documents reveal top nsa hacking unit

8/13/2019 Documents Reveal Top NSA Hacking Unit

http://slidepdf.com/reader/full/documents-reveal-top-nsa-hacking-unit 1/6

12/29/2013 09:18 AM

Inside TAO

Documents Reveal Top NSA Hacking Unit

By SPIEGEL Staff

The NSA's TAO hacking unit is considered to be the intelligence agenc 's top secret!eapon" It maintains its o!n covert net!ork# in$iltrates computers around the !orldand even intercepts shipping deliveries to plant back doors in electronics ordered bthose it is targeting"

In January 2010, numerous homeowners in San Antonio, Texas, stood a!!"ed in !ront o! their#"osed $ara$e doors% They wanted to dri&e to wor' or head o!! to do their $ro#ery sho((in$, uttheir $ara$e door o(eners had $one dead, "ea&in$ them stranded% )o matter how many timesthey (ressed the uttons, the doors didn*t ud$e% The (ro "em (rimari"y a!!e#ted residents in thewestern (art o! the #ity, around Mi"itary +ri&e and the interstate hi$hway 'nown as oo( -10%

In the .nited States, a #ountry o! #ars and #ommuters, the mysterious $ara$e door (ro "emui#'"y e#ame an issue !or "o#a" (o"iti#ians% ."timate"y, the muni#i(a" $o&ernment so"&ed theridd"e% au"t !or the error "ay with the .nited States* !orei$n inte""i$en#e ser&i#e, the )ationa"Se#urity A$en#y, whi#h has o!!i#es in San Antonio% !!i#ia"s at the a$en#y were !or#ed to admitthat one o! the )SA*s radio antennas was road#astin$ at the same !re uen#y as the $ara$e dooro(eners% m arrassed o!!i#ia"s at the inte""i$en#e a$en#y (romised to reso"&e the issue as ui#'"yas (ossi "e, and soon the doors e$an o(enin$ a$ain%

It was than's to the $ara$e door o(ener e(isode that Texans "earned ust how !ar the )SA*s wor'had en#roa#hed u(on their dai"y "i&es% or uite some time now, the inte""i$en#e a$en#y hasmaintained a ran#h with around 2,000 em("oyees at a#'"and Air or#e 4ase, a"so in SanAntonio% In 2005, the a$en#y too' o&er a !ormer Sony #om(uter #hi( ("ant in the western (art o!

the #ity% A ris' (a#e o! #onstru#tion #ommen#ed inside this enormous #om(ound% The a# uisitiono! the !ormer #hi( !a#tory at Sony 6"a#e was (art o! a massi&e ex(ansion the a$en#y e$an a!terthe e&ents o! Se(t% 11, 2001%

On%&all Digital lumbers

ne o! the two main ui"din$s at the !ormer ("ant has sin#e housed a so(histi#ated )SA unit, onethat has ene!ited the most !rom this ex(ansion and has $rown the !astest in re#ent years 77 the!!i#e o! Tai"ored A##ess (erations, or TA % This is the )SA*s to( o(erati&e unit 77 somethin$ "i'ea s uad o! ("um ers that #an e #a""ed in when norma" a##ess to a tar$et is "o#'ed%

A##ordin$ to interna" )SA do#uments &iewed y S6I , these on7#a"" di$ita" ("um ers arein&o"&ed in many sensiti&e o(erations #ondu#ted y Ameri#an inte""i$en#e a$en#ies% TA *s area o!

o(erations ran$es !rom #ounterterrorism to #y er atta#'s to traditiona" es(iona$e% The do#umentsre&ea" ust how di&ersi!ied the too"s at TA *s dis(osa" ha&e e#ome 77 and a"so how it ex("oits thete#hni#a" wea'nesses o! the IT industry, !rom Mi#roso!t to is#o and uawei, to #arry out itsdis#reet and e!!i#ient atta#'s%

The unit is ;a'in to the wunder'ind o! the .S inte""i$en#e #ommunity,; says Matthew Aid, ahistorian who s(e#ia"i<es in the history o! the )SA% ; ettin$ the un$etta "e; is the )SA*s owndes#ri(tion o! its duties% ;It is not a out the uantity (rodu#ed ut the ua"ity o! inte""i$en#e thatis im(ortant,; one !ormer TA #hie! wrote, des#ri in$ her wor' in a do#ument% The (a(er seen yS6I uotes the !ormer unit head statin$ that TA has #ontri uted ;some o! the mostsi$ni!i#ant inte""i$en#e our #ountry has e&er seen%; The unit, it $oes on, has ;a##ess to our &eryhardest tar$ets%;

A Unit (orn o$ the Internet

+e!inin$ the !uture o! her unit at the time, she wrote that TA ;needs to #ontinue to $row andmust "ay the !oundation !or inte$rated om(uter )etwor' (erations,; and that it must ;su((ort

sur 6

30/12/2013file:///C:/Users/Gomes/AppData/Local/Temp/Low/ 3L!"#$1%&tm



su(er&ised !rom the o!!i#es there, ma'in$ A&enida onstituyentes a one7sto( sho( !or anyonesee'in$ to "earn more a out the #ountry*s se#urity a((aratus%

Operation ,HIT-TA*A.-

That #onsidered, assi$nin$ the TA unit res(onsi "e !or tai"ored o(erations to tar$et theSe#retariat ma'es a "ot o! sense% A!ter a"", one do#ument states, the .S +e(artment o! ome"andSe#urity and the .nited States* inte""i$en#e a$en#ies ha&e a need to 'now e&erythin$ a out the

dru$ trade, human tra!!i#'in$ and se#urity a"on$ the .S7Mexi#o order% The Se#retariat (resentsa (otentia" ;$o"dmine; !or the )SA*s s(ies, a do#ument states% The TA wor'ers se"e#ted systemsadministrators and te"e#ommuni#ations en$ineers at the Mexi#an a$en#y as their tar$ets, thusmar'in$ the start o! what the unit du ed (eration @ IT TAMA %

@or'ers at )SA*s tar$et se"e#tion o!!i#e, whi#h a"so had An$e"a Mer'e" in its si$hts in 2002 e!oreshe e#ame #han#e""or, sent TA a "ist o! o!!i#ia"s within the Mexi#an Se#retariat they thou$htmi$ht ma'e interestin$ tar$ets% As a !irst ste(, TA (enetrated the tar$et o!!i#ia"s* emai"a##ounts, a re"ati&e"y sim("e o % )ext, they in!i"trated the entire networ' and e$an #a(turin$data%

Soon the )SA s(ies had 'now"ed$e o! the a$en#y*s ser&ers, in#"udin$ I6 addresses, #om(utersused !or emai" tra!!i# and indi&idua" addresses o! di&erse em("oyees% They a"so o tained dia$ramso! the se#urity a$en#ies* stru#tures, in#"udin$ &ideo sur&ei""an#e% It a((ears the o(eration#ontinued !or years unti" S6I !irst re(orted on it in #to er %

The te#hni#a" term !or this ty(e o! a#ti&ity is ; om(uter )etwor' x("oitation; B ) C% The $oa"here is to ;su &ert end(oint de&i#es,; a##ordin$ to an interna" )SA (resentation that S6I has&iewed% The (resentation $oes on to "ist near"y a"" the ty(es o! de&i#es that run our di$ita" "i&es 77;ser&ers, wor'stations, !irewa""s, routers, handsets, (hone swit#hes, S A+A systems, et#%;S A+As are industria" #ontro" systems used in !a#tories, as we"" as in (ower ("ants% Anyone who#an rin$ these systems under their #ontro" has the (otentia" to 'no#' out (arts o! a #ountry*s#riti#a" in!rastru#ture%

The most we""7'nown and notorious use o! this ty(e o! atta#' was the de&e"o(ment o! Stuxnet,the #om(uter worm whose existen#e was dis#o&ered in June 2010% The &irus was de&e"o(ed

oint"y y Ameri#an and Israe"i inte""i$en#e a$en#ies to sa ota$e Iran*s nu#"ear (ro$ram, andsu##ess!u""y so% The #ountry*s nu#"ear (ro$ram was set a#' y years a!ter Stuxnet mani(u"atedthe S A+A #ontro" te#hno"o$y used at Iran*s uranium enri#hment !a#i"ities in )atan<, renderin$ u(to 1,000 #entri!u$es unusa "e%

The s(e#ia" )SA unit has its own de&e"o(ment de(artment in whi#h new te#hno"o$ies arede&e"o(ed and tested% This di&ision is where the rea" tin'erers #an e !ound, and theirin&enti&eness when it #omes to !indin$ ways to in!i"trate other networ's, #om(uters andsmart(hones e&o'es a modern ta'e on H, the "e$endary $ad$et in&entor in James 4ond mo&ies%

Having /un at *icroso$t's -+pense

ne exam("e o! the sheer #reati&ity with whi#h the TA s(ies a((roa#h their wor' #an e seen in

a ha#'in$ method they use that ex("oits the error7(roneness o! Mi#roso!t*s @indows% &ery usero! the o(eratin$ system is !ami"iar with the annoyin$ window that o##asiona""y (o(s u( on s#reenwhen an interna" (ro "em is dete#ted, an automati# messa$e that (rom(ts the user to re(ort theu$ to the manu!a#turer and to restart the (ro$ram% These #rash re(orts o!!er TA s(e#ia"ists awe"#ome o((ortunity to s(y on #om(uters%

@hen TA se"e#ts a #om(uter somewhere in the wor"d as a tar$et and enters its uni ue identi!iersBan I6 address, !or exam("eC into the #orres(ondin$ data ase, inte""i$en#e a$ents are thenautomati#a""y noti!ied any time the o(eratin$ system o! that #om(uter #rashes and its userre#ei&es the (rom(t to re(ort the (ro "em to Mi#roso!t% An interna" (resentation su$$ests it is)SA*s (ower!u" ?eys#ore s(yin$ too" that is used to !ish these #rash re(orts out o! the massi&esea o! Internet tra!!i#%

The automated #rash re(orts are a ;neat way; to $ain ;(assi&e a##ess; to a ma#hine, the(resentation #ontinues% 6assi&e a##ess means that, initia""y, on"y data the #om(uter sends outinto the Internet is #a(tured and sa&ed, ut the #om(uter itse"! is not yet mani(u"ated% Sti"", e&enthis (assi&e a##ess to error messa$es (ro&ides &a"ua "e insi$hts into (ro "ems with a tar$eted

sur 6

30/12/2013file:///C:/Users/Gomes/AppData/Local/Temp/Low/ 3L!"#$1%&tm



(erson*s #om(uter and, thus, in!ormation on se#urity ho"es that mi$ht e ex("oita "e !or ("antin$ma"ware or s(yware on the unwittin$ &i#tim*s #om(uter%

A"thou$h the method a((ears to ha&e "itt"e im(ortan#e in (ra#ti#a" terms, the )SA*s a$ents sti""seem to en oy it e#ause it a""ows them to ha&e a it o! a "au$h at the ex(ense o! the Seatt"e7ased so!tware $iant% In one interna" $ra(hi#, they re("a#ed the text o! Mi#roso!t*s ori$ina" errormessa$e with one o! their own readin$, ;This in!ormation may e inter#e(ted y a !orei$n si$intsystem to $ather detai"ed in!ormation and etter ex("oit your ma#hine%; B;Si$int; stands !or;si$na"s inte""i$en#e%;C

ne o! the ha#'ers* 'ey tas's is the o!!ensi&e in!i"tration o! tar$et #om(uters with so7#a""edim("ants or with "ar$e num ers o! Tro ans% They*&e estowed their s(yin$ too"s with i""ustriousmoni'ers "i'e ;A) E> ) I 4 E,; ; @ EM )? >; or ;@AT E@IT %; These names maysound #ute, ut the too"s they des#ri e are oth a$$ressi&e and e!!e#ti&e%

A##ordin$ to detai"s in @ashin$ton*s #urrent ud$et ("an !or the .S inte""i$en#e ser&i#es, around85,000 #om(uters wor"dwide are (ro e#ted to e in!i"trated y the )SA s(e#ia"ists y the end o!this year% 4y !ar the ma ority o! these ;im("ants; are #ondu#ted y TA teams &ia the Internet%

Increasing Sophistication

.nti" ust a !ew years a$o, )SA a$ents re"ied on the same methods em("oyed y #y er #rimina"sto #ondu#t these im("ants on #om(uters% They sent tar$eted atta#' emai"s dis$uised as s(am#ontainin$ "in's dire#tin$ users to &irus7in!e#ted we sites% @ith su!!i#ient 'now"ed$e o! anInternet rowser*s se#urity ho"es 77 Mi#roso!t*s Internet x("orer, !or exam("e, is es(e#ia""y(o(u"ar with the )SA ha#'ers 77 a"" that is needed to ("ant )SA ma"ware on a (erson*s #om(uteris !or that indi&idua" to o(en a we site that has een s(e#ia""y #ra!ted to #om(romise the user*s#om(uter% S(ammin$ has one 'ey draw a#' thou$h: It doesn*t wor' &ery o!ten%

)e&erthe"ess, TA has dramati#a""y im(ro&ed the too"s at its dis(osa"% It maintains a so(histi#atedtoo" ox 'nown interna""y y the name ;H.A)T.MT E>%; ; ertain H.A)T.M missions ha&e asu##ess rate o! as hi$h as 80 , where s(am is "ess than 1 ,; one interna" )SA (resentationstates%

A #om(rehensi&e interna" (resentation tit"ed ;H.A)T.M A6A4I ITI S,; whi#h S6I has&iewed, "ists &irtua""y e&ery (o(u"ar Internet ser&i#e (ro&ider as a tar$et, in#"udin$ a#e oo',>ahoo, Twitter and >ouTu e% ;)SA H.A)T.M has the $reatest su##ess a$ainst >ahoo, a#e oo'and stati# I6 addresses,; it states% The (resentation a"so notes that the )SA has een una "e toem("oy this method to tar$et users o! oo$"e ser&i#es% A((arent"y, that #an on"y e done y4ritain*s H inte""i$en#e ser&i#e, whi#h has a# uired H.A)T.M too"s !rom the )SA%

A !a&ored too" o! inte""i$en#e ser&i#e ha#'ers is ;H.A)T.MI)S ET%; H wor'ers used thismethod to atta#' the #om(uters o! em("oyees at (art"y $o&ernment7he"d 4e"$iante"e#ommuni#ations #om(any 4e"$a#om, in order to use their #om(uters to (enetrate e&en !urtherinto the #om(any*s networ's% The )SA, meanwhi"e, used the same te#hno"o$y to tar$et hi$h7ran'in$ mem ers o! the r$ani<ation o! the 6etro"eum x(ortin$ ountries B 6 C at theor$ani<ation*s Gienna head uarters% In oth #ases, the trans7At"anti# s(yin$ #onsortium $ainedunhindered a##ess to &a"ua "e e#onomi# data usin$ these too"s%

The NSA's Shado! Net!ork

The insert method and other &ariants o! H.A)T.M are #"ose"y "in'ed to a shadow networ'o(erated y the )SA a"on$side the Internet, with its own, we""7hidden in!rastru#ture #om(rised o!;#o&ert; routers and ser&ers% It a((ears the )SA a"so in#or(orates routers and ser&ers !rom non7)SA networ's into its #o&ert networ' y in!e#tin$ these networ's with ;im("ants; that then a""owthe $o&ernment ha#'ers to #ontro" the #om(uters remote"y% B "i#' here to read a re"ated arti#"eon the )SA*s ;im("ants;%C

In this way, the inte""i$en#e ser&i#e see's to identi!y and tra#' its tar$ets ased on their di$ita"!oot(rints% These identi!iers #ou"d in#"ude #ertain emai" addresses or we site #oo'ies set on a

(erson*s #om(uter% ! #ourse, a #oo'ie doesn*t automati#a""y identi!y a (erson, ut it #an i! itin#"udes additiona" in!ormation "i'e an emai" address% In that #ase, a #oo'ie e#omes somethin$"i'e the we e ui&a"ent o! a !in$er(rint%

sur 6

30/12/2013file:///C:/Users/Gomes/AppData/Local/Temp/Lo /!3L"#$%1&'tm



A Race (et!een Servers

n#e TA teams ha&e $athered su!!i#ient data on their tar$ets* ha its, they #an shi!t into atta#'mode, (ro$rammin$ the H.A)T.M systems to (er!orm this wor' in a "ar$e"y automated way% I! adata (a#'et !eaturin$ the emai" address or #oo'ie o! a tar$et (asses throu$h a #a "e or routermonitored y the )SA, the system sounds the a"arm% It determines what we site the tar$et(erson is tryin$ to a##ess and then a#ti&ates one o! the inte""i$en#e ser&i#e*s #o&ert ser&ers,'nown y the #odename A I+%

This )SA ser&er #oer#es the user into #onne#tin$ to )SA #o&ert systems rather than the intendedsites% In the #ase o! 4e"$a#om en$ineers, instead o! rea#hin$ the in'edIn (a$e they werea#tua""y tryin$ to &isit, they were a"so dire#ted to A I+ ser&ers housed on )SA networ's%.ndete#ted y the user, the mani(u"ated (a$e trans!erred ma"ware a"ready #ustom tai"ored tomat#h se#urity ho"es on the tar$et (erson*s #om(uter%

The te#hni ue #an "itera""y e a ra#e etween ser&ers, one that is des#ri ed in interna" inte""i$en#ea$en#y ar$on with (hrases "i'e: ;@ait !or #"ient to initiate new #onne#tion,; ;ShootK; and ; o(eto eat ser&er7to7#"ient res(onse%; i'e any #om(etition, at t imes the #o&ert networ'*ssur&ei""an#e too"s are ;too s"ow to win the ra#e%; !ten enou$h, thou$h, they are e!!e#ti&e%Im("ants with H.A)T.MI)S ET, es(e#ia""y when used in #on un#tion with in'edIn, now ha&e asu##ess rate o! o&er 50 (er#ent, a##ordin$ to one interna" do#ument%

Tapping Undersea &ables

At the same time, it is in no way true to say that the )SA has its si$hts set ex#"usi&e"y on se"e#tindi&idua"s% ! e&en $reater interest are entire networ's and networ' (ro&iders, su#h as the !i ero(ti# #a "es that dire#t a "ar$e share o! $"o a" Internet tra!!i# a"on$ the wor"d*s o#ean !"oors%

ne do#ument "a e"ed ;to( se#ret; and ;not !or !orei$ners; des#ri es the )SA*s su##ess in s(yin$on the ;S A7M 7@ 7-; #a "e system% This massi&e underwater #a "e und"e #onne#ts uro(e with)orth A!ri#a and the u"! states and then #ontinues on throu$h 6a'istan and India, a"" the way toMa"aysia and Thai"and% The #a "e system ori$inates in southern ran#e, near Marsei""e% Amon$ the#om(anies that ho"d ownershi( sta'es in it are ran#e Te"e#om, now 'nown as ran$e and sti""(art"y $o&ernment7owned, and Te"e#om Ita"ia S(ar'"e%

The do#ument (roud"y announ#es that, on e % 13, 2013, TA ;su##ess!u""y #o""e#ted networ'mana$ement in!ormation !or the S A7Me7@e .ndersea a "e Systems BSM@7-C%; @ith the he"( o!a ;we site mas uerade o(eration,; the a$en#y was a "e to ;$ain a##ess to the #onsortium*smana$ement we site and #o""e#ted ayer 2 networ' in!ormation that shows the #ir#uit ma((in$!or si$ni!i#ant (ortions o! the networ'%;

It a((ears the $o&ernment ha#'ers su##eeded here on#e a$ain usin$ the H.A)T.MI)S ETmethod%

The do#ument states that the TA team ha#'ed an interna" we site o! the o(erator #onsortiumand #o(ied do#uments stored there (ertainin$ to te#hni#a" in!rastru#ture% 4ut that was on"y the!irst ste(% ;More o(erations are ("anned in the !uture to #o""e#t more in!ormation a out this and

other #a "e systems,; it #ontinues%

4ut numerous interna" announ#ements o! su##ess!u" atta#'s "i'e the one a$ainst the undersea#a "e o(erator aren*t the ex#"usi&e !a#tors that ma'e TA stand out at the )SA% In #ontrast tomost )SA o(erations, TA *s &entures o!ten re uire (hysi#a" a##ess to their tar$ets% A!ter a"", youmi$ht ha&e to dire#t"y a##ess a mo i"e networ' transmission station e!ore you #an e$in ta((in$the di$ita" in!ormation it (ro&ides%

Sp ing Traditions .ive On

To #ondu#t those ty(es o! o(erations, the )SA wor's to$ether with other inte""i$en#e a$en#iessu#h as the IA and 4I, whi#h in turn maintain in!ormants on "o#ation who are a&ai"a "e to he"(with sensiti&e missions% This ena "es TA to atta#' e&en iso"ated networ's that aren*t #onne#ted

to the Internet% I! ne#essary, the 4I #an e&en ma'e an a$en#y7owned et a&ai"a "e to !erry thehi$h7te#h ("um ers to their tar$et% This $ets them to their destination at the ri$ht time and #anhe"( them to disa((ear a$ain undete#ted a!ter as "itt"e as a ha"! hour*s wor'%

Page % sur 6

30/12/2013file:///C:/Users/Gomes/AppData/Local/Temp/Lo /!3L"#$%1&'tm



Responding to a query from SPIEGEL, NSA officials issued a statement saying, "Tailored Accessperations is a unique national asset t!at is on t!e front lines of ena ling NSA to defend t!enation and its allies#" T!e statement added t!at TA $s "%or& is centered on computer net%or&e'ploitation in support of foreign intelligence collection#" T!e officials said t!ey %ould not discussspecific allegations regarding TA $s mission#

Sometimes it appears t!at t!e %orld$s most modern spies are (ust as reliant on con)entionalmet!ods of reconnaissance as t!eir predecessors#

Ta&e, for e'ample, %!en t!ey intercept s!ipping deli)eries# If a target person, agency or companyorders a ne% computer or related accessories, for e'ample, TA can di)ert t!e s!ipping deli)eryto its o%n secret %or&s!ops# T!e NSA calls t!is met!od interdiction# At t!ese so*called "loadstations," agents carefully open t!e pac&age in order to load mal%are onto t!e electronics, ore)en install !ard%are components t!at can pro)ide ac&door access for t!e intelligence agencies#All su sequent steps can t!en e conducted from t!e comfort of a remote computer#

T!ese minor disruptions in t!e parcel s!ipping usiness ran& among t!e "most producti)eoperations" conducted y t!e NSA !ac&ers, one top secret document relates in ent!usiastic terms#T!is met!od, t!e presentation continues, allo%s TA to o tain access to net%or&s "around t!e%orld#"

E)en in t!e Internet Age, some traditional spying met!ods continue to li)e on#

REPORTED BY JACOB APPELBAUM, LAURA POITRAS, MARCEL ROSENBACH, CHRISTIAN STÖCKER, JÖRGSCHINDLER AND HOLGER STARK

URL:

!ttp+ %%%#spiegel#de international %orld t!e*nsa*uses*po%erful*tool o'*in*effort*to*spy*on*glo al*net%or&s*a*-./-0-#!tml

Related SPIEGEL ONLINE lin !:

S!opping for Spy Gear 1atalog Ad)ertises NSA Tool o' 234 4- 4/356!ttp+ %%%#spiegel#de international %orld /,3738,-./--.,//#!tml9riendly 9ire :o% G1:; <onitors Germany, Israel and t!e E= 234 4/ 4/356!ttp+ %%%#spiegel#de international %orld /,3738,-./357,//#!tmlil Espionage :o% t!e NSA and G1:; Spied on PE1 233 33 4/356!ttp+ %%%#spiegel#de international %orld /,3738,-54>>>,//#!tml9res! Lea& on =S Spying NSA Accessed <e'ican President$s Email 23/ 4/ 4/356!ttp+ %%%#spiegel#de international %orld /,3738,-4883>,//#!tml;uantum Spying G1:; =sed 9a&e Lin&edIn Pages to Target Engineers 233 33 4/356!ttp+ %%%#spiegel#de international %orld /,3738,-54843,//#!tmlAlly and Target =S Intelligence ?atc!es Germany 1losely 2/8 34 4/356!ttp+ %%%#spiegel#de international %orld /,3738,-30/4-,//#!tml

Related inte"net lin !

#$a!%in&t'n P'!t#: @eric!t er 1y er*Attac&en 4/33!ttp+ %%%#%as!ingtonpost#com %orld national*security us*spy*agencies*mounted*453*offensi)e*cy er*operations*in*4/33*documents*s!o% 4/35 /8 5/ d/-/a0ae*33-e*33e5* .c *fd>ce/.3d83.Bstory#!tmlSPIEGEL NLINE is not lia le for t!e content of e'ternal %e pages#

( SPIEGEL ONLINE )*+All Rig!ts Reser)edReproduction only allo%ed %it! t!e permission of SPIEGELnet Gm :

sur 6