So more revelations coming out about the NSA from the latest batch of documents leaked by Edward Snowden.
This time they detail a huge malware infection system created for widespread infections, it seems fairly advanced with the ability to spit out different types of malware depending on the target. Other than the TURBINE malware engine, there’s also some other interesting stuff like HAMMERSTEIN and HAMMERCHANT designed to intercept and snoop on VoIP and VPN connections.
The latest batch of top-secret intelligence documents from the hoard collected by NSA whistleblower Edward Snowden detail the massive increase in the agency’s use of its Tailored Access Operations (TAO) hacking unit – including a system dubbed TURBINE that can spam out millions of pieces of sophisticated malware at a time.
The presentation slides, published by The Intercept, show that 10 years ago the NSA had infiltrated and tapped a modest number of computers, but has since hugely bolstered its toolkit and increased its target list. Within eight years, the number of active pieces of implanted spyware was in the tens of thousands, and slides show an extensive arms catalog of malware for the TAO team to choose from.
“One of the greatest challenges for active SIGINT/attack is scale,” explained one presentation from 2009, marked top secret. “Human ‘drivers’ limit ability for large-scale exploitation (humans tend to operate within their own environment, not taking into account the bigger picture).”
The solution was to build TURBINE, which can carry out “automated implants by groups instead of individually,” and scale to operate millions of implants at a time. This command-and-control server includes an “expert system” that automatically picks the right malware for a victim and installs it on their computer, thus “relieve the [TURBINE] user from needing to know/care about the details.”
It’s some interesting stuff with discussions about scaling SIGINT attacks, there’s some pretty detailed analysis over here:
How the NSA Plans to Infect ‘Millions’ of Computers with Malware
Which includes decryption technology and plug-ins to grab web browsing logs, key strokes and record from the microphone.
TURBINE was active from at least July 2010, the documents state, and has infected up to 100,000 devices and machines, with more planned. According to the agency’s 2013 budget files, some of the $67.6m of taxpayer dollars allocated to the NSA’s TAO team went to maintaining and developing the system.
TURBINE also links into a NSA sensor system dubbed TURMOIL, which taps into computer networks around the world to monitor data traffic and identify potential targets. It can track down a mark from their email address or IP address, which device he or she is using, or by web cookies from Google, Microsoft, Twitter, Yahoo! and others.
While terrorist targets are mentioned, it’s clear from the documents that system administrators are also high on the todo list for the TAO team. One comment on an internal NSA message board system was titled simply: “I hunt sys admins.”
“Sys admins are a means to an end,” it states. “Once you have control of the IT manager’s computer then it’s easy to monitor any “government official that happens to be using the network some admin takes care of.”
Pwning the sysadmin is useful for malware attacks against large commercial routers and to defeat VPNs. The documents detail two pieces of NSA-developed malware, HAMMERCHANT and HAMMERSTEIN, which are designed to sit on routers and eavesdrop on VoIP traffic, and grab encryption keys to decrypt supposedly secure VPN connections, all in real time.
Targeting sysadmins is a means to an end, as if you can compromise them – you pretty much have access to everything, including core routers/switches/firewalls/vpn concentrators etc.
Plus servers and more if you can get hold of their SSH private key or passwords from keylogging/file grabbing etc.
Pretty hardcore stuff.
Source: The Register