Modern spying 101: How NSA bugs Chinese PCs with tiny USB radios - NYT

Or you just put your IT gear used for classified material inside a TEMPEST shielded room... just like we were all doing 20 years ago.

Re: Proving His Enemies Right

@john savard

The NSA and US govt lost the "right to privacy" when the decided to start spying on allied leaders, foreign businesses, charities, not to mention ordinary people.

To believe they are motivated by some urge to keep us or Taiwan or anywhere else safe is naive at best.

Re: Proving His Enemies Right

"The People's Republic of China is a totalitarian dictatorship..."

Not really, not anymore. Things are a bit more subtle than that.

Re: Proving His Enemies Right... ExCUSE me?

Just a few years ago, I MYSELF suspected stuff like nightstand, if only because with a good dose of paranoia that leaks from time to time, I once pondered (probably from watching a TV movie or one from Hong Kong or extrapolation of plot events) the use of infiltration radio waves to hijack computers. It is not a far-fetched idea to bring to reality.

Now, supose that *I* had gone public with it, but only after, say, handing someone $1,000 to rig up a proof of concept against major laptops and desktops and a handful of year 2007 mobiles. Would that make ME a traitor, even though I would have no proof that the tech is or could be in use, but a a much more sophisticated level tha $1,000 might tempt someone to make?

Watch enough movies and work in tech and allow your mind to feel the fear of characters in movies cornered and angry, and you can eventually start scratch-padding all sorts of things that are likely in play in the real world, but you'd be smart not to try to show who might be the target of such tech.

MOreover, I became even MORE paranoid/suspicious of it due to periodic reports of police vans containing mini-mobile cell towers, able to hijack comms and equipment. That was public maybe 2008 of 2009. As SOON as that hit the press, anyone in China's military elite ignoring it would be a fool. So, I suspect China -- if up to that point it had done nothing -- probably began R&D to find out their own susceptability. After all, China has been making supercomputers since the 80s or 90s (IIRC), and surely some of their own brightest minds posited such things but had other priorities or dearth of money to pursue it...

I don't condone nor condemn what Snowden did (as yet, I'm ambivalent. Maybe because since ALL governments lie, outright lie, for their missions, it is a game on THEIR level, and I don't have to take as stand because no country would listen to me one way or another -- aside from stringing me up domestically for being "ambivalent" -- because their missions will just adapt, evolve, improve, or fail), just as with "I can neither confirm nor deny the presence or absence of nuclear veapons aboard the USS (name your ship)" could be in some cases circumvented by states tech savvy enough to backscatter ships entering and leaving port.

Besides, every compromise just forces tech innovation, and hopefully at some point gets in the way of the REAL bad guys -- the ones stealing credit card numbers, hacking pace makers, and the like.

And, once again, so long as China OWNS most of the US debt and can plunge the sanctity of the "full faith and credit of the Dollar" down the commode, it is the height of hypocrisy to call one's economic salvation a "mortal enemy", except for public consumption by the weakest of minds. Enough of our politicians gave away the farm only a handful of years ago, yet pretend they didn't facilitate or turn a blind eye. China is (currently) worlds manufacterer of economies of scale choice, and until that changes, China's not going to do anything mortally wounding to change that. OTOH, she probably will do EVERYthing possible to keep the USA from delaying her own slip, and will do everything possible to take and keep that crown. Even in football, no one team keeps on winning and winning and winning... The USA is not the Energizer bunny. Even a $1, 20-minute battery is king if juice is only needed for 10 minutes in a desperate moment.

I'll pause before I too far in spirals on non-sensicality...

Just my $1.88...

Re: Proving His Enemies Right

"The People's Republic of China is a totalitarian dictatorship which oppresses its people in general and minorities in particular; it menaces the liberty of the people of Taiwan."

<snip>

Right, errr and America is? I would put it to you that one is no better than the other albeit that the US has a wider spread empire.

The NSA deserves all it gets. It is not fulfilling its legal mandate and is branching out in a way that the CIA tried in the 50s and 60s. the moment it started spying on all and sundry it set itself up for a fall.

Disclosure no surprise and a normal extrapolation from the Tempest concept.

Re: Proving His Enemies Right

"The People's Republic of China is a totalitarian dictatorship which oppresses its people in general and minorities in particular; it menaces the liberty of the people of Taiwan."

So your media tells you. Just as their media tells them that we are the aggressors. But that's ok: Neither of us have been there and we can totally take Murdoch's word on it, because he's a nice guy.

I'm not seriously saying that China is a happy place of freedom, but I am saying that you are blithely painting your own team as the good guys, despite the fact that China isn't the one currently sticking its military into other nations.

"Remember the time, not long ago, when an American airplane over international waters was disabled by a Chinese pilot, forcing it to land on Chinese territory - causing the plane, containing classified technology, to be taken apart while in China?"

I also remember all of the totally illegal flights over Chinese territory and invasion of their airspace by American recon aircraft. How do you justify that level of aggression?

"But at this point, the people who have been saying from the start that he deserves to be shot as a traitor finally have something they can point to."

Bullshit. This isn't a revelation. You acknowledged that you are a layperson in the field and hence only know what the media tells you. So how do you make the judgement that this is a step too far?

Truth is, everyone knows that even an airgap doesn't secure a system and never has. Do you honestly think China hasn't figured it out and takes precautions, too?

Re: Proving His Enemies Right

"The People's Republic of China is a totalitarian dictatorship"

They are not a totalitarian dictatorship...

They are a People's Democratic Dictatorship, which is a big difference,

mainly because they have a hierarchical electoral system, so yes they have local votes, but in reality it is unlikely a non CPC member will get elected, although it happens, the reason being if you want to get into power you join the CPC, there are people in the CPC who took part in protests in China, they know change takes time...

Anyway democracy is over-rated, when did choosing a leader in the UK make the slightest bit of difference?

Labour get in, they spend all the money, Conservatives get in, they save money, Labour get back in and they spend the money....

Re: Proving His Enemies Right

"The People's Republic of China is a totalitarian dictatorship which oppresses its people in general and minorities in particular"

So finally following America's lead in this space then....

Re: Proving His Enemies Right

And EU trade offices? Are you going to tell us the EU is a totalitarian dictatorship too?

Re: Proving His Enemies Right

The US spy plane was flying right on the border of chinese airspace playing a game of chicken with the chinese airforce pilot who was trying to ensure the US spy plane did not enter chinese airspaces when both planes collided. The chinese plane and pilot were lost the US plane was only damaged.

It is very unclear and probably unknowable whether the US pilot, chinese pilot or both made the fatal mistake but the entire situation was instigated by the aggressive and provocative actions of US spy planes flying straight at the border of chinese airspace and seeing how they reacted.

Potrraying this as chinese agression is very misleading

Re: Proving His Enemies Right

"The People's Republic of China is a totalitarian dictatorship which oppresses its people in general and minorities in particular; it menaces the liberty of the people of Taiwan."

Whilst the US has the highest prison population per head of any country in the world, and highest total prison population, way more than China does. In particular, one in ten black American males is a prison inmate, around ten times the imprisonment rate of the general population. US prisons are run as for-profit organisations, offering cheap labour and often undercutting privately owned businesses, such that a large portion of Us manufacturing is actually produced by what is essentially forced labour.

People in glass houses, and all that.

"So the Chinese military will make it a standard procedure to enclose their air-gapped systems in Faraday cages."

Dude: Everyone ALREADY DOES.

Re: Sceptical

That's why I think that the Snowdon 'revelations' have done no harm at all.

Re: Sceptical

Do not ruin rampant paranoia. It is such a surprise that a government might target another to find out what they are doing? That is what diplomacy is about and certainly what espionage does.

When will we get a Sowden Li running from his Chinese/Russions.Nork/whatever masters to hear how wonderfully honest they are and how they never do anything like the USA's Snowden suggests.

I'll put down my Enid Blyton book of spy fairy stories now, the one ghost written by a failed junior spy explaining how only the West seeks to look after its interests. I do not need any more fiction as I am now fully up to date with all the cr*p I need today from reading much of the above bedroom fantasy stuff.

For all you paranoid conspiracy theory pluggers. Who has experience bomb plots killing people in our buildings and transport? Oh yes we did in London, why, because intelligence was missed. I am more than happy for someone to look for the needles in hay stacks needed to stop such atrocities. Somehow the thought of being blown up, maimed or killed feels much worse than some one scanning email headers to see IF I'm writing to some dodgy character with murder on their tiny mind.

Re: Sceptical

XBee have a range of piddly little chips that can allegedly get that sort of range. Yes they need an antenna to do so, but I imagine you could piggyback on to the wireless antenna - you've got physical access already, right? As for RF, sure it would be if you're looking for RF. So set the device to only transmit when the laptop is at the owners home, not when it's in the TEMPEST protected room at the office.

And USB devices can present themselves as multiple devices - they can mimic a hub, for example, or they can can present themselves as a dual keyboard-and-disk if they want to. If that disk has an autorun script which immediately unmounts itself, you'd never notice it was there.

I totally agree a bit of scepticism isn't unwarranted here, but technically it's quite possible.

Re: Sceptical

I was sceptical too however I had a look at the NSA's "maplin" catalogue of cool toys here:

http://goo.gl/nPZf18

It appears that some of their data transmission devices such as LOUDAUTO and other devices from the ANGRYNEIGHBOUR range are long range RFID type devices that modulate their data onto a CW signal from the reader, sort of like the TAG used for paying the severn bridge, or the same sort of tag they use in the US for toll payments if my understanding is correct.

Which is a really clever way of doing things as the energy burden for transmission is then shifted to the reader rather than transmission device so you dont need massive batterys.

Sadly my knowledge of RF voodoo is a bit lacking or id have a bash at replicating the tech as it seems simple yet very clever, although It got me wondering if sites of security importance are going to be buying SDR radios to continuously scan the RF spectrum and alert if there are suddenly any large changes in recieved power in the GHz range, which would also catch active transmissions from their HOWLERMONKEY devices. Its all quite clever really.

And thats just the RF stuff, do the server jockeys on here trust their IPMI implementation (vPro etc)

Re: Sceptical

> A device that can transmit 8 miles to a briefcase sized receiver is going

> to need considerable RF output power (several hundred mW).

> it will be eminently detectable

They use something that they call "continuous wave radar". Essentially, the bug contains a FET with the gate connected to the signal being monitored and the source connected to ground. The drain is open (and I guess might have a small aerial). This doesn't actually radiate anything, and so isn't detected by the obvious bug sweeping methods.

The briefcase contains a powerful microwave transmitter and directional antenna, which is used to "illuminate" the bug. When on, the FET absorbs the microwaves - but because it only conducts in one direction, the current that flows has a half-cycle waveform. The effect is that it re-radiates on various harmonics of the illuminating frequency, with an amplitude that depends on the gate voltage. This re-radiation is received back at the briefcase.

This can be connected up to a low-frequency signal like a keyboard connection, RS232, etc. quite easily. Monitors can also be observed because although the signals are high-frequency you can integrate over many frames to build up the image (and it doesn't need to be pixel-perfect). Things like ethernet, SATA and high-speed USB would be more difficult, but probably still possible at shorter ranges.

> I just feel is is highly unlikely that it could be done without some

> inquisitive individual finding it.

They have VGA cables where the bug is inside the ferrite bulge, and they have PCB-mounted USB/ethernet sockets where the bug is built into the socket. They are able to intercept your new computer in the post and fit these things. I think those would get past most "inquisitive individuals".

Do have a look at the leaked PDF linked in one of the earlier comments - and do remember that that is now 5 years old.

Re: Sceptical

Its not that this stuff couldn't have been done. I just feel is is highly unlikely that it could be done without some inquisitive individual finding it.

I too am skeptical about this, and the fact that none has been discovered.

Re: I've heard .....

Not sure about the magnet feet, but I'm certain it has many more arses than that, working for it.

Re: I've heard .....

My wife has two arseholes and I am one of them.

Re: Re. hidden transmitters

I have been thinking along similar lines.

What about the PRR radio used by the Brits and quite a few others. It is spread spectrum on 2.4 ghz and can do quite a distance on line of sight although it is low power and spread spectrum to enhance it's security. there are no licensing issues using this kit as it is on a common frequency and there is a mass of other devices transmitting on the same frequency that can successfully obfuscate it.

Now imagine if you will a spread spectrum device using a common frequency hidden among the clutter of common devices. How would you pick up the signal? your scanning gear will only ever see a portion of the spread and separating it from the clutter would be both interesting and challenging.

On the other hand the RF could be ULF or something exotic that is not easily detectable unless you have very specialised kit.

Re: Re. hidden transmitters

Would such noise still exist in a Faraday cage?

Re: Re. hidden transmitters

Sure they have some really cool kit, and some really brave operators in the field, and after all it's their job to produce and make use of such marvels. Stuxnet and its implementation was very clever and also apparently very successful. But the deployment of these things are handicapped by the fact that once one is discovered the rest rapidly become much less useful until a new and better gadget can be created.

My opinion, and probably Ms Merkel shares my opinion, is that indiscriminate mass spying (collecting the haystack to get at the needle) is ineffective, is probably used for other purposes than security needs, and just plain pisses off everyone. The USA has already decided that gunboat diplomacy doesn't work, I think that they will find that blanket, indiscriminate spying won't work either.

Re: Of course, it could all be double-bluff

"The NSA doesn't necessarily *have* the technology, but arranges via Snowden to leak that it has, causing its putative foes to either revert to paper and mechanical typewriters (as it has been reported the Russians have done) or to develop their own computer hardware from the chips up..."

Do not forget that they will need a massive increase in funding so that they can pay to have these wonderful systems phased out or replaced nay even created.

So they have gone from a Wikkileak to a Dickileak and poor young Chelsea was fingered, shafted and subsequently banged up. Julian is also sorted. Why bother going through due process when the guy has banged himself up and saved everybody the effort.

Re: Of course, it could all be double-bluff

And what does Snowden get out of this? Apart from giving up a high paying job and a super hot girlfirend, to live on Russian state handouts.

Re: A license to do what they please and no oversight - perfect combination

Let me try a scenario. You work as a bodyguard for someone really stupid but also really rich. Given he's prone to mishap but also paying you well, what would be your MO?

Re: Tell me another..

You'd really like that to happen, wouldn't you, Mr Obama?

<snip>

"On a technical level I find this fascinating, but I can't get past the thought that I / we really shouldn't know this; security agencies and governments deserve to keep SOME secrets :o/"

The agencies themselves do not believe that anybody else (be they civilian, military, business, spy etc) deserves any privacy or the right to keep secrets so who cares!

Stuff the lot of them.

Harming National Security

". . . revelation of international espionage projects like this most definitely does undermine national security . . ."

That assertion relies on one very crucial assumption - that 'National Security' is served by such actions.

Even then, that alone is meaningless unless you define 'National Security' clearly. Until you do, you can't say that any given action is beneficial or detrimental.

That's really what needs to be answered - what particular goals were served by these actions (the spying), and are these goals really in the interests of 'National Security'.

National Security is a bit like self-defence. It is a valid justification for extreme actions, but only under certain circumstances. You can't claim 'self-defence' if you kill someone because you think they were going to assault you at some point in the future, nor if you hit your partner because they cheated on you.

That's one of the big gripes about all this - that the government and NSA use 'National Security' as a free pass - a blanket justification for whatever they are doing. The law even allows the President to stop court cases, requiring little more than the assertion that something, something, National Security, something, something.

If you want to bug the UN or foreign embassies, or tap the phones of heads of state or hack into overseas energy companies' private and confidential files, you need to be able prove how those actions are necessary for National Security and how, had you not taken those steps, the country would be in danger.

Modifying the analogy that Psyx used, you might carry a pistol for self-defence. Well and good*. However, if you start using that pistol to shoot out your neighbour's windows, or threaten someone who took your parking spot, then the argument that you need ti for self-defence should fall on deaf ears and you should have your permit rescinded.

That pistol still has a valid use in self-defence but you have proved that you aren't responsible enough to own one.

Remember: Karate for defense only.

* - In the US at least.

Re: Ahem..What if all the NSA/Snowden stuff was a carefully planned ruse.....

Does the 'unwashed masses' include foreign heads of state and those purchasing US IT equipment in China or signing up for US-hosted 'cloud' services in Europe?

I'd also been wondering about the implications for Dragos Riui's claims of airgap jumping malware. I'll keep an eye out for updates.

Re: Secret computer technology?

"As in, if the perps can never be sure they are being spied on, they're less likely to use 'computers' for communication."

No vast difference then from instilling in people the idea that an omnipotent entity can see what they're doing all the time and that if they do something wrong they'll be painfully tortured for all eternity...

Just sayin': Authorities have always used invisible policemen and fear to keep us in line.