The NSA Playset: 5 Better Tools To Defend Systems

ant-product-banner-icons-tiny.jpgThe NSA ANT catalog is a 50-page classified document listing technology available to the United States National Security Agency (NSA)Tailored Access Operations (TAO) by the ANT division to aid in cyber surveillance

Inspired by the National Security Agency’s Ant Catalog, a community of security researchers have been working over the past year to make cutting edge security tools more accessible and easier to use and understand, tapping into the open source software community and commercially-available products.

The NSA Playset project “grew out of an interest by security researchers to build the same types of tools nation states use,” applying open source and commercially-available hardware and software, said Michael Ossmann, a wireless security researcher and founder of Great Scott Gadgets, a company that is working to put cybersecurity tools into the hands of innovative people.

The goal of the NSA Playset project is to develop technology and techniques that serve as a demonstration of the types of threats people might not have considered before, Ossmann said during a session on Thursday at Black Hat, entitled NSA Playset: A Year of Toys and Tools.

The NSA ANT Catalog is a 50-page classified document listing technology available to the NSA Tailored Access Operations by the ANT division to aid in cyber surveillance. Most documents are described as already operational and available to U.S. nationals and members of the Five Eyes Alliance – Australia, Canada, New Zealand, the United Kingdom and the United States. The document was first revealed in an article by security researchers in the German newspaper Der Spiegel, which released the catalog to the public on December 30, 2013.

A lot of the hacking techniques and tools revealed in the NSA ANT Catalog were known to the public security research community. However, some were new, which lead researchers like Ossmann wondering why they had not seen some of these exploits before.
“We as a security community as a whole have the benefit of learning from these leaks,” from a technical and threat prevention perspective, Ossmann said. The information helps security researchers learn about the technology and threat techniques they should consider when developing defenses for systems.
So the NSA ANT Catalog gave birth to the idea of the NSA Playset, whose members have been developing a host of “toys and tools” over the past year. Ossmann described more than a dozen during his talk. The tools have been grouped into five categories based on their functions. The categories are: Physical Domination, Hardware Implants, Passive Radio Interception, Active Radio Injection, and Radio Frequency Retroreflectors.

Here are five examples from Ossmann’s presentation. A full list can be found on the NSA Playset website:

Physical Domination Slotscreamer is an inexpensive PCI Express attack tool that can be used in a number of ways. Ossmann said it can be implanted into a computer and the device allows a person to implement a PCI Express device that can access the memory bus of a computer. Joe Fritz and Miles Crabill built a prototype based on a commercial microchip that serves as a USB device and also as a PCI Express device. An open hardware and software framework that will be released by NSA Playset will give researchers the ability to tinker with Direct Memory Access attacks to read memory, bypass software and hardware security measures.

Hardware Implant ChuckWagon takes advantage of I2C, a serial bus that many people do not realize they have on their computers. But people doing electronic design use it all the time, Ossmann said. It is typically used to attach lower-speed peripheral ICs to processors and microcontrollers. There are I2C buses on PC motherboards that are exposed to the operating system. However, some are exposed on the outside of computers via VGA cables or HDMI ports. If an interface can be surreptitiously placed on a computer a communications channel could be created to run malware on that computer. At DEFCON last year, Josh Datko and Teddy Reed demonstrated a ChuckWagon prototype using a VGA board attached externally to a computer that gave malware a covert channel into the system.

Passive Radio Interception There are several tools for sniffing Global System for Mobile Communication (GSM) in the NSA Playset. For example, Leviticus is a handheld spectrum analyzer, which existed before the NSA Playset. But it fits nicely into the project so the folks decided to give it a silly name and move it into the NSA Playset, Ossmann said. It is an older mobile phone using the Calypso chipset. Hackers who learned to write code for that chipset over the years have introduced interesting tools. One tool measures the received signal strength indicator from baseband. A lot of RSSI data can be pulled into a large spectrum analyzer application with limited bandwidth embedded into the mobile phone. “I think it is cool that you can take an off-the-shelf mobile phone and do such a thing,” without making any hardware changes, Ossmann said.

Active Radio Injection Tiny Alamo is a suite of tools for Bluetooth keystroke surveillance and injection, and these were presented, by Mike Ryan at the DEFCON Wireless village last year. It is more of a software attack, which targets Bluetooth keyboards and mice, which are basically unsecure. Ryan was able to spoof a wireless Bluetooth mouse and inject keystrokes. People might think that they don’t have to worry much about wireless mice, but Ryan demonstrated that an attacker “can take a vulnerable mouse and do something far more powerful with it,” Ossmann said.

RF Retroreflector CongaFlock is an RF retroreflector built by Ossmann. RF retroreflectors are becoming increasingly important for security reasons, he noted. CongaFlock is designed, to be implanted in hardware, such as a cable, monitor, keyboard or PC --any kind of electronic device that has a signal that goes over a wire. It gives an attacker the ability to ease-drop on the signal on that wire using radar. Implanted in a keyboard it could let an attacker study keystrokes or sniff video screens, Ossmann said.

The NSA Playset has other projects in development, but Ossmann thought it was a good time to describe the work its members have done over the past year.
Dark Reading: http://http://ubm.io/1PoVKCs

 

« Twitter says U.S Government Want More User Account Information
Russia, China & U.S. Engage in Cyber War »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

iStorage

iStorage

iStorage is the leading global provider of PIN Activated, hardware encrypted, portable data storage solutions.

Cyber Defense Media Group (CDMG)

Cyber Defense Media Group (CDMG)

CDMG is the leading global media group for all things cyber defense.

CGI Group

CGI Group

CGI is a leading IT and business process services provider. Services include IT consulting, Systems Integration, Application Development, Infrastructure, Business Processes, Digital IP.

Surrey Centre for Cyber Security (SCCS)

Surrey Centre for Cyber Security (SCCS)

The Centre focuses on three main research directions - Privacy and Data Protection, Secure Communications, and Human-Centred Security.

Optimum Insurance

Optimum Insurance

Optimum's Cyber Risk & Data Protection Insurance policies are designed to protect against cyber exposures that arise when a company’s data and customer information is breached or stolen.

OneVisage

OneVisage

Our award-winning 3DAuth digital identity platform turns any consumer mobile device into a real-time 3D facial scanner that securely authenticates the user in seconds.

CYBERSEC Forum

CYBERSEC Forum

CYBERSEC Forum is an annual European Public Policy Conference dedicated to strategic aspects of cybersecurity.

CIO Dive

CIO Dive

CIO Dive provides news and analysis for IT executives in areas including IT strategy, cloud computing, cyber security, big data, AI, software, infrastructure, dev ops and more.

NSEIT

NSEIT

NSEIT offers end-to-end Information Technology products, solutions and services including cybersecurity to organizations in the financial sector.

AVORD

AVORD

AVORD is a cloud-based security testing platform that allows clients to manage security testing requirements in a far more productive and efficient way.

Intuity

Intuity

The Intuity suite of services provides companies with a complete awareness of their security status and helps them in an efficient, efficient and sustainable improvement process.

Plug and Play Tech Center

Plug and Play Tech Center

Plug and Play is the ultimate innovation platform, bringing together the best startups and the world’s largest corporations.

SECURITI.ai

SECURITI.ai

SECURITI.ai's PrivacyOps platform is a full-stack solution that operationalizes and simplifies privacy compliance using robotic automation and a natural language interface.

Siemens

Siemens

Siemens Industrial Security Services provide solutions for cybersecurity in automation environments based on the recommendations of the international standard IEC 62443.

Bolster

Bolster

Bolster (previously RedMarlin) is an AI-based cyber-security platform designed to detect phishing and fraudulent sites in real-time.

Reflectiz

Reflectiz

Reflectiz empowers digital businesses to make all web applications safer by non-intrusively mitigating any website risks without a single line of code.