back to article NSA's TURBINE robot can pump 'malware into MILLIONS of PCs'

The latest batch of top-secret intelligence documents from the hoard collected by NSA whistleblower Edward Snowden detail the massive increase in the agency's use of its Tailored Access Operations (TAO) hacking unit – including a system dubbed TURBINE that can spam out millions of pieces of sophisticated malware at a time. The …

COMMENTS

This topic is closed for new posts.
  1. Franklin

    "signals intelligence shall be collected exclusively where there is a foreign intelligence or counterintelligence purpose to support national and departmental missions..."

    ...and it's convenient, though not necessary, when the department's missions align with the nation's.

    1. Anonymous Coward
      Anonymous Coward

      Amazingly the Dutch NSA have just admitted "overcollecting"

      http://www.dutchnews.nl/news/archives/2014/03/dutch_security_services_do_bre.php

      "Dutch security services do break law on intercepting phone traffic"

      it seems the NL intel Agencies oversight panel have found disproportionate overcollecting issues, viz: "security services regulator CTIVD said security service agents do sometimes set taps without permission from the minister as required by law. They also hack into accounts without asking for permission."

      So, happily, there is at least a debate in NL over the level of overcollecting, although the 89 page regulator report doesn't yet clarify how to deal with the NL Agencies overcollecting on Website Forums (like presumably here) and overcollecting other Social Media.

  2. Anonymous Coward
    Mushroom

    I invite the US and the other 5 eyes partners...

    to kiss my ass!

    1. Hit Snooze
      Big Brother

      Re: I invite the US and the other 5 eyes partners...

      F-Secure's malware research chief Mikko Hyppönen told the summit that so far government-developed malware was coming from Germany, Russia, China, and even Sweden...

      It's not just the 5 Eyes you have to worry about...

      1. eap

        Re: I invite the US and the other 5 eyes partners...

        I wonder why he listed Germany first. All I know about is that federal trojan buisiness from a few years ago (2011). The German federal police apparently wanted to listen in to skype calls and since they couldn't just NSL Microsoft, they decided to circumvent encryption by installing trojans on suspects' computers. Ill advised for many reasons, but almost cute from a post-Snowden perspective.

        1. Christian Berger Silver badge

          Re: I invite the US and the other 5 eyes partners...

          Well the German case is very well documented. Newspapers even printed commented disassemblies of it. (No I'm not kidding here's the PDF https://www.faz.net/dynamic/download/fas/FAS_09_10_2011_S41_S47_Staatstrojaner.pdf )

      2. Anonymous Coward
        Anonymous Coward

        Re: I invite the US and the other 5 eyes partners...

        Of course not, but Russian and China don't turn to media crying wolf that the Chinese were lunching attacks into to the "free world" like the US Gov like to do.

    2. Sebastian A

      Re: I invite the US and the other 5 eyes partners...

      As a resident of one of the 5 eyes countries, I don't like this shit happening any more than anyone else does, but there's nothing I can do about it. Whichever bunch of jackasses I vote in, they'll all happily keep doing this stuff.

      1. Anonymous Coward
        Anonymous Coward

        Re: I invite the US and the other 5 eyes partners...

        they'll all happily keep doing this stuff whichever lot you vote for or even don't vote for at all. Remember, resistance is futile.

        Shit, I can't even set fire to myself in protest, because they'll think I was a nutter or something....

        ;)

    3. Gray
      Boffin

      Re: I invite the US and the other 5 eyes partners...

      Get just a little more out of line with that attitude, and they'll (we'll) rendition your sorry ass. But not until they (we) pwn your computer/mobile/xpad/device, of course.

      Feel better now?

      1. Mark 85 Silver badge
        Pirate

        Re: I invite the US and the other 5 eyes partners...

        You could do what I'm doing... starting a religion. My religion consists of the 4-B's... Babes, Beaches, Beer, and BBQ. The method to this madness is that when I get rendered to Gitmo and they have to "provide for my religion".. ahem... the 4-B's. I figure the Marine guard detachment will all be converts in 30 days.

        1. oolor
          Pint

          Re: I invite the US and the other 5 eyes partners...

          > provide for my religion

          But will you really have time to decompress between "not-torture" "interrogations" to enjoy your pyrrhic victory?

          El Reg needs a 4-B's icon >>>>

        2. Crisp Silver badge

          Re: Babes, Beaches, Beer, and BBQ

          Your ideas are intriguing to me and I wish to subscribe to your newsletter.

        3. Frankee Llonnygog

          Re: I invite the US and the other 5 eyes partners...

          Having sex in a prison cell with a misanthrope in an orange polyester jumpsuit - those 'babes' will be queueing around the block!

        4. Tim Jenkins

          Re: I invite the US and the other 5 eyes partners...

          "My religion consists of the 4-B's... Babes, Beaches, Beer, and BBQ"

          Your interrogation regime* will therefore consist of Ann Widdecombe in a micro-bikini, serving you warm Kaliber lager and cold Linda MacCartney sausages on a replica of Blackpool seafront in November.

          * Illegally renditioned UK citizens only. Feel free to substitute other methods where culturally appropriate.

        5. aregross

          Re: I invite the US and the other 5 eyes partners...

          You are not real, you are a SPY and I'm surprised no-one here has yet vetted you out! Everyone knows there are *5* Bs.... Babes, Beaches, Brandy (or Beer), BBQ and BACON! Shameful really....

          1. Mark 85 Silver badge

            Re: I invite the US and the other 5 eyes partners...

            My apologies forgetting BACON. I realize it is its own food group when done properly, like beer. Here in the States we don't have proper bacon just a facsimile. If a given rasher is 1 inch (2.54 cm or 25.4 mm) wide, most of it is fat with little lean. Which makes it suitable only for rendering grease for frying eggs or breakfast potatoes. Or.. if you're of the ilk, coating your bullets with the grease to ensure any terrorists you shoot won't get to heaven.

          2. Sarah Balfour

            Re: I invite the US and the other 5 eyes partners...

            Nah, 6 - Babes (blokes), Beaches, Booze, Beer, Bacon and Blunts - can't do without my MJ! I

            Actually, scratch that, just gimme a beach, a BBQ, Bacon and the Blunts. Oh wait a BoomBox too, this party needs tunes, right…?!

          3. Sarah Balfour

            Re: I invite the US and the other 5 eyes partners...

            Nah, 6 - Babes (blokes), Beaches, Booze, Beer, Bacon and a Bong (or several) - can't do without my MJ! I

            Actually, scratch that, just gimme a beach, a BBQ, Bacon and the Bong(s). Oh wait a BoomBox too, this party needs tunes, right…?!

            1. Mark 85 Silver badge

              Re: I invite the US and the other 5 eyes partners...

              Bongs or Blunts??? Why can't we have both, Coleman? (Apologies to Eddie Murphy)

      2. Anonymous Coward
        Stop

        Re: I invite the US and the other 5 eyes partners...

        On which ground? Ass to ugly? Anyway, when people get affraid to speak their minds, that means there's no guts anymore. But hey, if you like modern versions of STASI, then you must be very happy.

  3. John Smith 19 Gold badge
    Unhappy

    Yay, Malware even simpler than skiddies

    Hope this is making all you Americans feel safer.

    Because it's done in your name.

    1. ecofeco Silver badge

      Re: Yay, Malware even simpler than skiddies

      Ha! That was done in decades ago.

  4. Destroy All Monsters Silver badge
    Big Brother

    Do YOU have UNITEDRAKE FOGGYBOTTOM SALVAGERABBIT clearance?

    "The madness is spreading"

    Clearly, Chtulhu is up and about and looking people in the eye. I think this ain't gonna end well.

    1. phuzz Silver badge

      Re: Do YOU have UNITEDRAKE FOGGYBOTTOM SALVAGERABBIT clearance?

      Just wait until the Gruadiaid publishes the leaks about CASE NIGHTMARE GREEN...

    2. Michael Wojcik Silver badge

      Re: Do YOU have UNITEDRAKE FOGGYBOTTOM SALVAGERABBIT clearance?

      I want to know who developed the feared ADJECTIVENOUN random-name generator.

      (And, as always, must wonder what the intelligence community's BLOCKCAPITALS fetish is compensating for.)

  5. Cirdan
    Black Helicopters

    Land of the free...

    I was never here. I didn't read this. I am not a sysadmin. I don't control any routers. I have no influence over security.

    Thank $Diety that I don't use Faceboo...just a second while I answer the door...

    HEY, WAIT! I HAVE MY COPY OF THE CONSTITUTION RIGHT HERE AND MMPH MMMM MMMMPH MMMMPH MMMMMM!

    1. Gray
      Devil

      Re: Land of the free...

      As our esteemed Senator Diane Feinstein and her staff have discovered recently with the CIA, the Constitution of the United States has been reprinted on a roll of toilet paper and left to soak in the CIA/NSA/FBI/DHS toilet overnight to discourage unauthorized access.

      But that's alright. They'll be eager to interpret it for you at your trial.

      1. Anonymous Coward
        Anonymous Coward

        Re: Land of the free...

        The Constitution of the United States is now a theological document - obsolete in language, used in vastlhy changed circumstances, and interpreted by whoever happens to be in power or has the best lobbyists.

        The only real answer would be a complete rewrite, but where would you find the people to do it? The original was written by people with many axes to grind, but fortunately most of the axes were relatively harmless. It is hard to imagine the authors of a rewrite today being motivated by anything other than money, malice and special interests.

        Mega biblion, says the Greek proverb, mega kakon. A great book is a great evil.

    2. Version 1.0 Silver badge

      Re: Land of the free...

      I suspect that the United States Constitution may have been secretly amended to permit this snooping - of course, we the people would not have the security clearance or the need to know about this amendment.

      So that's alright then.

  6. nematoad Silver badge
    Unhappy

    "Art Coviello calling for an international moratorium on attack code before the situation gets out of control"

    Sorry to break it to you Mr. Coviello but it's already out of control.

    What we need are not calls for the stable door to be bolted, but for you and others in a similar position to get off your backsides and start working out ways to beat these bastards or at the least make it so expensive that they become a little more discriminating on who they are digitally assaulting.

    From your comment it would appear that you have not been keeping up with the news lately.

    1. Mad Chaz

      "or at the least make it so expensive that they become a little more discriminating on who they are digitally assaulting."

      That doesn't work. They aren't the ones footing the bill, tax payers are. Not only that, but the tax payer's not allowed to ask what it's being spent on, so (s)he as no say in the matter.

      1. Michael Wojcik Silver badge

        They aren't the ones footing the bill, tax payers are

        Naive. Taxpayers aren't "footing the bill" either. The national governments pay for their pet projects by expanding the money supply, pure and simple.

        And it's likely that a very small portion of the intelligence budgets of the major industrialized nations leaves their respective countries, while a fair bit of money likely enters due to intelligence trade with assorted despots and other foreign parties. So on balance the economic activity due to the intelligence-industrial complex, in the US or similar states, is likely to benefit the populace, in a strictly monetary sense.

        But the upshot is that, yes, monetary cost is not the way to create incentives against the intelligence industry. Unfortunately, nothing else looks like a particularly viable candidate either. It's likely to be around until the next civilization-destroying catastrophe. (When the next supervolcano goes boom or a decent-sized rock hits the planet, the NSA will be well-down on the list of things to worry about. Obnoxious as they are, and as much as I'd like to see civil rights restored, there's something to be said for having these sorts of problems.)

    2. ecofeco Silver badge

      WAY out of control and has been for years.

  7. Herby

    Interesting choice of words

    All these fancy names. Do they have a buzzword generator or something? Look if they want it "secret" something like "project 42" (kinda like "area 51") would be better.

    Of course, the names might ALL refer to the same project, you never know.

    As for financing the operation, maybe they used cryptolocker? Great slush fund generator (unfortunately at our expense!)

    Scott McNealy was right!

    1. dan1980

      Re: Interesting choice of words

      I asked a similar question of a mate I know who's a police detective. Apparently sometimes they just drop a dictionary a few times and pick some words more-or-less at random.

      He might have been taking the piss but the results would hardly be much different.

      1. dogged

        Re: Interesting choice of words

        Ours do. The USA does it more along the lines of "let's think of a cool name".

        Operation Redeeming Freedom, anyone?

        1. Anonymous Blowhard

          Re: Interesting choice of words

          They've been running "Operation Reaming Freedom" for the last decade...

      2. Mark 85 Silver badge

        Re: Interesting choice of words

        Back in the 1700's, English ships were named for mythological characters. This was done by the First Lord who had book of mythology. He'd randomly open a page and point. The name nearest his finger became the name of the new ship. Military operations since WWII are usually just random words tossed together. I'm pretty sure this practice is still ongoing only computer generated?

    2. Toastan Buttar
      Big Brother

      Re: Interesting choice of words

      I kept waiting to see SMERSH, SPECTRE and IPCRESS.

    3. Pascal Monett Silver badge

      QuantumCopper, QuantumSky, QuantumHand . . .

      Is there any chance that there's a Dr Who fan choosing the code names ?

  8. eap

    "I hunt sys admins."

    That's it. They've openly declared war. Simon, I'm afraid it's time to release the PFY. Knock him out, get him into his orange jump suit and dump him along with a pry bar in an airduckt in Fort Meade. By the time he's figured out that he's not at LHC the "issue" should be solved.

  9. Daniel B.
    Boffin

    FOXACID?

    Seems to me that someone in that NSA team has been playing too much Metal Gear Solid.

  10. dan1980

    Sigh

    "If government cyberattacks are normalized then the effects on the general public could be catastrophic, he noted, but there's no sign of a change of policy from the NSA."

    Dear <every world government>,

    Your job - your only job - is to provide a better quality of life for your citizens. Before you do a single thing, make sure it passes that test.

    You might want to actually ask those citizens from time-to-time too, just to make sure you're on the right track. Say, whether blanket, warrantless surveillance and widespread cyber attacks make them feel safe, uneasy or outright violated.

    Sincerely,

    The people (you might have seen us around.)

    p.s. - Before you start congratulating yourselves on how well you're protecting your 'national interests' by spying and fighting and generally antogonising each other, ask yourselves if the people enjoyed the dick-measuring contest that was the Cold War, or if a folded flag in exchange for a son is fair trade.

    1. ecofeco Silver badge

      Re: Sigh

      Ah naivete. How.... quaint.

      Governments' ONLY job from day one is to protect the rich and powerful from other rich and powerful. Everything else is showbiz.

      1. Duncan Macdonald Silver badge

        Re: Sigh

        Correction - Governments' ONLY job from day one is to protect the rich and powerful from the people who are not rich or powerful.

        1. This post has been deleted by its author

    2. Anonymous Coward
      Anonymous Coward

      Re: Sigh

      Dear <every world citizen>,

      Nah, Nah, Nah, Nah, Nah

      Respectfully yours

      <government>

      1. dan1980

        Re: Sigh

        @what's a handle

        Sadly.

  11. Eddy Ito Silver badge

    Dear Uncle Sam,

    "How far you can go without destroying from within what you are trying to defend from without?"

    -- Ike

  12. Anonymous Coward
    Anonymous Coward

    When you ARE the Law

    You are ABOVE the Law.

    1. Pascal Monett Silver badge

      In theory, a democracy is supposed to prevent that.

      This just demonstrates that nobody is actually living in a democracy today.

      1. Eddy Ito Silver badge

        Plato was right. A democracy does denigrate into tyranny and it seems the democratic republic does as well.

  13. Schultz
    Terminator

    Skynet already alive?

    When I read the statement from the British intelligence agency: "All of GCHQ's work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate, and that there is rigorous oversight," I could swear I heard that exact statement before. Must be the AI robot answering the phone.

    But if the AI network is truly intelligent, it would surely do a better job pretending to be human?! My head hurts!

    1. Pascal Monett Silver badge

      As has already been said elsewhere, nobody is contesting the fact that this whole thing is legal.

      The whole problem is that it is legal.

    2. allan wallace

      Re: Skynet already alive?

      yes.

      http://en.wikipedia.org/wiki/Skynet_(satellite)

  14. Marketing Hack Silver badge
    Flame

    So now they are impersonating Facebook...

    I have no real love for FB, though it does have its uses. However, the NSA and friends are leaving quite a list of corporate collateral damage on their way to their secure nirvana. If I were LinkedIn, FB and Yahoo!, I would start looking for a California Senatorial candidate who is much better on civil liberties than Dianne "It's fine if they spy on you, as long as they don't spy on me" Feinstein.

    It's a pity that these companies can't just sue Uncle Sam for damaging their brand and goodwill in the marketplace.

    1. tony2heads
      Big Brother

      Re: So now they are impersonating Facebook...

      So how can I know which facebook is spying on me?

      1. nematoad Silver badge

        Re: So now they are impersonating Facebook...

        It doesn't matter. Which ever one you use will spy on you.

        It's a matter of who gets the benefit.

        (Hint: it's not you.)

  15. Christian Berger Silver badge

    It's time for the next step in computer security

    After FOSS which already eradicated many intentional backdoors for the people using it, we now need to add simplicity. The less code you have the less likely it is to contain a backdoor.

    So we need protocols which can be implemented with as few lines as possible. And we may even need hardware separation so if one of the components gets compromised, it won't be able to compromise the others.

    1. d3rrial

      Re: It's time for the next step in computer security

      First step: Abolish Java?

      1. Pascal Monett Silver badge

        Amen to that !

  16. swissrobin

    Re: It's time for the next step in computer security

    Practicality and security are, unfortunately, not good bed fellows. The fact that you want to read The Register means you're willing to risk your traffic to be redirected, monitored and extra payloads added and executed on your browser (JavaScript via AJAX, JPEGs, etc., are all the stuff of modern web sites but also the Achilles heal of your browser and privacy).

    You can have a secure computer only when (a) you only communicate with trusted peers via pre-shared keys or similar and (b) you trust all your peers to do the same; as soon as one peer is compromised, you're all dead in the water. That's not very practical.

    Your best bet is to use one-shot computers for as much traffic as you can, but that means you need another device to manage the endless list of credentials required to access your internet footprint. As the one-shot is reset after each use, any infections you pick up in one session will not compromise future sessions (but you'll also lose all your cookies - hence the extra device). You also need to be ruthless about outbound firewalling to prevent any command and control traffic heading back to the bad guys, etc., etc.

    1. Anonymous Coward
      Anonymous Coward

      Re: It's time for the next step in computer security

      Paid for subscriptions and text documents sent out over XMPP. It would be a nuisance only seeing comments updated on a daily basis, perhaps, and basic HTML is a bit limiting, but it is doable.

      Actually, I think BBM is going down something like this route.

      1. Pascal Monett Silver badge

        Re: Paid for subscriptions and text documents sent out over XMPP

        And that would impact packet sniffing how exactly ?

        1. Christian Berger Silver badge

          Re: Paid for subscriptions and text documents sent out over XMPP

          "And that would impact packet sniffing how exactly ?"

          XMPP supports various ways of end-to-end encryption, so that might be doable... even though I'd count XMPP as one of the more complex protocols.

      2. Andy Davies

        Re: It's time for the next step in computer security

        Interestingly, Google is dropping support for XMPP on April 1st.

  17. Gordon 10 Silver badge

    Take down the bot nets

    So reading betweeen the lines of this article - the NSA have had the capability for years to take down every significant botnet ever created, which no doubt have caused $100m's of financial damages to consumers and businesses, but instead they've used it for many purposes that probably have little or no value to the average joe.

    1. Anonymous Coward
      Anonymous Coward

      Re: Take down the bot nets

      You misunderstand - it is not your security that interests them.

  18. Anonymous Coward
    Anonymous Coward

    spam spam glorious spam

    at least the official figures are right: the biggest source of spam is the US, lol.

  19. Frankee Llonnygog

    And while all that's going on...

    Terrorists are writing their messages on slips of paper and leaving them in cracks in walls

    1. Pascal Monett Silver badge

      Yeah, but terrorists never were the problem.

      They are just the distraction for the public.

  20. R69

    Dont be so naive

    If youve genuinely got nothing to hide, youve probably got nothing to worry about. The issue is not the NSAs use of these tools but the undoubtedly equally nefarious use of them by the more unscrupulous governments of the world - i.e china, iran, israel, syria, russia et al.

    This stuff should never have been made public - the supreme naivete of the liberal press astounds me hear - talk about shooting yourself in the foot, for what in the second world war would most certainly have been considered treason and punished by hanging. He isnt a whistle blower - this was some screwed up ego trip disguised under the pretext of doing us all a favour.

    If we dont stay ahead of the rest of the world in this dept we will only end up regretting it - and the same press who lauded Mr Snowdens self interested ego boosting antics will be wondering why we cut our own nose off to spite our face in the first place.

    1. This post has been deleted by its author

      1. R69

        Re: Dont be so naive

        Youve missed the point pal - the economic benefits associated with the infrastructure regeneration of destroyed countries, the potential mineral assets of the country in question are usually - along with achieving a stable socio-economic platform for those nations who influence your own balance of trade - the determining factors, or excuses that influence whether the US declares a war or not. And no that isnt a quote.

        I for one am not naive nor asleep - why would you weaken your own country's position in the very real cyber war that has been going on for several years now (see Stuxnet et al) - thereby risking the economic and social stability of your home nation - by leaking confidential information, for any reason other than ego fluffing. Morality, to quote Jim Royle, my arse.

        Read twice, comment once.

  21. Zog_but_not_the_first Silver badge
    Black Helicopters

    And I thought I was helping SETI...

  22. Anonymous Coward
    Anonymous Coward

    A question.

    Is anyone missing the simpler times?

    1. Wensleydale Cheese
      Pint

      Re: A question.

      "Is anyone missing the simpler times?"

      Aye, we had Rickets, Diptheria, Hitler, and

      By we did look well going to school with no backsides in us trousers n

      All us little heads painted Purple cause we had Ringworm

      Tony Capstick Comes Home

  23. thx1138v2

    "...be collected exclusively where there is a foreign intelligence or counterintelligence purpose to support national and departmental missions, and not for any other purposes." When the government decides to control every aspect of every citizen's life this covers everything, as Diane Feinstein is finding out.

  24. Dan Paul

    Fools and Idiots....

    If you believe ANYTHING your government says or does, you are a fool, naive at least and idiot at best.

    Dianne Feinstein is both so is Udall, they ALL have lied so many times they no longer no the difference between what is real and what is not.

  25. Ian Johnston

    Oh yeah?

    "All of GCHQ's work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate, and that there is rigorous oversight," the British intelligence agency said in a statement.

    A statement which they make so often that I expect it's a keyboard macro in the press office there. Does anyone seriously believe that they would tell the truth about this?

This topic is closed for new posts.

Biting the hand that feeds IT © 1998–2020