Monthly Archives: May 2014

NSA techs perform an unauthorized field upgrade to Cisco hardware in these 2010 photos from an NSA document.

A document included in the trove of National Security Agency files released with Glenn Greenwalds book No Place to Hide details how the agencys Tailored Access Operations (TAO) unit and other NSA employees intercept servers, routers, and other network gear being shipped to organizations targeted for surveillance and install covert implant firmware onto them before theyre delivered. These Trojan horse systems were described by an NSA manager as being some of the most productive operations in TAO because they pre-position access points into hard target networks around the world.

The document, a June 2010 internal newsletter article by the chief of the NSAs Access and Target Development department (S3261) includesphotos (above) of NSA employees opening the shipping box for a Cisco router and installing beacon firmware with a load station designed specifically for the task.

The NSA manager described the process:

Heres how it works: shipments of computer network devices (servers, routers, etc,) being delivered to our targets throughout the world are intercepted. Next, they are redirected to a secret location where Tailored Access Operations/Access Operations (AO-S326) employees, with the support of the Remote Operations Center (S321), enable the installation of beacon implants directly into our targets electronic devices. These devices are then re-packaged and placed back into transit to the original destination. All of this happens with the support of Intelligence Community partners and the technical wizards in TAO.

Sean Gallagher / Sean is Ars Technica's IT Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland.

Excerpt from:

Photos of an NSA upgrade factory show Cisco router getting implant

NSA leaks View all

In his new book No Place to Hide, Glenn Greenwald revealed a number of additional details onthe craft and tools used by the NSA and its British counterpart, the GCHQ. While many of the capabilities and activities Greenwald details in the book were previously published in reports drawing from Edward Snowdens vast haul of NSA documents, a number of new pieces of information have come to lightincluding the NSAs and GCHQs efforts to use airlines in-flight data service to track and surveil targeted passengers in real time.

The systemscodenamed Homing Pigeon by the NSA and Thieving Magpie by the GCHQallowed the agencies to track which aircraft individuals under surveillance boarded based on their phone data.

We can confirm that targets are on board specific flights in near real time, enabling surveillance or arrest teams to be put in place in advance, a GCHQ analyst wrote in a PowerPoint slide presentation on the program. If they use data, we can also recover email addresss [sic], Facebook IDs, Skype addresses, etc.

The technology allows the NSA and GCHQ to get a geographic fix on surveilled aircraft once every two minutes in transit.

Latest batch of documents leaked shows NSA's power to pwn.

Greenwald asserts in his book that at the same time the US intelligence community and legislators were warning that Chinese networking vendors Huawei and ZTE were untrustworthy because of connections to Chinas Peoples Liberation Army, the NSA was routinely intercept[ing] routers, servers, and other computer network devices being exported from the US before they are delivered to the international customers.

Greenwald cited a June 2010 report from the head of the NSAs Access and Target Development department in which the official wrote, In one recent case, after several months a beacon implanted through supply-chain interdiction called back to the NSA covert infrastructure. This call back provided us access to further exploit the device and the network.

Read this article:

NSA routinely tapped in-flight Internet, intercepted exported routers