Archive for the ‘NSA’ Category

Memes, lolz and intel incels: behind the scenes in the NSA hacker corps – British GQ

Since its debut in 2006, for reasons lost to history, the annual hackers conference in northern Virginia has been known as Jamboree. Possibly the name is meant to be tongue-in-cheek. It brings to mind incongruous scenes of Boy Scouts and Girl Scouts and campfires and songs of peace. In the wiretappers Jamboree, the setting is less pastoral a conference space and the lyrics sing of digital battlefields.

Jamboree celebrates technical brilliance, audacity on offense and a relentless drive to win. It promotes a laser focus on mission accomplishment. Those are virtues among spies, important ones. They are not the only virtues. Jamboree springs from an operational world that can be nonchalant about the privacy of innocents and contemptuous of men and women who allow themselves to be owned, as hackers say, by American cyber warriors. Sexual innuendo, ethnic slurs and mockery of the dead are neither furtive nor especially rare in the discourse of USs National Security Agency (NSA). The people who speak this language among themselves show no apparent concern for reproach by superiors. They are the same people whose work may decide who lives and who dies in a conflict zone. As many of you know, our forces in Iraq are dropping bombs on the strength of sigint alone, Charles H Berlin III, the former chief of staff of the Signals Intelligence Directorate, told his workforce in an internal newsletter in 2004.

There are many professionals in the NSA who take no part in the japery. I have little doubt that they make up a large majority. NSA personnel and veterans I have met are thoughtful about their power and conflicted about trespassing, as inevitably they do, into private terrain that does not belong to a foreign intelligence target. Among the top guns of the NSA hacker club and those who make use of their work, looser language and attitudes are commonplace. Scores of examples in documents and confidential interviews reveal a tendency in those precincts to infuse official reports with snickering insults and derisive memes invented by teenagers, gamers and nerds on the internet.

The NSAs blue-badge employees divide between civilian hires and uniformed personnel on assignment from Army, Navy, Air Force, Marine Corps and Coast Guard intelligence. Military employees arrive prescreened. Civilians run a gauntlet when they apply: a 567-question psychological test, a follow-up interview, the SF-86 Questionnaire For National Security Positions and a polygraph exam to probe for counterintelligence threats. Even so, in the internet age, the NSA has had to adaptin order to recruit the cohort of gifted hackers it needs. They do not tend to arrive with spit-shined shoes and hair cut high and tight. The culture, Edward Snowden said, is T-shirts, jeans, bleached hair, green hair, earrings, meme shirts, memes posted all over your cubicle. Screeners make allowances. Some of the top recruits would never have made the cut in the analog age of listening posts and paper files.

The larger part of the NSAs intake depends upon what the agency describes as special sources. The NSA asks for secret access to one or another piece of the backbone of the global communications network. Security-cleared executives at US internet and telecommunications companies agree to provide it. The NSA likes that arrangement. Why hot-wire a car when the owner will lend you the keys? Some executives not as many since Snowden regard support for US intelligence as a patriotic duty. Some are compelled by law. Some companies, such as AT&T, have classified arrangements with the NSA, code-named Blarney, that stretch back to the 1970s. The companies are compensated for their trouble from a classified budget for corporate partners that reached $394 million in fiscal year 2011.

When the NSA cannot negotiate access, it helps itself. Overseas, where domestic legal restrictions do not apply, the acquisitions directorate, S3, is free to tunnel just about anywhere it likes. A worldwide hacking infrastructure called Quantum deploys a broad range of tools to inject software exploits, intercept communications with methods known as man in the middle and man on the side and reroute calls and emails through NSA collection points. Most of these are known as passive operations because they collect electronic signals automatically as they pass through large trunk lines and junctions. When passive methods do not suffice, the job becomes, in NSA parlance, interactive. During one representative week in April 2012, there were 2,588 such interactive missions. That kind of bespoke hacking is the province of Tailored Access Operations (TAO).

Sexual innuendo, ethnic slurs and mockery of the dead are neither furtive nor rare in NSA discourse

Locker room bravado is one thing when it takes place in the field. The trash talk, in this case, is built into the official vocabulary of the NSA headquarters at Fort Meade, Maryland, where engineers and managers describe close access work in terms of seduction and drunken conquest. Surveillance targets, as depicted in formal accounts of expeditionary operations, are like women who would regret the night if only they remembered it in the morning.

One common mission for TAO is to hack into a local wireless network. Wi-Fi signals do not travel far, even when amplified by surveillance equipment, which means that access teams have to sneak in fairly close. Every stage of their work comes with a suggestive cover name. First comes Blinddate, in which a team member searches for vulnerable machines. He slips into the network during Happyhour, mingles among the computers there and lures his tipsy victim into a liaison. Next comes Nightstand, short for one-night stand, wherein the operator delivers a load of malware into the defenceless machine. Further exploitation and hilarity ensue on Seconddate. For all their subtlety, the cover names might as well be Bimbo, Roofie, Bareback and The Clap.

None of this is to cast shade on the operations themselves. By nature an expeditionary mission is closely targeted, the opposite of mass surveillance, and the NSA chooses the marks to fit the demands of its political masters. The targets I saw in documents are what you would expect of an intelligence agency doing its job. The question is what to make of the giggles between the lines. It is not too much, I think, to say that sexual exploitation is an official metaphor of close-access operations, passed up the chain of command in operations reports and back down to the lower ranks in training materials. The seven-part qualifying course on wireless exploitation techniques, for example, includes units called Introduction To Blindate (Grab a partner!) and Introduction To Nightstand. There are plenty more where those come from. The NSA archive features dozens of cover names in the same style, from Vixen and Badgirl to Ladylove and Pant_sparty. The latter is versatile slang in pop culture, suitable for any of several intimate acts. In surveillance speak it stands for injection of an NSA software tool into a backdoor in the targets defences. Get up close, whip out your Pant_sparty tool and stick it in her back door. The developers, briefers and trainers who trade in this kind of mirth, without exception that I could find, are men.

Alan Tu, a former threat operations analyst, told me the dick-swinging badinage is the product of a workforce that was incredibly young, young and male. Many either in their first post-college job or 19- to 21-year-old military operators. This is the age of peak testosterone. It would not occur to those men, Tu added, that anyone outside their circle would read what they wrote or find reason to object. And oversight can be thin, he recalled: Getting quality managers was sometimes a struggle because often they would pick from what seemed to be the most appropriate technical guy and give them their first leadership and management job.

Snowden turned down a job in TAO, but this was the culture he grew up in. The memes are awesome for morale and having fun but youre having fun with systems that get people literally killed, he told me. It is adolescent empowerment. Literally, I can do what I want. What are you going to do to stop me? I am all-powerful. I would point out what defines our understanding of adolescence and what it means to be juvenile is a lack of self-awareness and restraint.

Towards the end of 2018, I sat down with former FBI director James B Comey for a long conversation in a midtown New York hotel suite. He put a lot of effort into cultural change in his own agency before Donald Trump fired him in May 2017.

The FBI, like the NSA, worked hard to recruit and accommodate young technical talent. Before the Trump administration came topower, Comey was looking for ways to soften a ban on applicants with a history of marijuana use. I have to hire a great workforce to compete with those cyber criminals and some of those kids want to smoke weed on the way to the interview, he told the Wall Street Journal then. Attorney general Jeff Sessions put a stop to any squishiness on that point, but the bureau, like the NSA, relaxed some entrenched ideas about who belonged. I asked Comey whether he thought Fort Meade has come to grips with the subculture that the young hacker recruits brought with them.

Thats a great question, he said. I suspect not, because I remember the first time I went there, 2004, 2005, I was struck that Id just stepped into the 1950s. I remember walking in and seeing the old wood panelling, old-fashioned carpeting. I felt like Id gone back in time. The support staff seemed to be mostly white women with beehive hairdos, all done up, and a lot of men in short sleeves. Kind of like what you see in a Nasa movie [set in] the 1960s. Thats what it felt like. I remember, when I joked about it, someone saying a huge number of employees are legacy. Their parents worked there. Its a family business.

There are hundreds of cover names that make no effort to be opaque. They are hand-selected for meaning, simple or otherwise

By doctrine the agency is supposed to assign its cover names at random. That is only sometimes true in practice. A true cryptonym, usually a pair of randomly selected words, conceals any hint of the secret it protects. Byzantinehades, for instance, betrays no link to Chinese cyber espionage. But there are hundreds of other cover names that make no effort to be opaque. They are hand-selected for meaning, simple or otherwise. At times the names are artlessly literal. One classified compartment, shared with the United Kingdoms GCHQ, is called Voyeur. It refers to spying on another countrys spies as they spy on someone else, an especially intimate encounter. Scissors, a more prosaic choice, is a processing system that slices up data for sorting. Voyeurs peer through windows. Scissors cut. No mystery is intended or achieved.

The most revealing cover names are compact expressions of culture akin to street art. The culture owes a great deal to gamers, coders and other digital natives in the outside world. Some of its products, like the sequence from Blinddate to Nightstand, evoke the brotopia of Emily Changs eponymous book about Silicon Valley. Some, like Boundlessinformant, which is a live-updated map of surveillance intake around the world, are so tone-deaf as to verge on self-parody. (The map itself, despite some breathless commentary, is nothing sinister.) In public remarks and testimony, NSA officials often speak of their compliance culture, humble and obedient to post-Watergate laws. There is truth in that, but when the agencys hackers roam abroad, where far fewer restraints apply, they strike an outlaw pose. There is a whole branch of the acquisitions directorate, S31177, devoted to Transgression. A mysterious Badass compartment is mentioned but left unexplained. Pitiedfool, a suite of technical attacks on the Windows operating system, evokes the ferocity of Mr Ts warning to enemies (I pity the fool!) in the film Rocky III. Blackbelt, Felonycrowbar, Zombiearmy and Devilhound share the macho vibe. Another whole class of cover names, including Epicfail and Erroneousingenuity, jeer opsec errors by surveillance targets who imagine that they are covering their tracks.

The insider folkways signal membership in a tribe. The tribe likes science fiction and fantasy, comic book heroes, Star Trek, Star Wars, Harry Potter, fast food, whiskey, math jokes, programmer jokes, ethnic jokes, jokes about nontechnical people and caustic captions on photographs. NSA nerds use dork and bork as verbs. As in: dork the operating system to exploit a device, but dont bork it completely or the device will shut down. They illustrate reports with photos of animals in awkward predicaments; one of them likens a surveillance target to a horse with its head stuck in a tree. They condescend about leet (or l33t) adversaries, wannabe elite hackers who think they can swim with the NSAs sharks. They boast of dining on rivals who are honing their skillz, another term of derision. The themes and memes of NSA network operations are telltales of a coder class that lives its life on-screen, inattentive to the social cues of people who interact IRL in real life.

The keyboard geekery can be whimsical. One training officer, apropos of nothing, dropped a joke about binary numbers into a cryptography lecture. There are ten types of people in this world: those who understand binary and those that dont, the instructor wrote. A weekly briefing on surveillance operations paused to celebrate Pi Day, 14 March, when the numeric form of the date is the best-known constant in math. Then there is the NSA Round Table, an electronic discussion group that invites participants to vote one anothers comments up or down. The voting system, lifted from Reddit, rewards amusing insults as much as content in a forum ostensibly devoted to classified business. Why is a scoop of potatoes larger than a scoop of eggs in the cafeteria? a contributor named Michael wondered one day. Paul jumped in to play the troll. Let me be the first to down-vote you, Paul wrote, naming several pedantic reasons. A side debate erupted: should Michaels post be down-voted, flagged or removed? Clyde returned to the topic at hand with a facetious theory that scoop volume is proportional to the relative size of potatoes and eggs themselves. In that case, Scott replied, what would happen if we served eggs that were bigger than potatoes, like of an ostrich? Someone proposed a uniform system, One spoon to scoop them all, an homage to The Lord Of The Rings. Punsters demanded the inside scoop and lamented the waste of time on small potatoes.

The same aspirations to nerdy wit define a large universe of NSA cover names. Somebody came up with Captivated Audience for a software tool that listens in on conversations by switching on the microphone of a targets mobile handset.

Many, many cryptonyms juxtapose animal names rabbits, goats, monkeys, kittens, a whole menagerie with incongruous adjectives. Comic book heroes and villains take prominent places in the pantheon. Mjolnir, the mythical hammer of Thor, is an NSA weapon to break the anonymity of Tor. Batcave includes a digital hideout for agency hackers who emerge to steal another countrys software code. Batmans alluring foe and sometime love interest, Poisonivy, is the cover name for a remote-access trojan used by Chinese government spies. Another programme is named for Deputydawg, the cartoon sheriff in a Terrytoons childrens show. Nighttrain is harder to source with confidence, being a blues song and a country song and a Guns N Roses song, but it seems to refer in context to a volume of the Hellboy comic series. Inside the agency it is part of an especially sensitive programme: espionage on a close US ally during operations alongside the ally against a common foe. Nighttrain is the allys surveillance technology. The NSA hacks into it with Ironavenger, named for a Marvel Comics story line about robot duplicates of famous superheroes. An NSA system for automated decryption of enciphered data is named Turtlepower, after the Teenage Mutant Ninja Turtles.

So it goes. Harry Potter fans dreamed up Quidditch in honour of the exploits of the NSAs Special Collection Service. Sortinghat, the enchanted cap that selects a Hogwarts house for each young wizard, is what the NSA calls the traffic control system for information exchanged with its British counterpart. Dystopian fiction contributes Bladerunner and Alteredcarbon, a pair of stories adapted from print to film. Grok, a verb invented by science-fiction author Robert Heinlein to signify deep understanding, is an NSA key logger that records every character a victim types. Favourite libations (Makersmark, Walkerblack, Crownroyal) and junk foods (Krispykreme, Cookiedough, Lifesaver) make regular appearances. Unpacman is a nod to early arcade games.

The culture is T-shirts, jeans, bleached hair, green hair, earrings, memes posted all over your cubicle

Star Trek lore provides an especially rich source of memes. Vulcandeathgrip, first officerSpocks ultimate combat move, is a nerdy play on network lingo: the grip in this case seizes encryption keys during the handshake of two devices as they establish a secure link. Borgerking is a twofer: fast food and a nod to the Borg collective that overmatches Starfleet captain Jean-Luc Picard. Trekkies account for Vulcanmindmeld and Wharpdrive, too, but their best work is no doubt Kobayashimaru. That is what the NSA calls its contract with General Dynamics to help break into another countrys surveillance equipment. In the Star Trek oeuvre, the name refers to a simulated mission at Starfleet Academy that tests a young cadets character in the face of certain doom. Every path in the game is programmed to destroy the players ship and crew. Cadet James T Kirk, having none of that, hacks into the simulator and adds a winning scenario. The metaphor stands for more than it may intend: not only creative circumvention, an NSA speciality, but a hacker spirit that gamifies its work.

Anthony Brown / Alamy Stock Photo

The fun and games are sometimes dispiriting to read. In the NSAs Hawaii operations centre, civilian and enlisted personnel used their work machines to circulate dozens of photo memes that originated on Reddit, 4chan, and somethingawful.com. One photo showed a four-foot plastic Donald Duck with hips positioned suggestively between the legs of a pigtailed little girl. Another depicted a small boy tugging at a playmates skirt with the caption, I would tear that ass up! An image of blue balls accompanied a warning to a girl in her early teens against teasing her boyfriend without submitting to sex. Beneath a photo of smiling middle school children, one of them in a wheelchair, another caption read, Who doesnt belong? Thats right. Wheel your ass on outta here. A similar photo, overlaid with an arrow that pointed to one of the boys, declared, Everyone can be friends! Except for this little faggot. One more, shot at the finish line of a Special Olympics footrace, advised the joyful victor, Even if you win, youre still retarded.

None of that could be called official business, even if distributed at work, but ethnic and other slurs find their way into NSA briefings and training resources as well. They turn up most commonly when syllabus writers are called upon to make up foreign names. Invented names are a staple of NSA course materials because analysts in training have no need to know the identities of actual foreign surveillance targets. Instructors use fictional substitutes to teach the technical and procedural fine points of target selection.

One of the first things an analyst needs to learn is what counts as an adequate reason to judge that a prospective surveillance target is a foreign national on foreign territory.

(Fourth Amendment restrictions apply otherwise.) The NSA syllabus for its Smart Target Enhancement Program walks through 12 foreignness factors that analysts may rely upon, each illustrated with examples. Some of the ersatz target names are merely playful: Elmer Fudd, Dr Evil, Bad Dude, Bad Girl, Bad Guy and Super Bad Guy. Most of them descend into stereotype. Lotsa Casho is a Colombia-based coordinator for a drug cartel. A Beijing-based Chinese party of interest can be found online as friedrice@hotmail.com. The Turkish target (kababs4u@yahoo.com) is Master Kabob, believed by the NSA to have provided grilled kabobs for hungry Islamic cells.

The most derisive descriptions, and the ones used most often, are reserved for fictional Arabs and Muslims. Many are named with a bastardised reference to an Arabic term of respect for fatherhood. Abu Bad Guy, Abu Evil and Abu Raghead make appearances, among others. Another version takes the name of the Prophet: Mohammed Bad Guy, Mohammed Evil, and so on. Weekly programme updates in briefings prepared for supervisors display related tropes. One report on a surveillance operation in progress took a break from matters at hand to joke about what happens when the mulla [sic] mixes his Viagra with his heroin. (Now he gets an erection but cant stand up.) Save for the last example, these are bureaucratically vetted teaching materials.

In the age of Trump, I found a new openness among my bitter critics in the intelligence community. People who had shunned contact after the Snowden revelations began to talk to me again.

One of them, soon after retiring as director of national intelligence, was Air Force lieutenant general James Clapper. Both his parents had worked for a time at Fort Meade and Clapper himself did a tour there as aide to the NSA director in the course of a half-century career. In 2014, Clapper had come as close as anyone in government to accusing me, along with the documentary maker Laura Poitras and journalist Glenn Greenwald, of taking part in a criminal conspiracy with Snowden. Four years later, in the summer of 2018, he agreed to meet face-to-face. Clapper had responded crankily at first to my request for half a day of his time. I need to know what this is about before I sit for an hours-long recorded interrogation, he wrote. I made fun of his choice of noun but replied at length. Eventually he agreed to breakfast at the McLean Family Restaurant, a CIA hangout in northern Virginia, where Clapper seemed to know half the room. He made the rounds, chatting up old friends and colleagues, then ordered an egg white omelette. During several hours of conversation, long after servers cleared our plates, he listened respectfully and responded without mincing words. I recounted some of the stories I planned to tell here.

Near the end of the interview, I asked Clapper what to make of an agency culture in which hackers and analysts feel free to mock the dead and conduct official business with ethnic and sexual slurs. These are not necessarily the people you want to be in charge, I said.

His face tightened. TAO, he said, referring to Tailored Access Operations, is supposed to be, you know, our legitimate government officially sanctioned hackers.

Right. Theyre supposed to be, I replied. But if theyre snickering about...

He interrupted, sarcastic. But we want them to be nice. We dont want to do anything thats politically incorrect. Right? Isnt that what youre saying?

What you want is to think theres a certain level of maturity and respect for the amount of power they have.

Clapper softened. Well, yeah. You do. But, hey, theyre human beings too. And Im sure we could clean that up.

Open-mindedness in a leader of Clappers rank is not to be taken for granted. Even so, he could have probed more deeply. Language is the symptom, not the problem. NSA geeks are not like other geeks whose folkways they share. The NSAs top guns build and operate the machinery of a global surveillance hegemon, licensed to do things that would land them in prison if they tried them anywhere else. The eagle and serpent would not be alpha predators without them. Only judgment and self-control can govern them where there is some play in the rules, as there usually is in a sprawling enterprise. Digital weapons designers, like engineers everywhere, are inclined to do what works. The choices they make reach well beyond the terrain of Bad Girls and Bad Guys.

Dark Mirror: Edward Snowden And The American Surveillance State by Barton Gellman (The Bodley Head, 20) is out now. amazon.co.uk

Best books to read right now

In search of Myanmars billion-dollar meth lab

How rebel football helped keep Kosovan identity alive during the Yugoslav War

See the original post here:
Memes, lolz and intel incels: behind the scenes in the NSA hacker corps - British GQ

Verizon and AT&T Partner With Pro-Police Militarization Lobbying Group – Sludge

As protesters outraged over police killings of black people were met with police violence, AT&T took to Twitter on Sunday to say that the companys advocacy toward equality and inclusivity continues today and will for the future, adding that at AT&T we stand for equality and embrace freedom.

Verizon made a similar statement and went a step further by pledging to donate to the cause. The events unfolding across the country that are rooted in hate are contradictory with our beliefs as a company, read a statement from Verizon CEO Hans Vestberg released on Monday. Vestberg said that the companys foundation would donate a total of $10 million to seven social justice organizations. (The Verizon Foundations total charitable giving has been between $35 million and $65 million in recent years, according to tax documents.)

While the telecom companies side publicly with social justice activists, they are continuing their longstanding funding of a group that works to militarize local police, expand the use of warrantless surveillance, and promote policing policies that have disproportionately harsh impacts on communities of color.

Through their brands Verizon Connect and AT&T FirstNet, the companies are both platinum partners of the National Sheriffs Association (NSA), a lobbying group that describes itself as one of the largest U.S. law enforcement organizations. The two largest U.S. telcos are among the most prominent corporations that partner with NSA. Verizon is also one of NSAs three diamond partners, the groups top corporate partnership tier, entitling it to a private dinner with the NSA Executive Committee. This intimate setting will give you coveted time with the key policy makers within the organization, a brochure reads.

NSAs legislative priorities include making permanent a program that allows civilian law enforcement agencies to acquire weapons and equipment from the military that were designed for use on the battlefield. NSA encourages the codification of the 1033 Military Surplus Program that provides lifesaving gear and equipment for law enforcement, NSAs website states.

Under the Department of Defenses 1033 program, state and local police are able to obtain Mine-Resistant Ambush Protected Vehicles (MRAPs), grenade launchers, helicopters, unmanned aerial and ground vehicles, bayonets, and other weapons of war. State and local law enforcement currently hold $1.75 billion worth of military equipment that they acquired through the program.

Sludge is reader-supported and ad-free. If you appreciate our independent journalism, Become a member today.

In 2015, President Obama placed limits on the type of equipment that could be made available to police by an executive order, but President Trump reversed Obamas order in 2017, allowing controlled military weapons to continue flowing into police departments. Codifying the program would prevent a future president from ending the program without an act from Congress.

Police have used the military equipment they acquired through the 1033 program heavily against communities of color. In a 2014 report, the American Civil Liberties Union found that the military arsenals acquired by police are used largely in the so-called War on Drugs and that 54% of the people impacted by SWAT teams employing military equipment and tactics for executing search warrants were black or Latino, the ACLU found.

The National Sheriffs Association has spent more than $1.3 million on lobbying the government on issues including the codification of the 1033 Program since 2016, according to congressional records.

In 2012, Verizon outfitted a humvee that NSA acquired through the 1033 program with mobile technology. Wireless connectivity allows them to access records and manage paperwork in the eld, tap into video surveillance prior to arriving at a crime scene, communicate with dispatch and more, NSAs says on its website about the partnership.

NSAs legislative priorities also include opposing privacy advocates proposals for reforming the Electronic Communications Privacy Act (ECPA), a federal law that allows police to obtain domestic communications records from companies like AT&T and Verizon without a warrant. NSA recognizes the increasing threat that going dark has on their ability to effectively and efficiently obtain potentially life-saving digital materials, its website states. NSA describes ECPA as an essential piece of legislation that seeks to ensure that telecommunications companies properly work in collaboration with law enforcement. In its past lobbying on the issue, NSA urges lawmakers not to limit their access to communications data and questions whether the premise that its partnership with the telecoms invades peoples privacy.

Sign up to get our next investigations over email:

Through its Project Calso known as HemisphereAT&T maintains and analyzes billions of domestic and international call records that pass through its networks and makes information available without a court order to the Drug Enforcement Agency and other several law enforcement organizations.

During the 2016 protests against the Dakota Access Pipeline, NSA employed crisis communications consultants to create talking points to discredit protesters, including that many were out of state agitators with ties to George Soros, according to a report from MuckRock based on emails obtained through an open records request. NSA was also the central organizing vehicle which brought hundreds of out-of-state cops to Standing Rock, according to the report.

Sludge reached out to Verizon and AT&T about their partnerships with the National Sheriffs Association, but neither company responded by the time of publication.

Some members of Congress have recently renewed calls for Congress to pass legislation to repeal or amend the 1033 program. Since March 2019, a bipartisan bill to place restrictions on the program, the Stop Militarizing Law Enforcement Act, has been pending in Congress, but the House Armed Services Committee to which it has been referred has yet to act on it. The committee is chaired by Rep. Adam Smith (D-Wa.), a top recipient of campaign funding from the defense industry, which benefits from sales made under the 1033 program.

Several of the organizations that Verizon pledged to donate to, including The Leadership Conference on Human and Civil Rights, National Urban League, and NAACP, recently sent a letter to Congress calling for the end to the 1033 program, among other legislative measures addressing abusive police practices.

Read more from Sludge:

The Members of Congress Who Profit From War

Liberate Rally Organizers Worked to Criminalize Anti-Pipeline Protests

New House Foreign Affairs Chair Receives Money from Weapons Contractors He Oversees

Every day, the reporters at Sludge are relentlessly following the money to reveal the hidden networks and conflicts of interest that drive political corruption. We are 100% ad-free and reader supported, so were counting on our readers to help us continue calling out powerful politicians and lobbyists. If you appreciate the work we do, please consider becoming a member for $5 a month to support our investigative journalism. We cant do this work without your support.

Continued here:
Verizon and AT&T Partner With Pro-Police Militarization Lobbying Group - Sludge

This Week In Security: Exim, Apple Sign-in, Cursed Wallpaper, And Nuclear Secrets – Hackaday

So first off, remember the Unc0ver vulnerability/jailbreak from last week? In the 13.5.1 iOS release, the underlying flaw was fixed, closing the jailbreak. If you intend to jailbreak your iOS device, make sure not to install this update. That said, the normal warning applies: Be very careful about running out-of-date software.

An exploit in Apples web authentication protocol was fixed in the past week . Sign In With Apple is similar to OAuth, and allows using an Apple account to sign in to other sites and services. Under the hood, a JSON Web Token (JWT) gets generated and passed around, in order to confirm the users identity. In theory, this scheme even allows authentication without disclosing the users email address.

So what could go wrong? Apparently a simple request for a JWT thats signed with Apples public key will automatically be approved. Yeah, it was that bad. Any account linked to an Apple ID could be trivially compromised. It was fixed this past week, after being found and reported by [Bhavuk Jain].

So when someone posts an image on twitter, and warns everyone to *never* use it as your phone wallpaper, whats the logical thing to do? Apparently its only appropriate to immediately set it as your phones wallpaper, and then complain that it renders your phone unusable. So whats going on?

The image in question uses a special color-space that the Android UI isnt equipped to handle. That particular picture has a color value over 255, which is out of bounds, causing a crash in the UI. Once the Android UI has crashed, its impossible to change the wallpaper, leading to a crash loop. A few users were able to switch out their wallpapers in the few moments between crashes, but the surest way to clean up the mess is to manually remove the image using something like TWRP.

This vulnerability is one that keeps on giving. We talked about CVE-2019-10149 just about a year ago. This week, the NSA published a warning (PDF) that certain state actors are actively exploiting this Exim bug.

For a quick refresher, the Exim mail server is the most popular mail server on the net. CVE-2019-10149 is a clever exploit that tricks a vulnerable server into trying to send an email to a specially crafted address, hosted at a malicious mail server. When the target machine tries to send a bounceback message, the malicious server sends a byte every four minutes, forcing the connection to stay open for a week. This strategy ensures that the vulnerable code is hit. When the message is finally sent, the payload embedded in the email address is evaluated and executed.

The NSA warning specifies the Russian GRU as the culprit, acting under the name Sandworm. Theres likely quite the story behind how the current attacks were discovered to be of Russian origin. As none of the indicators of compromise are directly tied to the GRU, well just have to take the NSAs word for it, but of course theyre not going to make public how they get their counter-intel either.

In further GRU news, the UK has officially attributed to them a series of attacks on the country of Georgia. These attacks shut down the Georgian power grid, encrypted hard drives (ransomware), and directly damaged financial systems. And just last month, the German government attributed hacks on their parliament to one particular GRU officer: Dmitriy Badin.

Attributing cyber attacks to a particular actor is always tricky, especially when savvy foreign intelligence agencies which dont want to get caught are behind the work, but the fact that multiple government agencies are converging on the same conclusions is more persuasive. The German evidence, collected over five years and pointing to a particular agent, is particularly so.

Our final story comes from Sky News, who breaks the news that Westech International was hit with a ransomware attack. As you may have guessed, this sections title is Betteridges Law in action, albeit ironically.

So what really happened, and why is the nuclear secrets angle almost certainly bunk? First off, Westech isnt a huge engineering firm, and they havent worked on designing any nuclear weapons systems. Go to their website, and look at the contracts they have and services they offer. Telecommunications, maintenance, and logistics planning.

Secondly, we know that the ransomware attack hit the machines doing their payroll. Classified information is subject to a strict set of rules in the US. Its only to be kept and used in a Sensitive Compartmented Information Facility (SCIF). Computers containing classified information are never to be connected to the unsecure network. There is even a dedicated Secret Internet Protocol Router Network (SIPRNet) that is only for secure communications and only accessible from a SCIF. All this to say, if a ransomware attack can ex-filtrate data back to an attacker, then somebody royally messed up in a way that often leads to jail time. Its a long way from payroll to nuclear secrets.

[Andrew Dupuis] had an Arris Fiber Gateway provided by AT&T, and like many a hacker, he wasnt satisfied. Before we dive all the way into the rabbit-hole, we should point out that AT&T is charging $10 a month for this device, and refuses to let their customers use their own hardware instead. [Andrew] believes that this probably violates FCC rules. In any case, he wanted to run his own gateway instead of being locked into AT&Ts. The fiber connection uses 802.1x security on the physical connection, which also serves to lock customers into the official hardware. If a user could extract the 802.1x certificates, they could replace the official AT&T gateway with their own hardware, which is the point of the writeup.

The exploit itself starts with a firmware downgrade, back to a version that still contains the vulnerability. The vulnerability? A REST server intended for troubleshooting and debugging. A bit of work later, and the hardware is rooted, with a telnet server just waiting for you. It shouldnt be very surprising, the OS under the hood is a standard embedded Linux. The first order of business is to disable the auto-update function, to avoid getting locked back out of the device.

[Andrew] explains how to properly secure the gateway, and re-tune it for better performance, good ideas if you intend to continue using it in your network. The real goal here is extracting the certificates. Im not sure how much of a surprise it should be, but it seems that every device uses the same security certificates, and [Andrew] was kind enough to share the copy he extracted.

[Andrew] sent this in on the Hackaday Tipline. If you have research to share, or came across something you think we should cover, be sure to let us know about it!

Go here to see the original:
This Week In Security: Exim, Apple Sign-in, Cursed Wallpaper, And Nuclear Secrets - Hackaday

The NSA has a warning: Russia’s most infamous hackers are still active – NBC News

The same Russian intelligence unit that leaked Democrats' files in 2016 is engaged in an ongoing email hacking campaign, the National Security Agency announced Thursday.

Hackers in Russia's GRU, its military intelligence agency, regularly target email accounts, as is common for many with robust cyber capabilities. But this is the first time that the NSA has issued a direct public alert that named the agency and warned of an ongoing hacking campaign.

Byers Market Newsletter

Get breaking news and insider analysis on the rapidly changing world of media and technology right to your inbox.

It wasn't immediately clear if the advisory was merely a byproduct of the NSA's stated desire to be a better public adviser to the public on cybersecurity issues, or if it had a particular strategic aim. The agency launched its Cybersecurity Directorate in October with the intent of being a more open cybersecurity ally. In January, it said that it had alerted Microsoft to a critical Windows vulnerability rather than exploiting the flaw for its own purposes, the first time it made such an announcement.

The alert describes how the GRU is targeting a vulnerability in unpatched Unix systems, an alternative to the operating systems of Microsoft and Apple. It does not specify who it has seen targeted.

It does specify that the campaign is the work of GRU's Unit 74455, which has been tied to some of the most infamous cyberattacks in history. The U.S. Justice Department has accused Unit 74455 of creating the Guccifer 2.0 and DCLeaks personas, which then leaked stolen Democratic emails and files as part of its 2016 election interference campaign.

They are probably Russias most brazen and successful cyberattack organization, said John Hulquist, the director of threat intelligence at FireEye, which tracks the group.

The U.K. has named 74455 as the creators of NotPetya, the ransomware worm that grew wildly out of control and spread around the world in 2017, causing billions of dollars in damage and prompting international outcry.

In February, the State Department accused Unit 74455 of running a multitiered harassment campaign against the nation of Georgia.

Kevin Collier

Kevin Collier is a cybersecurity reporter based in New York City.

Originally posted here:
The NSA has a warning: Russia's most infamous hackers are still active - NBC News

NSA’s cyber wing looks to safeguard COVID research and expand outreach – FCW.com

Cybersecurity

Optional caption goes here. Optional caption goes here. Optional caption goes here. Optional caption goes here.

The National Security Agency's cybersecurity directorate is focusing its resources on protecting medical research related to the COVID-19 pandemic and assisting critical infrastructure that can help speed up America's economic recovery, according to the agency's Deputy Director George Barnes.

Speaking on a webcast hosted by the Intelligence National Security Alliance, Barnes provided an update on the agency's cyber-focused directorate formed late last year. The rise of the COVID-19 pandemic has provided a whole host of additional challenges, increasing the collective digital threat surface as governments and businesses moved to mostly online operations and putting public health organizations and pharmaceutical companies working on a vaccine and other aspects of the response firmly in the crosshairs of nation-state hackers.

Barnes said the fallout from the pandemic has pushed the directorate to ask "how do we protect critical activities that are vital to us getting back in a healthy state?" and enable Americans to get back to work and keep the economy moving. When it comes to protecting private and public medical research, the agency's bread and butter -- signals intelligence can provide medical research organizations with insight into what information foreign governments are after as well as the tools and methods they're using to get it.

"It wasn't [more than] a few days into March where phone calls were coming in to NSA asking us for our insights and our support to that community, and so we have doubled down and really accelerated and intensified efforts to reach out," he said.

While one of the directorate's core missions is protecting national security systems such as nuclear command and control infrastructure, the organization has realized that many of the vulnerabilities they're called upon to defend against are the result of poorly designed parts and components. A lack of coordination between the industries that create technologies and the governments who use them to protect cyberspace "we are not well positioned as a nation" to defend against digital espionage and supply chain compromises.

That has caused the directorate to canvass the Department of Defense as well as the defense industrial base and non-defense businesses to create a more collaborative, bidirectional relationship.

"We are tied between government and industry. Industry drives government, industry creates the capabilities, the solutions that we press into service operationally," said Barnes. "Our security can't just start once we take something on and receive it and deploy it. It has to start from the design, and we know all too well that designs are ripe for plucking."

The directorate was initially designed to focus on protecting national security systems and the defense industrial base from hacking groups, foreign intelligence services and other threats. It was also set up to boost information sharing efforts and foster better cooperation between NSA, other agencies and the private sector on digital security matters.

Curtis Dukes, formerly head of the now defunct Information Assurance branch at NSA, told FCW last year that information sharing efforts between intelligence agencies are often hampered by a declassification process that waters down the usefulness of most threat data, and the directorate seems designed to counter that criticism. It operates out of a new 380,000 square foot building alongside personnel from its sister agency, U.S. Cyber Command and cleared representatives from defense contractors and other federal agencies.

The organization's ambitions are also bold, and it has outlined a portfolio that includes defending U.S. defense assets, protecting critical infrastructure from cyberattacks, raising situational and threat awareness among American commercial enterprise, curbing intellectual property theft by foreign nations and partnering with academia and industry to cultivate a technically minded workforce that treats cybersecurity as a critical component rather than an add on after-the-fact.

In each arena, Barnes said the directorate focused resources on the things only it can do. Success will be measured not by NSA but by the customers it serves, from DOD, intelligence agencies and the Joint Chiefs of Staff to other civilian agencies and the broader cybersecurity community. When it comes to working with the Department of Homeland Security and its component Cybersecurity and Infrastructure Security Agency, the directorate is quickly building relationships while pondering how to share data and work together to push out threat advisories to critical infrastructure, contractors and the private sector at large.

"At NSA I want to do things that nobody else can do," Barnes said. "I don't want to do things that others can do. The world's too big, we have too many priorities, too many pressing needs to pursue duplication out of product."

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at [emailprotected], or follow him on Twitter @derekdoestech.

Click here for previous articles by Johnson.

Continued here:
NSA's cyber wing looks to safeguard COVID research and expand outreach - FCW.com