The United States National Security Agency’s surveillance efforts include radio transmissions from circuit boards and USB cards inserted surreptitiously into computers, The New York Times reported Tuesday. This apparently has been going on since 2008.
The story bears out Der Spiegel’s December report that the NSA had a 50-page catalog of surveillance products — including bugging devices disguised as USB plugs, which could send and receive data over radio waves undetected.
“This is pretty cool,” Jim McGregor, principal analyst at Tirias Research, told TechNewsWorld. “You could embed a transmitter in a USB dongle or memory card or mouse plugin or USB plugin … . There are lots of places you could hide it.”
Guerilla Radio
The device used for remote spying over radio is the Nightstand, which security researcher Jacob Appelbaum, who cowrote the Der Spiegel article, described at the Chaos Communications Congress in December.
The Nightstand, a standalone tool running Linux Fedora Core 3 on an x86 laptop, can be used to attack PCs running Windows 2000, Windows XP, XP SP1 and XP SP2 running Internet Explorer 5.0-6.0.
The Nightstand can inject packets into one target or into multiple targets on a wireless network, undetectable to the user.
Under ideal environmental conditions, when external amplifiers and antennae are used, Nightstand has successfully launched operational attacks from up to eight miles away.
The technology has been used since at least 2008.
Listening to the Enemy
Using radio technology lets American intelligence monitor computers it previously could not access, either because they were hardened against penetration or were on an isolated network.
“Any connection can be hacked, and the only way to prevent that is to completely isolate the system, whether it’s a computer or an entire network,” McGregor said. “Defense contractors in the U.S. do this … . If you’re developing a new weapon or working on a new defense system, you don’t want your computer connected to the Internet.”
The U.S. has protested similar actions against it by China, but the NSA told The New York Times that its actions are not comparable to those of the Chinese.
“Every country does this,” McGregor pointed out.
No Americans Involved
Just as it did when asked whether it was spying on Americans’ phone communications, the NSA has denied that it is targeting Americans with radio technology.
The agency’s activities are deployed only against valid foreign intelligence targets in response to intelligence requirements, spokesperson Vanee Vines told The New York Times.
However, that remains a point of debate.
“The question now is, do you trust all the components attached to your computer?” asked Daniel Castro, senior analyst at the Information Technology & Innovation Foundation. “At the end of the day, you need to know the provenance of every computer in your infrastructure.”
However, Tirias’ McGregor thinks only computers that have been sold to specific targets will have the radio technology implanted, because the profit margins on components is small, and “you could create some problems if you’ve got too many devices running on the same signal.”
Backlash Against the US
The news “means that anyone who makes a USB-connected device or cable could right now be accused of being a front for the NSA,” the ITIF’s Castro told TechNewsWorld. “Logitech, cable manufacturers — anyone who makes any parts for the computer.”
That could further impact U.S. exports of electronic products, which already have been hit by revelations about the NSA’s activities.
If he were in the marketing department of a foreign competitor of any U.S. computer parts manufacturer, Castro remarked, he would point out the possibility that the U.S. company was working with the NSA.
Loading ...
