NSA Has 50,000 ‘Digital Sleeper Agents

[NC Susan]

NSA Has 50,000 ‘Digital Sleeper Agents’ Via Computer Malware, Says Latest Snowden Leak

Posted <time datetime="2013-11-23" class="timestamp">yesterday</time> by Darrell Etherington (@drizzled)

http://techcrunch.com/2013/11/23/nsa-has-50000-digital-sleeper-agents-snowden/

Sleeper agents are among the most sinister spy assets: they lie in wait, wolves in sheep’s clothing, and then deliver a critical blow when activated. The NSA has 50,000 of those waiting for the literal push of a button, according to the latest batch of leaked Snowden documents, as seen by Dutch daily evening newspaper NRC. But these aren’t people, like Keri Russel and Matthew Rhys in The Americans – these are computers, infected with malware and untroubled by conscience or the risk of going native.

The NSA reportedly infected 50,000 computer networks worldwide with malicious software with the sole aim of harvesting sensitive information it wasn’t privy to, which is basically what you’d call textbook spy work in the digital age, from an agency tasked with spying. That’s not to excuse or dismiss the significance of this revelation, but we’ve heard from the Washington Post previously that the NSA was working on this sort of thing and that at least 20,000 computers had been infected by the program as of 2008. So to hear from Snowden documents via the NRC that it’s now climbed to 50,000 is hardly surprising.

New details brought to light indicate that operations from its so-called “Computer Networks Exploitation” program are active around the world, and can remain active for many years without being detected in some parts of the world like Venezuela and Brazil. All the malware can we watched and controlled remotely, and turned on and off “with a single push of a button.” A New York Times report published yesterday also asserts that the NSA has been pushing to stretch its surveillance powers even further, with the aim of catching up to the spread and reach of digital technology and online communications.
The truly amazing thing about this is just how pedestrian the NSA’s efforts are – according to NRC, they’re essentially running the same kind of phishing scams with false email requests that you’ll see from any other purveyor of malicious software. As an example, NRC points to how the British GCHQ used false LinkedIn pages to lure and infect Belgacom network employees. Just one more good reason to never click on anything sent from anyone ever.

The ongoing NSA debacle is like a Breugel painting, with more and more detail emerging every time you look at it anew. Yahoo and Google’s networks were apparently compromised in a similar fashion, documents revealed in late October, and with up to 200,000 documents in total potentially taken by Snowden and shared with reporters, it’s unlikely we’re anywhere near seeing the whole picture at this point.

The NSA declined to comment on this story or the original report.

 

[NC Susan]

http://techcrunch.com/2013/11/23/nsa-has-50000-digital-sleeper-agents-snowden/

Everything you need to know about the NSA and Tor in one FAQ

• By Timothy B. Lee
• <time datetime="2013-10-04T15:56:28+00:00">October 4 at 3:56 pm</time>

(Torkild Retvedt)

Documents released by whistleblower Edward Snowden have revealed that the National Security Agency has powerful capabilities to identify and spy on users of the Tor network, three of my colleagues report. But what's Tor? How do the attacks work? And what does all this mean for Internet security?
Read on to find out.


What's Tor?
Tor originally stood for The Onion Router. It's a worldwide network of servers designed to help users browse the Web anonymously, along with software to access the network.
The open-source software was developed 11 years ago with funding from the U.S. military, but no single person or organization controls the network as a whole.

How does it work?
The Tor service disguises a user's identity by bouncing traffic among several different Tor servers, or nodes. The packets are encrypted in a way that ensures that each link in the chain only knows about the links immediately before and after it. As a result, when a packet emerges from the Tor network, no one can figure out who sent it.

That sounds really complicated. Can ordinary users use it?
To make the system easier to use, the Tor project provides the Tor Browser Bundle. That's a version of the Firefox Web browser that's been pre-configured to send all of its traffic through the Tor network. So to anonymize your traffic, all you do is download the Tor version of Firefox and use it like you would an ordinary Web browser. No special configuration or technical knowledge is required.

That sounds really easy. Why doesn't everyone do that?
Encrypting your packets and bouncing them around the Internet isn't costless. All that extra work means that browsing the Web via Tor feels sluggish compared to using a conventional browser.
If anonymity is important to you — say, you're a dissident in a repressive country, a corporate whistleblower or the owner of a Bitcoin-based drug marketplace — that extra sluggishness is well worth the trouble. But for most of us, the anonymity of Tor is overkill, so we don't use it.
And that's a good thing, because the Tor network has limited capacity. Tor nodes are donated by governments, institutions and private individuals who want to promote privacy. There's never quite enough to go around, so the network is often congested.

Is the Tor network secure?
As far as we know, yes. Even the NSA has struggled to spy on the network. "We will never be able to de-anonymize all Tor users all the time," a slide from a 2007 NSA presentation stated. "With manual analysis we can de-anonymize a very small fraction of Tor users." But at least as of 2007, the NSA didn't have any techniques that would allow them to target particular users on demand.

Then what's this about the NSA spying on Tor users?
Remember I said earlier that the most popular way to use Tor is to download the Tor Browser Bundle? Well, Web browsers are much more complicated than stand-alone Tor software. So while hacking the core Tor network has proven difficult, hacking a Tor user's browser is easier.
According to the Guardian, the NSA's attack works by "implanting malicious code on the computer of Tor users who visit particular websites." The malicious code is designed to target vulnerabilities that exist in the version of Firefox that's in the Tor Browser Bundle.

This sounds familiar. Wasn't the government accused of using a compromised server to serve malware to child pornography suspects in July?
Yes. The FBI recently admitted that it had taken control of Freedom Hosting, a company that provides Tor hidden services, in July. The server began serving malware that "exploited a security hole in Firefox to identify users of the Tor Browser Bundle." That apparently allowed the NSA to identify people who had been browsing a Tor hidden service for child pornography.
It looks like the compromise of Freedom Hosting was one use of the NSA's powerful capacity to attack users of the Tor Browser Bundle.

So this attack depends on the target visiting an NSA-controlled Web site?
Ordinarily it would, but according to Bruce Schneier, who has been working with the Guardian's investigative team, the NSA has the ability to impersonate Web sites it doesn't control to inject malicious code.
"The NSA places secret servers, codenamed Quantum, at key places on the internet backbone," Schneier writes. These servers intercept requests for legitimate websites and respond before the legitimate server can reply. The Quantum server's response redirects the target's browser to an NSA-controlled web server that sends the browser malware.

That sounds like a sophisticated attack. What kind of infrastructure is required to carry it out?
Executing this type of attack, known as "man in the middle," requires working closely with Internet backbone providers. Major telecommunications companies apparently allow the NSA to install equipment in their facilities and tap into the streams of data they transmit.
The NSA also has a secret network of sophisticated Web servers to deliver the malware, Schneier writes. Servers in this system, code-named FoxAcid, install malware capable of burrowing deep into the target computer, making it difficult to detect or remove. The malware can spy on the user and report back to the NSA with information.
Schneier reports that "By 2008, the NSA was getting so much FoxAcid callback data that they needed to build a special system to manage it all."

Could that same infrastructure be turned against people who aren't using Tor?
It seems that way. While the specific attacks disclosed today focused on users of the Tor Browser Bundle, the Quantum and FoxAcid program could be used to attack any user whose browser had vulnerabilities known to the NSA. And new browser vulnerabilities are discovered on a regular basis. In other words, there's a good chance the NSA could use systems like Quantum and FoxAcid hack into the computer you're using to read this right now if it wanted to.

Where can I read the NSA documents that Ed Snowden leaked regarding Tor surveillance?
We've got an annotated copy of two of the documents available here, here, and here. Additional documents are available from the Guardian here and here.