NSA Large Scale TURBINE Malware Also Target Sysadmins


So more revelations coming out about the NSA from the latest batch of documents leaked by Edward Snowden.

This time they detail a huge malware infection system created for widespread infections, it seems fairly advanced with the ability to spit out different types of malware depending on the target. Other than the TURBINE malware engine, there’s also some other interesting stuff like HAMMERSTEIN and HAMMERCHANT designed to intercept and snoop on VoIP and VPN connections.

NSA Turbine Malware

The latest batch of top-secret intelligence documents from the hoard collected by NSA whistleblower Edward Snowden detail the massive increase in the agency’s use of its Tailored Access Operations (TAO) hacking unit – including a system dubbed TURBINE that can spam out millions of pieces of sophisticated malware at a time.

The presentation slides, published by The Intercept, show that 10 years ago the NSA had infiltrated and tapped a modest number of computers, but has since hugely bolstered its toolkit and increased its target list. Within eight years, the number of active pieces of implanted spyware was in the tens of thousands, and slides show an extensive arms catalog of malware for the TAO team to choose from.

“One of the greatest challenges for active SIGINT/attack is scale,” explained one presentation from 2009, marked top secret. “Human ‘drivers’ limit ability for large-scale exploitation (humans tend to operate within their own environment, not taking into account the bigger picture).”

The solution was to build TURBINE, which can carry out “automated implants by groups instead of individually,” and scale to operate millions of implants at a time. This command-and-control server includes an “expert system” that automatically picks the right malware for a victim and installs it on their computer, thus “relieve the [TURBINE] user from needing to know/care about the details.”


It’s some interesting stuff with discussions about scaling SIGINT attacks, there’s some pretty detailed analysis over here:

How the NSA Plans to Infect ‘Millions’ of Computers with Malware

Which includes decryption technology and plug-ins to grab web browsing logs, key strokes and record from the microphone.

TURBINE was active from at least July 2010, the documents state, and has infected up to 100,000 devices and machines, with more planned. According to the agency’s 2013 budget files, some of the $67.6m of taxpayer dollars allocated to the NSA’s TAO team went to maintaining and developing the system.

TURBINE also links into a NSA sensor system dubbed TURMOIL, which taps into computer networks around the world to monitor data traffic and identify potential targets. It can track down a mark from their email address or IP address, which device he or she is using, or by web cookies from Google, Microsoft, Twitter, Yahoo! and others.

While terrorist targets are mentioned, it’s clear from the documents that system administrators are also high on the todo list for the TAO team. One comment on an internal NSA message board system was titled simply: “I hunt sys admins.”

“Sys admins are a means to an end,” it states. “Once you have control of the IT manager’s computer then it’s easy to monitor any “government official that happens to be using the network some admin takes care of.”

Pwning the sysadmin is useful for malware attacks against large commercial routers and to defeat VPNs. The documents detail two pieces of NSA-developed malware, HAMMERCHANT and HAMMERSTEIN, which are designed to sit on routers and eavesdrop on VoIP traffic, and grab encryption keys to decrypt supposedly secure VPN connections, all in real time.

Targeting sysadmins is a means to an end, as if you can compromise them – you pretty much have access to everything, including core routers/switches/firewalls/vpn concentrators etc.

Plus servers and more if you can get hold of their SSH private key or passwords from keylogging/file grabbing etc.

Pretty hardcore stuff.

Source: The Register

Posted in: Malware, Privacy

, ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.


Comments are closed.