Snowden Documents Show NSA Can't Keep Its Eyes On Its Own Papers; Harvests Data From Other Surveillance Agencies

from the METAPHORCOLLISION:-the-NSA's-haystack-sipping-program dept

Another pile of Snowden documents has been released by Der Spiegel, detailing more of previously revealed NSA/GCHQ activities -- like the harvesting of exploits and hardware shipment "interdiction" -- along with some new stuff, including the NSA's piggybacking on other countries' surveillance to further buttress its massive haystacks.

The report digs deeper into the NSA's Tailored Access Operations, noting that the agency's plans for its targets' hardware are even more aggressive than previously indicated. A document [pdf link] details different offerings for NSA "interns," who will be tasked with a variety of operations to not only compromise hardware integrity, but possibly disable or destroy it.
Potential interns are also told that research into third party computers might include plans to "remotely degrade or destroy opponent computers, routers, servers and network enabled devices by attacking the hardware." Using a program called Passionatepolka, for example, they may be asked to "remotely brick network cards." With programs like Berserkr they would implant "persistent backdoors" and "parasitic drivers". Using another piece of software called Barnfire, they would "erase the BIOS on a brand of servers that act as a backbone to many rival governments."
Despite "tailored" being one of the key words in Tailored Access Operations, the exploits used aren't necessarily targeted. Because the same holes can be exploited by criminals or other "bad guys," non-targeted persons are at risk. And because some of the exploits are by nature self-replicating (documents obtained show the NSA seeking out and deploying trojans and worms), the potential for unintentional collateral damage is always present.
In this guerilla war over data, little differentiation is made between soldiers and civilians, the Snowden documents show. Any Internet user could suffer damage to his or her data or computer. It also has the potential to create perils in the offline world as well. If, for example, a D weapon like Barnfire were to destroy or "brick" the control center of a hospital as a result of a programming error, people who don't even own a mobile phone could be affected.
One of the most fascinating documents is a presentation that borrows a famous line from There Will Be Blood. [pdf link]


The NSA doesn't do all of its own dirty work. Its haystacking efforts also take advantage of surveillance programs deployed by anyone outside of its Five Eyes partnership -- including nominally "friendly" countries like Germany. A combination of hacking and exploits allows the NSA to pursue what it calls "fourth party collections."

Some of this is along the lines of what's expected from a national intelligence service -- like the targeting of "unfriendly" countries.
In 2009, an NSA unit took notice of a data breach affecting workers at the US Department of Defense. The department traced an IP address in Asia that functioned as the command center for the attack. By the end of their detective work, the Americans succeeded not only in tracing the attack's point of origin to China, but also in tapping intelligence information from other Chinese attacks -- including data that had been stolen from the United Nations. Afterwards, NSA workers in Fort Meade continued to read over their shoulders as the Chinese secretly collected further internal UN data. "NSA is able to tap into Chinese SIGINT collection," a report on the success in 2011 stated.
But it goes further than that. Allies outside the Five Eyes partnership are not immune from the NSA's piggybacking. And the NSA goes further than simply utilizing man-in-the-middle attacks to "make copies" of anything interesting other countries' surveillance networks have picked up. The presentation lays out the NSA's use of "fourth party collections" to deploy its own exploits (called "victim stealing") or collect new exploits being deployed by other surveillance agencies.

The stuff the NSA pulls from other surveillance networks is then routed away from the agency in order to cover its tracks. Anything that might lead back to the agency is obscured, which could easily result in innocent persons or companies being targeted by irritated foreign surveillance agencies who happen to notice their networks have been accessed by others.
In technical terms, the ROC [Remote Operations Center] lays false tracks as follows: After third-party computers are infiltrated, the process of exfiltration can begin -- the act of exporting the data that has been gleaned. But the loot isn't delivered directly to ROC's IP address. Rather, it is routed to a so-called Scapegoat Target. That means that stolen information could end up on someone else's servers, making it look as though they were the perpetrators.

Before the data ends up at the Scapegoat Target, of course, the NSA intercepts and copies it using its mass surveillance infrastructure and sends it on to the ROC. But such cover-up tactics increase the risk of a controlled or uncontrolled escalation between the agencies involved.
This isn't as deep as the rabbit hole gets, however. The documents leaked by Ed Snowden also detail yet another layer of the NSA's collection-by-proxy efforts. A Q&A pulled from the NSA's internal message boards [pdf link] contains the following discussion:
Is there "fifth party" collection?

"Fourth party collection" refers to passively or actively obtaining data from some other actor's CNE [computer network exploitation] activity against a target. Has there ever been an instance of NSA obtaining information from Actor One exploiting Actor Two's CNE activity against a target that NSA, Actor One, and Actor Two all care about?

-----

Yes. There was a project that I was working last year with regard to the South Korean CNE program. While we aren't super interested in SK (things changed a bit when they started targeting us a bit more), we were interested in North Korea and SK puts a lot of resources against them.

At that point, our access to NK was next to nothing but we were able to make some inroads to the SK CNE program. We found a few instances where there were NK officials with SK implants on their boxes, so we got on the exfil points, and sucked back the data. Thats fourth party. However, some of the individuals that SK was targeting were also part of the NK CNE program. So I guess that would be the fifth party collect you were talking about. But once that started happening, we ramped up efforts to target NK ourselves (as you dont want to rely on an untrusted actor to do your work for you). But some of the work that was done there was able to help us gain access.

I know of another instance (I will be more vague because I believe there are more compartments involved and parts are probably NF) where there was an actor we were going against. We realized there was another actor that was also going against them and having great success because of a 0 day they wrote. We got the 0 day out of passive and were able to re-purpose it. Big win.
The NSA's long straw surveillance also repurposes vernacular from another arena where the war is neverending and the foes declared so dangerous that every Constitutional violation is justified. Those who are used without their knowledge as "hosts" for information gathered by the NSA's "fourth party" efforts have been given an unflattering nickname.
The unwitting victim, whose phone has been infected with a spy program, smuggles the information out of the office. The information is then retrieved remotely as the victim heads home after work. Digital spies have even adopted drug-dealer slang in referring to these unsuspecting accomplices. They are called "unwitting data mules."
When the NSA discusses its efforts with its oversight, very few details are given on the means and methods. The general attitude seems to be that if something like this occurs outside of the US, it doesn't matter. The NSA may make minimal efforts to preserve American citizens' rights, but it has absolutely no concern for anyone located outside of America's borders.

As Der Spiegel notes, the NSA is operating in a "legal vacuum." The tracks left behind by its milkshake drinking cause it no great concern. While it does make some effort to obfuscate its origins (by saddling uninvolved "data mules" with the consequences), it generally remains unconcerned about being caught in the act. There's no legal process that can truly hold the NSA accountable for its extraterritorial actions -- at least nothing that couldn't easily be deflected by one of the most powerful nations in the world.





Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 21 Jan 2015 @ 9:52am

    It's even scarier when you think about how old these documents are getting from when Snowden liberated them and how much more time the NSA has had to do even more and bigger evil things.

    reply to this | link to this | view in chronology ]

  • icon
    Nastybutler77 (profile), 21 Jan 2015 @ 9:53am

    Wow. So I guess we really are the bad guy.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 21 Jan 2015 @ 9:54am

    How many more US Internet based business's will see profit losses this week, Keep building that wall NSA sooner or later no one will do business with-in any five eyes country, The US being first on the list .. for the NSA its a good thing they stopped the crime because they killed all Internet commerce.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 10:18am

      Re:

      Would say that UK is probably first on the list. GCHQ is even more rabid and far more vocal in their anti-freedom fighting than NSA, which is quite an achievement.

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 21 Jan 2015 @ 2:00pm

        Re: Re:

        security cameras as surveillance cameras, sleep walked into license plate recognition, no doubt efforts into facial recognition, oyster cards as another alternative to tracking...oh yeah, i think uk has em beat

        reply to this | link to this | view in chronology ]

    • icon
      Pronounce (profile), 21 Jan 2015 @ 1:41pm

      Re: 5 Eyes Business Loss Due to Spying

      It's always wise to diversify your business holdings. For cloud business this may look like investment in storage locations inside the firewall of viable economies. So then the major impact by unfriendly business policy is most significantly felt by the local employees and not the corporate office at large.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 21 Jan 2015 @ 10:05am

    What will the NSA do when they find they are reading their own traffic via a another spy agency?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 10:12am

      Re: Who hacks the hacking hackers?

      What will the NSA do when they find they are reading their own traffic via a another spy agency?
      Use the other agency's system to hack into an NSA computer and use the hacked computer to attack the other agency. When the other agency complains, point out the attack came from a hacked computer, could have been anybody, and obviously was not the NSA because it is never so direct and never gets caught doing its own dirty work. Then ask why analysis of the hack shows that the complaining agency had access to that server.

      reply to this | link to this | view in chronology ]

    • icon
      Pronounce (profile), 21 Jan 2015 @ 1:53pm

      Re:

      If their performance during the Sony Hack is any indication the answer to this question is, "Nothing".

      It seems the only point of all this spying is to see who can pwn whom, and get more funding.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 2:12pm

      Re:

      ????

      Implicate themselves?

      Whoahh, inception, man

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 21 Jan 2015 @ 10:10am

    Another defense lawyer angle

    "Your honour, my client is nothing more than an unwitting data mule for the American National Security Agency. He did not commit the hacking alleged by the prosecution and indeed lacks the technical capacity even to attempt such a thing, which is why he was so successfully abused by the Americans."

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 2:19pm

      Re: Another defense lawyer angle

      Judge
      "Wait, you mean, this was an intelligence service who framed your client, and your client had nothing whatsoever to do with what he's being accused of.....oh, ahem, well,.....thats diffrent...."

      Turns to jury

      "!?GUILTY, court dismissed"

      Quickly walks out, whispering sorry,sorry,sorry in to his turned off phone

      reply to this | link to this | view in chronology ]

  • icon
    pixelpusher220 (profile), 21 Jan 2015 @ 10:20am

    Not new?

    I thought it was already well established that Country A hoover's up all data outside Country A, Country B hoovers up all data outside Country B. A and B share data and now they are both 'legal' because they didn't 'collect' their own country's data?
    (obviously the 'only' outside is theoretical only!)

    Which is why the laws should be written to make 'possession' of data from inside the country illegal as well as the collection.

    reply to this | link to this | view in chronology ]

  • icon
    DannyB (profile), 21 Jan 2015 @ 11:13am

    Could the NSA collect disinformation?

    Could the other intelligence agencies who know the NSA is peeking, or allow them to do so, deliberately give the NSA disinformation that the NSA would believe to be genuine surveillance results?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 1:33pm

      Re: Could the NSA collect disinformation?

      That's been going on as long as there has been intelligence gathering. It's not enough to obtain information; one must also obtain the information's accuracy.

      And the folks who decide the information's accuracy don't always get it right.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 2:26pm

      Re: Could the NSA collect disinformation?

      dont worry, they'll only put the most effort into verifying the validity of something untill they get the result they want and no further

      reply to this | link to this | view in chronology ]

  • icon
    John Fenderson (profile), 21 Jan 2015 @ 11:23am

    I am shallow

    As despicable as I find the actions of the NSA, my outrage is amped up even further by the jovial, joking tone taken by many of these internal documents. It's bad enough to spy on us all, they don't have to take such obvious joy in doing so. That just multiplies the evil.

    reply to this | link to this | view in chronology ]

    • icon
      Pronounce (profile), 21 Jan 2015 @ 1:45pm

      Re: I am shallow

      Oh, hahaha, you have no clue how arrogant these people are. The talk behind closed doors is that of a wolf looking at a flock of sheep and gleefully deciding whom to kill. But unlike a wolf who is following their natural instinct these individuals get a rush and high watching the flock flee and squirm as they go for a kill.

      Watch the glee on that dude's game video of him pwning people with head-shots. His enjoyment is on par with what I'm talking about.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 21 Jan 2015 @ 2:43pm

      Re: I am shallow

      Really, i keep getting the impression that its written by for lack of a better word geeks, with a shiny toy and being very excited, or at least, technilogical savvy people in suits playing with the nice shiny new toys they've had their geek department create......now dont get me wrong, technilogical smart dudes or geeks, i have major respect for, i think you as the inovators of the technological world, and am forever greatfull ........but geeks putting their intellectual minds into something that is bad, is still geeks putting their intellectual minds into something that is bad........masse surveilance specifically i mean but not limited

      reply to this | link to this | view in chronology ]

      • icon
        John Fenderson (profile), 21 Jan 2015 @ 3:37pm

        Re: Re: I am shallow

        I am a great big honkin' geek myself. Being a geek doesn't excuse this at all.

        Really, there is a subset of the geek sphere that I routinely see this sort of sociopathic behavior in: criminal hackers in general, but primarily the script kiddies. Even if the NSA wasn't doing anything controversial, that sort of attitude very badly on the agency. It makes it look like they hired a bunch of adolescent crooks.

        reply to this | link to this | view in chronology ]

  • icon
    Padpaw (profile), 21 Jan 2015 @ 12:42pm

    secretly making war on the whole world.

    They were right exposing their crimes will make things worse for America only because the people running things are evil warmongering monsters apparently

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 21 Jan 2015 @ 1:15pm

    Their using our lives as their fucking game

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 21 Jan 2015 @ 1:53pm

    The unwitting victim, whose phone has been infected with a spy program, smuggles the information out of the office. The information is then retrieved remotely as the victim heads home after work. Digital spies have even adopted drug-dealer slang in referring to these unsuspecting accomplices. They are called "unwitting data mules."

    So add, commiting a crime and implicating someone else to the list

    reply to this | link to this | view in chronology ]

  • icon
    M. Alan Thomas II (profile), 21 Jan 2015 @ 1:55pm

    So the NSA knows that (1) nation-states can render IP tracking of a "cyberattack" irrelevant if they've compromised the backbone or even simply hacked the scapegoat and (2) if one nation-state has found a 0 day or other security flaw, another nation-state can hijack it or the resulting data flows for their own purposes.

    Now if only we could convince policy-makers of this....

    reply to this | link to this | view in chronology ]

  • icon
    Pronounce (profile), 21 Jan 2015 @ 2:01pm

    Is it Incompetence or Arrogance?

    GCQH hacks media. NSA hacks intelligence agencies. So why in the world does Der Spiegel even still have access to the Snowden docs?

    It's obvious that the media agencies like Der Spiegel, Techdirt, Last Week Tonight with John Oliver, aren't *THAT* big of a deal (in terms of funding) to these agencies otherwise they'd have a NK DDoS or Charlie Hebdo "accident".

    reply to this | link to this | view in chronology ]

    • icon
      That One Guy (profile), 21 Jan 2015 @ 6:36pm

      Re: Is it Incompetence or Arrogance?

      I imagine anyone who has the Snowden documents is very careful to keep multiple backups, on systems and devices with absolutely no connection whatsoever to the internet.

      reply to this | link to this | view in chronology ]

  • icon
    KoD (profile), 21 Jan 2015 @ 2:12pm

    As much as I would hate to glorify these people wiping their ass with our Constitution, that is some impressive shit.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 21 Jan 2015 @ 4:04pm

    So how can they be sure that someone else is not exploiting their backbone while their exploiting someone elses backbone........this is not gonna end well

    reply to this | link to this | view in chronology ]

  • identicon
    derp, 22 Jan 2015 @ 8:55pm

    NSA spying scandal is old news. Je ne suis pas Charlie.

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: I Invented Email
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.