The Most Important Talk of the Year
Dear Readers,
We are back from hibernation to present you an incredibly informative talk by Jacob Applebaum (@ioerror) at the 30th Chaos Communication Congress. It is on various techniques used by NSA to hack into your computer hardware.
If you do not want to spend one hour listening to the talk (time well spent), Der Spiegel has an article by the same author.
Shopping for Spy Gear: Catalog Advertises NSA Toolbox
The most troubling aspect is the extent to which NSA goes to corrupt computer hardware purchased by individuals and companies. Sometimes they find out about the packages purchased from Amazon by people, go to the US post office and replace the package to be delivered with a different hardware that has NSA- infected bug in it. They change the firmwares of commonly used hard-drives from Western Digital, Seagate, Maxtor and Samsung. If you store your financial data in one such corrupted hard-drive, NSA can remotely access it and pass it to your competitor.
The ANT division doesn’t just manufacture surveillance hardware. It also develops software for special tasks. The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer’s motherboard that is the first thing to load when a computer is turned on.
This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this “Persistence” and believe this approach has provided them with the possibility of permanent access.
Another program attacks the firmware in hard drives manufactured by Western Digital, Seagate, Maxtor and Samsung, all of which, with the exception of the latter, are American companies. Here, too, it appears the US intelligence agency is compromising the technology and products of American companies.
Other ANT programs target Internet routers meant for professional use or hardware firewalls intended to protect company networks from online attacks. Many digital attack weapons are “remotely installable” – in other words, over the Internet. Others require a direct attack on an end-user device – an “interdiction,” as it is known in NSA jargon – in order to install malware or bugging equipment.
The vulnerabilities created by NSA can be exploited by others as well. A malicious person can also use a NSA-created firmware change in your hard-drive to wipe out years of data from your disk or take control of your back account. In the talk, Applebaum gives an example, where a hacking team discovered a NSA-created security hole in iphone to remotely take control of all iphones. This team was merely demonstrating the security hole, but other hackers may not be so nice.
