API tools faq
paste
Advertisement
Guest User

gchqdox

a guest
Jun 22nd, 2016
725
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 69.16 KB | None | 0 0
raw download clone embed print report
  1. Preface
  2. When the Government, Telecommunications companies and Internet Service
  3. Providers, implant secret spying equipment in your home without your
  4. knowledge or consent under the guise of something else, then use that
  5. equipment to infect your computers and spy on your private network activity
  6. (not the internet), we believe you have a right to know.
  7. It is not possible to make these claims without actual proof and without
  8. naming the actual companies involved.
  9. These events coincide with the global surveillance systems recently disclosed
  10. and they further confirm the mass scale of the surveillance and how deeply
  11. entrenched the Governments are in our personal lives without our knowledge.
  12. The methods we disclose are a violation of security and trust. Good
  13. Information Security (InfoSec) dictates that when we discover such back
  14. doors and activity, we analyze, understand, publicize and fix/patch such
  15. security holes. Doing otherwise is morally wrong.
  16. What is revealed here is the missing piece to the global surveillance puzzle,
  17. that answers key InfoSec questions which include:
  18. How do the NSA/GCHQ perform Computer Network Exploitation?
  19. We reveal the actual methods used by the NSA/GCHQ and others that allows
  20. them to instantly peer into your personal effects without regard for your
  21. privacy, without your knowledge and without legal due process of law, thus
  22. violating your Human Rights, simply because they can.
  23. Disclosures
  24. The risks taken when such activity is undertaken is "Being Discovered" and
  25. the activity being "Publicly Exposed", as well as the "Loss of Capability".
  26.  
  27. ▶Anonymous 06/21/16 (Tue) 12:19:43 09d44b No.6407074
  28. >>6407070
  29. 6
  31. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  32. Source of this Information
  33. "The simple knowledge that we may be clandestinely observed in our own
  34. homes provided the determination to find the truth, which we did."
  35. This information is not the result of any knowledge of classified documents or
  36. leaks, but based on information in the public domain and our own fact finding
  37. mission due to Forensic and Network Analysis Investigations of private SOHO
  38. networks located in the UK.
  39. As we detail the methods used, you will see that information was uncovered
  40. fairly, honestly and legally and on private property using privately owned
  41. equipment.
  42. Our Laws
  43. There is no law that we are aware of that grants to the UK Government the
  44. ability to install dual use surveillance technology in millions of homes and
  45. businesses in the UK.
  46. Furthermore, there is no law we are aware of that further grant the UK
  47. Government the ability to use such technology to spy on individuals, families
  48. in their own homes on the mass scale that this system is deployed.
  49. If there are such hidden laws, the citizens of the UK are certainly unaware of
  50. them and should be warned that such laws exist and that such activity is
  51. being engaged in by their own Government.
  52. All of the evidence presented is fully reproducible.
  53. It is our belief that this activity is NOT limited to the UK.
  54.  
  55. ▶Anonymous 06/21/16 (Tue) 12:19:59 09d44b No.6407077>>6407080
  56. 7
  58. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  59. Companies
  60. BT are directly responsible for covertly embedding secret spy equipment in
  61. millions of homes and businesses within the UK as our evidence will
  62. demonstrate.
  63. BT have directly enabled Computer Network Exploitation (CNE) of all its
  64. home and business customers.
  65. Technical Nature of this Information
  66. The information described here is technical, this is because, in order to
  67. subvert technology, the attackers need to be able to fool and confuse experts
  68. in the field and keep them busy slowing them down, but regardless, the
  69. impact and effect can be understood by everybody.
  70. Your main take away from this disclosure is to understand conceptually how
  71. these attacks work, you can then put security measures in place to prevent
  72. such attacks.
  73.  
  74. ▶Anonymous 06/21/16 (Tue) 12:20:22 09d44b No.6407080>>6407086
  75. >>6407077
  76. 8
  78. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  79. Credibility of this Research
  80. We first made our discoveries in June 2013 and kept silent so that we could
  81. research the capabilities without being detected. As more Edward Snowden
  82. disclosures were published it became crystal clear that what we discovered is
  83. a major component of the surveillance system.
  84. Those who wish to discredit our evidence, feel free to do so, but do so on a
  85. technical level, simply claiming it "it's not true" or performing some social
  86. attack simply re-enforces it and identifies the "discreditor" as an agent of the
  87. NSA/GCHQ or an agent of the global surveillance system.
  88. Our evidence is based on public available UNMODIFIED firmware images.
  89. To verify our claims using UNMODIFIED images requires connecting a USB
  90. to serial port to the modem motherboard board which allows you to login
  91. (admin/admin) and verify yourself. As most people will find this difficult, we
  92. provided a link to third party MODIFIED images based on official BT release
  93. GNU source code that allow you to telnet to the device (192.168.1.1), this
  94. modified version includes the same backdoor. These can be found here:
  95. http://huaweihg612hacking.wordpress.com/
  96. and
  97. http://hackingecibfocusv2fubirevb.wordpress.com/
  98. The MODIFIED images have been publicly available since August, 2012, long
  99. before the Edward Snowden disclosures.
  100. The methods we published, allows confirmation without having to open the
  101. device. However if you are suspicious of the MODIFIED firmware from August
  102. 2012, simply connect to the USB serial port of your own existing unmodified
  103. modem and login to verify, either way the results will be the same.
  104.  
  105. ▶Anonymous 06/21/16 (Tue) 12:20:25 dd24c2 No.6407082>>6407087
  106. the <script src=""> tag breaks it
  107.  
  108. ▶Anonymous 06/21/16 (Tue) 12:20:39 09d44b No.6407086>>6407096
  109. >>6407080
  110. 9
  112. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  113. Privacy vs Security
  114. Loss of privacy is a breach of personal security and the legal violation of
  115. privacy is purely a consequence of that security loss.
  116. We've focused on the technical breach of security i.e. the Computer
  117. Network Exploitation itself and by fixing that you can restore at least some of
  118. your personal privacy.
  119. This illustrates that there is no such thing as a balance between security and
  120. privacy, you have them both or you have none.
  121. 10
  123. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  124. Motivation
  125. Motivation
  126. After studying in detail the revelations by the Edward Snowden, we realized
  127. there was a large missing part of the puzzle.
  128. There has been little to nothing published on specifically how the attackers
  129. technically achieve their goals. Most information published is based on
  130. theoretical situations.
  131. If we don't know how hackers actually achieve these security breaches, we
  132. cannot defend against such breaches.
  133. For example, a slide similar to the following was published, of all the slides
  134. released, it's uninteresting and easily dismissed, as it simply describes what is
  135. commonly known as a theoretical Man-In-The-Middle attack.
  136. The media focus of the slide is of course the Google's Servers, and your first
  137. thought might be, 'this is Google's problem to solve', but what if , 'Google
  138. Server' was 'My Banks Servers', you would probably be more concerned,
  139. because that may directly effect you.
  140. But we thought, what if, 'Google Server', was 'Any Server, Anywhere?'
  141. 11
  143. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  144. Our investigation led to us uncover, and understand how this attack really
  145. works in practice, how it is implemented and the hair-raising reality of its true
  146. nature and that is, this not just a back door, but an entire attack platform and
  147. distributed architecture.
  148. Terminology
  149. To ease explanation, we are going to use standard security terms from here
  150. on.
  151. Attacker - GCHQ, NSA, BT Group or any combination.
  152. The Hack ­ The technical method used by the attackers to illegally break into
  153. your home network computers and phones.
  154.  
  155. ▶Anonymous 06/21/16 (Tue) 12:20:39 dd24c2 No.6407087
  156. >>6407082
  157. sets off the 8ch block*
  158.  
  159. ▶Anonymous 06/21/16 (Tue) 12:21:03 09d44b No.6407096>>6407102
  160. >>6407086
  161. 12
  163. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  164. Basic Security
  165. Your Home Network
  166. In order to explain how these Computer Network Exploitation attacks work,
  167. and how this affects you personally, we must first look at the architecture of a
  168. typical home or office network. Look familiar to you?
  169. Most Internet connections consists of an DSL type modem and one or more
  170. Ethernet ports attached to the modem that you connect your computers,
  171. devices and add-on switches etc.
  172. There are two security factors in operation here:
  173. a) NAT based networking, meaning that your home computers are
  174. hidden and all share a single public IP address
  175. b) Your modem has a built-in firewall which is blocks inbound traffic. The
  176. inherent security assumption is that data cannot pass from the inbound
  177. DSL line to a LAN switch port without first being accepted or rejected by
  178. the built-in firewall
  179. 13
  181. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  182. For the technical minded, these security assumptions are further re-enforced
  183. if the modems software is open source e.g. using Linux and that its source
  184. code is freely and openly available as per the GNU GPL requirements.
  185. Given that the above is the most common architecture on the Internet as it
  186. applies to almost every home and office, everywhere, lets now revisit that first
  187. slide, but this time, we ask one simple question:
  188. How do the attackers get between You and Google or some other
  189. service?
  190. On closer inspection of the diagram you will notice that "Google Request"
  191. and the Attacker (Log into Router) share the same router, when this slide
  192. was released, we all assumed that this router was either Google's own router
  193. or some upstream router, that way the attacker could intercept packets and
  194. perform a Man-In-The-Middle (MITM) attack.
  195. However, this would not work for every website or service on the Internet.
  196. The attacker would need to be upstream everywhere!
  197. So where does the attacker hide? Where is this Common
  198. Router? again we ask:
  199. How do the attackers get between You and Google or
  200. some other service?
  201. Lets examine the diagram one last time.
  202.  
  203. ▶Anonymous 06/21/16 (Tue) 12:21:42 09d44b No.6407102>>6407107
  204. >>6407096
  205. 14
  207. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  208. You guessed it, it's right inside your house. It's the router
  209. supplied by your trusted Internet Service Provider (ISP).
  210. If this is true, it means that you are being Internet wiretapped, because the
  211. attacker has as entered your private property and unlawfully accessed your
  212. computer equipment.
  213. Unlike a lawful interception in which a warrant is served on the third party
  214. (ISP), the intercept happens at the ISPs property upstream and outside your
  215. property.
  216. This is happening in your home or office, without your knowledge, without
  217. your permission and you have not been served with a search warrant as is
  218. required law.
  219. But worse, is the fact that this architecture is designed for Cyber Attacking
  220. in addition to passive monitoring as we will detail next.
  221. 15
  223. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  224. The Hack
  225. The Hack
  226. This example is based on the UK version of what we are calling The Hack
  227. using BT Internet services. If you are not in the UK and regardless of the
  228. service, you should always assume that the exact same principles detailed
  229. here are always being used against you regardless of your country or ISP.
  230. The Hack is based on the fact that a second secret/hidden network and
  231. second IP address is assigned to your modem. Under normal use, you cannot
  232. detect or see this from your LAN, but the attacker has direct access to your
  233. modem and LAN in your house from the Internet.
  234. How it Works
  235. When the DSL connection is established a covert DHCP request is sent to a
  236. secret military network owned by the U.S. Government D.O.D. You are
  237. then part of that U.S. D.O.D. military network, this happens even before you
  238. have been assigned your public IP address from your actual ISP.
  239. This spy network is hidden from the LAN/switch using firewall rules and
  240. traffic is hidden using VLANs in the case of BT et al, it uses VLAN 301, but
  241. other vendors modems may well use different VLANs. The original slide has a
  242. strange number 242 with grey background, we think this represents the
  243. VLAN number/Vendor number so BT would be 301.
  244. This hidden network is not visible from your "Modem's Web Interface" and
  245. not subject to your firewall rules, also not subject to any limitations as far
  246. as the switch portion of your modem is concerned and the hidden network
  247. also has all ports open for the attacker.
  248. Other tools and services are permanently enabled inside the modem, which
  249. greatly aid the attacker, such as Zebra & Ripd routing daemons, iptables
  250. firewall, SSH remote shell server, along with a dhcp client.
  251. These tools allow the attacker to control 100% of the modem functionality
  252. from the Internet and in an undetectable manner. e.g., the attacker can
  253.  
  254. ▶Anonymous 06/21/16 (Tue) 12:22:21 09d44b No.6407107>>6407113
  255. >>6407102
  256. 16
  258. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  259. forward all your DNS requests to their private network, they can selectively
  260. route specific protocols, ports or networks or everything to their network and
  261. by default they do.
  262. Although the hidden network is owned by U.S. D.O.D., it is located within the
  263. UK as the ping time to the attacker's IP gateway is < 8ms from within the
  264. UK.
  265. This clearly demonstrates that the UK Government, U.S. Government, U.S.
  266. Military and BT are co-operating together to secretly wiretap all Internet
  267. users in their own homes (with few exceptions). The modems are provided by
  268. BT and locked down. If you cannot confirm otherwise, you must assume that
  269. all ISPs in the UK by policy have the same techniques deployed.
  270. Your home network actually looks something like the following diagram. To
  271. the right is the WHOIS record of the network our modems are automatically
  272. connected, yours may vary.
  273. The above hidden network is created automatically
  274. in all our test cases across a wide range of modems.
  275. It should be noted that even before your Point-to-Point over Ethernet (PPPOE)
  276. request is issued, this hidden network is already fully operational. So much
  277. so, that your LAN can be directly accessed even when you think your modem
  278. is off-line.
  279. This is an extremely complex and covert attack infrastructure and it's built
  280. 17
  282. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  283. right into your modems firmware which can also be updated remotely as
  284. required by the attacker using the built-in BTAgent.
  285. The Hack attack is turned on by default, but is selectively turned off for
  286. special purposes or specific dangerous customers, for example, for certain
  287. software, firmware and hardware developers/engineers (which may include
  288. you), so that these people don't discover The Hack.
  289. The attacker identifies these specific "threats" and marks their Internet
  290. connections as "NO DHCP", such that the same dhcpc requests from their
  291. telephone lines are ignored and while these requests are ignored, the hidden
  292. network will not appear inside their modem and is much harder to discover.
  293. Firmware engineers usually want to know if the modems are using Open
  294. Source software such as Linux and Busybox, in which case they are subject to
  295. the terms of the GNU Public License.
  296. These engineers as well as tech savvy users may wish to put their own
  297. software (e.g. OpenWRT) on these modems, maybe because they don't trust
  298. their ISP, but are prevented by their ISP for obscure reasons.
  299. Most modem providers usually violate copyright law by not releasing the
  300. source code and BT was no exception to this rule. Only by the threat of legal
  301. action did they release the source code. However, BT still prevents the
  302. modems from being updated by their customers or third parties.
  303. BT goes to extreme lengths to prevent anyone from changing the firmware,
  304. and those that come close are first subjected to Physical and Psychological
  305. Barriers explained later and the few that overcome that, are subjected to a
  306. separate NSA/GCHQ targeted Social Attack designed specifically to derail
  307. any engineering progress made, this is also explained later. These attacks are
  308. almost always successful.
  309. During these attacks, BT uses all the information discovered by the engineers
  310. to produce firmware updates that prevent anyone else using those same
  311. techniques under the guise of security and protecting the customer and this is
  312. performed without notice to any customers.
  313. As we move to new generations of hardware, the modems are very
  314.  
  315. ▶Anonymous 06/21/16 (Tue) 12:23:24 09d44b No.6407113>>6407119
  316. >>6407107
  317. As we move to new generations of hardware, the modems are very
  318. 18
  320. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  321. sophisticated and very covert, the engineers capable of even attempting to
  322. replace the firmware become practically non-existent.
  323. As we detail, the sole purpose of locking the modem is to prevent people
  324. discovering that they are actually being wiretapped by BT on behalf of
  325. NSA/GCHQ.
  326. As a side note NSA describe Linux/Open Source as Indigenous and a SIGINT target.
  327. NSA documents, describe this means of SIGINT collection as:
  328. Others include:
  329. and
  330. 19
  332. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  333. Your Real Network
  334. Your Real Network
  335. The following is a more realistic view of your home network and what is now
  336. possible, given the attacker now has secret access to your home LAN.
  337. It is now a simple matter to use other tools and methods available to the
  338. attacker to penetrate your internal computers, this includes:
  339. · Steal private VPN/SSH/SSL/PGP keys ·Steal content as required
  340. · Infect machines with viruses ·Access Corporate VPNs
  341. · Install key loggers ·Clean up after operations
  342. · Install screen loggers ·Route traffic on demand (e.g. MITM)
  343. · Clone/destroy hard drives ·Censorship and Kill Switch
  344. · Upload/destroy content as required ·Passive observation
  345. 20
  347. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  348. The Attacks
  349. The Attacks
  350. This section lists the attacks on you that are now possible by the NSA/GCHQ.
  351. Later, we show how you can defend against these attacks and it would be wise
  352. to implement our defenses with immediate effect.
  353. Unlike the revaluations so far by Snowden where the attacks occur out there
  354. somewhere on the Internet, these attacks happen in your home/office.
  355. The attacks listed are the most obvious attacks, some are mentioned in
  356. Edward Snowden revelations and referred to as Computer Network
  357. Exploitation (CNE).
  358. Internal Network Access
  359. The attacker has direct access to your LAN and is inside your firewall.
  360. Your modem acts as a server, it listens on lots of ports such as SSH (22) and
  361. TELNET (23), so the attacker can just hop on to it (but you cannot).
  362. This is possible because another hidden bridged interface exists with its own
  363. VLAN. Firewall rules do not apply to this interface, so the attacker can see
  364. your entire LAN and is not subject to your firewall rules because those rules
  365. apply to the BT link (black line) not the attackers link (red lines).
  366. When you scan your BT Public IP address from outside, you may well only see
  367. port 161 open (BTAgent, more on this later), but when scanned from the
  368. attackers network, all necessary ports are open and with an SSH daemon
  369. running (even the username and password are the basic admin:admin).
  370. Basically the attacker is inside your home network, and ironically, in most
  371. cases, right behind your actual curtain (where the modems are usually
  372. located).
  373. This is the digital version of Martial Law with a Cyber Attack Soldier in every
  374. home in the country.
  375. The first task of the attacker is to perform a site survey and learn as much as
  376.  
  377. ▶Anonymous 06/21/16 (Tue) 12:23:44 09d44b No.6407119
  378. >>6407113
  379. 21
  381. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  382. possible about all the devices attached to your network.
  383. All your hardware can be identified by the specific MAC addresses and then
  384. fingerprinted for specific protocols and software versions. All this cannot be
  385. detected unless you are logged into your locked modem.
  386. The above is just the base platform of the NSA/GCHQ from which hundreds of
  387. types of attacks are now possible, which now include all of the following:
  388. Man-In-The-Middle Attack
  389. The attacker controls all outbound routes, he can easily perform an HTTPS
  390. Man-In-The-Middle attack by forwarding specific traffic for port 443 or
  391. destination network to a dedicated MITM network which he controls (as per
  392. previous slides).
  393. The only thing required is a valid SSL certificates + keys for a specific domain
  394. (which he already has, see below), The attacker is between you and any
  395. site you visit or any service you use (not just websites). e.g. Skype, VOIP, SSH
  396. etc.
  397. The attacker simply creates a static route or more easily publishes a Routing
  398. Information Protocol Request (RIP) request to the Zebra daemon running in
  399. the router for the target network address and your traffic for that network
  400. will then be routed to the attackers network undetectable by you.
  401. The attacker can then use asymmetric routing and upon examination of the
  402. requests he can filter specific requests he is interested in and respond to
  403. those, but let the target website server or service respond to everything else.
  404. The key here, is, traffic from the target website back to the user does not
  405. then have to go via the attackers hidden network, it can go directly back to
  406. users public IP (which would be logged by the ISP).
  407. MITM can be on any port or protocol not just HTTPS (443), for example your
  408. SSH connections, all UDP or GRE, PPTP, IPSec etc. or any combination of
  409. anything.
  410. 22
  412. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  413. All SSL Certificates Compromised in Real-Time
  414. The security of Public Key Infrastructure (PKI) is based primarily on the
  415. security of the owners private keys. These private keys are not necessarily
  416. required in order to perform a MITM attack.
  417. All that is required is an actual duplicate signed certificate using NSA/GCHQ
  418. own private keys. The MITM attack can be as simple as running a transparent
  419. proxy and you will always see a valid certificate but unable to detect the
  420. attack.
  421. At the point of the proxy all your traffic is decrypted in real-time, at which
  422. point targeted packet injection can occur or simply monitored.
  423. It makes perfect sense that the trusted Certificate Authority (CA) actually
  424. make a second duplicate SSL certificate with a separate set NSA provided
  425. private keys, as the CA never sees the real certificate owners private keys.
  426. When you send your Certificate Signing Request (CSR) and order your SSL
  427. Certificate, a duplicate signed certificate is then automatically sent to the
  428. NSA and stored in their "CES Paring database" as per Snowden releases.
  429. We must therefore assume that NSA/GCHQ already have a duplicate of every
  430. PKI certificate+key (key different from yours).
  431. This means as soon as you revoke or renew your certificate, the NSA is ready
  432. and waiting again, allowing them to do real-time decryption on almost any
  433. site anywhere across any protocol that uses PKI.
  434.  
  435. 23
  437. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  438. Theft of Private Keys
  439. Home networks are usually very insecure, mainly because only you or family
  440. use them, your guard is down and your SSH, VPN, PGP, SSL keys are all
  441. vulnerable to theft by the attacker and his available methods.
  442. The Hack is the key mechanism that enables these thefts.
  443. As an example of the above, if you use the modems built-in VPN feature, you
  444. usually add your certificate and private key to the modem or generate them
  445. both via its web interface, at some later time, the attacker can just copy
  446. these keys to the "CES Pairing database" via his private network, the data
  447. collected from SIGINT can later be decrypted off-line or in real-time.
  448. In the case of keys extracted from the modems built-in VPN, the "CES Paring
  449. database" now contains the real key/cert pair, meaning the attacker can now
  450. attack the VPN server environment directly when that server would have not
  451. being exploitable otherwise.
  452. The attacker can also mask as the genuine user by performing the server
  453. attack from within the users modem (using the correct source IP address),
  454. this way nothing unusual will appear in the VPNs logs. Once inside the
  455. parameter of the VPN server the cycles repeats.
  456. You should assume that all "Big Brand" VPNs and routers use the exact same
  457. attack strategy and architecture with variances in the specific implementation
  458. e.g. Big Brand supports IPSec, Little Brand supports PPTP.
  459. The NSA Bullrun Guide states:
  460. "The fact that Cryptanalysis and Exploitation Services (CES) works with
  461. NSA/CSS Commercial Solutions Center (NCSC) to leverage sensitive,
  462. cooperative relationships with specific industry partners".
  463. Specific implementations may be identified by specifying Equipment
  464. Manufacturer (Big Brand/Make/Model), Service Provider (ISP) or Target
  465. Implementation (specific modem/router implementation).
  466. In this disclosure, we are interested in "Target Implementation", because in
  467. our example case, BT has covertly implanted these devices in homes where
  468. there is an absolute expectation of privacy, whereas the other
  469. implementations exist within the ISP or large corporations in which you
  470. cannot expect privacy.
  471. It's important to remember that "Big Brands" also make small SOHO DSL and
  472.  
  473. ▶Anonymous 06/21/16 (Tue) 12:24:51 09d44b No.6407130
  474. 24
  476. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  477. cable modems.
  478. Further evidence of the mass global distribution of this technology to at least
  479. the 14 Eyes: USA, GBR, CAN, AUS, NZL, FRA, DEU, DNK, NLD, NOR, ESP,
  480. ITA, BEL, SWE and almost certainly many more countries:
  481. Quote from GCHQ regarding their ability to steal your private keys:
  482. It is imperative to protect the fact that GCHQ, NSA and their Sigint
  483. partners have capabilities against specific network security technologies
  484. as well as the number and scope of successes. These capabilities are
  485. among the Sigint community's most fragile, and the inadvertent
  486. disclosure of the simple "fact of" could alert the adversary and result in
  487. immediate loss of the capability.
  488. Consequently, any admission of "fact of" a capability to defeat encryption
  489. used in specific network communication technologies or disclosure of
  490. details relating to that capability must be protected by the BULLRUN
  491. COI and restricted to those specifically indoctrinated for BULLRUN.
  492. The various types of security covered by BULLRUN include, but are not
  493. limited to, TLS/SSL, https (e.g. webmail), SSH, encrypted chat, VPNs
  494. and encrypted VOIP.
  495. And
  496. Reports derived from BULLRUN material shall not reveal (or imply) that
  497. the source data was decrypted. The network communication technology
  498. that carried the communication should not be revealed.
  499. From the NSA:
  500.  
  501. ▶Anonymous 06/21/16 (Tue) 12:26:03 09d44b No.6407148
  502. 25
  504. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  505. The Kill Switch
  506. Actual capabilities uncovered here include the actual ability to apply physical
  507. censorship on the Internet by governments directed at individuals, groups,
  508. companies, entire countries or the majority of the users of the Internet at
  509. once (given a coordinated government agreement). This is something that can
  510. be turned on globally within minutes.
  511. This "kill switch" is only a small portion of the total capabilities available that
  512. are in place right now. Essentially, any operation that can be applied using a
  513. single firewall or RIP router, can be applied to every customer at once.
  514. Uploading/Download Content
  515. The attacker can upload or download content via either your public ISPs
  516. network or via his private hidden network. The differences is that your ISP
  517. could confirm or deny from their logs the user did or did not upload/download
  518. content from/to a particular source.
  519. In other words, the possibilities and ability to frame someone cannot ever be
  520. overlooked.
  521. When the attackers steal content, that information always travels via the
  522. private network.
  523. Hacking in to a VOIP/Video Conferences in Real-Time
  524. As an example, it's a trivial matter for the attacker to route specific traffic for
  525. specific media protocol such as VOIP (SIP/H.323/RTSP) etc. to his network in
  526. real-time these protocols are usually not encrypted so no key theft is required.
  527. In the case of Skype, it's no stretch of the imagination to assume that
  528. Microsoft handed over the keys on day one.
  529. Those they do not redirect in real-time as we know, will be collected via
  530. upstream SIGINT.
  531. 26
  533. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  534. Tor User/Content Discovery
  535. Users of the Tor network can easily be discovered by LAN packet
  536. fingerprinting, but also by those who download the Tor client. The attacker
  537. can stain packets leaving your network and before entering the Tor network,
  538. making traffic analysis much easier than was previously known.
  539. All Tor traffic can be redirected to a dedicated private Tor network
  540. controlled by the attacker, in this way the attacker controls ALL Tor nodes
  541. and so can see everything you do from end-to-end.
  542. This is not something the Tor project can fix, it can only be fixed by the user
  543. following our methods.
  544. Tor hidden services should drop all traffic from un-trusted Tor nodes, this way
  545. clients running in the simulated Tor network will fail to connect to their
  546. destination.
  547. Encrypted Content
  548. The attacker is in your network and has all the tools necessary (such as
  549. operating system back doors) or zero day vulnerabilities to hack into your
  550. computers and steal your VPN, PGP, SSH keys as well as any other keys they
  551. desire. Also, content that is encrypted can be captured before encryption via
  552. any number of methods when the attacker is already inside your network.
  553. Covert International Traffic Routing
  554. The attacker can secretly route your traffic to the U.S. without your
  555. permission, consent or knowledge thus by passing any European data
  556. protection or privacy laws.
  557. Activists
  558. We have seen many activist groups, protest organizers identified and silenced
  559. over the few years, we believe this is the primary method used to capture
  560. activists. Knowing the victims ISP would indicate which ISPs are involved.
  561. Destroy Systems
  562. Released documents state that the U.S. Cyber Command have the ability to
  563. disable or completely destroy an adversaries network and systems, the first
  564. step to this would be to penetrate the adversaries network firewall making
  565. secondary steps much easier.
  566.  
  567. ▶Anonymous 06/21/16 (Tue) 12:26:05 dd24c2 No.6407149
  568. >>6406589
  569. This "pdf" is actually an html file.
  570.  
  571. ▶Anonymous 06/21/16 (Tue) 12:26:18 09d44b No.6407152
  572. 27
  574. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  575. Censorship
  576. The attacker has control of the hidden firewall, it is easy for the attacker to
  577. simply block traffic based on specific ports or based on destination address or
  578. network route, for example, the government can block port 8333 at source
  579. and therefore block all Bitcoin transactions.
  580. A coordinated attack on the Bitcoin network is possible by blocking ports of
  581. Minors around the world. Reducing the hash rate and blocking transactions.
  582. Mobile WIFI Attacks
  583. Mobile devices phones/tablets etc, are as easily accessible once they connect
  584. to your WIFI network which is, from the attackers perspective, just another
  585. node on the your LAN that the attacker can abuse.
  586. The level of sophistication or advanced encryption in use by your WIFI is no
  587. defense because the attacker has gained a trusted position in your network.
  588. All MAC addresses gathered from your LAN are stored in the XKEYSCORE
  589. database so they can be used to identity specific devices and specific
  590. locations, allowing the attacker to track you without the aid of GPS or where
  591. no GPS signal exists.
  592. Document Tracking
  593. Microsoft embeds the physical MAC addresses of the computer inside
  594. documents it creates. This allows the source of a document to be identified
  595. easily. The following is from the XKEYSCORE PowerPoint.
  596. 28
  598. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  599. The Mobile Hack
  600. 2G/3G/4G Mobile Attacks
  601. Given the NSA/GCHQ plan to spy on "any phone, anywhere, any time".
  602. The Hack detailed in this document is a carrier independent method to
  603. achieve that goal that works very well. The attacker will almost certainly re-
  604. use the same strategy for all Mobile phones or wireless broadband devices.
  605. Your mobile phone (2G/3G/4G) is almost certainly subject to this same attack
  606. architecture because from the attackers perspective, his side of the
  607. infrastructure would remain the same regardless of device being attacked.
  608. A mobile phone these days is simply a wireless broadband modem + phone,
  609. so any encrypted messaging system for example can be captured before
  610. encryption. Therefore mobile phones are subject to all the same and many
  611. more attacks as per The Hack.
  612. This would mean that mobile phone makers may well be in collusion with the
  613. NSA/GCHQ because they would need to implement the equivalent routing
  614. and firewall ability in each mobile phone as part of the OS if it was to remain
  615. hidden.
  616. The mobile phone version of The Hack is also much more difficult to detect
  617. than the broadband version. Mobile phones make more use of IPv6 and the
  618. overall complexity of IPv6 means that even experts may not know what they
  619. are looking at in the routing tables even if they could see them. Carriers often
  620. have multiple IPs for different services they provide.
  621. Even top-up mobile phones without any credit can be accessed, for example,
  622. the mobiles phones top-up services are always available and their DNS
  623. servers are always accessible regardless of your top-credit state.
  624. Modern kernels use multiple routing tables (e.g. ip rule show) for policy based
  625. routing, so again unless you confirm who owns a specific IP6 range, it will be
  626. difficult to spot, especially as firmware hackers are not even looking for such
  627. back doors. Maybe now they will.
  628. We do not provide defense methods for Mobile Phones at this time.
  629.  
  630. ▶Anonymous 06/21/16 (Tue) 12:26:35 09d44b No.6407158
  631. 29
  633. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  634. Basic Defense
  635. Basic Defense
  636. Knowing how you are being attacked is half the battle, but in this case, due to
  637. the attackers abuse of a privileged position and the fact that the attacker is
  638. your own government and its foreign partners, defense is much more difficult,
  639. compared to a common virus, worms or hackers.
  640. One of the best defenses is to take Legal action against BT or your ISP.
  641. If you are serious about your privacy, don't expect any help from your
  642. attackers (as attackers never help their victims). You must ensure your own
  643. privacy. Before we explain practical defenses, here are some good tips.
  644. Secure your end-points
  645. · Never ever trust ISP supplied equipment (e.g. router, firewall, STBs),
  646. always consider such devices as hostile and position them in your
  647. network architecture accordingly i.e. in the Militarized Zone (MZ)
  648. · Do not use any built-in features of ISP equipment (e.g. Firewalls, VPNs)
  649. · Never ever trust a device that has any closed source firmware or other
  650. elements, regardless of the excuses the your attacker gives you
  651. · Never trust a device that you cannot change the firmware yourself,
  652. regardless of "big brand" names
  653. · Disable all protocols that you don't use or don't understand, especially
  654. TR-069 and any other Remote Management features, these are all part of
  655. the surveillance control system (e.g. BTAgent firmware update)
  656. · Always use a second Linux firewall which you control, that you have built
  657. · Control all your NAT on your second Linux firewall not the ISPs supplied
  658. router
  659. · Make sure you control all end-points whenever possible
  660. · Ensure that 100% of packets UDP/TCP (e.g. including DNS) are
  661. encrypted leaving your second firewall (this is the key to end-point
  662. security), this requires using Outbound Defense method described
  663. later
  664. · Always use a VPN and remote proxy that you control or trust, disable
  665. logging altogether to protect privacy. This requires using Outbound
  666. Defense method described later
  667. 30
  669. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  670. Inbound Defense
  671. Inbound Defense
  672. This defense method against most NSA/GCHQ Inbound attacks is fairly easy
  673. to implement and not too technical, everybody at a minimum should include
  674. this method in their defense strategy.
  675. The strategy will only prevent NSA/GCHQ from hacking into your home/office
  676. LAN. It cannot prevent other direct attacks because the attacker can still
  677. intercept and route all packets leaving your property.
  678. A second Linux firewall device (blue) that you control and manage is
  679. placed in front of the ISP router effectively placing the ISPs router in the
  680. Militarized Zone (MZ) i.e. the Internet. A single cable (red) is used to link the
  681. LAN of the ISP router to the Internet LAN port of the Linux firewall.
  682. Block all inbound access including multicast packets from the ISP router, run
  683. DHCP and NAT on your Linux firewall.
  684. Your second firewall can then issue PPPOE requests via its Internet port and
  685. create a local ppp0 device which will be its new Internet connection. All
  686. packets leaving the firewall will now be PPPOE encapsulated.
  687.  
  688. ▶Anonymous 06/21/16 (Tue) 12:26:46 09d44b No.6407160
  689. 31
  691. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  692. Outbound Defense
  693. Outbound Defense
  694. This defense method should be used against all NSA/GCHQ Inbound and
  695. Outbound attacks. This is the only sure fire method to protect Tor clients.
  696. This defense requires that you (control/own/rent) a Server or VM elsewhere
  697. on the Internet (far away from your ISP) and preferably in a different country.
  698. Run a VPN such as OpenVPN between your Linux Firewall (blue) and the
  699. your VPS server (green cloud), there, you run Squid Proxy and DNS and
  700. block all inbound access except from your VPN. Always run your own DNS
  701. service on your VM/Server.
  702. 32
  704. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  705. An alternative short-term defense is to use OpenWRT router software that
  706. you install into the modem yourself so that you can confirm no hidden
  707. networks or IP addresses exists and that the firewall actually functions.
  708. However, this is technically impossible for must users.
  709. For open source router software visit https://openwrt.org/
  710. More Defense Tips
  711. · Isolate your WIFI from your LAN and limit by MAC address + strong
  712. passwords alternatively, Isolate your WIFI from your LAN and leave it
  713. open as a free hot-spot.
  714. · If you are capable, install your own router firmware (openwrt)
  715. · Tell your ISP you do NOT want a router with back doors or malware in it,
  716. ask them to confirm in writing that back doors do not exist, this will help
  717. you in court when suing them
  718. · Stop using any operating systems that is known to contain back doors
  719. · Only use Tor if you are using Outbound Defense method, otherwise you
  720. could be using a NSA/GCHQ wonderland version of the Tor network
  721. · It cannot be emphasized enough, never trust closed source routers
  722. · Never use your ISP DNS servers
  723. 33
  725. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  726. MITM Defense
  727. MITM Defense
  728. Until now, it was not fully understood how a MITM actually worked with
  729. regard to how the attacker could get in the middle of any connection.
  730. Now we know with 100% confidence that the man is not in the middle, but in
  731. the modem and that's how any individual can be subjected to MITM attack.
  732. We hereby rename this attack Man-In-The-Modem attack.
  733. As an alternative defense for the future in place of the previous (admittedly
  734. complex outbound defense), you could use TcpCrypt. You can prevent this
  735. attack by ensuring that your client and servers are running TcpCrypt, which is
  736. a TCP protocol extension. It works without any configuration and
  737. automatically encrypts TCP connections if both server and client support it or
  738. it will fall back to no encryption. It's also 100% NAT friendly.
  739. Once installed, this works for any port not just port 80, it will also protects
  740. HTTPS, SMTP, SSH and every other service.
  741.  
  742. ▶Anonymous 06/21/16 (Tue) 12:27:07 09d44b No.6407167>>6407171
  743. >>640716034
  745. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  746. TCPCRYPT
  747. TCPCRYPT
  748. TcpCrypt is a very secure approach to many of the problems posed by the
  749. NSA/GCHQ because its true native end-to-end encryption and does not
  750. require a certificate authority and is free open source software.
  751. The NSA have tried to kill this project a number of times and will continue to
  752. do so or limit its use, you must not let that happen.
  753. Let's get all TCP connections
  754. Encrypted by default!
  755. Available now free open source for Linux, Windows and OSX visit:
  756. http://www.tcpcrypt.org/
  757. Kernel Developers - please support
  758. TcpCrypt Kernel Module
  759. If you would like to see how NSA and GCHQ agents try to kill projects like
  760. this in public, view the video http://www.tcpcrypt.org/talk.php and go to
  761. 26:22 and hear the voice of the NSA and then GCHQ.
  762.  
  763. ▶Anonymous 06/21/16 (Tue) 12:27:25 09d44b No.6407171
  764. >>6407167
  765. 35
  767. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  768. Frequently Ask Questions
  769. Why Full Disclosure?
  770. We are under no obligation to withhold this information from citizens of
  771. Europe, specifically we are not subject to any provisions of the Official
  772. Secrets Act of 1998 as we have never been:
  773. · a member of the security and intelligence services
  774. · a Crown servant or a government contractor
  775. But more importantly because:
  776. · This information was discovered on private property
  777. · As security conscious users of the Internet, we identified serious
  778. intentional security flaws which need to be fixed, and fast
  779. · The needs of the many outweigh the needs of the few
  780. · Under the rule of law, the truth is an absolute defense and that is what
  781. we present here
  782. · lastly, Because we can
  783. Who should read this information
  784. The intended audience is citizens of Europe, but anyone who is or could be a
  785. victim of global surveillance systems, this includes everybody in the world
  786. now and in the future.
  787. Why does this document exist
  788. When a person(s) or government takes away your inalienable rights such as
  789. your Right to Privacy (especially in your own home), you take it back. This is
  790. not something that can be negotiated or traded.
  791. What about the debate, the balance?
  792. There is no such thing as a balance between privacy and security, you either
  793. have them both or you have none.
  794. I'm an American, does this apply to me
  795. The NSA would only use this technique in the U.S. if they really thought they
  796. could go undetected. In the UK they have gone undetected until now (since
  797. 2011, as evidenced by the date of the firmware), you should assume that the
  798. U.S. is doing the same to all Americans and you should use the defenses as
  799. detailed herein as a precaution. We can turn off the lights ourselves.
  800. 36
  802. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  803. Will stopping BTAgent software stop these Attacks
  804. No. BTAgent is just misdirection. It is not required or directly used in the
  805. attacks. It can be used to update the firmware of a target modem should the
  806. attacker need specific functionality on the modem, but this would be
  807. unusual. So, killing BTAgent is does not help (you should kill it anyway).
  808. Is it possible that BT is unaware of this
  809. No, this is their firmware, controlled by BT, publish by BT, updated by BT,
  810. they also lock the modems.
  811. My equipment is completely different?
  812. The Hack is an NSA/GCHQ Global Strategy and its architecture is
  813. independent of a specific make or model of modem or mobile phone, it is also
  814. independent of the method transport e.g. dial-up vs. ADSL, DOCSIS, VDSL,
  815. Cable modem etc.. It sits at the top of the stack (TCP/UDP etc), so however
  816. you connect, it connects. Each implementation will vary and improve with
  817. each generation.
  818. You should only use, fully open source, firmware that is publicly verified.
  819. I've never done anything wrong
  820. Yes you have, you have allowed hackers to enter your home network and plant
  821. malware that infects your computers, which may now have become part of a
  822. zombie army with tentacles controlled by the NSA/GCHQ. This is worst than
  823. any virus or worm you can imagine.
  824. How can I verify this myself
  825. Following the instructions in the following sections, you can also create
  826. simulations off-line, but that is more technical.
  827. I would like to donate and support your work
  828. Thank you, please see the last page of this document for details.
  829.  
  830. ▶Anonymous 06/21/16 (Tue) 12:28:01 09d44b No.6407185>>6407190
  831. >>6407175
  832. 37
  834. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  835. How you can verify
  836. The following section explains how you can confirm that your modem has the
  837. GCHQ/NSA back door.
  838. In these examples, we use two BT OpenReach white modems, (but more
  839. accurately described as BT OverReach) models:
  840. Huawei EchoLife HG612 and ECI B-FOCuS VDSL2 modem.
  841. These two look almost identical. The HG612 is an earlier model.
  842. The process of confirmation is slightly different for each modem.
  843. We will show two of ways to verify the back door, the first is something
  844. anyone can do and requires just the ping command. The second requires re-
  845. flashing the firmware so you can login to the modem itself.
  846. Claims of Huawei modems (Left) having back-doors are false, the vendor
  847. (e.g. BT) build and install the OS for these modems. Huawei simply
  848. provided hardware. ECI Telecom Ltd, is the provider of the second modem
  849. (Right) ­ the more dangerous of the two.
  850. 38
  852. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  853. Easy Confirmation
  854. Step 1. Remove Power from the modem and disconnect the telephone line.
  855. Step 2. On your PC (assumed Linux) add an IP address 192.168.1.100 i.e:
  856. # ifconfig eth0:1 192.168.1.100 up
  857. Step 3. Start to ping 192.168.1.1 from your PC i.e:
  858. # ping 192.168.1.1
  859. Step 4. Connect a network cable to LAN1
  860. Step 5. Plug-in the power cable to the modem and wait for about 30 seconds
  861. for the device to boot, you will then notice:
  862. 64 bytes from 192.168.1.1: icmp_seq=115 ttl=64 time=0.923 ms
  863. 64 bytes from 192.168.1.1: icmp_seq=116 ttl=64 time=0.492 ms
  864. 64 bytes from 192.168.1.1: icmp_seq=117 ttl=64 time=0.514 ms
  865. You may notice up to ten responses, then it will stop.
  866. What is happening is the internal Linux kernel boots, the start up scripts then
  867. configure the internal and virtual interfaces and then turn on the hidden
  868. firewall at which point the pings stop responding.
  869. In other words, there is a short window (3-10 seconds) between when the
  870. kernel boots and the hidden firewall kicks in.
  871. You will not be able to detect any other signs of the hidden network without
  872. actually logging into the modem, which is explained in the next section.
  873.  
  874. ▶Anonymous 06/21/16 (Tue) 12:28:25 09d44b No.6407190
  875. >>6407185
  876. 39
  878. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  879. Hard Confirmation
  880. Method 1: (no firmware modification required)
  881. For this method, you need to connect a USB to serial port to the serial port
  882. pins on the modem motherboard as detailed here:
  883. http://hackingecibfocusv2fubirevb.wordpress.com/
  884. If you are unable to use this method because it requires opening the modem,
  885. please use method 2.
  886. Method 2: (public firmware modification required)
  887. For this method, you will need to re-flash the modem by following the
  888. instructions in the document called hg612_unlock_instructions_v1-3.pdf
  889. which is available from:
  890. http://huaweihg612hacking.files.wordpress.com/2011/11/hg612_unlock_instru
  891. ctions_v1-3.pdf
  892. Or you can navigate to: http://huaweihg612hacking.wordpress.com/
  893. and click "Unlocked Firmware Images for Huawei HG612" on the right
  894. panel.
  895. Once you have re-flashed your modem, you will be able to login to the modem
  896. via telnet as follows.
  897. Note: If your network is not 192.168.1.0, you will need to add the IP address
  898. to your PC as explained previously, i.e.
  899. # ifconfig eth0:1 192.168.1.100 up
  900. # telnet 192.168.1.1, then login
  901. # Username: admin, Password: admin
  902. # then type: shell to get the BusyBox shell prompt.
  903. Your telephone line (RJ11) cable should remain disconnected.
  904. To prevent your devices firmware from being updated, disable the following
  905. components, as they are not required for confirmation.
  906. Kill the pid of the /bin/sh /BTAgent/ro/start (See UN-Hack later)
  907. # kill pid
  908. # killall tftpd sshd MidServer btagent
  909.  
  910. ▶Anonymous 06/21/16 (Tue) 12:28:40 09d44b No.6407194>>6407197
  911. 40
  913. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  914. You will be surprised to learn there exists 16 network interfaces inside the
  915. device, most are legitimate, but others are part of The Hack.
  916. All IP + MAC addresses have been redacted to protect victims identities.
  917. # ifconfig a
  918. br0 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2 <redacted MAC address
  919. inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
  920. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  921. br1 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  922. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  923. dsl0 Link encap:UNSPEC HWaddr 00000000000000000000000000000000
  924. [NO FLAGS] MTU:0 Metric:1
  925. eth0 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  926. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  927. eth0.2 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  928. BROADCAST MULTICAST MTU:1500 Metric:1
  929. eth0.3 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  930. BROADCAST MULTICAST MTU:1500 Metric:1
  931. eth0.4 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  932. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  933. eth0.5 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  934. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  935. imq0 Link encap:UNSPEC HWaddr 00000000000000000000000000000000
  936. UP RUNNING NOARP MTU:16000 Metric:1
  937. 41
  939. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  940. imq1 Link encap:UNSPEC HWaddr 00000000000000000000000000000000
  941. UP RUNNING NOARP MTU:16000 Metric:1
  942. imq2 Link encap:UNSPEC HWaddr 00000000000000000000000000000000
  943. UP RUNNING NOARP MTU:16000 Metric:1
  944. pktcmf_sa Link encap:UNSPEC HWaddr FEFFFFFFFFFFFFFF0000000000000000
  945. UP NOTRAILERS RUNNING NOARP MTU:0 Metric:1
  946. pktcmf_sw Link encap:UNSPEC HWaddr FEFFFFFFFFFFFFFF0000000000000000
  947. UP NOTRAILERS RUNNING NOARP MTU:0 Metric:1
  948. ptm1 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A2
  949. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  950. ptm1.101 Link encap:Ethernet HWaddr 10:C6:1F:C1:27:A2
  951. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  952. ptm1.301 Link encap:Ethernet HWaddr 10:C6:1F:C1:25:A3
  953. UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
  954. 42
  956. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  957. Lets examine the routing table:
  958. # route n
  959. Kernel IP routing table
  960. Destination Gateway Genmask Flags Metric Ref Use Iface
  961. 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
  962. # ip route show
  963. 192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1
  964. # netstat n
  965. Active Internet connections (w/o servers)
  966. Proto RecvQ SendQ Local Address Foreign Address State
  967. tcp 0 0 192.168.1.1:23 192.168.1.100:57483 ESTABLISHED # telnet
  968. tcp 0 0 127.0.0.1:2600 127.0.0.1:33287 ESTABLISHED # Z>rip
  969. tcp 0 0 127.0.0.1:33287 127.0.0.1:2600 ESTABLISHED # rip>Z
  970. Active UNIX domain sockets (w/o servers)
  971. Proto RefCnt Flags Type State INode Path
  972. unix 3 [ ] STREAM CONNECTED 766 /var/BtAgentSocket # SPIES Socket
  973. Lets see what processes are running: (duplicate and uninteresting lines
  974. remove for brevity)
  975. # ps
  976. PID Uid VSZ Stat Command
  977. 1 0 336 S init
  978. 101 0 SW [dsl0]
  979. 116 0 SW [eth0]
  980. 127 0 504 S mc
  981. 131 0 380 S /bin/msg msg
  982. 136 0 1124 S /bin/dbase
  983. 146 0 1680 S /bin/cms
  984. 147 0 1148 S /bin/cwmp
  985. 191 0 328 S zebra f /var/zebra/zebra.conf
  986. 193 0 332 S ripd f /var/zebra/ripd.conf
  987. 548 0 396 S dhcpc i ptm1.301 I ptm1.301 <HELLO?
  988. 552 0 504 S monitor
  989. 570 0 348 S dnsmasq conffile=/var/dnsmasq.conf
  990. 733 0 248 S tftpd p 69
  991. 741 0 292 S sshd E < HELLO?
  992. 762 0 1136 S MidServer
  993. 766 0 380 S /bin/sh /BTAgent/ro/start
  994. 780 0 832 S ./btagent
  995. All looks innocent at first. Now, lets plug-in the telephone line cable and wait
  996. few seconds:
  997.  
  998. ▶Anonymous 06/21/16 (Tue) 12:29:02 09d44b No.6407197
  999. >>6407194
  1000. 43
  1002. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1003. NOTE: We have redacted some IP addresses assigned to us by the attacker
  1004. xx = redacted address.
  1005. # route n
  1006. Kernel IP routing table
  1007. Destination Gateway Genmask Flags Metric Ref Use Iface
  1008. 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
  1009. 30.150.xx.0 0.0.0.0 255.255.xxx.0 U 0 0 0 ptm1.301
  1010. 0.0.0.0 30.150.xx.1 0.0.0.0 UG 0 0 0 ptm1.301 <Default?
  1011. # ip route show
  1012. 192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1
  1013. 30.150.xx.0/21 dev ptm1.301 proto kernel scope link src 30.150.xx.xx
  1014. default via 30.150.xx.1 dev ptm1.301
  1015. We have a new IP address on VLAN 301, this is before any computers are
  1016. connected and before the PPPOE discover command has been issued from the
  1017. LAN connected Hub or PC. The default route sends all traffic to the
  1018. attacker by default @ 30.150.xx.1
  1019. How close is the attacker? very close, < 8ms
  1020. # ping 30.150.xx.1
  1021. PING 30.150.xx.1 (30.150.xx.1): 56 data bytes
  1022. 64 bytes from 30.150.xx.1: seq=0 ttl=64 time=7.174 ms
  1023. 64 bytes from 30.150.xx.1: seq=1 ttl=64 time=7.648 ms
  1024. 64 bytes from 30.150.xx.1: seq=2 ttl=64 time=7.685 ms
  1025. NOTE: You are now pinging the NSA/GCHQ
  1026. Now lets see what is happening at a socket level (comments on right after #):
  1027. # netstat an
  1028. Active Internet connections (servers and established)
  1029. Proto RecvQ SendQ Local Address Foreign Address State
  1030. tcp 0 0 0.0.0.0:161 0.0.0.0:* LISTEN # This is BTAgent
  1031. tcp 0 0 127.0.0.1:2600 0.0.0.0:* LISTEN # This is Zebra Router
  1032. tcp 0 0 127.0.0.1:8011 0.0.0.0:* LISTEN # Transparent tproxy
  1033. tcp 0 0 30.150.xx.xx:8081 0.0.0.0:* LISTEN # This NSA/GCHQ Services
  1034. tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN # This is DNS
  1035. tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN # This is SSH Server
  1036. tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN # This is TELNET
  1037. tcp 0 55 192.168.1.1:23 192.168.1.100:57484 ESTABLISHED # This telnet session
  1038. tcp 0 0 127.0.0.1:2600 127.0.0.1:36825 ESTABLISHED # This is zebrarip
  1039. tcp 0 0 127.0.0.1:36825 127.0.0.1:2600 ESTABLISHED # This is rip>zebra
  1040. udp 0 0 0.0.0.0:69 0.0.0.0:* # TFTP Server for upgrades
  1041. Active UNIX domain sockets (servers and established)
  1042. Proto RefCnt Flags Type State INode Path
  1043. unix 3 [ ] STREAM CONNECTED 766 /var/BtAgentSocket # Special Agent BT
  1044. The device is now awaiting the hub/PC to issue a PPPOE discover request, at
  1045. which point you will receive your "Real Public IP".
  1046. At this point the attacker has complete control of the modem and your LAN,
  1047. extra firewall rules are added the moment the ptm1.301 VLAN device is
  1048. enabled by the dhcpc command.
  1049.  
  1050. ▶Anonymous 06/21/16 (Tue) 12:29:10 09d44b No.6407199>>6407204 >>6407345
  1051. 44
  1053. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1054. The UN-HACK
  1055. The UN-Hack
  1056. If you are able to login to your router (via serial port or LAN), there is a
  1057. defense which will prevent ALL the attacks using The Hack. This will un-
  1058. hack the modem and needs to be done after each reboot.
  1059. Step 1. Unplug the telephone cable and boot the Modem then login and issue
  1060. the following commands (in bold), the hash is the prompt (don't type that):
  1061. Kill the following processes:
  1062. # killall zebra ripd dnsmasq tftpd sshd MidServer
  1063. Kill the pids of the /bin/sh /BTAgent/ro/start:
  1064. # kill 766
  1065. Now, Kill all of the BTAgent processes:
  1066. # killall btagent
  1067. Unmount the BTAgent partition:
  1068. # umount /usr/BTAgent
  1069. Remove the attackers VLAN 301:
  1070. # vconfig rem ptm1.301
  1071. Kill the rogue dhcpc process with force (-9) or it will re-spawn
  1072. # killall -9 dhcpc
  1073. Remove all hidden firewall rules
  1074. # iptables -F -t mangle
  1075. # iptables -F -t nat
  1076. # iptables -F
  1077. Step 2. Plugin the telephone cable and the DSL will connect to BT (without
  1078. the NSA/GCHQ listening).
  1079. Step 3. Now start your PPPOE session from your second Linux firewall
  1080. machine as per the instructions for Inbound Defense and Outbound
  1081. Defense as applicable and Enjoy your privacy.
  1082.  
  1083. ▶Anonymous 06/21/16 (Tue) 12:29:28 09d44b No.6407204
  1084. >>6407199
  1085. 45
  1087. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1088. Special AgentBT
  1089. Special AgentBT
  1090. This "special" software installed on all modems provided by BT called
  1091. BTAgent.
  1092. This software listens on port 161, which is the IANA assigned port for Simple
  1093. Network Management Protocol (SNMP), anyone looking at this process would
  1094. automatically assume this to be the case. SNMP type programs are often
  1095. referred to as SNMP Agents.
  1096. The primary purpose of BTAgent is unpublished, but a version has been
  1097. partially reverse engineered and the software does download firmware and
  1098. update the modems flash.
  1099. BT responses to queries about their BTAgent is to claim that they need to
  1100. "remotely manage modems for security purposes".
  1101. User concerns with BTAgent:
  1102. 1. It's closed source
  1103. 2. Users cannot turn it of
  1104. 3. The secretive nature and responses from BT
  1105. 4. Users cannot upgrade the firmware using BTAgent
  1106. 5. Port 161 is open to the public internet
  1107. The second (special) purpose of the BTAgent is purely reverse reverse
  1108. psychology and designed to keep you wondering about it, to cause you to
  1109. waste your time reverse engineering it, when it may well be what it says on
  1110. the tin and while your thinking about BTAgent you're not thinking about the
  1111. other network interfaces such as ptm1.301 and the dhcpc requests which all
  1112. look innocent but actually perform the dirty deeds right in the open.
  1113. When you reverse engineer BTAgent and publish your results, this allows the
  1114. NSA/GCHQ to target you for other type of attacks.
  1115. We should remember, that with a single Firmware update from BTAgent, it
  1116. could morph itself and into what we originally feared!
  1117.  
  1118. ▶Anonymous 06/21/16 (Tue) 12:29:43 09d44b No.6407208
  1119. 46
  1121. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1122. Psychological and
  1123. Physical Barriers
  1124. Barriers
  1125. The NSA/GCHQ will do anything and everything to stop the The Hack being
  1126. discovered. The first step is to deal with the majority of users and prevent
  1127. them from even thinking about opening it up or even touching the modem.
  1128. Some of the suggestions listed here may seem extreme, but the less interest
  1129. created in this box, the less attention it receives from consumers.
  1130. 1. It's a white box, psychologically it's not a "black box" so it should be safe
  1131. 2. It comes in a plain brown cardboard box, which contain no words or
  1132. graphics whatsoever, with a single white bar-code label with make/model
  1133. of the modem
  1134. 3. The BT engineer personally carries and installs it in your home, while
  1135. other components such as BT Home Hub, the more expensive component
  1136. are sent through the postal system. BT cannot leave this shiny white
  1137. modem hanging around for a week while they allocate your connection,
  1138. you may try to open it or do research about it online, and they want to
  1139. know who is researching it
  1140. 4. The telephone socket (RJ11) is designed such that when you plug in the
  1141. telephone cable, it becomes very difficult to remove it, much more so
  1142. than a standard telephone RJ11. Its not just a case of pinching the lever,
  1143. you have to pinch and push further in, then remove. This is subtle, but it
  1144. will prevent a lot of people from even attempting to disconnect the
  1145. telephone cable, just in case they break it
  1146. 5. The older model was easy to open, just a few screws, the newer models
  1147. is almost impossible to open because it is clip locked closed, meaning
  1148. that you will damage it if you attempt to open it
  1149. 6. Red Warning Sticker on the back ­ "Don't cover Air Holes", wise but
  1150. scary
  1151. 7. The only documentation is a single piece of white paper detailing how it
  1152. should be mounted, there is no instructions about which cables go
  1153. where, this is designed never to be touched
  1154. 8. All internal serial port headers are removed so, you cant easily hack it
  1155. 9. The modem is plain white and square, extremely uninteresting, boring,
  1156. "Nothing to see here, move along",
  1157. All of this subtle "Anti-Marketing" for the most advanced BT product?
  1158.  
  1159. ▶Anonymous 06/21/16 (Tue) 12:29:51 09d44b No.6407213
  1160. 47
  1162. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1163. Social Attacks on
  1164. Engineers
  1165. Social Attacks on Engineers
  1166. Having discovered the attack architecture and disabled it, we decided to visit
  1167. some forums online, we were interested to see if anyone, anywhere is close
  1168. to uncovering The Hack and how the NSA/GCHQ react to such issues.
  1169. Generally, there are engineers chatting and sharing pictures of their modems
  1170. and how they solder wires on to the (usually hidden) serial ports, the
  1171. discussions usually leads to login and gaining root access of the modem or
  1172. replacing the firmware altogether.
  1173. When engineers start to get really close, something usually extra-ordinary
  1174. happens, almost like "superman to the rescue", someone who is highly
  1175. qualified, someone who has built up a reputation of being a ethical
  1176. hacker/security expert, introduces themselves and produces what appears to
  1177. be major break-through in gaining access to the modems.
  1178. However, because of the "ethical" element, superman instead of sharing the
  1179. method contacts BT, or BT contacts superman, directly and they agree to
  1180. allows BT to fix the flaw (e.g. giving BT a 30 days head start) after which,
  1181. superman will publish the method he used.
  1182. All things being equal, this is fair enough, but things are not all equal because
  1183. this was a complete smoke screen, played out to discourage the engineers
  1184. from further development knowing that in a few weeks "superman" will give
  1185. them access.
  1186. Many of the engineers/enthusiast waiting end-up getting caught by upgrades
  1187. of their modems firmware which then locks them out of the game.
  1188. This is a cat and mouse game, and engineers should be very wary of those
  1189. bearing gifts, their agenda is to slow you down and prevent you from making
  1190. any progress hoping you will just give up.
  1191. You can clearly see this on the BT forums as well others such as
  1192. http://www.psidoc.com, http://www.kitz.co.uk/, http://http://community.bt.com,
  1193. and others. Reverse engineering is legal, legitimate and it is a great source of
  1194. innovation.
  1195.  
  1196. ▶Anonymous 06/21/16 (Tue) 12:29:59 09d44b No.6407214
  1197. 48
  1199. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1200. Counter-Intelligence
  1201. Counter-Intelligence
  1202. The NSA/GCHQ et al. have being watching and attacking us, it's about time
  1203. we turned the tables, started defending ourselves and also watching them.
  1204. This section is not going to detail specific techniques, but rather suggest
  1205. overall approaches, some of which we have done over a period of months.
  1206. NSA Honeypots
  1207. Now we understand the attack architecture, we can simulate the modem in a
  1208. MIPS Virtual Machine (BTAgent is not required).
  1209. We can route the NSA/GCHQ traffic to your lab and just let them hack away in
  1210. a private cloud while we log traffic including how they attempt to use their
  1211. back doors and other dirty tricks.
  1212. You will need to forward and tap VLAN 301 (in the case of BT et al) to the
  1213. virtual modem where you can analyze its traffic in real-time or offline, you
  1214. should always store whatever information you gather forever, (just like they
  1215. do).
  1216. After gathering enough evidence, you can then publicize it and take legal
  1217. action, your logs can be used in court when you sue the conspirators and co-
  1218. conspirators under the "Computer Misuse Act 1990" as well as other laws.
  1219.  
  1220. ▶Anonymous 06/21/16 (Tue) 12:30:17 09d44b No.6407222
  1221. 49
  1223. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1224. About the Authors
  1225. The authors of this document wish to remain anonymous. However we are
  1226. fully prepared to stand in a court of law and present our evidence.
  1227. We are a group of technical engineers, we are not associated with any
  1228. activists groups whatsoever. We don't have a name, but if we did it would
  1229. probably be "The Adversaries" according to NSA/GCHQ.
  1230. Our Mission
  1231. Freedom is only appreciated when lost. We are on the brink of a irreversible
  1232. totalitarian multi-government regime and even though the European
  1233. Parliament has stated that citizens should not have to defend themselves
  1234. against state sponsored Cybercrime, the fact remains that our own
  1235. Governments continue to attack us in our own homes while we sleep.
  1236. Our mission is defensive and legal. Our objectives are to expose the sources
  1237. and methods used by those that harm our personal freedoms and rights and
  1238. to provide practical information to individuals around the world allowing them
  1239. to defend themselves against such cyber attacks.
  1240. We believe this as well as future disclosures to be in the public interest.
  1241. Donations
  1242. Our ongoing work is technical, slow, tedious and expensive any donations are
  1243. very welcome. We only accept bitcoins at this time.
  1244. bitcoin:1D6Hj37DS2mPTPm9u7TqS5ocddPHXjmau8
  1245. You can also support us by sending this document to a friend or host it on
  1246. your website.
  1247. Licensed under the Creative Commons Attribution-NoDerivs (CC BY-ND)
  1248.  
  1249. ▶Anonymous 06/21/16 (Tue) 12:30:31 09d44b No.6407226>>6407276 >>6407279
  1250. 50
  1252. Uncovered ­ //NONSA//NOGCHQ//NOGOV - CC BY-ND
  1253. UPDATE 2
  1254. Documents released by Der Spiegel have confirmed our own findings, original
  1255. sources can be found here:
  1256. http://www.spiegel.de/international/topic/united_kingdom/
  1257. http://www.spiegel.de/international/topic/united_states/
  1258. The very fact that we reported these back-doors exactly as described in these
  1259. new leaks proves that our claims are legitimate and true. This is exactly what
  1260. we uncovered in BT's modems, the architecture, design and attackers
  1261. networks are exactly as we illustrated in our diagrams and descriptions and
  1262. list of capabilities.
  1263. We verified our results by purchasing and testing many modems directly from
  1264. the BT as well as third party sources, all of which had the back doors as
  1265. described.
  1266. Individual Der Spiegel documents relating to our claims can be found here:
  1267. Backdoors NSAGCHQ Verification Document
  1268. Firewalls http://cryptome.org/2013/12/nsa-ant-firewalls.pdf
  1269. Routers http://cryptome.org/2013/12/nsa-ant-router.pdf
  1270. QFIRE Attack Networks http://cryptome.org/2013/12/nsa-qfire.pdf
  1271. BULLRUN-NSA http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf
  1272. EDHEHILL http://cryptome.org/2013/09/nsa-decrypt-guardian-13-0905.pdf
  1273. BULLRUN-GCHQ http://cryptome.org/2013/09/nsa-bullrun-brief-nyt-13-0905.pdf
  1274. Public Comments http://cryptome.org/2013/12/full-disclosure-comments.htm
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!