Feeds

NSA tactics no better than a CYBERCRIME GANG, says infosec'er

Detailed analysis reveals they're on par with banking scammers

The essential guide to IT transformation

The NSA operates like a state-sponsored cybercrime gang using much the same tools and techniques as miscreants slinging banking trojans, one cynic has suggested.

Anyone following the Snowden revelations knows by now that the NSA uses exploits and malware to spy on the online activities of targets, but ponytailed infosec expert Bruce Schneier has put together the clearest explanation to date on its methodology for running such attacks.

Encryption guru Schneier has pored over recent Snowden leaks to work out the methodology for deploying Foxacid, the NSA's Exploit Kit.

According to Schneier, the NSA normally carry out reconnaissance prior to tricking their targets into visiting Foxacid exploit servers. Usually the NSA resorts to “man-in-the-middle” hack attempts through an NSA-run set of servers codenamed “Quantum” that sit on the Internet's “backbone”. These redirect targets away from their intended destinations. In other cases, forms of phishing might be deployed.

Targets might be TOR-using terrorism suspects, foreign dignitaries or others targeted by the NSA's cyber-warriors. These tactics exist at the opposite end of the spectrum from dragnet-style programs such as PRISM.

Information on the relative importance and technical sophistication of someone targeted by Foxacid is used to decide the ferocity of a cyber-attack, Schneier explains.

"If the target is a high-value one, Foxacid might run a rare zero-day exploit that it developed or purchased," Schneier explains in a blog post, based on an essay that first appeared in The Atlantic.

"If the target is technically sophisticated, Foxacid might decide that there's too much chance for discovery, and keeping the zero-day exploit a secret is more important. If the target is a low-value one, Foxacid might run an exploit that's less valuable. If the target is low-value and technically sophisticated, Foxacid might even run an already-known vulnerability."

"We know that the NSA receives advance warning from Microsoft of vulnerabilities that will soon be patched; there's not much of a loss if an exploit based on that vulnerability is discovered. Foxacid has tiers of exploits it can run, and uses a complicated trade-off system to determine which one to run against any particular target."

The NSA's Tailored Access Operations (TAO) unit, which runs Foxacid, has detailed rules of engagement and a well-thought-out procedure that allows relatively unskilled operators to act with subtlety and sophistication, Schneier adds.

"Operators running the Foxacid system have a detailed flowchart, with tons of rules about when to stop," Schneier explains. "If something doesn't work, stop. If they detect a PSP, a personal security product, stop. If anything goes weird, stop. This is how the NSA avoids detection, and also how it takes mid-level computer operators and turn them into what they call 'cyberwarriors'. It's not that they're skilled hackers, it's that the procedures do the work for them."

Schneier notes the variety of catchy code-names applied to different approaches of attack by the TAO crew.

"According to a top-secret operational procedures manual provided by Edward Snowden, an exploit named Validator might be the default, but the NSA has a variety of options. The documentation mentions United Rake, Peddle Cheap, Packet Wrench, and Beach Head - all delivered from a Foxacid subsystem called Ferret Cannon."

The security guru contrasts the nuanced attacks carried out by TAO on a tactical level with the blanket collection of data through dragnet programmes favoured on a policy level by the NSA's chiefs.

However some, such as computer security researcher “the grugq”, were less impressed by the NSA's tactical savviness, comparing the spy agency's tools to well-known underground utilities such as the Blackhole Exploit Kit and the ZeuS banking trojan.

The Electronic Frontier Foundation's more serious redux of the latest NSA spying revelations also concludes that the techniques in play aren't particularly sophisticated. EFF reckons knowing more about these approaches might help browser makers – and others – develop more secure technologies.

"The NSA's system for deploying malware isn't particularly novel, but getting some insight into how it works should help users and browser and software vendors better defend against these types of attacks, making us all safer against criminals, foreign intelligence agencies, and a host of attackers," it concludes. ®

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.