NSA Employees Routinely Undermined 'Non-Attributable' Web Access With Personal Web Use
from the ONE-OF-US dept
Another large batch of Snowden docs have been released by The Intercept. The new documents are part of the site's "SID (Signals Intelligence Directorate) Today" collection, a sort of interoffice newsletter featuring discussions of intelligence-gathering efforts the agency has engaged in, as well as more mundane office business.
The one discussed in this Intercept post details some careless opsec by Intelligence Community (IC) employees. Like anyone in any office anywhere, IC employees use their office computers to send personal email, shop online, and fritter away the downtime with some web surfing.
That's where they're running into problems. This SID Today document [PDF] deals with the IC's personal use of company computers -- namely, the "attribution" problem that develops when outside websites are accessed using IP addresses that can be traced back to the NSA and other IC components.
The IC uses a system called AIRGAP to provide internet access for IC employees while supposedly still preventing outsiders from tracing IP addresses back to sensitive locations. Set up in 1998 by "one of the world's largest internet providers," the system was supposed to provide non-attributable access to the outside internet world.
Unfortunately, as is detailed by the SID Today doc, the execution of AIRGAP was lacking.
One early concern about the firewall was that it funneled all internet traffic through a single IP address, meaning that if any activity on the address was revealed to be associated with U.S. spies, a broad swath of other activity could then be attributed to other U.S. spies. More IP addresses were subsequently added, but “occasionally we find that the ISP reverts to one address, or does not effectively rotate those assigned,” Speight wrote.
Speight added that the “greater security concern” was the very intelligence agents the system was designed to protect. “Despite rules and warnings to the contrary, all too frequently users will use AIRGAP for registering on web sites or for services, logging into other sites and services and even ordering personal items from on-line vendors,” Speight wrote in a classified passage. “By doing so, these users reveal information about themselves and, potentially, other users on the network. So much for ‘non-attribution.'”
It's the sort of simple carelessness that's almost unavoidable in large organizations. The NSA's effort to distance itself from its employees' internet use was thwarted by the ISP's funnel and IC employee sloppiness. As The Intercept points out, this mirrors some of the brainlessness exhibited by Russian hackers, who used a system designed to obscure their origin, but constantly undermined that protection by using the same system to log in to personal social media accounts.
The difference between the two is AIRGAP was just there to open a portal out of the IC's closed system. The Russian's system was designed to obscure the source of attacks. But the personal use of the IC's firewall/AIRGAP is still a violation of internal policy, as the document points out.
Rather than work towards preventing the unpreventable (personal web use), the IC set up another system -- OUTPARKS -- which provided more than 200 random IP addresses, all of which would be registered to an ISP, rather than the IC itself. Confusingly, the new system -- put in place in 2005 -- is also referred to as AIRGAP, primarily because IC employees are creatures of habit and referred to OUTPARKS as AIRGAP despite it being an entirely new, NSA-owned operation.
Ultimately, the document shows NSA employees are just like the rest of us: periodically bored and prone to using work computers for personal reasons.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: covering tracks, mistakes, nsa, security
Reader Comments
Subscribe: RSS
View by: Time | Thread
Nope. Not me. :-p
[ link to this | view in chronology ]
entertaining..
a smart person would do this type of thing..
And not route data thru a portal suggesting it WAS the other IP..
Love Caller ID, thinking that YOU have the info on WHO is on the other end of the phone..
[ link to this | view in chronology ]
[ link to this | view in chronology ]
non-attributable
If I owned the company or was in charge of a TLA, I would tell every employee that if I found even one exception to the rule, they would lose their job, all company contributions to their retirement, and be prosecuted.
Another company I worked for redirected all web requests to the corporate policy page and asked you to get the URL approved by your supervisor.
[ link to this | view in chronology ]
Re: non-attributable
Frankly I'd rather sandpaper my nipples off than work for any company or TLA you owned.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Not necessarily...
The general principle is the more secure the data, the more stringent the policies and access controls. You might for example allow USB access and screenshots on internet facing machines, but on secure networks you'd want controls in place.
[ link to this | view in chronology ]
IC "security" is ... stupid... or incompetent?
A hacker as "shortsighted" so as to use a pool of 200 addresses from which to launch attacks would be laughed out of any room at DEFCON. How even worse that our vaunted intelligence services are stupider than that.
There's some comparison in the article (twice) to Russian Hackers obfuscating their IP addresses. The point is missed that Russian hackers DID obfuscate their IP addresses. The US IC people were stupid. Or incompetent.
E
[ link to this | view in chronology ]
Re: IC "security" is ... stupid... or incompetent?
See also "Who uses Tor?":
It's important that "normal" people use it too. If everyone on Tor is a government agent, server/network operators who see Tor traffic might not care which agency it is.
[ link to this | view in chronology ]
Re: IC "security" is ... stupid... or incompetent?
The point isn't to be secure in the conventional sense. These are information requests sent to and from the open, public Internet. They're insecure by nature.
The original AIRGAP is a system that acknowledges that any TLA-owned IP address will eventually be identified, and seeks to obscure, rather than secure, by routing all information through it.
A query goes out that interacts with a location in Russia. If that can be associated with a "contacting friends" address, then the activity was to contact a US spy in Russia. If it can be associated with an "observing our enemies" address then that information is similarly revealed.
Funnel everything through a single contact point though and you lose all context for the interest. You can't see whether the TLA was contacting a friend or foe.
OUTPARKS takes that data decontextualisation and spreads it out over a wider range of addresses that are then more difficult to discover.
You might see my message out through IP address A on Monday and infer one thing but on Tuesday I'm communicating through IP address B, which you don't know about and therefore miss.
It's a good, sensible system.
[ link to this | view in chronology ]
Re: IC "security" is ... stupid... or incompetent?
In the DarkMarket case, Master Splynter, the undercover FBI agent who ended up as an admin on a server for carders, almost got exposed when the IP address he used was traced back to a law enforcement agency. He managed to recover his credibility, but almost lost the entire case for that. He was not hacking, he was just undercover as a hacker.
https://en.wikipedia.org/wiki/DarkMarket provides some basic info, but doesn't specifically mention that incident.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
and these people vote?
[ link to this | view in chronology ]
situsbokep88
http://www.situsbokep88.com/category/cerita-dewasa/
http://www.situsbokep 88.com/category/film-bokep/
[ link to this | view in chronology ]