NSA Large Scale TURBINE Malware Also Target Sysadmins


So more revelations coming out about the NSA from the latest batch of documents leaked by Edward Snowden.

This time they detail a huge malware infection system created for widespread infections, it seems fairly advanced with the ability to spit out different types of malware depending on the target. Other than the TURBINE malware engine, there’s also some other interesting stuff like HAMMERSTEIN and HAMMERCHANT designed to intercept and snoop on VoIP and VPN connections.

NSA Turbine Malware

The latest batch of top-secret intelligence documents from the hoard collected by NSA whistleblower Edward Snowden detail the massive increase in the agency’s use of its Tailored Access Operations (TAO) hacking unit – including a system dubbed TURBINE that can spam out millions of pieces of sophisticated malware at a time.

The presentation slides, published by The Intercept, show that 10 years ago the NSA had infiltrated and tapped a modest number of computers, but has since hugely bolstered its toolkit and increased its target list. Within eight years, the number of active pieces of implanted spyware was in the tens of thousands, and slides show an extensive arms catalog of malware for the TAO team to choose from.

“One of the greatest challenges for active SIGINT/attack is scale,” explained one presentation from 2009, marked top secret. “Human ‘drivers’ limit ability for large-scale exploitation (humans tend to operate within their own environment, not taking into account the bigger picture).”

The solution was to build TURBINE, which can carry out “automated implants by groups instead of individually,” and scale to operate millions of implants at a time. This command-and-control server includes an “expert system” that automatically picks the right malware for a victim and installs it on their computer, thus “relieve the [TURBINE] user from needing to know/care about the details.”


It’s some interesting stuff with discussions about scaling SIGINT attacks, there’s some pretty detailed analysis over here:

How the NSA Plans to Infect ‘Millions’ of Computers with Malware

Which includes decryption technology and plug-ins to grab web browsing logs, key strokes and record from the microphone.

TURBINE was active from at least July 2010, the documents state, and has infected up to 100,000 devices and machines, with more planned. According to the agency’s 2013 budget files, some of the $67.6m of taxpayer dollars allocated to the NSA’s TAO team went to maintaining and developing the system.

TURBINE also links into a NSA sensor system dubbed TURMOIL, which taps into computer networks around the world to monitor data traffic and identify potential targets. It can track down a mark from their email address or IP address, which device he or she is using, or by web cookies from Google, Microsoft, Twitter, Yahoo! and others.

While terrorist targets are mentioned, it’s clear from the documents that system administrators are also high on the todo list for the TAO team. One comment on an internal NSA message board system was titled simply: “I hunt sys admins.”

“Sys admins are a means to an end,” it states. “Once you have control of the IT manager’s computer then it’s easy to monitor any “government official that happens to be using the network some admin takes care of.”

Pwning the sysadmin is useful for malware attacks against large commercial routers and to defeat VPNs. The documents detail two pieces of NSA-developed malware, HAMMERCHANT and HAMMERSTEIN, which are designed to sit on routers and eavesdrop on VoIP traffic, and grab encryption keys to decrypt supposedly secure VPN connections, all in real time.

Targeting sysadmins is a means to an end, as if you can compromise them – you pretty much have access to everything, including core routers/switches/firewalls/vpn concentrators etc.

Plus servers and more if you can get hold of their SSH private key or passwords from keylogging/file grabbing etc.

Pretty hardcore stuff.

Source: The Register

Posted in: Malware, Privacy

, ,


Latest Posts:


OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.
trident - Automated Password Spraying Tool trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling
tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.
Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.


Comments are closed.