Jacob Appelbaum technical talk about the NSA's capabilities (scary) - Page 1
Forum section: electronics / general

author: casper.bang
author_rank: Frequent Contributor
timestamp: January 07, 2014, 10:31:37 pm
content: Don't know if you guys have seen the excellent talk by Jacob Appelbaum, where he outlines the techniques used by the NSA leaked by Edward Snowden, Julian Assange and others (traffic hijacking, hardware implants, product compromizations, 1kW continuous wave generator, remote monitor monitoring etc. etc.).http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html#I'm impressed and spooked at the same time (and personally very interested in the 20uW micro beacon at the very end from COTS parts).

author: Skimask
author_rank: Super Contributor
timestamp: January 08, 2014, 03:36:13 am
content: Break out the tin foil hats...

author: vk6zgo
author_rank: Super Contributor
timestamp: January 08, 2014, 05:50:34 am
content: Quote from: casper.bang on January 07, 2014, 10:31:37 pmThat's a hour I'll never get bacK

author: casper.bang
author_rank: Frequent Contributor
timestamp: January 08, 2014, 09:08:28 am
content: Quote from: vk6zgo on January 08, 2014, 05:50:34 amDon't worry, you can catch up on Sex and the City another time!

author: David_AVD
author_rank: Super Contributor
timestamp: January 08, 2014, 09:18:10 am
content: I started watching it, but the presentation was just too... I dunno... dry? boring?Even tried skipping ahead, but just couldn't get into it at all.Probably only watched 10 minutes of it in total.

author: peter.mitchell
author_rank: Super Contributor
timestamp: January 08, 2014, 10:08:35 am
content: Quote from: David_AVD on January 08, 2014, 09:18:10 amSome people just aren't good for this kinda thing, I've watch hundreds of hours of this kinda thing, it basically comes down the the presenter.

author: casper.bang
author_rank: Frequent Contributor
timestamp: January 08, 2014, 10:36:33 am
content: Quote from: peter.mitchell on January 08, 2014, 10:08:35 amI've seen much much worse, kind of surprised people find it boring - i.e. I know now we have servers at my work potentially compromised by the NSA! Makes me wonder if this is a software vs. hardware ting (Appelbaum is a software guy and so am I). Anyway, for the time challenged, most of what he talks about comes fromthese slides.

author: LukeW
author_rank: Frequent Contributor
timestamp: January 08, 2014, 11:12:48 am
content: This is the NSA ANT "catalog" leaked by Snowden which is the main interesting of Appelbaum's video, without any video to waste your bandwidth.http://leaksource.wordpress.com/2013/12/30/nsas-ant-division-catalog-of-exploits-for-nearly-every-major-software-hardware-firmware/NOTE: Website contains leaked Top Secret data. If you're a US government employee or contractor obviously you should be handling this information the right way (even when it's on a public website) to keep your security clearance in order.Some notes on the interesting hardware:The LOUDAUTO / SURLYSPAWN family of devices are completely passive and do not transmit RF actively, making their detection difficult compared to traditional RF transmitters. The device is illuminated with RF from a "radar" unit, which receives and processes the re-transmitted signal.This is similar to how passive RFID works, but it's hardly a new technology. This is sort of a modern electronic version of the famous passive cavity resonator bug designed during World War 2 by Leon Theremin and installed in the US embassy in Moscow where it remained undetected for years.RAGEMASTER provides something close to classic Neal Stephenson-style van Eck phreaking to pick up a remote video signal from a monitor over such a communications channel, which is impressive.COTTONMOUTH and FIREWALK are impressive evil little bits of spyware. But if they're always transmitting RF then they're vulnerable to any ordinary RF countersurveillance / bug-sniffing. It seems to me that these devices would be most successful if the radios were only activated sometimes in limited bursts, perhaps controlled by malware installed on the PC. (If the software doesn't have to do anything malicious except send a USB packet to the hardware implant at the right time, then this may be difficult to detect, or difficult to identify as malicious, compared to a conventional malicious software implant on the PC which may be more likely to be identified as malicious if it actually does the work itself.)IRONCHEF can be "implanted" onto the motherboard of a Dell server, at least as far as the hardware component is concerned. It plugs into the SMBus (I2C), and although not all boards expose it to a friendly header, you can tap in on basically any memory slot, such as with a fake DIMM. FLUXBABBITT connects on the motherboard via a JTAG port.

author: casper.bang
author_rank: Frequent Contributor
timestamp: January 08, 2014, 12:40:18 pm
content: Quote from: LukeW on January 08, 2014, 11:12:48 amI already linked to those though in the above post.Quote from: LukeW on January 08, 2014, 11:12:48 amYou better read the files again. Nowhere in the text do they equate this to passive RFID, in fact they explicitly mention battery voltage and self-discharge. The devices remains quiet under normal operation (no RF) and only uses incoming RF signal to wake up and actively start sending back.Quote from: LukeW on January 08, 2014, 11:12:48 amThe text pretty much outlines that's its actually the other way around. COTTONMOUTH appears to be a highly targetable point-of-entry attack vector for conquering air-gaps, whereby it becomes possible to install more sophisticated backdoor software.

author: nihilism
author_rank: Regular Contributor
timestamp: January 08, 2014, 03:09:24 pm
content: Quote from: casper.bang on January 08, 2014, 12:40:18 pmYou can get active RFID tags for long (meters) ranges for use on vehicles commercially. The term used in the description of "RF Retroreflector" does sound like a similar mode or principal of operation to RFID.

author: casper.bang
author_rank: Frequent Contributor
timestamp: January 08, 2014, 03:53:55 pm
content: Quote from: nihilism on January 08, 2014, 03:09:24 pmYup, I use one when I cross a toll bridge. They generally have to be carefully mounted behind the rear mirror in order to have sufficient clear line of sight for it to function (and yet fails often, especially if the window has shading build into it). Given the tiny size of the NSA devices (no coil) and considering the inverse square law when applied to radio waves, I seriously doubt we're talking about a passive reflector (though if the NSA is close enough and transmits with 1kW, they might be able to paint an RF reflector - and heat up the targets lunch at the same time). I still think the mentioning of "reflector" refers to it transmitting only by command or possible modulating on top of this. Similar to emulating client mode with an active NFC/Mifare reader with your own power source (one of the recent features of theAndroid 4.4 API).

author: Stonent
author_rank: Super Contributor
timestamp: January 08, 2014, 05:46:23 pm
content: Worth mentioning that one of our Senators is suing the NSA and President Obama over the NSA spying stuff.http://www.foxnews.com/on-air/hannity/2014/01/06/exclusive-rand-paul-file-lawsuit-against-nsaIt's a class action lawsuit and from what I last saw over 250,000 people have joined in.The basis of the suit is that amendment 4 to the US constitution (regarding searches) would not cover a single warrant to conduct searches of millions of people.

author: chicken
author_rank: Frequent Contributor
timestamp: January 08, 2014, 05:54:07 pm
content: Not sure why anyone is surprised about that catalog. It's basically a collection of exploits as presented at the various hacker conferences like Black Hat, DEF CON, and yes CCC where Applebaum spoke this year.

author: GeoffS
author_rank: Unknown
timestamp: January 08, 2014, 05:56:06 pm
content: A US judge has ruled that the NSA phone surveillance is legal.http://www.aljazeera.com/news/americas/2013/12/us-judge-rules-nsa-phone-tapping-legal-2013122717117483526.htmlThis was a US district judge so I don't know how/if this affects thinks federally. Would this have any bearing on the likely success of the senators law suit?

author: JoeyP
author_rank: Frequent Contributor
timestamp: January 08, 2014, 06:03:41 pm
content: That ruling will likely be challenged in the Supreme court. Until they've upheld it, the class action suit could still have legs.On a related note, that division of the NSA would be *seriously* fun to work for!

author: GeoffS
author_rank: Unknown
timestamp: January 08, 2014, 06:06:37 pm
content: Quote from: JoeyP on January 08, 2014, 06:03:41 pmI'd like the job of coming up with names for these 'projects'. I'm sure I could do better than what's been exposed so far.

author: LukeW
author_rank: Frequent Contributor
timestamp: January 08, 2014, 08:28:56 pm
content: Quote from: Stonent on January 08, 2014, 05:46:23 pmYeah, you're right - not completely passive, it is using some power, either from a battery or tapped in from the target hardware, but doesn't do anything until the external CW RF source illuminates it. The analogy to NFC and longer-distance readers as used for toll roads is a good one.

author: casper.bang
author_rank: Frequent Contributor
timestamp: January 08, 2014, 08:46:02 pm
content: Quote from: GeoffS on January 08, 2014, 06:06:37 pmIt's a pretty long list though:http://cryptome.org/2014/01/nsa-codenames.htm

author: FrankBuss
author_rank: Unknown
timestamp: January 08, 2014, 08:48:22 pm
content: Quote from: JoeyP on January 08, 2014, 06:03:41 pmThen you should apply for a job, they are always hiring, if you don't care about the ethics. And working for the NSA means you can have lots of fun with the game "spot the fed" at the next DEF CON party

author: JoeyP
author_rank: Frequent Contributor
timestamp: January 08, 2014, 09:03:12 pm
content: Quote from: FrankBuss on January 08, 2014, 08:48:22 pmIn fact I have worked on an NSA project in the past - but it was a very different type of asset, in a department that thrived on paper-work rather than productivity.It was the most miserable job I ever had in my life.But this division sounds a lot more fun and agile, and wouldn't need the ridiculous amounts of documentation we had to go through.As far as the ethics - I'd have no issue whatsoever with working on another NSA project. They're a fucking spy agency. Of course they spy, and I hope they're the best in the world at it. What the assets are used for is not something that people at my level would be deciding. That's for the bureaucrats in Washington to decide. If people don't like what they're being used for, then they should get off their asses, get educated, and vote.

author: FJV
author_rank: Regular Contributor
timestamp: January 08, 2014, 10:46:46 pm
content: I feel sorry for the NSA guy that has to eavesdrop on the potentially endless hobby conversations between 2 train modelling enthousiasts, while not having any interest in it.After a few hours of eavesdropping you might wanna keep him/her away from sharp objects, just to prevent self mutilation.

author: staxquad
author_rank: Frequent Contributor
timestamp: January 08, 2014, 11:46:10 pm
content: Quote from: casper.bang on January 07, 2014, 10:31:37 pmI liked it, good enough presentation with useful informationso much appreciated casper.bang

author: vk6zgo
author_rank: Super Contributor
timestamp: January 09, 2014, 01:34:48 am
content: Quote from: casper.bang on January 08, 2014, 10:36:33 amHardware people find it difficult to suspend their critical faculties,so that when he gets to the various hardware gadgets,we are continually evaluating the possible performance of these things.They appear a bit pedestrian for the wide ranging surveillance they are supposedly used for.The "pretend" cell tower box,for instance,would need to be quite close to its target to work,& would be unlikely to be able to steal cellphone calls "en masse".Cellphone cells use large towers,high power ,& gain antennas for a reason--the NSA is not immune to the Laws of Physics.Some of the gadgets are quoted in the "catalogues" as being capable of 1kW output "with external amplifiers & antennas"------well,duhh!Any 1kW transmitter starts out with a much lower level of power,& these external bits are not extra stealthy.Gain antennas get their gain because they are directional---this in itself mitigates against "scattergun "style surveillance.Yes,people can be exposed to 1kW at 1.2GHz for extended periods with no apparent ill effect.Trying to assassinate someone with RF is about as effective as beating them to death with a baguette!I'll give you all the software based stuff,as that seems a much more logical way to do mass surveillance.The problem is,that we have been exposed to so much ridiculous drivel over the years,in a very similar format,complete with ,in many cases,out of context pictures of high tech Military/NSA/CIA hardware,that it causes a sort of "Conspiracy Theory Fatigue",so what may be factual information is simply "lost in the noise".

author: Stonent
author_rank: Super Contributor
timestamp: January 09, 2014, 02:06:30 am
content: Quote from: GeoffS on January 08, 2014, 06:06:37 pmEven better if the name of some really despicable NSA spy stiff was called something like "Project Keysight"It might shame a certain test and measurement company into finding a better name.

author: Legit-Design
author_rank: Frequent Contributor
timestamp: January 09, 2014, 02:30:38 pm
content: https://youtu.be/vILAlhwUgIU?t=54m42s@54m42sDell leaves JTAG debugging interface in their products so NSA can exploit it.I thought leaving jtag is extremely useful for production testing and programming the chips and so on.I'm sure he is right at least half of the time, but that's just plain ridiculous. Maybe he should consult some electronics forums before launching something like that.EDIT: On second thought they could blow some kind of security fuse to disable jtag, that would also mean possibly servicing those products could be harder. But most products just have their jtag enabled because there is no real need to disable it, other than nsa backdoors or stopping people from tinkering with their devices.

author: BBQ
author_rank: Regular Contributor
timestamp: January 09, 2014, 04:56:06 pm
content: All this is really not news since the disclosure of ECHELON. But my God, i couldn't even imagine it was so comprehensive and refined, i'm such a naive soul."Guilty until proven innocent"

author: rsjsouza
author_rank: Super Contributor
timestamp: January 09, 2014, 05:15:31 pm
content: Good video, although not everything seems solid - I agree with vk6zgo's remarks about the transmitting power and "killing someone with RF".Also, I have seen over the years several commercial products with JTAG connections left behind...

author: staxquad
author_rank: Frequent Contributor
timestamp: January 09, 2014, 05:48:59 pm
content: California bill to make life hard for the NSA