page_title: NSA ANT catalog
section_title: Capabilities list
hierarchical_section_title: NSA ANT catalog / Capabilities list
caption_attribution_description: English: TRINITY - Miniaturized digital core packaged into a multi-chip module (MCM)
context_page_description: The NSA ANT catalog is a 50-page classified document listing technology available to the United States National Security Agency Tailored Access Operations by the Advanced Network Technology Division to aid in cyber surveillance. Most devices are described as already operational and available to US nationals and members of the Five Eyes alliance. According to Der Spiegel, which released the catalog to the public on December 30, 2013, "The list reads like a mail-order catalog, one from which other NSA employees can order technologies from the ANT division for tapping their targets' data." The document was created in 2008.
  Security researcher Jacob Appelbaum gave a speech at the Chaos Communications Congress in Hamburg, Germany, in which he detailed techniques that the simultaneously published Der Spiegel article he coauthored indicate the NSA uses in its surveillance efforts in the US and internationally.
  The prices of the items in the catalog range from free to US$250,000.
context_section_description: The NSA ANT document contains codeword references to hardware and software surveillance technology available to the NSA.
  BULLDOZER: Technology that creates a hidden wireless bridge allowing NSA personnel to remotely control a system wirelessly.
  CANDYGRAM: A $40,000 tripwire device that emulates a GSM cellphone tower. 
  COTTONMOUTH: (see image at right) A family of modified USB and Ethernet connectors that can be used to install Trojan horse software and work as wireless bridges, providing covert remote access to the target machine. COTTONMOUTH-I is a USB plug that uses TRINITY as digital core and HOWLERMONKEY as RF transceiver. Cost in 2008 was slightly above $1M for 50 units.
  COTTONMOUTH-II is deployed in a USB socket (rather than plug), and costs only $200K per 50 units, but requires further integration in the target machine to turn into a deployed system.
  COTTONMOUTH-III is a stacked Ethernet and USB plug costing approximately $1.25M for 50 units.
  CROSSBEAM is "a GSM communications module capable of collecting and compressing voice data" 
  CTX4000: Continuous wave radar device that can ""illuminate" a target system for recovery of "off net" information.
  CYCLONE-HX9 - GSM Base Station Router
  DEITYBOUNCE: Technology that installs a backdoor software implant on Dell PowerEdge servers via the motherboard BIOS and RAID controller(s).
  DROPOUTJEEP: "A software implant for the Apple iPhone that utilizes modular mission applications to provide specific SIGINT functionality. This functionality includes the ability to remotely push/pull files from the device. SMS retrieval, contact list retrieval, voicemail, geolocation, hot mic, camera capture, cell tower location, etc. Command, control and data exfiltration can occur over SMS messaging or a GPRS data connection. All communications with the implant will be covert and encrypted."
  EBSR is a "tri-band active GSM base station with internal 802.11/GPS/handset capability" 
  ENTOURAGE
  FEEDTROUGH: Software that can penetrate Juniper Networks firewalls allowing other NSA-deployed software to be installed on mainframe computers. 
  FIREWALK: (see image at right) A device that looks identical to a standard RJ45 socket that allows data to be injected, or monitored and transmitted via radio technology. using the HOWLERMONKEY RF transceiver. It can for instance create a VPN to the target computer. Cost in 2008: $537K for 50 units.
  FOXACID: Technology that can install spyware using a "quantum insert" capable of infecting spyware at a packet level.  (Not numbered because FOXACID may or may not be part of the NSA ANT catalog; sources differ.)
  GENESIS
  GINSU: Technology that uses a PCI bus device in a computer, and can reinstall itself upon system boot-up.
  GOPHERSET: GSM software that uses a phone's SIM card's API (SIM Toolkit or STK) to control the phone through remotely sent commands.
  GOURMETTROUGH: User-configurable persistence implant for certain Juniper Networks firewalls.
  HALLUXWATER: Back door exploit for Huawei Eudemon firewalls.
  HEADWATER: Persistent backdoor technology that can install spyware using a "quantum insert" capable of infecting spyware at a packet level on Huawei routers. 
  HOWLERMONKEY: (see image at right) A RF transceiver that makes it possible (in conjunction with digital processors and various implanting methods) to extract data from systems or allow them to be controlled remotely.
  IRATEMONK: Technology that can infiltrate the firmware of hard drives manufactured by Maxtor, Samsung, Seagate, and Western Digital.
  IRONCHEF: Technology that can "infect" networks by installing itself in a computer I/O BIOS. IRONCHEF includes also  "Straitbizarre" and "Unitedrake" which have been linked to the spy software REGIN.
  JUNIORMINT
  JETPLOW: Firmware that can be implanted to create a permanent backdoor in a Cisco PIX series and ASA firewalls.
  LOUDAUTO: $30 audio-based RF retro-reflector listening device. 
  MAESTRO-II: a multi-chip module approximately the size of a dime that serves as the hardware core of several other products. The module contains a 66 MHz ARM7 processor, 4 MB of flash, 8 M
caption: TRINITY
exif: {}