Feeds

NSA tactics no better than a CYBERCRIME GANG, says infosec'er

Detailed analysis reveals they're on par with banking scammers

SANS - Survey on application security programs

The NSA operates like a state-sponsored cybercrime gang using much the same tools and techniques as miscreants slinging banking trojans, one cynic has suggested.

Anyone following the Snowden revelations knows by now that the NSA uses exploits and malware to spy on the online activities of targets, but ponytailed infosec expert Bruce Schneier has put together the clearest explanation to date on its methodology for running such attacks.

Encryption guru Schneier has pored over recent Snowden leaks to work out the methodology for deploying Foxacid, the NSA's Exploit Kit.

According to Schneier, the NSA normally carry out reconnaissance prior to tricking their targets into visiting Foxacid exploit servers. Usually the NSA resorts to “man-in-the-middle” hack attempts through an NSA-run set of servers codenamed “Quantum” that sit on the Internet's “backbone”. These redirect targets away from their intended destinations. In other cases, forms of phishing might be deployed.

Targets might be TOR-using terrorism suspects, foreign dignitaries or others targeted by the NSA's cyber-warriors. These tactics exist at the opposite end of the spectrum from dragnet-style programs such as PRISM.

Information on the relative importance and technical sophistication of someone targeted by Foxacid is used to decide the ferocity of a cyber-attack, Schneier explains.

"If the target is a high-value one, Foxacid might run a rare zero-day exploit that it developed or purchased," Schneier explains in a blog post, based on an essay that first appeared in The Atlantic.

"If the target is technically sophisticated, Foxacid might decide that there's too much chance for discovery, and keeping the zero-day exploit a secret is more important. If the target is a low-value one, Foxacid might run an exploit that's less valuable. If the target is low-value and technically sophisticated, Foxacid might even run an already-known vulnerability."

"We know that the NSA receives advance warning from Microsoft of vulnerabilities that will soon be patched; there's not much of a loss if an exploit based on that vulnerability is discovered. Foxacid has tiers of exploits it can run, and uses a complicated trade-off system to determine which one to run against any particular target."

The NSA's Tailored Access Operations (TAO) unit, which runs Foxacid, has detailed rules of engagement and a well-thought-out procedure that allows relatively unskilled operators to act with subtlety and sophistication, Schneier adds.

"Operators running the Foxacid system have a detailed flowchart, with tons of rules about when to stop," Schneier explains. "If something doesn't work, stop. If they detect a PSP, a personal security product, stop. If anything goes weird, stop. This is how the NSA avoids detection, and also how it takes mid-level computer operators and turn them into what they call 'cyberwarriors'. It's not that they're skilled hackers, it's that the procedures do the work for them."

Schneier notes the variety of catchy code-names applied to different approaches of attack by the TAO crew.

"According to a top-secret operational procedures manual provided by Edward Snowden, an exploit named Validator might be the default, but the NSA has a variety of options. The documentation mentions United Rake, Peddle Cheap, Packet Wrench, and Beach Head - all delivered from a Foxacid subsystem called Ferret Cannon."

The security guru contrasts the nuanced attacks carried out by TAO on a tactical level with the blanket collection of data through dragnet programmes favoured on a policy level by the NSA's chiefs.

However some, such as computer security researcher “the grugq”, were less impressed by the NSA's tactical savviness, comparing the spy agency's tools to well-known underground utilities such as the Blackhole Exploit Kit and the ZeuS banking trojan.

The Electronic Frontier Foundation's more serious redux of the latest NSA spying revelations also concludes that the techniques in play aren't particularly sophisticated. EFF reckons knowing more about these approaches might help browser makers – and others – develop more secure technologies.

"The NSA's system for deploying malware isn't particularly novel, but getting some insight into how it works should help users and browser and software vendors better defend against these types of attacks, making us all safer against criminals, foreign intelligence agencies, and a host of attackers," it concludes. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.