NSA’s Revealed Surveillance State: Hacking Keyboards, USB Drives, Firmware, Monitors and More

http://benswann.com/nsas-revealed-surveillance-state-hacking-keyboards-usb-drives-firmware-monitors-and-more/

NSA’s Revealed Surveillance State: Hacking Keyboards, USB Drives, Firmware, Monitors and More

Article submitted by guest contributor Ezra Van Auken.

What’s been said so far about the National Security Agency (NSA) is certainly frightening to privacy and civil libertarian advocates; but with the newest revelations of them all, it’s clear that more of the revealing leaks have only arrived. Whether the leaks are a positive or negative move by whistleblower Edward Snowden is debatable, but the fact remains that what Snowden did has changed the landscape of government discussion.

Digging right in, computer hackers and gurus converged on Brazil for the 2013 Chaos Communication Conference (CCC), the thirtieth year in a row the event has taken place. Of course though, this year around, government spying revelations have hit tech junkies and privacy backers like a ton of bricks. Featured at the CCC event were speakers well known to the current tech community such as Jacob Applebaum and Julian Assange.

Given the current government surveillance debate, Applebaum and Assage were pretty much expected, considering both have dealt heavily with intrusive spying. During the event, Assange video-chatted into the Brazilian conference and offered solution, telling hackers and computer gurus to fight against state-sanctioned surveillance. What Applebaum had to offer though, is what brought down the house for listeners.

Just moments before Applebaum’s CCC speech, Germany’s newspaper Der Spiegel dropped new revelations – probably the most revealing yet – showing the NSA’s vast backdoor access into systems worldwide. Applebaum, member of the Tor project, which is an Internet web browser dedicated to increasing anonymity, decided to gear his speech around the latest revelations. What came during Applebaum’s hour-long speech turned wake-up call, shook the room and YouTube views.

To begin, Applebaum revealed a handful of programs, tools and backdoor hacks, which the NSA uses to monitor people’s systems and data. Let’s take a detailed look into each.

The first newly leaked NSA component called “RAGEMASTER” is a hardware implant that detects and seizes image signals from VGA monitors. The implant itself is hidden in the ferrite insulation of the monitor cable, behind the plug. What is even more mind numbing is the way it works.

When RAGEMASTER is illuminated by the radar unit, the signal is inflected with the red video information. As explained on the released slide, “This information is re-radiated, where it is picked up at the radar, demodulated, and passed onto the processing unit and an external monitor,” which then recreates the horizontal and vertical sync of the monitor, giving NSA personnel the ability to see exactly what’s on the monitor.

Now that we’ve learned how the NSA is able to view exactly what is on your monitor, let’s take a look at “SURLYSPAWN”. This particular hack allows NSA personnel to record and analyze keystrokes, even when the computer isn’t connected to the Internet. SURLYSPAWN is a hardware implant as well, and assists in the transmitting of what a user is typing. The slide noted that “An invisible signal emitted by the implant is modified by every keystroke, and then a radar signal emitted by a device located outside the building makes the implant’s invisible signal visible.”

Once the signal is visible, personnel around the target can see everything being stroked on the keyboard. Using similar processes as RAGEMASTER, the SURLYSPAWN hack requires the implant onto a keyboard.

Then there’s “COTTONMOUTH”: another hardware implant inserted into a USB drive. It is disguised as either a keyboard’s USB plug or a USB extension cord that can be connected between a device and the intended computer. Its role is either to intercept communications or to interject Trojans, while also being able to respond to other already-implanted COTTONMOUTH implants. COTTONMOUTH can monitor the network as well as command the computer and network.

Switching over to the computer in its entirety, “GINSU” is a software hack, which allows other NSA hardware and software programs like BULLDOZER and KONGUR to maintain its stay in the system. When installed, GINSU can catch system reboots and upgrades, so that when the upgrade or reboot takes place, the software is restored to the system. Leaving the target entirely infected, rebooted or not.

And don’t think your wireless LAN is free from constraint. Der Spiegel explains, “The NSA’s ANT division also develops methods for gaining access to wireless LAN networks from the outside, allowing them to tap into these networks and plant their own software on them.” This brings us to the NSA’s “NIGHTSTAND”, which can remotely insert data packets into various Windows systems. The list includes insertions of malware into the wireless networks’ traffic. NIGHTSTAND’s process is mobile and works up to 8 miles.

Some of the targets that NIGHTSTAND can successfully exploit include Win2k, WinXP and WinXPS1P2 running IE, and the packet injection can go after either one target or multiple targets, remaining undetectable by users. Overall, the NIGHTSTAND packet injection would be used during situations when the intended target has no access to a wired connection.

Unfortunately for the privacy advocates and opponents to the surveillance state, Der Spiegel, its journalists involved and Applebaum didn’t stop here. Other NSA backdoors include phone software/hardware hacks, which allow the remote ability to control the hotmic, camera, voicemail details and other areas in the mobile phone. In addition, it’s been revealed that the NSA’s personnel have successfully exploited larger server systems and firewalls with programs such as IRONCHEF and JETPLOW.
At the same time of hype however, those concerned with state spying are only confirming their previously unsure speculation. From reading a user’s monitor, to keyboard stroke detection, to hacking wireless LANs, your footsteps on the Internet are being constantly preserved and stored by the watchers: the NSA. In the end, as government spying grows, it’ll be left up to the market of hackers, computer gurus and other specialists to block, exploit and encrypt around the NSA’s prying eyes, which even now seems like a stretch.

Read more: http://benswann.com/nsas-revealed-surveillance-state-hacking-keyboards-usb-drives-firmware-monitors-and-more/#ixzz2rl5lGtLF
Follow us: @BenSwann_ on Twitter

Feds tell Web firms to turn over user account passwords

Here we go again. The US government abusing their powers to exploit the American public. Demanding passwords from ISP's? Are you kidding me? I am not sure how to stop this or even begin to fight these problems we face today with the tyrannical government we have adopted. All I can do is help educate the people. Help get the word out. - NoMoreLies

Secret demands mark escalation in Internet surveillance by the federal government through gaining access to user passwords, which are typically stored in encrypted form.

(Credit: Photo illustration by James Martin/CNET)  

 

 

 

 

 

 

 

 

 

 

 

 

The U.S. government has demanded that major Internet companies divulge users' stored passwords, according to two industry sources familiar with these orders, which represent an escalation in surveillance techniques that has not previously been disclosed.
If the government is able to determine a person's password, which is typically stored in encrypted form, the credential could be used to log in to an account to peruse confidential correspondence or even impersonate the user. Obtaining it also would aid in deciphering encrypted devices in situations where passwords are reused.
"I've certainly seen them ask for passwords," said one Internet industry source who spoke on condition of anonymity. "We push back."
A second person who has worked at a large Silicon Valley company confirmed that it received legal requests from the federal government for stored passwords. Companies "really heavily scrutinize" these requests, the person said. "There's a lot of 'over my dead body.'"
Some of the government orders demand not only a user's password but also the encryption algorithm and the so-called salt, according to a person familiar with the requests. A salt is a random string of letters or numbers used to make it more difficult to reverse the encryption process and determine the original password. Other orders demand the secret question codes often associated with user accounts.

This is one of those unanswered legal questions: Is there any circumstance under which they could get password information?"
--Jennifer Granick, Stanford University 

A Microsoft spokesperson would not say whether the company has received such requests from the government. But when asked whether Microsoft would divulge passwords, salts, or algorithms, the spokesperson replied: "No, we don't, and we can't see a circumstance in which we would provide it."
Google also declined to disclose whether it had received requests for those types of data. But a spokesperson said the company has "never" turned over a user's encrypted password, and that it has a legal team that frequently pushes back against requests that are fishing expeditions or are otherwise problematic. "We take the privacy and security of our users very seriously," the spokesperson said.
A Yahoo spokeswoman would not say whether the company had received such requests. The spokeswoman said: "If we receive a request from law enforcement for a user's password, we deny such requests on the grounds that they would allow overly broad access to our users' private information. If we are required to provide information, we do so only in the strictest interpretation of what is required by law."
Apple, Facebook, AOL, Verizon, AT&T, Time Warner Cable, and Comcast did not respond to queries about whether they have received requests for users' passwords and how they would respond to them.
Richard Lovejoy, a director of the Opera Software subsidiary that operates FastMail, said he doesn't recall receiving any such requests but that the company still has a relatively small number of users compared with its larger rivals. Because of that, he said, "we don't get a high volume" of U.S. government demands.
The FBI declined to comment.
Some details remain unclear, including when the requests began and whether the government demands are always targeted at individuals or seek entire password database dumps. The Patriot Act has been used to demand entire database dumps of phone call logs, and critics have suggested its use is broader. "The authority of the government is essentially limitless" under that law, Sen. Ron Wyden, an Oregon Democrat who serves on the Senate Intelligence committee, said at a Washington event this week.
Large Internet companies have resisted the government's requests by arguing that "you don't have the right to operate the account as a person," according to a person familiar with the issue. "I don't know what happens when the government goes to smaller providers and demands user passwords," the person said.
An attorney who represents Internet companies said he has not fielded government password requests, but "we've certainly had reset requests -- if you have the device in your possession, than a password reset is the easier way."

Source code to a C implementation of bcrypt, a popular algorithm used for password hashing.

(Credit: Photo by Declan McCullagh)

Cracking the codes
Even if the National Security Agency or the FBI successfully obtains an encrypted password, salt, and details about the algorithm used, unearthing a user's original password is hardly guaranteed. The odds of success depend in large part on two factors: the type of algorithm and the complexity of the password.
Algorithms, known as hash functions, that are viewed as suitable for scrambling stored passwords are designed to be difficult to reverse. One popular hash function called MD5, for instance, transforms the phrase "National Security Agency" into this string of seemingly random characters: 84bd1c27b26f7be85b2742817bb8d43b. Computer scientists believe that, if a hash function is well-designed, the original phrase cannot be derived from the output.
But modern computers, especially ones equipped with high-performance video cards, can test passwords scrambled with MD5 and other well-known hash algorithms at the rate of billions a second. One system using 25 Radeon-powered GPUs that was demonstrated at a conference last December tested 348 billion hashes per second, meaning it would crack a 14-character Windows XP password in six minutes.
The best practice among Silicon Valley companies is to adopt far slower hash algorithms -- designed to take a large fraction of a second to scramble a password -- that have been intentionally crafted to make it more difficult and expensive for the NSA and other attackers to test every possible combination.
One popular algorithm, used by Twitter and LinkedIn, is called bcrypt. A 2009 paper (PDF) by computer scientist Colin Percival estimated that it would cost a mere $4 to crack, in an average of one year, an 8-character bcrypt password composed only of letters. To do it in an average of one day, the hardware cost would jump to approximately $1,500.
But if a password of the same length included numbers, asterisks, punctuation marks, and other special characters, the cost-per-year leaps to $130,000. Increasing the length to any 10 characters, Percival estimated in 2009, brings the estimated cracking cost to a staggering $1.2 billion.
As computers have become more powerful, the cost of cracking bcrypt passwords has decreased. "I'd say as a rough ballpark, the current cost would be around 1/20th of the numbers I have in my paper," said Percival, who founded a company called Tarsnap Backup, which offers "online backups for the truly paranoid." Percival added that a government agency would likely use ASICs -- application-specific integrated circuits -- for password cracking because it's "the most cost-efficient -- at large scale -- approach."
While developing Tarsnap, Percival devised an algorithm called scrypt, which he estimates can make the "cost of a hardware brute-force attack" against a hashed password as much as 4,000 times greater than bcrypt.
Bcrypt was introduced (PDF) at a 1999 Usenix conference by Niels Provos, currently a distinguished engineer in Google's infrastructure group, and David Mazières, an associate professor of computer science at Stanford University.
With the computers available today, "bcrypt won't pipeline very well in hardware," Mazières said, so it would "still be very expensive to do widespread cracking."
Even if "the NSA is asking for access to hashed bcrypt passwords," Mazières said, "that doesn't necessarily mean they are cracking them." Easier approaches, he said, include an order to extract them from the server or network when the user logs in -- which has been done before -- or installing a keylogger at the client.

Sen. Ron Wyden, who warned this week that "the authority of the government is essentially limitless" under the Patriot Act's business records provision.

(Credit: Getty Images)

Questions of law
Whether the National Security Agency or FBI has the legal authority to demand that an Internet company divulge a hashed password, salt, and algorithm remains murky.
"This is one of those unanswered legal questions: Is there any circumstance under which they could get password information?" said Jennifer Granick, director of civil liberties at Stanford University's Center for Internet and Society. "I don't know."
Granick said she's not aware of any precedent for an Internet company "to provide passwords, encrypted or otherwise, or password algorithms to the government -- for the government to crack passwords and use them unsupervised." If the password will be used to log in to the account, she said, that's "prospective surveillance," which would require a wiretap order or Foreign Intelligence Surveillance Act order.
If the government can subsequently determine the password, "there's a concern that the provider is enabling unauthorized access to the user's account if they do that," Granick said. That could, she said, raise legal issues under the Stored Communications Act and the Computer Fraud and Abuse Act.
Orin Kerr, a law professor at George Washington University and a former federal prosecutor, disagrees. First, he said, "impersonating someone is legal" for police to do as long as they do so under under court supervision through the Wiretap Act.
Second, Kerr said, the possibility that passwords could be used to log into users' accounts is not sufficient legal grounds for a Web provider to refuse to divulge them. "I don't know how it would violate the Wiretap Act to get information lawfully only on the ground that the information might be used to commit a Wiretap violation," he said.
The Justice Department has argued in court proceedings before that it has broad legal authority to obtain passwords. In 2011, for instance, federal prosecutors sent a grand jury subpoena demanding the password that would unlock files encrypted with the TrueCrypt utility.
The Florida man who received the subpoena claimed the Fifth Amendment, which protects his right to avoid self-incrimination, allowed him to refuse the prosecutors' demand. In February 2012, the U.S. Court of Appeals for the Eleventh Circuit agreed, saying that because prosecutors could bring a criminal prosecution against him based on the contents of the decrypted files, the man "could not be compelled to decrypt the drives."
In January 2012, a federal district judge in Colorado reached the opposite conclusion, ruling that a criminal defendant could be compelled under the All Writs Act to type in the password that would unlock a Toshiba Satellite laptop.
Both of those cases, however, deal with criminal proceedings when the password holder is the target of an investigation -- and don't address when a hashed password is stored on the servers of a company that's an innocent third party.
"If you can figure out someone's password, you have the ability to reuse the account," which raises significant privacy concerns, said Seth Schoen, a senior staff technologist at the Electronic Frontier Foundation.
Last updated on July 26 at 12 p.m. PT with comments from Orin Kerr. A previous update added comment from Yahoo, which responded after this article was published.
Disclosure: McCullagh is married to a Google employee not involved with this issue.

Declan McCullagh is the chief political correspondent for CNET. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.