List of compromized hardware according to leaked NSA docs

[viking60]

Der Spiegel is a German magazine with impeccable reputation. They have investigated the NSA documents leaked and structured it in a way that makes the attempted "smokescreens" useless.

Here is a list of Compromised hardware according to the NSA leaks: Cisco: Cisco Pix and ASA (Adaptive Security Appliance) firewalls, 5505, 5510, 5540, 5550 (firmware implant) HP: HP ProLiant 380DL G5 servers (hardware implant) Dell: Dell PowerEdge 1850 / 2850 / 1950 / 2950 RAID servers with BIOS versions A02, A05, A06, 1.1.0, 1.2.0, or 1.3.7 (BIOS exploits) Dell PowerEdge 1950 / 2950 servers (hardware implant, JTAG interface) Juniper: Juniper Netscreen ns5xt, ns25, ns50, ns200, ns500, and ISG 1000 firewalls Juniper SSG 500 and SSG 300 firewalls (320M, 350M, 520, 550, 520M, 550M). JUNOS (Juniper’s customized version of FreeBSD) on all J-Series, M-Series, T-Series routers Huawei: Huawei Eudemon 200, 500, and 100 series firewalls (installed as a boot ROM upgrade). Moreover, the document says that Huawei routers are targeted, as part of a joint operation between the NSA and the CIA to exploit Huawei equipment (project: TURBOPANDA). ...

The companies all deny that they are knowingly cooperating in this. They are all "pro customer" and totally independent and will investigate everything on behalf of their beloved customers. Their degree of shock and surprise is mixed with a handsome bit of moral indignation.

The "winner" here is clearly Huawei since it is pretty clear that the Chinese company is not cooperating with the NSA and all NSA compromising has to happen via interceptions. So their routers are only compromised because they have been hacked by the NSA.
Interceptions that typically can be done by the NSA controlled; UPS, FedEx or U.S Postal.

On the other hand Huawei could have flaws baked in by the Chinese counterpart to the NSA.
(What we need is a Chinese Edward Snowden)

In addition to this the Hard drives can be compromised by manipulating the Harddisk controllers:


The hardware can be compromised by Western Digital firmware upgrade tools, or some equivalent.
This can give you access to the root account.

These revelations are a result of the security expert Jacob Appelbaum's work:

Listen to all of it and be shocked

Here is a list over the project names:

http://cryptome.org/2014/01/nsa-codenames.htm

And here is one of many ways to compromise the hardware:

Click this LINK for an interactive map of how your privacy is violated (and don't think that this is limited to the US - they only seem to be best at it).

[Snorkasaurus]

don't think that this is limited to the US - they only seem to be best at it

They likely have the most financial and staffing resources to throw at it.

At home I have a pfSense router while at my remote location (where I host junk like my email and web sites) I just have an old Compaq Presario box with iptables. I am pretty sure I am going to switch my home box to basic iptables soon too. I hope there's no backdoors there. :-)

S.

[R_Head]

How you do a BIOS exploit? The ones that I know involve the shutting down the system and booting up with a disk or USB drive. Others you have to have the BIOS update software installed under MS, have not seen it on Linux yet.

My take this is a vulnerability of Physical Security.

[Snorkasaurus]

... hmmm, what about bare metal remote access utilities like iLO and DRAC?
S.

[viking60]

Well it is a fair assumption that it could be compromised. But I am not sure it is necessary to use DRAC or iLO to compromise the boxes. We have learned that they target Sys admins though - so they will be able to use it indirectly.

It is pretty safe to assume that this list is old already and that it has been modernized.

[Snorkasaurus]

One of the reasons I think a baremetal remote agent might be an easy target for goofs is because admins frequently like to use easy passwords on them. I think a lot of admins might be under the impression that baremetal access is limited enough (access to data that is) to not care about it... of course, they'd be wrong. If nothing else they should at least limit baremetal access to an administrative VLAN or subnet.

S.

[Snorkasaurus]

I wanted to make specific comments about the Appelbaum video but there is so much content there that it makes a comprehensive reply pretty hard. In general I was bothered by some of what he said and wanted to look a little deeper in to some of the information. For example, the first device he mentions at 16:15 is a "Close Access Operations Box" which is essentially a laptop that puts unwanted packets on to a wireless network. He specifically goes out of his way to mention that it runs Linux but the OS is really pretty irrelevant... the software they made on it is what is important. It is kind of a compliment to Linux that they chose not to develop their virus on another platform. What struck me as odd is that the slide in the background indicated what OS's it could target but he didn't actually read it out loud. It is able to target

Win2k
WinXP
WinXP SP1
WinXP SP2 w/ IE5.x/6.x

but even those of us who hate Windows 7 enough to still run XP would at least have SP3 installed (especially since it is a requirement for WPA2). Of course it is entirely possible that their virus has been updated but the talk was given just a few months ago and XP/SP2 has been mostly useless for a lot longer than that. This also gives me the impression that it does not target routers or other network devices which I would have expected since it could provide them enhanced remote access.

At 17:12 he is still speaking about the same device and says that the NSA is sabotaging and undermining American companies and American ingenuity. That really sticks in my craw because frankly I hold American companies as being among the least reputable organizations on the planet. For him to say that the NSA is being naughty to Microsoft is like saying that a junkie once punched a rival gang member in the mouth for no good reason. Ultimately I find the insult to US corporations far less important than the complete annihilation of personal privacy and security.

At 24:32 he is specifically talking about untasked surveillance when he remarks that going to certain web sites if you are Muslim will result in an automatic attack. He ends up never finishing his sentence but the part he does actually say does not make sense. Untasked surveillance would not be able to determine the religious views of a web site visitor and therefore could not launch a religiously motivated attack. If the surveillance had been "tasked" instead then the statement would make sense but then that would exclude a lot of people (unless the NSA is now performing mass tasked surveillance).

There were a number of references to projects with names beginning with "quantum" but it seemed that a number of these required an initial compromise which would grant access for the "quantumthing". There was also mention of BIOS based attacks and even hard drive firmware attacks but no details on exactly how these attacks are carried out. As R_Head mentioned, this sounds like it would require far more than a bunch of packets blasted out on a wireless network.

At 53:04 and 55:42 he is mentioning a number of physical devices ranging from USB implants to implants on internal bus connectors to keyboard implants. Now of course all of these are targeted attacks since it wouldn't make sense that they are putting these in all PC's and laptops by default. Potentially they could encourage manufacturers to do this for them, but then it wouldn't be implants it would be a backdoor. In any case, the idea that the NSA could intercept your mail and implant these devices exists but certainly doesn't account for a terrorist who decides to walk in to a computer store and buy a computer.

The tempest thing he mentions at 57:58 sounds interesting, but not much more exotic than a 1GHz ham radio with a 1kW amplifier. I imagine that if it had a proper antenna it could do some physical damage but frankly I would think they'd be better off killing people with bullets in a slingshot.

I'm of course not saying that the content of the talk is false, or that it is unimportant... but I wish there was a complete disclosure of how each of these things works and an opportunity to make them ourselves and learn about them.

I also watched the related William Binney video at MIT and wondered why the audience was full of "older" folks who didn't seem to be deeply technical. I also wondered what a "crypto mathmetician" is. It seems Mr. Binney is the only person who uses the term. He says that he was managing 6000 people which to me is an indication that he is not technical and would not have a deep understanding of the devices and software. He did have a lot to say about the data being recorded but not about the size... he should be able to quote actual numbers on the storage requirements on a year by year basis (even if just rough estimates) and how much is needed for each individual and how much of the data is of US citizens vs. non-US. I have a hard time believing that the NSA's infrastructure (which as he mentions is entirely out of the US) would have enough bandwidth and storage to accommodate the data he says they have. I certainly wouldn't imply that they have no data at all, but I can't believe he is entirely accurate.

The bottom line is that while I can see value in exposing the NSA's poor treatment of people's privacy and security, I wish it didn't have to be so dramatic. I'm not even sure that the sensationalism helps the cause because clearly there are many people who simply believe that it is just fine to be governed by a completely unaccountable group. Unfortunately I think that government and corpocracy will simply carry on until something much more significant happens.

Cheers to clicking submit at 2am in a bad mood. :-)
S.

[viking60]

How you do a BIOS exploit? The ones that I know involve the shutting down the system and booting up with a disk or USB drive. Others you have to have the BIOS update software installed under MS, have not seen it on Linux yet.

My take this is a vulnerability of Physical Security.

It is possible to provide the Bios with software that can replace a file on your root - a trojan of any kind. It can be a key-logger or anything else like taking control over your entire system.
The Bios updates all come from the producers like Intel and they are encrypted so it is mostly useful for the governments. It is probably not easy for common crooks to infect the Bios; they can still mess with your MBR though.

But if the Hardware producers like Intel and the government play on the same team; then it is possible (and likely?) that they can put a default backdoor in there that can be activated the day you turn terrorist.
If North Korea ordered a lot of Dell servers - It would be of great advantage to be able to shut those computers down before those rockets are launched.
More of an advantage than playing AC/DC's Thunderstruck....

viewtopic.php?f=21&t=2176&p=13425&hilit=thunderstruck#p13425

Even though I have to admit that I found that rocking worm ..pretty cool.

It is not cool though when they put it in every computer produced; as a default.

[viking60]

At 17:12 he is still speaking about the same device and says that the NSA is sabotaging and undermining American companies and American ingenuity. That really sticks in my craw because frankly I hold American companies as being among the least reputable organizations on the planet. For him to say that the NSA is being naughty to Microsoft is like saying that a junkie once punched a rival gang member in the mouth for no good reason. Ultimately I find the insult to US corporations far less important than the complete annihilation of personal privacy and security.

Well he is trying to speak a language the Americans understand. If their companies are suffering then they tend to react.
On a principle note it is way more important to ensure the Human rights - like privacy. But that does not "sell" as well in the US.

Another amusing example is if they have checked the health danger of the radiation when spying on your computer with radars - even when you are offline.
The governmental bureaucrats do not let you do anything until you can document over a 100 pages that it is safe - you even have to document that you should not dry poodles in the microwave oven.

For some reason that line of argumentation makes more sense to US buerocrats

It is a fact that Dell HP Microsoft Apple Facebook and Google will have a harder life abroad now. The Germans have every reason to be skeptical - the French are born skeptical so Fujitsu/Siemens will have a bright future.

There is no way anybody can trust a Dell server or a Cisco switch or a HP server etc anymore. Tampering with the hardware is serious stuff.
So the companies are let down by the NSA or by themselves in cases where they cooperated voluntary.

If I was producing European or Japanese cars I would consider everybody putting known tainted hardware in there as an idiot to be fired.

It is not the point if the US are actually committing industrial espionage - that is not how business works. It is the job of the Industry to ensure the security and eliminate risks - both for cars and computers.
They always must consider the worst case scenario and act accordingly; if the US can spy on the head of state then it certainly cannot be ruled out that they can spy on industries.

Europeans and Asians will look for alternatives to American hardware now - even Americans will.

At 53:04 and 55:42 he is mentioning a number of physical devices ranging from USB implants to implants on internal bus connectors to keyboard implants. Now of course all of these are targeted attacks since it wouldn't make sense that they are putting these in all PC's and laptops by default. Potentially they could encourage manufacturers to do this for them, but then it wouldn't be implants it would be a backdoor. In any case, the idea that the NSA could intercept your mail and implant these devices exists but certainly doesn't account for a terrorist who decides to walk in to a computer store and buy a computer.

The USB plugs connecting keyboards are country specific so they may all have a backdoor ready to be exploited - as a default. The problem there would be keyboards produces outside the US. That is where UPS Fedex and US Postal comes in handy.
It would be quite an operation, but they need the capacity to check them for Chinese back doors anyway so it is easier to remove the foreign USB plug and put on a standard "American" one.

After that they can send the removed plug to a lab and check it for a long time, while you still would get your keyboard swiftly.

I don't know any of this - but so far my worst imagination has not been able to go far enough....

[R_Head]

If the system has to be highly secure it will be off the internet and the only way to get to it is by Sneaker Net.

Not sure if anybody know what a "Sneaker Net" is but in the way I was told is a colloquial term of "sneaking" in and/or out information (disc, usb drives, tape drives, etc...)

When I was system admin many moons ago the highly important servers/nodes were isolated from the common network. We have our very own network that only few ports were open and traffic was encrypted on top of that. All the special features like PXE Boot were disable in the BIOS with a Password. If you wanted to hack the system you pretty much had to be present at the node and good luck with that. Doors have Cypher Locks and before you get to that door you have to go through more layers of physical security.

However, some servers were like Honeypots.
You have to give the attackers some to chew on

Noticed that I said Attackers and not Hackers. Not all Hackers are Attackers

You want security?
Is as easy as making your own e-mail server, forget Facebook, Tweeter and all the worthless Social Media.
Close the unused Ports on your Router.
And the most important part; do not advertise what you have/do
Evildoers do what they do it because they want some that you have.

Want more info on how to secure your communication, search for TACLANE.
General Dynamics has some pretty nifty encrypted routers/switches.

I wonder how come nobody have made one commercial?
Would be nice to make your own keys by using a strong password similar to a secured WAP.

So to say all this "Hacker News" is all a bunch of BS scare tactics.

[Snorkasaurus]

I was under the impression that SneakerNet referred to people using sneakers (shoes) as the physical layer of their network.

I [sort of] like the idea of people running their own mail servers, I have done so since uhhhm, well I guess since the early 2000's. Server has full disk encryption, can use SSL/TLS for inbound and outbound connections, backed up to remote location via SSH, has SSL webmail or SSL IMAP for retrieval, heavily customized SpamAssassin service, ClamAV mal-removal, and uses all free software. Too bad it has to run on Windows... I only wish I could find a way to do it with Linux that didn't involve patching together a dozen individual apps and then having to add/configure plugins for something as basic as greylisting.

Running an MTA is also probably well beyond the abilities of most users (geek or not)... look through the support forums of any common MTA package and weep at the lack of effort to understand the protocol. It is not that people are stupid (not all of them anyways) just that folks don't want to spend the time learning about SMTP before they open port 25 to the wild. I am still hoping (probably in futility) that some day people will adopt a new standard of mail transport that enforces authentication and accountability.

S.

[R_Head]

Sneakers came from and I think the cops in London back in the late 1800s (story that read long ago). They requested to change their shoe soles to be made out of rubber.
That way they can "sneak" on people (for good or bad, who knows). So the rubber sole shoes became "Sneakers"

What has to do with the network?

Is "Sneaking" a media and the data, undetected to slip data from one node to another.

I would say is play/pun with words.