NSA's TURBINE robot can pump 'malware into MILLIONS of PCs'
Sysadmins, routers, criminals' IRC botnets, and maybe terrorists, all for the pwning
By Iain Thomson, 12 Mar 2014
The latest batch of top-secret intelligence documents from the hoard collected by NSA whistleblower Edward Snowden detail the massive increase in the agency's use of its Tailored Access Operations (TAO) hacking unit – including a system dubbed TURBINE that can spam out millions of pieces of sophisticated malware at a time.
The presentation slides, published by The Intercept, show that 10 years ago the NSA had infiltrated and tapped a modest number of computers, but has since hugely bolstered its toolkit and increased its target list. Within eight years, the number of active pieces of implanted spyware was in the tens of thousands, and slides show an extensive arms catalog of malware for the TAO team to choose from.
"One of the greatest challenges for active SIGINT/attack is scale," explained one presentation from 2009, marked top secret. "Human 'drivers' limit ability for large-scale exploitation (humans tend to operate within their own environment, not taking into account the bigger picture)."
The solution was to build TURBINE, which can carry out "automated implants by groups instead of individually," and scale to operate millions of implants at a time. This command-and-control server includes an "expert system" that automatically picks the right malware for a victim and installs it on their computer, thus "relieve the [TURBINE] user from needing to know/care about the details."
...
TURMOIL hunts the sysadmin
TURBINE also links into a NSA sensor system dubbed TURMOIL, which taps into computer networks around the world to monitor data traffic and identify potential targets. It can track down a mark from their email address or IP address, which device he or she is using, or by web cookies from Google, Microsoft, Twitter, Yahoo! and others.
While terrorist targets are mentioned, it's clear from the documents that system administrators are also high on the todo list for the TAO team. One comment on an internal NSA message board system was titled simply: "I hunt sys admins."
"Sys admins are a means to an end," it states. "Once you have control of the IT manager's computer then it's easy to monitor any "government official that happens to be using the network some admin takes care of."
Pwning the sysadmin is useful for malware attacks against large commercial routers and to defeat VPNs. The documents detail two pieces of NSA-developed malware, HAMMERCHANT and HAMMERSTEIN, which are designed to sit on routers and eavesdrop on VoIP traffic, and grab encryption keys to decrypt supposedly secure VPN connections, all in real time.
...
A 2010 presentation also gives details about the QUANTUM family of malware developed by the government for attacking systems. This includes code for the redirection of web traffic, controlling crooks' IRC botnets, hijacking DNS, and corrupting downloads.
Another malware system, called UNITEDRAKE, comes with a selection of plugins for different purposes, each with its own classification. The CAPTIVATEDAUDIENCE plugin will take over a system's microphone to record conversations, FOGGYBOTTOM will record internet history and login details, and SALVAGERABBIT copies the contents of any flash drives plugged into the machine.
...
NSA's TURBINE robot can pump 'malware into MILLIONS of PCs' • The Register
http://www.theregister.co.uk/...sas_malware_turbine_can_pump_out_millions_of_malware_attacks/?page=2