NSA Spy Gadgets

Among the documents published by Edward Snowden, a former employee of the CIA and the US National Security Agency, materials were found describing some of the details of espionage techniques used by the NSA. The list of software and hardware is designed as a small catalog. A total of forty-eight pages marked with the headings "Secret" and "Top Secret", which give a brief description of a particular technology for surveillance. This list is not exhaustive. Techniques associated with obtaining hidden access to computer technology and networks are presented, as well as electronic intelligence methods and methods associated with mobile communications and surveillance equipment. In this article I will talk about these espionage methods, then there will be four dozen slides (caution, traffic).

The “originals” of documents describing espionage techniques are hidden under spoilers. The names of technologies are indicated in capital letters, however, not all technologies mentioned are described in slide texts. A hardware bookmark is a hidden technical device, a kind of bug that allows you to access the target or information about it. A program bookmark refers to hidden programs that allow you to access the target programmatically, such as using Trojan horses and backdoors.

Computers

GINSU is a technique that allows you to restore a software bookmark called KONGUR on target systems with a hardware bookmark BULLDOZZER on the PCI bus. For example, if you update or reinstall the operating system on the target computer. These technologies are designed for remote access to a computer running Windows from 9x to Vista.

IRATEMONK allows you to ensure the presence of tracking software on desktop and laptop computers by using a bookmark in the hard drive firmware, which allows you to get the ability to execute your code by replacing the MBR. The method works on various Western Digital, Seagate, Maxtor and Samsung drives. Of the file systems, FAT, NTFS, EXT3, and UFS are supported. Systems with RAID are not supported. After implementation, IRATEMONK will start its functional part each time the target computer is turned on.

SWAP allows you to ensure the presence of espionage software through the use of the BIOS of the motherboard and the HPA area of ​​the hard drive by executing code before the operating system starts. This tab allows you to remotely access various operating systems (Windows, FreeBSD, Linux, Solaris) with various file systems (FAT32, NTFS, EXT2, EXT3, UFS 1.0). Two utilities are used for installation: ARKSTREAM flashes the BIOS, TWISTEDKILT writes to the HPA the area of ​​the SWAP disk and its functional part.

WISTFULTOLL is a plugin for the UNITEDRAKE and STRAITBIZZARE programs to collect information on the target system, uses WMI calls and registry entries. It is possible to work as an independent program. If you have physical access to the system, it can reset data received during analysis to a USB drive.

HOWLERMONKEY is a small and medium radius radio transmitter. It is a special radio module for other hardware bookmarks. Used to receive data from bookmarks and provide remote access to them.


JUNIORMINT is a miniature hardware bookmark based on the ARM system, which can be configured for various tasks. For example, such a system may be part of other espionage devices. It has the following characteristics: ARM9 400MHz processor, 32MB flash, 64MB SDRAM, Vertex4 / 5 FPGA equipped with 128MB DDR2.

MAESTRO-II is a miniature hardware bookmark based on an ARM system, the size of a one-cent coin. The characteristics are rather modest: the ARM7 66MHz processor, 8MB RAM, 4MB flash.

SOMBERKNAVE software bookmark running under Windows XP providing remote access to the target computer. Uses idle Wi-Fi adapters, in case the user uses the SOMBERKNAVE adapter, it stops transmitting data.

TRINITY is a miniature hardware bookmark based on an ARM system, the size of a one-cent coin. It has the following characteristics: ARM9 processor 180MHz, 96MB RAM, 4MB flash. Used in other devices.

COTTONMOUTH-I is a USB hardware tab that provides a wireless bridge to the target network, as well as exploit downloads on the target system. It can create a hidden communication channel for transmitting commands and data between hardware and software bookmarks. Using the built-in radio transmitter, it can interact with other COTTONMOUTH. It is based on the element base of TRINITY, HOWLERMONKEY is used as a radio transmitter. There is a version called MOCCASIN, which is a bookmark in the USB keyboard connector.


COTTONMOUTH-II is a hardware USB tab providing a hidden channel for accessing the network of the target. This tab is designed to work on the computer chassis and is a dual-port USB-connector on the board. It can create a hidden communication channel for transmitting commands and data between hardware and software bookmarks.


COTTONMOUTH-III is a hardware tab in USB that provides a wireless bridge to the target network, as well as loading exploits on the target system. It is based on the element base of TRINITY, HOWLERMONKEY is used as a radio transmitter. It is a block of connectors (RJ45 and two USB) installed on the chassis, can interact with other COTTONMOUTH installed on the same chassis.


FIREWALK is a hardware network tab capable of passively collecting Gigabit Ethernet network traffic, as well as actively injecting Ethernet packets into the target network. Allows you to create a VPN tunnel between the target network and the center. It is possible to establish wireless communication with other HOWLERMONKEY-compatible devices. The design of this bookmark is similar to COTTONMOUTH-III, the same block of connectors (RJ45 and two USB) on the chassis. It is based on the element base of TRINITY, HOWLERMONKEY is used as a radio transmitter.

SURLYSPAWN - a hardware tab (keylogger) that allows you to receive data from the target via a radio channel (keyboard, low-speed digital devices). Data is transmitted in the reflected signal, for activation it is necessary to irradiate the bookmark with a radio signal from a specialized emitter. The keylogger is compatible with USB and PS / 2 keyboards, in the future it is planned to add compatibility with laptop keyboards.

RAGEMASTER - hardware tab allows you to intercept the signal from the VGA monitor. The bookmark is hidden in a regular VGA cable connecting the video card and the monitor; it is usually installed in ferrite on the video cable. Signal capture from the red color channel is implemented. It is a passive reflector, i.e. activated by exposure to a radio signal from a specialized emitter.

Wi-Fi networks

NIGHTSTAND is a mobile complex for carrying out active attacks on Wi-Fi networks, the targets are machines running Windows (from Win2k to WinXP SP2). It is usually used in operations in which access to the target is impossible. The complex is implemented on the basis of a laptop running Linux and radio equipment. Together with external amplifiers and antennas, the range can reach 13 km.

SPARROW II is an embedded computer system running Linux. It is a fully functional wireless data collection system. To expand the functionality, it has four built-in Mini PCI slots allowing you to connect a GPS module and additional wireless network cards.

Servers

IRONCHEF provides access to target systems using the BIOS of the motherboard and using the SMM mode to communicate with the hardware tab providing two-way radio communication. Apparently, this tab should be installed on the system chassis, like COTTONMOUTH-II. The HP Proliant 380DL G5 servers are vulnerable to this technique.

DEITYBOUNCE provides programmatic access to Dell PowerEdge servers using the motherboard BIOS and using the SMM mode to enable startup before booting the system. Installation can be done using ARKSTREAM, or using a USB flash drive. After installation, it will be performed every time the system is turned on. Goals may include Dell PowerEdge 1850/2850/1950/2950 with BIOS versions A02, A05, A06, 1.1.0, 1.2.0, or 1.3.7.

network hardware

JETPLOW is a bookmark for Cisco PIX firmware and ASA (Adaptive Security Appliance) firewalls. Saves the BANANAGLEE program bookmark and contains a backdoor. JETPLOW is capable of running on the Cisco PIX 500 Series and ASA firewalls (5505, 5510, 5520, 5540, 5550)

HALLUXWATER is a backdoor installed as a bootloader update to Huawei Eudemon firewalls. When the target is rebooted, the bookmark installer finds the necessary points for the patch and backdoor in the incoming packet processing routine. This backdoor is saved when updating the operating system and automatic updates to the bootloader. HALLUXWATER can run on Huawei Eudemon 200, 500 and 1000 series firewalls.

FEEDTROUGH is a technique for installing two program bookmarks BANANAGLEE and ZESTYLEAK used against Juniper Netscreen firewalls. The following Juniper models are at risk: ns5xt, ns25, ns50, ns200, ns500 and ISG 1000. The method is processed when the firewall starts, if the operating system is in the database, bookmarks are set, otherwise the device boots in normal mode. FEEDTROUGH is retained when updating the firewall operating system.

GOURMETTROUGH tab for some Juniper models, has the ability to customize. It hides the BANANAGLEE tab and allows you to save it after rebooting or updating the OS.

SOUFFLETROUGH tab for the Juniper SSG 500 and SSG 300 series firewall BIOS. It hides the BANANAGLEE tab, in case the device does not support the addition of BANANAGLEE, it opens a backdoor. Remote update and installation of SOUFFLETROUGH possible.

SCHOOLMONTANA provides the presence of network bookmarks. Allows you to save a bookmark when updating and replacing the operating system, including when physically replacing the flash card of the router. The main attack vector is aimed at modifying the BIOS. It is aimed at Juniper J-series routers running the JUNOS operating system. In essence, this is a backdoor designed for use under FreeBSD.

SIERRAMONTANA provides the presence of network bookmarks in Juniper M-Series routers. Features are similar to SCHOOLMONTANA.

STUCCOMONTANA provides the presence of network bookmarks in Juniper T-Series routers. Features are similar to SCHOOLMONTANA.

HEADWATER is a backdoor for some models of Huawei routers. The backdoor is installed when updating the bootloader. The general scheme of operation is similar to other tabs for network equipment.

GSM networks

CROSSBEAM - bookmark in the form of a GSM module based on an embedded computer. It can intercept and record data transmitted in GSM networks.

CANDYGRAM is a GSM base station emulator (900, 1800, 1900), designed to track the location of a cell phone target. Each time the target telephone enters the coverage area of ​​the CANDYGRAM base station, the system sends SMS via an external channel to the observer's telephone.

CYCLONE Hx9 is a GSM base station emulator designed to carry out attacks on mobile phones using the GSM 900 standard. It allows you to listen to and intercept transmitted data. Range up to 32 kilometers.

EBSR is a low-power (1 W) multi-purpose tri-band active GSM base station. Designed to listen and intercept transmitted data. It is possible to combine several such devices into a macro network.

ENTOURAGE is a device for direction finding signals from mobile phones of GSM / UMTS / CDMA2000 / FRS standards. To use it, you need an antenna of the desired range and a laptop (for control).

GENESIS - a device for electronic intelligence based on a modified cell phone standard GSM. Designed for search and analysis of cellular networks, as well as determining the location of target phones. It has the ability to record the radio frequency spectrum into the internal memory, the volume of which is 16GB.

NEBULA is a portable base station for GSM, UMTS, CDMA2000 networks. Allows you to intercept voice and data.

TYPHON HX is a portable base station for GSM networks (850/900/1800/1900). It has full support for the GSM protocol and call control. The tactical element of electronic intelligence.

WATERWITCH is a portable device for determining the coordinates of target phones in range.

DROPOUTJEEP - software bookmark for Apple iPhone iOS allows you to remotely access your phone via SMS or GPRS connection. To install a backdoor, you need physical access to the device; the possibility of remote installation is planned in future releases.

GOPHERSET - software tab for GSM SIM cards. Allows you to send the phone book, SMS and information about the phone’s calls to the target to a predefined SMS number. Download to the card is possible either via USB or by air. In both cases, installation may require keys to access the SIM card used by the mobile operator.


MONKEYCALENDAR - software tab for GSM SIM cards. Sends encrypted coordinates of the target phone to a predefined SMS number. The installation technology is similar to GOPHERSET.

PICASSO is a modified GSM standard telephone designed to collect user data, record indoor sound and track (based on data about base stations). Management and data transfer is carried out via SMS.

TOTECHASER - software tab (for Windows CE) for a dual-band (satellite and GSM) Thuraya 2520 phone. Allows you to receive user data from the target phone via hidden SMS via satellite or GSM channel.


TOTEGHOSTLY 2.0 - software tab for the Windows Mobile operating system. It has rich functionality and allows you to get full access to the phone. Management is possible both via SMS and through a GPRS connection.

Indoor Work Equipment

CTX4000 is a portable continuous emitter designed to illuminate target systems to receive data from bookmarks installed there. The predecessor of PHOTOANGLO.

LOUDAUTO - hardware bookmark. A bug works when irradiated with a special signal, transmitting sound from the room in which it is installed in the reflected radio signal.

NIGTHWATCH - a system based on a laptop computer designed to process signals from a target monitor. The signal can come from information collection systems (for example, from CTX4000 or PHOTOANGLO when the bookmark in the RAGEMASTER video cable is highlighted), or from a general-purpose receiver.

PHOTOANGLO is an improved continuous emitter designed to illuminate target systems and receive data from bookmarks installed there. More portable than CTX4000.

TAWDRYYARD - a miniature beacon that works when a radio signal is received from a specialized emitter. Used to find the installation locations of other bookmarks, such as, for example, RAGEMASTER.


Based on materials from FreeSnowden , LeakSource , Spiegel .