Feeds

NSA tactics no better than a CYBERCRIME GANG, says infosec'er

Detailed analysis reveals they're on par with banking scammers

Protecting against web application threats using SSL

The NSA operates like a state-sponsored cybercrime gang using much the same tools and techniques as miscreants slinging banking trojans, one cynic has suggested.

Anyone following the Snowden revelations knows by now that the NSA uses exploits and malware to spy on the online activities of targets, but ponytailed infosec expert Bruce Schneier has put together the clearest explanation to date on its methodology for running such attacks.

Encryption guru Schneier has pored over recent Snowden leaks to work out the methodology for deploying Foxacid, the NSA's Exploit Kit.

According to Schneier, the NSA normally carry out reconnaissance prior to tricking their targets into visiting Foxacid exploit servers. Usually the NSA resorts to “man-in-the-middle” hack attempts through an NSA-run set of servers codenamed “Quantum” that sit on the Internet's “backbone”. These redirect targets away from their intended destinations. In other cases, forms of phishing might be deployed.

Targets might be TOR-using terrorism suspects, foreign dignitaries or others targeted by the NSA's cyber-warriors. These tactics exist at the opposite end of the spectrum from dragnet-style programs such as PRISM.

Information on the relative importance and technical sophistication of someone targeted by Foxacid is used to decide the ferocity of a cyber-attack, Schneier explains.

"If the target is a high-value one, Foxacid might run a rare zero-day exploit that it developed or purchased," Schneier explains in a blog post, based on an essay that first appeared in The Atlantic.

"If the target is technically sophisticated, Foxacid might decide that there's too much chance for discovery, and keeping the zero-day exploit a secret is more important. If the target is a low-value one, Foxacid might run an exploit that's less valuable. If the target is low-value and technically sophisticated, Foxacid might even run an already-known vulnerability."

"We know that the NSA receives advance warning from Microsoft of vulnerabilities that will soon be patched; there's not much of a loss if an exploit based on that vulnerability is discovered. Foxacid has tiers of exploits it can run, and uses a complicated trade-off system to determine which one to run against any particular target."

The NSA's Tailored Access Operations (TAO) unit, which runs Foxacid, has detailed rules of engagement and a well-thought-out procedure that allows relatively unskilled operators to act with subtlety and sophistication, Schneier adds.

"Operators running the Foxacid system have a detailed flowchart, with tons of rules about when to stop," Schneier explains. "If something doesn't work, stop. If they detect a PSP, a personal security product, stop. If anything goes weird, stop. This is how the NSA avoids detection, and also how it takes mid-level computer operators and turn them into what they call 'cyberwarriors'. It's not that they're skilled hackers, it's that the procedures do the work for them."

Schneier notes the variety of catchy code-names applied to different approaches of attack by the TAO crew.

"According to a top-secret operational procedures manual provided by Edward Snowden, an exploit named Validator might be the default, but the NSA has a variety of options. The documentation mentions United Rake, Peddle Cheap, Packet Wrench, and Beach Head - all delivered from a Foxacid subsystem called Ferret Cannon."

The security guru contrasts the nuanced attacks carried out by TAO on a tactical level with the blanket collection of data through dragnet programmes favoured on a policy level by the NSA's chiefs.

However some, such as computer security researcher “the grugq”, were less impressed by the NSA's tactical savviness, comparing the spy agency's tools to well-known underground utilities such as the Blackhole Exploit Kit and the ZeuS banking trojan.

The Electronic Frontier Foundation's more serious redux of the latest NSA spying revelations also concludes that the techniques in play aren't particularly sophisticated. EFF reckons knowing more about these approaches might help browser makers – and others – develop more secure technologies.

"The NSA's system for deploying malware isn't particularly novel, but getting some insight into how it works should help users and browser and software vendors better defend against these types of attacks, making us all safer against criminals, foreign intelligence agencies, and a host of attackers," it concludes. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.