Jump to content

Tailored Access Operations

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Talencar (talk | contribs) at 01:04, 30 March 2014 (see also cyberwarfare). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

A reference to Tailored Access Operations in an XKeyscore slide

The Office of Tailored Access Operations (TAO) is a cyber-warfare intelligence-gathering unit of the National Security Agency (NSA). It has been active since at least circa 1998.[1][2] TAO identifies, monitors, infiltrates, and gathers intelligence on computer systems being used by entities foreign to the United States.[3][4][5][6] The NSA terms these activities "computer network exploitation" (CNE).

TAO is reportedly "now the largest and arguably the most important component of the NSA's huge Signal Intelligence (SIGINT) Directorate, consisting [more than] 1,000 military and civilian computer hackers, intelligence analysts, targeting specialists, computer hardware and software designers, and electrical engineers."[1]

A document leaked by Edward Snowden describing the unit's work says that TAO has software templates allowing it to break into commonly used hardware, including “routers, switches, and firewalls from multiple product vendor lines".[7] According to The Washington Post, TAO engineers prefer to tap networks rather than isolated computers, because there are typically many devices on a single network.[7]

Physical locations

TAO's headquarters are termed the Remote Operations Center (ROC) and are based at Fort Meade, Maryland. TAO also has expanded to NSA Hawaii (Wahiawa, Oahu), NSA Georgia (Fort Gordon, Georgia), Texas Cryptologic Center, and Buckley Air Force Base, Denver.[1]

Organization

In the Remote Operations Center (ROC) 600 employees gather information from around the world.[8][9]

  • Data Network Technologies Branch: develops automated spyware
  • Telecommunications Network Technologies Branch: improve network and computer hacking methods[10]
  • Mission Infrastructure Technologies Branch: operates the software provided above[11]
  • Access Technologies Operations Branch: Reportedly includes personnel seconded by the CIA and the FBI, who perform what are described as "off-net operations," which is a polite way of saying that they arrange for CIA agents to surreptitiously plant eavesdropping devices on computers and/or telecommunications systems overseas so that TAO's hackers may remotely access them from Fort Meade.[1] Probably specially equipped submarines, currently USS Jimmy Carter,[12] are used to wiretap fibre optic cables around the globe.

QUANTUM attacks

"I iz in ur space-time continuum, upsetting all your gravity and quantums and stuffs."
Lolcat image from an NSA presentation explaining in part the naming of the QUANTUM program
NSA's QUANTUMTHEORY overview slide with various codenames for specific types of attack and integration with other NSA systems

The TAO has developed an attack suite they call QUANTUM. It relies on a compromised router that duplicates internet traffic, typically HTTP requests, so that they go both to the intended target and to an NSA site (indirectly). The NSA site runs FOXACID software which sends back exploits that load in the background in the target web browser before the intended destination has had a chance to respond (it's unclear if the compromised router facilitates this race on the return trip). If the browser is exploitable, further permanent "implants" (rootkits etc.) are deployed in the target computer, e.g. OLYMPUSFIRE for Windows, which give complete remote access to the infected machine.[13] This type of attack is part of the man-in-the-middle attack family, though more specifically it is called man-on-the-side attack. It is difficult to pull off without controlling some of the Internet backbone.[14]

There are numerous services that FOXACID can exploit this way. The names of some FOXACID modules are given below:[15]

By collaboration with the British GHCQ (see MUSCULAR), Google services could be attacked too, including Gmail.[16]

Finding machines that are exploitable and worth attacking is done using analytic databases such as XKeyscore.[17] A specific method of finding vulnerable machines is interception of Windows Error Reporting traffic, which is logged into XKeyscore.[18]

QUANTUM attacks launched from NSA sites can be too slow for some combinations of targets and services as they essentially try exploit a race condition, i.e. the NSA server is trying to beat the legitimate server with its response.[19] As of mid-2011, the NSA was prototyping a capability codenamed QFIRE, which involved embedding their exploit-dispensing servers in virtual machines (running on VMware ESX) hosted closer to the target, in the so-called Special Collection Sites (SCS) network worldwide. The goal of QFIRE was to lower the latency of the spoofed response, thus increasing the probability of success.[20][21] [22]

QUANTUMCOOKIE attack

QUANTUMCOOKIE is a more complex form of attack which can be used against Tor users.[23]

Known targets and collaborations

According to a 2013 article in Foreign Policy, “TAO has become increasingly accomplished at its mission, thanks in part to the high-level cooperation it secretly receives from the "big three" American telecom companies (AT&T, Verizon and Sprint), most of the large US-based Internet service provides, and many of the top computer security software manufactures and consulting companies.”[31] A 2012 TAO budget document claims that these companies, on TAO's behest, "insert vulnerabilities into commercial encryption systems, IT systems, networks and endpoint communications devices used by targets".[31] A number of US companies, including Cisco and Dell, have subsequently made public statements denying that they insert such back doors into their products.[32] Microsoft provides advance warning to the NSA of vulnerabilities it knows about, before fixes or information about these vulnerabilities is available to the public; this enables TAO to execute so-called zero-day attacks.[33] A Microsoft official who declined to be identified in the press confirmed that this is indeed the case, but said that Microsoft can't be held responsible for how the NSA uses this advance information.[34]

See also

References

  1. ^ a b c d e Aid, Matthew M. (10 June 2013). "Inside the NSA's Ultra-Secret China Hacking Group". Foreign Policy. Retrieved 11 June 2013.
  2. ^ Paterson, Andrea (30 August 2013). "The NSA has its own team of elite hackers". The Washington Post. Retrieved 31 August 2013.
  3. ^ Kingsbury, Alex (June 19, 2009). "The Secret History of the National Security Agency". U.S. News & World Report. Retrieved 22 May 2013.
  4. ^ Kingsbury, Alex (November 18, 2009). "U.S. is Striking Back in the Global Cyberwar". U.S. News & World Report. Retrieved 22 May 2013. {{cite web}}: Unknown parameter |coauthors= ignored (|author= suggested) (help)
  5. ^ Riley, Michael (May 23, 2013). "How the U.S. Government Hacks the World". Bloomberg Businessweek. Retrieved 23 May 2013.
  6. ^ Aid, Matthew M. (8 June 2010). The Secret Sentry: The Untold History of the National Security Agency. Bloomsbury USA. p. 311. ISBN 978-1-60819-096-6. Retrieved 22 May 2013.
  7. ^ a b Barton Gellman; Ellen Nakashima (August 30, 2013). "U.S. spy agencies mounted 231 offensive cyber-operations in 2011, documents show". The Washington Post. Retrieved 7 September 2013. Much more often, an implant is coded entirely in software by an NSA group called, Tailored Access Operations (TAO). As its name suggests, TAO builds attack tools that are custom-fitted to their targets. The NSA unit's software engineers would rather tap into networks than individual computers because there are usually many devices on each network. Tailored Access Operations has software templates to break into common brands and models of "routers, switches, and firewalls from multiple product vendor lines," according to one document describing its work.
  8. ^ "Secret NSA hackers from TAO Office have been pwning China for nearly 15 years | Computerworld Blogs". Blogs.computerworld.com. 2013-06-11. Retrieved 2014-01-27.
  9. ^ Rothkopf, David. "Inside the NSA's Ultra-Secret China Hacking Group". Foreignpolicy.com. Retrieved 2014-01-27.
  10. ^ "Hintergrund: Die Speerspitze des amerikanischen Hackings - News Ausland: Amerika". tagesanzeiger.ch. Retrieved 2014-01-27.
  11. ^ WebCite query result
  12. ^ noahmax (2005-02-21). "Jimmy Carter: Super Spy?". Defense Tech. Retrieved 2014-01-27.
  13. ^ "Quantumtheory: Wie die NSA weltweit Rechner hackt - SPIEGEL ONLINE". Spiegel.de. 2013-12-30. Retrieved 2014-01-18.
  14. ^ Posted on October 7, 2013 at 6:24 AM • 120 Comments (2013-10-07). "Schneier on Security: How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID". Schneier.com. Retrieved 2014-01-18.{{cite web}}: CS1 maint: numeric names: authors list (link)
  15. ^ Fotostrecke (2013-12-30). "NSA-Dokumente: So knackt der Geheimdienst Internetkonten - SPIEGEL ONLINE - Netzwelt". Spiegel.de. Retrieved 2014-01-18.
  16. ^ Fotostrecke (2013-12-30). "NSA-Dokumente: So knackt der Geheimdienst Internetkonten - SPIEGEL ONLINE - Netzwelt". Spiegel.de. Retrieved 2014-01-18.
  17. ^ Gallagher, Sean (August 1, 2013). "NSA's Internet taps can find systems to hack, track VPNs and Word docs". Retrieved August 8, 2013.
  18. ^ a b c "Inside TAO: Targeting Mexico - SPIEGEL ONLINE". Spiegel.de. 2013-12-29. Retrieved 2014-01-18.
  19. ^ Fotostrecke (2013-12-30). "QFIRE - die "Vorwärtsverteidigng" der NSA - SPIEGEL ONLINE - Netzwelt". Spiegel.de. Retrieved 2014-01-18.
  20. ^ Fotostrecke (2013-12-30). "QFIRE - die "Vorwärtsverteidigng" der NSA - SPIEGEL ONLINE - Netzwelt". Spiegel.de. Retrieved 2014-01-18.
  21. ^ Fotostrecke (2013-12-30). "QFIRE - die "Vorwärtsverteidigng" der NSA - SPIEGEL ONLINE - Netzwelt". Spiegel.de. Retrieved 2014-01-18.
  22. ^ Fotostrecke (2013-12-30). "QFIRE - die "Vorwärtsverteidigng" der NSA - SPIEGEL ONLINE - Netzwelt". Spiegel.de. Retrieved 2014-01-18.
  23. ^ Weaver, Nicholas (2013-03-28). "Our Government Has Weaponized the Internet. Here's How They Did It | Wired Opinion". Wired.com. Retrieved 2014-01-18.
  24. ^ Posted on October 7, 2013 at 6:24 AM • 120 Comments (2013-10-07). "Schneier on Security: How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID". Schneier.com. Retrieved 2014-01-27.{{cite web}}: CS1 maint: numeric names: authors list (link)
  25. ^ "Inside TAO: The NSA's Shadow Network - SPIEGEL ONLINE". Spiegel.de. 2013-12-29. Retrieved 2014-01-27.
  26. ^ Gallagher, Sean (2013-11-12). "Quantum of pwnness: How NSA and GCHQ hacked OPEC and others". Ars Technica. Retrieved 2014-01-18.
  27. ^ "How the NSA hacks PCs, phones, routers, hard disks 'at speed of light': Spy tech catalog leaks". The Register.
  28. ^ "British spies reportedly spoofed LinkedIn, Slashdot to target network engineers". Network World. 2013-11-11. Retrieved 2014-01-18.
  29. ^ "Läs dokumenten om Sverige från Edward Snowden - Uppdrag Granskning". SVT.se. Retrieved 2014-01-18.
  30. ^ "What You Wanted to Know" (PDF). Retrieved 2014-01-27.
  31. ^ a b Matthew M. Aid, (October 15, 2013) "The NSA's New Code Breakers", Foreign Policy
  32. ^ Farber, Dan (2013-12-29). "NSA reportedly planted spyware on electronics equipment | Security & Privacy - CNET News". News.cnet.com. Retrieved 2014-01-18.
  33. ^ Wise, Nan (2013-10-04). "How the NSA Thinks About Secrecy and Risk - Bruce Schneier". The Atlantic. Retrieved 2014-01-18.
  34. ^ Riley, Michael (2013-06-14). "U.S. Agencies Said to Swap Data With Thousands of Firms". Bloomberg. Retrieved 2014-01-18.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Tailored_Access_Operations&oldid=601898543"