practical terms, theNSA's agents still seem to enjoy it because it allows them to have abit of a laugh at the expense of the Seattle-based software giant. Inone internal graphic, they replaced the text of Microsoft's originalerror message with one of their own reading, "This informationmay be intercepted by a foreign sigint system to gather detailedinformation and better exploit your machine." ("Sigint"stands for "signals intelligence.")
Oneof the hackers' key tasks is the offensive infiltration of targetcomputers with so-called implants or with large numbers of Trojans.They've bestowed their spying tools with illustrious monikers like"ANGRY NEIGHBOR," "HOWLERMONKEY" or "WATERWITCH."These names may sound cute, but the tools they describe are bothaggressive and effective.
Accordingto details in Washington's current budget plan for the USintelligence services, around 85,000 computers worldwide areprojected to be infiltrated bythe NSA specialists by the end of this year. By far the majority ofthese "implants" are conducted by TAO teams via theInternet.
IncreasingSophistication
Untiljust a few years ago, NSA agents relied on the same methods employedby cyber criminals to conduct these implants on computers. They senttargeted attack emails disguised as spam containing links directingusers to virus-infected websites. With sufficient knowledge of anInternet browser's security holes -- Microsoft's Internet Explorer,for example, is especially popular with the NSA hackers -- all thatis needed to plant NSA malware on a person's computer is for thatindividual to open a website that has been specially crafted tocompromise the user's computer. Spamming has one key drawback though:It doesn't work very often.
Nevertheless,TAO has dramatically improved the tools at its disposal. It maintainsa sophisticated toolbox known internally by the name "QUANTUMTHEORY.""Certain QUANTUM missions have a success rate of as high as 80%,where spam is less than 1%," one internal NSA presentationstates.
Acomprehensive internal presentation titled "QUANTUMCAPABILITIES," which SPIEGEL has viewed, lists virtually everypopular Internet service provider as a target, including Facebook,Yahoo, Twitter and YouTube. "NSA QUANTUM has the greatestsuccess against Yahoo, Facebook and static IP addresses," itstates. The presentation also notes that the NSA has been unable toemploy this method to target users of Google services. Apparently,that can only be done by Britain's GCHQ intelligence service, whichhas acquired QUANTUM tools from the NSA.
Afavored tool of intelligence service hackers is "QUANTUMINSERT."GCHQ workers used this method to attackthe computers of employees atpartly government-held Belgian telecommunications company Belgacom,in order to use their computers to penetrate even further into thecompany's networks. The NSA, meanwhile, used the same technologyto targethigh-ranking members of the Organization of the Petroleum ExportingCountries (OPEC)at the organization's Vienna headquarters. In both cases, thetrans-Atlantic spying consortium gained unhindered access to valuableeconomic data using these tools.
TheNSA's Shadow Network
Theinsert method and other variants of QUANTUM are closely linked to ashadow network operated by the NSA alongside the Internet, with itsown, well-hidden infrastructure comprised of "covert"routers and servers. It appears the NSA also incorporates routers andservers from non-NSA networks into its covert network by infectingthese networks with "implants" that then allow thegovernment hackers to control the computers remotely. (Click here toread a relatedarticle onthe NSA's "implants".)
Inthis way, the intelligence service seeks to identify and track itstargets based on their digital footprints. These identifiers couldinclude certain email addresses or website cookies set on a person'scomputer. Of course, a cookie doesn't automatically identify aperson, but it can if it includes additional information like anemail address. In that case, a cookie becomes something like the webequivalent of a fingerprint.
ARace Between Servers
OnceTAO teams have gathered sufficient data on their targets' habits,they can shift into attack mode, programming the QUANTUM systems toperform this work in a largely automated way. If a data packetfeaturing the email address or cookie of a target passes through acable or router monitored by the NSA, the system sounds the alarm. Itdetermines what website the target person is trying to access andthen activates one of the intelligence service's covert servers,known by the codename FOXACID.
ThisNSA server coerces the user into connecting to NSA covert systemsrather than the intended sites. In the case of Belgacom engineers,instead of reaching the LinkedIn page they were actually trying tovisit, they were also directed to FOXACID servers housed on NSAnetworks. Undetected by the user, the manipulated page transferredmalware already custom tailored to match security holes on the targetperson's computer.
Thetechnique can literally be a race between servers, one that isdescribed in internal intelligence agency jargon with phrases like:"Wait for client to initiate new connection," "Shoot!"and "Hope to beat server-to-client response." Like anycompetition, at times the covert network's surveillance tools are"too slow to win the race." Often enough, though, they areeffective. Implants with QUANTUMINSERT, especially when used inconjunction with LinkedIn, now have a success rate of over 50percent, according to one internal document.
TappingUndersea Cables
Atthe same time, it is in no way true to say that the NSA has itssights set exclusively on select individuals. Of even greaterinterest are entire networks and network providers, such as the fiberoptic cables that direct a large share of global Internet trafficalong the world's ocean floors.
Onedocument labeled "top secret" and "not for foreigners"describes the NSA's success in spying on the "SEA-ME-WE-4"cable system. This massive underwater cable bundle connects Europewith North Africa and the Gulf states and then continues on throughPakistan and India, all the way to Malaysia and Thailand. The cablesystem originates in southern France, near Marseille. Among thecompanies that hold ownership stakes in it are France Telecom, nowknown as Orange and still partly government-owned, and Telecom ItaliaSparkle.
Thedocument proudly announces that, on Feb. 13, 2013, TAO "successfullycollected network management information for the SEA-Me-We UnderseaCable Systems (SMW-4)." With the help of a "websitemasquerade operation," the agency was able to "gain accessto the consortium's management website and collected Layer 2 networkinformation that shows the circuit mapping for significant portionsof the network."
Itappears the government hackers succeeded here once again using theQUANTUMINSERT method.
Thedocument states that the TAO team hacked an internal website of theoperator consortium and copied documents stored there pertaining totechnical infrastructure. But that was only the first step. "Moreoperations are planned in the future to collect more informationabout this and other cable systems," it continues.
Butnumerous internal announcements of successful attacks like the oneagainst the undersea cable operator aren't the exclusive factors thatmake TAO stand out at the NSA. In contrast to most NSA operations,TAO's ventures often require physical access to their targets. Afterall, you might have to directly access a mobile network transmissionstation before you can begin tapping the digital information itprovides.
SpyingTraditions Live On
Toconduct those types of operations, the NSA works together with otherintelligence agencies such as the CIA and FBI, which in turn maintaininformants on location who are available to help with sensitivemissions. This enables TAO to attack even isolated networks thataren't connected to the Internet. If necessary, the FBI can even makean agency-owned jet available to ferry the high-tech plumbers totheir target. This gets them to their destination at the right timeand can help them to disappear again undetected after as little as ahalf hour's work.
Respondingto a query from SPIEGEL, NSA officials issued a statement saying,"Tailored Access Operations is a unique national asset that ison the front lines of enabling NSA to defend the nation and itsallies." The statement added that TAO's "work is centeredon computer network exploitation in support of foreign intelligencecollection." The officials said they would not discuss specificallegations regarding TAO's mission.
Sometimesit appears that the world's most modern spies are just as reliant onconventional methods of reconnaissance as their predecessors.
Take,for example, when they intercept shipping deliveries. If a targetperson, agency or company orders a new computer or relatedaccessories, for example, TAO can divert the shipping delivery to itsown secret workshops. The NSA calls this method interdiction. Atthese so-called "load stations," agents carefully open thepackage in order to load malware onto the electronics, or eveninstall hardware components that can provide backdoor access for theintelligence agencies. All subsequent steps can then be conductedfrom the comfort of a remote computer.
Theseminor disruptions in the parcel shipping business rank among the"most productive operations" conducted by the NSA hackers,one top secret document relates in enthusiastic terms. This method,the presentation continues, allows TAO to obtain access to networks"around the world."
Evenin the Internet Age, some traditional spying methods continue to liveon.
REPORTEDBY JACOB APPELBAUM, LAURA POITRAS, MARCEL ROSENBACH, CHRISTIANSTÖCKER, JÖRG SCHINDLER AND HOLGER STARK

URL:

• http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969.html
  

RelatedSPIEGEL ONLINE links:

• Shopping for Spy Gear Catalog Advertises NSA Toolbox (12/29/2013)
  http://www.spiegel.de/international/world/0,1518,940994,00.html
  
  
• Friendly Fire How GCHQ Monitors Germany, Israel and the EU (12/20/2013)
  http://www.spiegel.de/international/world/0,1518,940135,00.html
  
  
• Oil Espionage How the NSA and GCHQ Spied on OPEC (11/11/2013)
  http://www.spiegel.de/international/world/0,1518,932777,00.html
  
  
• Fresh Leak on US Spying NSA Accessed Mexican President's Email (10/20/2013)
  http://www.spiegel.de/international/world/0,1518,928817,00.html
  
  
• Quantum Spying GCHQ Used Fake LinkedIn Pages to Target Engineers (11/11/2013)
  http://www.spiegel.de/international/world/0,1518,932821,00.html
  
  
• Ally and Target US Intelligence Watches Germany Closely (08/12/2013)
  http://www.spiegel.de/international/world/0,1518,916029,00.html
  

Relatedinternet links

• "Washington Post": Bericht über Cyber-Attacken 2011
  http://www.washingtonpost.com/world/national-security/us-spy-agencies-mounted-231-offensive-cyber-operations-in-2011-documents-show/2013/08/30/d090a6ae-119e-11e3-b4cb-fd7ce041d814_story.htmlSPIEGEL ONLINE is not liable for the content of external web pages.
  

12/29/201309:19 AM

Shoppingfor Spy Gear

Catalog AdvertisesNSA Toolbox

ByJacob Appelbaum, JudithHorchert and ChristianStöcker
Afteryears of speculation that electronics can be accessed by intelligenceagencies through a back door, an internal NSA catalog reveals thatsuch methods already exist for numerous end-user devices.
Editor'snote: This article accompanies our main feature story on the NSA'sTailored Access Operations unit. You can read it here.
Whenit comes to modern firewalls for corporate computer networks, theworld's second largest network equipment manufacturer doesn't skimpon praising its own work. According to Juniper Networks' online PRcopy, the company's products are "ideal" for protectinglarge companies and computing centers from unwanted access fromoutside. They claim the performance of the company's specialcomputers is "unmatched" and their firewalls are the"best-in-class." Despite these assurances, though, there isone attacker none of these products can fend off -- the UnitedStates'NationalSecurity Agency.
Specialistsat the intelligence organization succeeded years ago in penetratingthe company's digital firewalls. A document viewed by SPIEGELresembling a product catalog reveals that an NSA division called ANThas burrowed its way into nearly all the security architecture madeby the major players in the industry -- including American globalmarket leader Cisco and its Chinese competitor Huawei, but alsoproducers of mass-market goods, such as US computer-maker Dell.
A50-Page Catalog
TheseNSA agents, who specialize in secret back doors, are able to keep aneye on all levels of our digital lives -- from computing centers toindividual computers, and from laptops to mobile phones. For nearlyevery lock, ANT seems to have a key in its toolbox. And no matterwhat walls companies erect, the NSA's specialists seem already tohave gotten past them.
This,at least, is the impression gained from flipping through the 50-pagedocument. The list reads like a mail-order catalog, one from whichother NSA employees can order technologies from the ANT division fortapping their targets' data. The catalog even lists the prices forthese electronic break-in tools, with costs ranging from free to$250,000.
Inthe case of Juniper, the name of this particular digital lock pick is"FEEDTROUGH." This malware burrows into Juniper firewallsand makes it possible to smuggle other NSA programs into mainframecomputers. Thanks to FEEDTROUGH, these implants can, by design, evensurvive "across reboots and software upgrades." In thisway, US government spies can secure themselves a permanent presencein computer networks. The catalog states that FEEDTROUGH "hasbeen deployed on many target platforms."
MasterCarpenters
Thespecialists at ANT, which presumably stands for Advanced or AccessNetwork Technology, could be described as master carpenters for theNSA's department for TailoredAccess Operations (TAO).In cases where TAO's usual hacking and data-skimming methods don'tsuffice, ANT workers step in with their special tools, penetratingnetworking equipment, monitoring mobile phones and computers anddiverting or even modifying data. Such "implants," as theyare referred to in NSA parlance, have played a considerable role inthe intelligence agency's ability to establish a global covertnetwork that operates alongside the Internet.
Someof the equipment available is quite inexpensive. A rigged monitorcable that allows "TAO personnel to see what is displayed on thetargeted monitor," for example, is available for just $30. Butan "active GSM base station" -- a tool that makes itpossible to mimic a mobile phone tower and thus monitor cell phones-- costs a full $40,000. Computer bugging devices disguised as normalUSB plugs, capable of sending and receiving data via radioundetected, are available in packs of 50 for over $1 million.
'Persistence'
TheANT division doesn't just manufacture surveillance hardware. It alsodevelops software for special tasks. The ANT developers have a clearpreference for planting their malicious code in so-called BIOS,software located on a computer's motherboard that is the first thingto load when a computer is turned on.
Thishas a number of valuable advantages: an infected PC or server appearsto be functioning normally, so the infection remains invisible tovirus protection and other security programs. And even if the harddrive of an infected computer has been completely erased and a newoperating system is installed, the ANT malware can continue tofunction and ensures that new spyware can once again be loaded ontowhat is presumed to be a clean computer. The ANT developers call this"Persistence" and believe this approach has provided themwith the possibility of permanent access.
Anotherprogram attacks the firmware in hard drives manufactured by WesternDigital, Seagate, Maxtor and Samsung, all of which, with theexception of the latter, are American companies. Here, too, itappears the US intelligence agency is compromising the technology andproducts of American companies.
OtherANT programs target Internet routers meant for professional use orhardware firewalls intended to protect company networks from onlineattacks. Many digital attack weapons are "remotely installable"-- in other words, over the Internet. Others require a direct attackon an end-user device -- an "interdiction," as it is knownin NSA jargon -- in order to install malware or bugging equipment.
Thereis no information in the documents seen by SPIEGEL to suggest thatthe companies whose products are mentioned in the catalog providedany support to the NSA or even had any knowledge of the intelligencesolutions. "Cisco does not work with any government to modifyour equipment, nor to implement any so-called security 'back doors'in our products," the company said in a statement. Contacted bySPIEGEL reporters, officials at Western Digital, Juniper Networks andHuawei also said they had no knowledge of any such modifications.Meanwhile, Dell officials said the company "respects andcomplies with the laws of all countries in which it operates."
Manyof the items in the software solutions catalog date from 2008, andsome of the target server systems that are listed are no longer onthe market today. At the same time, it's not as if the hackers withinthe ANT division have been sleeping on the job. They have continuedto develop their arsenal. Some pages in the 2008 catalog, forexample, list new systems for which no tools yet exist. However, theauthors promise they are already hard at work developing new toolsand that they will be "pursued for a future release."

URL:

• http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html
  

RelatedSPIEGEL ONLINE links:

• Inside TAO Documents Reveal Top NSA Hacking Unit (12/29/2013)
  http://www.spiegel.de/international/world/0,1518,940969,00.html
  

[Magda Hassan]

Sorry for letting them snoop? Dell apologizes for inconvenience' caused by NSA backdoor

Published time: December 31, 2013 18:14 Get short URL

AFP Photo / Getty Images / Justin Sullivan




Trends
NSA leaks Tags
China, Germany, Hacking, Information Technology, Intelligence, Internet, SciTech, Security, Snowden, USA

Security researcher Jacob Appelbaum dropped a bombshell of sorts earlier this week when he accused American tech companies of placing government-friendly backdoors in their devices. Now Texas-based Dell Computers is offering an apology.
Or to put it more accurately, Dell told an irate customer on Monday that they "regret the inconvenience" caused by selling to the public for years a number of products that the intelligence community has been able to fully compromise in complete silence up until this week.
Dell, Apple, Western Digital and an array of other Silicon Valley-firms were all name-checked during Appelbaum's hour-long presentation Monday at the thirtieth annual Chaos Communication Congress in Hamburg, Germany. As RT reported then, the 30-year-old hacker-cum-activist unveiled before the audience at the annual expo a collection of never-before published National Security Agency documents detailing how the NSA goes to great lengths to compromise the computers and systems of groups on its long list of adversaries.

Spreading viruses and malware to infect targets and eavesdrop on their communications is just one of the ways the United States' spy firm conducts surveillance, Appelbaum said. Along with those exploits, he added, the NSA has been manually inserting microscopic computer chips into commercially available products and using custom-made devices like hacked USB cables to silently collect intelligence.
One of the most alarming methods of attack discussed during his address, however, comes as a result of all but certain collusion on the part of major United States tech companies. The NSA has information about vulnerabilities in products sold by the biggest names in the US computer industry, Appelbaum said, and at the drop off a hat the agency has the ability of launching any which type of attack to exploit the flaws in publically available products.
The NSA has knowledge pertaining to vulnerabilities in computer servers made by Dell and even Apple's highly popular iPhone, among other devices, Appelbaum told his audience.
"Hey Dell, why is that?" Appelbaum asked. "Love to hear your statement about that."
Equally as curious were Dave Waterson and Martijn Wismeijer two IT experts who took to Twitter to express their outrage before Appelbaum's lecture was even presented and preliminary information about the NSA leaks were published in an article he co-authored for Germany's Der Spiegel magazine.
"NSA planet backdoors to access devices from Cisco, Dell, Western Digital, Seagate, Maxtor and Samsung," Waterson wrote in a tweet that linked to a CNET article from Sunday that quoted from Der Spiegel's top-secret documents.
"Thanks," Wismeijer wrote on Monday. "I just found out my Dell server has NSA bug in Rand BIOS," he said of one critical component that's easily exploited, according to Appelbaum.

@DavidLWaterson Thanks I just found out my #Dell server has #NSA bug in RAID Bios. @DellCares You obviously don't care about your customers!
Martijn Wismeijer (@twiet) December 30, 2013

TechDirt reporter Mike Masnick noticed early Tuesday that Dell's official customer service Twitter account opted to issue a cookie-cutter response that drips of insincerity.
"Thanks you for reaching out and regret the inconvenience," the Dell account tweeted to Wismeijer. "Our colleagues at @DellCaresPro will be able to help you out."
"Inconvenience? You got to be F*ckin kidding me!" Wismeijer responded. "You place an NSA bug in our servers and call it an inconvenience?"

@DellCares @dellcarespro Inconvenience? You got to be F*ckin kidding me! You place an NSA bug in our servers and call it an inconvenience?
Martijn Wismeijer (@twiet) December 31, 2013

"There are times when big brands with social media people' might want to teach those junior level employees to recognize that using one of the standard scripted' answers might be inappropriate," opined Masnick.
Appelbaum didn't leave Dell off the hook after revealing just that one exploit known to the NSA, however. Before concluding his presentation, he displayed a top-secret document in which the agency makes reference to a hardware implant that could be manually installed onto Dell PowerEdge servers to exploit the JTAG debugging interface on its processor a critical circuitry component that apparently contains a vulnerability known to the US government.
"Why did Dell leave a JTAG debugging interface on these servers?" asked Appelbaum. "Because it's like leaving a vulnerability in. Is that a bugdoor, or a backdoor or just a mistake? Well hopefully they will change these things or at least make it so that if you were to see this, you would know that you have some problems. Hopefully Dell will release some information about how to mitigate this advance persistent threat."
Appelbaum also provoked Apple by acknowledging that the NSA boasts of being able to hack into any of their mobile devices running the iOS operating system.
"Either they have a huge collection of exploits that work against Apple products meaning they are hoarding information about critical systems American companies product and sabotaging them or Apple sabotages it themselves," he said.
"Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone," the company responded through an official statement on Tuesday. "Whenever we hear about attempts to undermine Apple's industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who's behind them."
Meanwhile, other top-tier computer companies have already addressed Der Spiegel and Appelbaum's allegations that they either colluded with the NSA or complied with the spy firm as they exploited vulnerabilities, known or unknown, in their own products. A representative for Microsoft told the Huffington Post on Monday that their companies "does not provide any government with direct or unfettered access to our customer's data" and said the tech giant "would have significant concerns if the allegations about government actions are true," but a Washington, DC representative for Chinese company Huawei was more upfront when reached for comment by Wired about any cooperation with the US government or other entities.
"We read the media reports, and we've noted the references to Huawei and our peers," Huawei vice president William Plummer told Wired from the US capital. "As we have said, over and over again and as now seems to be validated threats to networks and data integrity can come from any and many sources."
"Everything that the United States government accused the Chinese of doing which they are also doing, I believe we are learning that the United States government has been doing to American companies," Appelbaum said towards the end of Monday's presentation. "That to me is really concerning and we've had no public debate about these issues."
http://rt.com/usa/dell-appelbaum-30c3-apology-027/

[Peter Lemkin]

How about some class action lawsuits against all of these corporate collaborators~!::fury:: 'Sorry for the inconvenience' won't 'cut it'!