Last year was a momentous one in revelations about the NSA, technical espionage, and exploitation. I’ve been meaning for a while to write about the information that has been revealed by Snowden and what it means for the public crypto and security world.
Part of the problem has been the slow release of documents and their high-level nature. We’ve now seen about 6 months of releases, each covering a small facet of the NSA. Each article attempts to draw broad conclusions about the purpose, intent, and implementation of complex systems, based on leaked, codeword-laden Powerpoint. I commend the journalists who have combed through this material as it is both vague and obfuscated, but I often cringe at the resulting articles.
My rule of thumb whenever a new “earth shattering” release appears is to skip the article and go straight for the backing materials. (Journalists, please post your slide deck sources to a publicly accessible location in addition to burying them in your own site’s labyrinth of links.) By doing so, I’ve found that some of the articles are accurate, but there are always a number of unwarranted conclusions as well. Because of the piecemeal release process, there often aren’t enough additional sources to interpret each slide deck properly.
I’m going to try to address the revelations we’ve seen by category: cryptanalysis, computer exploitation, software backdoors, network monitoring, etc. There have been multiple revelations in each category over the past 6 months, but examining them in isolation has resulted in reversals and loose ends.
For example, the first conclusion upon the revelation of PRISM was that the NSA could directly control equipment on a participating service’s network in order to retrieve emails or other communications. Later, the possibility of this being an electronic “drop box” system emerged. As of today, I’m unaware of any conclusive proof as to which of these vastly differing implementations (or others) were referred to by PRISM.
However, this implementation difference has huge ramifications for what the participating services were doing. Did they provide wholesale access to their networks? Or were they providing court-ordered information via a convenient transfer method after reviewing the requests? We still don’t know for sure, but additional releases seem to confirm that at least many Internet providers did not intentionally provide wholesale access to the NSA.
Unwarranted jumping to conclusions has created a new sport, the vendor witch hunt. For example, the revelation of DROPOUTJEEP, an iPhone rootkit, was accompanied by allegations that Apple cooperated with the NSA to create it. It’s great that Jacob Applebaum worked with the Spiegel press, applying his technical background, but he is overreaching here.
Jacob said, “either they [NSA] have a huge collection of exploits that work against Apple products … or Apple sabotaged it themselves.” This ignores a third option, which is that reliable exploitation against a limited number of product versions can be achieved with only a small collection of exploits.
The two critical pieces of information that were underplayed here are that the DROPOUTJEEP description was dated October 1, 2008 and says “the initial release will focus on installing the implant via close access methods” (i.e., physical access) and “status: in development”.
What was October 2008 like? Well, there were two iPhones, the original and just-released 3G model. There were iOS versions 1.0 – 1.1.4 and 2.0 – 2.1 available as well. Were there public exploits for this hardware and software? Yes! The jailbreak community had reliable exploitation (Pwnage and Pwnage 2.0) on all of these combinations via physical access. In fact, these exploits were in the boot ROM and thus unpatchable and reliable. Meanwhile, ex-NSA TAO researcher Charlie Miller publicly exploited iOS 1.x from remote in summer 2007.
So the NSA in October 2008 was in the process of porting a rootkit to iOS, with the advantage of a publicly-developed exploit in the lowest levels of all models of the hardware, and targeting physical installation. Is there any wonder that such an approach would be 100% reliable? This is a much simpler explanation and is not particularly flattering to the NSA.
One thing we should do immediately is stop the witch hunts based on incomplete information. Some vendors and service providers have assisted the NSA and some haven’t. Some had full knowledge of what they were doing, some should have known, and others were justifiably unaware. Each of their stories is unique and should be considered separately before assuming the worst.
Next time, I’ll continue with some background on the NSA that is essential to interpreting the Snowden materials.
rdist 
Hi Nate,
I’m surprised that you’ve taken my question to Apple and many of the named vendors as an allegation. I was very clear – I explicitly said that I’d like each company, including Apple, to clear up their involvement with the NSA. We already know that Apple is a PRISM partner; what that means is an open question for most of the involved companies.
When you say the following, I think you’re basically dismissing what I said at the 30c3:
“This ignores a third option, which is that reliable exploitation against a couple versions of a product is unremarkable.”
I made exactly this point in the talk. There are two ways: They have a way to insert VALIDATOR without exploitation or they resort to exploitation. If they resort to exploitation, they’re sitting on some amount of remote bugs per version. Given the number of iPhone (software/hardware) releases since 2008, I’d guess they’ve been collecting bugs for more than six years.
In any case, we specifically had a slide that references the following QUANTUM slide deck where the BAH/NSA folks say:
“note: QUANTUMNATION and standard QUANTUM tasking results in the same
exploitation technique. The main difference is QUANTUNATION deploys a
state 0 implant and is able to be submitted by the TOPI. Any ios device
will always get VALIDATOR deployed.”
( Note that this slide is from February 22nd, 2013. )
There are a few ways to read that slide and the text. On the one hand, it shows a user that is vulnerable to exploitation and on the other it may be that they’re always vulnerable because they’re an iOS device. The context is of course that the NSA is seeing five years of progress in exploiting iOS. It is likely that there are many different methods – though the TAO CNE angle means that they’re likely exploiting buggy Apple software remotely and locally with physical access. When combined with the SIM card hacking stuff – they’ve likely a few different angles into any given Apple (GSM) device.
I’d like the US Congress to ask the NSA and Apple – which is it? Is every iOS device exploitable and thus the NSA is sitting on bugs that are going to be found by others (eg: bugs they don’t disclose to Apple)? Or is the NSA exploiting things that no other group may exploit (eg: a signing key just for them)? If it is the former, I think the NSA should be working with Apple to fix their software; basically as the President’s review board basically suggested for 0day. If it is the latter, I’d love to hear the legal rationale behind such an activity.
Apple is said to be a PRISM partner with the NSA. What else do they do for the NSA? Do they do it willingly? Do they also give up business records? Do they have any right to resist these actions? Do they even try? I’m giving Apple a lot of credit here when many other companies are *not* PRISM partners and when many other companies are not referenced with such loving highlights.
In any case, I hardly think that any of the above is overreaching – these are reasonable conclusions and fairly straight forward questions.
As a side note, I worked on these stories, how they all fit together and in understanding the context for the last several months of my life. I think that you shouldn’t suggest that my only role with Der Spiegel is as a technical reference.
Jake, thanks for writing back.
I agree with your goal of getting companies to clarify (and ultimately, limit) their extra-judicial cooperation with any governments.
What I was disagreeing with was your statement that reliable exploitation on multiple devices requires either a huge number of bugs or surreptitious vendor cooperation. That’s a false dichotomy. I think that a small number of bugs suffices, especially in homogenized platforms like mobile devices and even more so if you allow for an attacker that is willing to resort to physical access.
It is quite possible the NSA has a huge number of bugs, but they’re the only ones who could confirm this. So it’s not very helpful to try to extrapolate from NSA’s claims of success to the general code quality of a particular target. We have better open information (e.g., the jailbreak history) to assess this.
Your questions about assessing the nature of cooperation between businesses and the government are important. As a customer, I would like assurance that the vendors I use are not assisting any government (my own or others) with providing access to the hardware and software I use.
Finally, I did not intend to diminish your role by saying “assisting the Spiegel press with his technical background”. I meant that whatever work you had done to earn the first author position, you certainly also added technical expertise to the article(s) on the whole. I’ll edit that to try to capture the difference.
[Note: the post was edited to try to clarify all the above]
Heya Nate,
Your blog is worth reading, even if I felt a bit burned by it personally today. :)
I suppose at this point, we’re arguing on the difference between “large” and “small” in this context of how many bugs they hoard for QUANTUM related programs. That collection of exploitable bugs is specifically just remote over the network pwnage and not physical and local to the device related exploitation. If that is our only point of disagreement, I think that we’ll be horrified to learn about the size of the NSA’s exploit cache.
So what counts as large? Ten exploits that work reliably for all iPhone software versions and hardware models? One hundred exploits for a similar coverage? Thousands?
What is the value of one QUANTUMINSERT like “bug” that helps with further exploitation?
I suppose we might agree that thousands of bugs would be large? I think that you could probably do it with ten or twenty but that isn’t their M.O. from what I’ve seen.
From what little I’ve seen, I think it is fair to say that they’re sitting on exploits for nearly everything that they find interesting. “They” also leverage anything that helps them to further compromise systems. That is to say – a phone – as you point out – it is a security disaster. It has a baseband and all the nightmares that Ralf continues to dish up regularly. It has a web browser. It has tons of image parsers. It has well, you get the point. Every piece of software is buggy and every bug is worth something to such an attacker. They collect them all. And boy is that a story on its own.
I look forward to upcoming publications that will hopefully shed some light on the details of this topic. One minor nitpick – rarely does a publication actually release every source document. There are points in our stories that come from material that isn’t released – such as the fiber tapping evidence from our main story in the last issue. Please do not dismiss that as mere hand-waving or bullshitting – there are complex reasons for such disclosures to happen or not to happen.
I feel that the Der Spiegel catalog shows an example of what they have in store for the world; it shows things that previously were considered science fiction or spy folklore from a bygone era.
By the way: thanks for working in the open – I hope that you’ll continue to do so!
I think this discussion is getting too wide-ranging for blog comments.
My overall point is that I believe there are a lot of people that share your outrage with NSA’s subversive behavior and are doing everything they can to thwart it. Protecting technology and services against a nation-state adversary is extremely hard, and NSA success does not require active cooperation or mean you “write shitty software”. Again, that’s a false dichotomy.
Should Google and Yahoo have been encrypting their datacenter links? Yes, and they are working on that. But I wouldn’t go so far as to say that NSA success in tapping these two providers was probably due to active cooperation or they were incompetent for not doing so. Security is hard, and I tend to believe that there are many more that are working to improve it than those who would subvert their own users.
Somewhat similar to Jacob Appelbaum, I also tried to understand and analyse the Snowden-documents which were published over the last six months. About many aspects I wrote articles on my weblog, and in many cases it stated out that the press reports had exaggerated claims which were not or only partly supported by the original documents.
As for PRISM, it has become clear that it’s the Data Intercept Technology Unit (DITU) of the FBI which actually collects the data at the various internet companies. The companies will probably hand them over to DITU in different ways, but one thing that’s clear now, is that NSA has no “direc access” to Facebook, Google, Yahoo etc., as the initial claim in the papers was.
Another case which led to some grave misinterpretations, but which is less known in the US, is about the screenshots of the BoundlessInformant tool. Papers in various European countries published a screenshot from this tool, showing a chart which was interpreted by Glenn Greenwald as showing the amounts of data which NSA collected from/in that particular country. But comparing these screenshots with one another and taking a close look at some details, showed that these interpretations are probably not fully correct. I wrote about this here: http://electrospaces.blogspot.com/2013/11/screenshots-from-boundlessinformant-can.html
I suppose at this point, we’re arguing on the difference between “large” and “small” in this context of how many bugs they hoard for QUANTUM related programs!