Vulnerabilities / Threats
5/13/2014
11:40 AM
Connect Directly
RSS
E-Mail
100%
0%

NSA Reportedly Adds Backdoors To US-Made Routers

Secret "supply-chain interdiction" program intercepts networking equipment being shipped overseas and adds phone-home surveillance capabilities, says Guardian report.

The National Security Agency has routinely intercepted networking equipment that's built in the United States, added backdoor access capabilities, then shipped the devices to their intended recipients abroad.

So says a report by journalist Glenn Greenwald published Tuesday by the Guardian. Greenwald cites a June 2010 document (leaked by former NSA contractor Edward Snowden) labeled as being from the head of the NSA's Access and Target Development group.

"The NSA routinely receives -- or intercepts -- routers, servers, and other computer network devices being exported from the US before they are delivered to the international customers," Greenwald writes. "The agency then implants backdoor surveillance tools, repackages the devices with a factory seal and sends them on. The NSA thus gains access to entire networks and all their users."

According to the document from the NSA -- the US intelligence agency charged with practicing signals intelligence -- this supply chain "SIGINT tradecraft... is very hands-on (literally!)."

When the hacked networking equipment is brought online, it phones home to NSA-controlled servers. "In one recent case, after several months a beacon implanted through supply-chain interdiction called back to the NSA covert infrastructure," Greenwald quotes the leaked NSA report. "This call back provided us access to further exploit the device and survey the network."

Greenwald has worked with filmmaker Laura Poitras to publish the lion's share of the files leaked to date by Snowden, and his NSA router-backdoor report was timed to coincide with Tuesday's publication of his book, No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State.

The report has already triggered a flood of related questions, including the degree to which technology manufacturers and shipping firms might be colluding -- or are legally forced to comply -- with the NSA's equipment-interception program.

Edward Snowden
Edward Snowden

But it's unclear how often the technique gets used. Last year, Snowden told Hong Kong's South China Morning Post that for eavesdropping, the NSA prefers to hack into infrastructure on a grander scale. "We hack network backbones -- like huge Internet routers, basically -- that give us access to the communications of hundreds of thousands of computers without having to hack every single one," he told the Post.

Last year, however, security expert Bruce Schneier -- who also has access to the trove of NSA documents leaked by Snowden -- warned that the NSA was hacking networking equipment as well. "The NSA also attacks network devices directly: routers, switches, firewalls, etc.," he said. "Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on."

The revelations over the NSA's backdoor-installation program cast new light on warnings issued last year by former CIA director Michael Hayden, who accused Chinese telecom equipment maker Huawei of actively spying for the Chinese government. Expect the latest NSA leak to stoke the ongoing debate about the agency's tactics, and their impact on the privacy rights of non-US citizens.

But some information security experts have warned that the NSA's programs -- and bigger surveillance-state analyses -- must be kept in context. "This is the problem with Greenwald: his inept analysis created a whole new urban mythology about who did what to whom," says Thomas H. Ptacek, principal at Matasano Security, via Twitter.

Indeed, if there's one espionage truism, it's that whatever one side is doing, the other side is likely not far behind -- as has been proven by tit-for-tat accusations from both China and the United States that one is hacking the other.

At the same time that Hayden singled out Chinese networking manufacturers for colluding with the military, he conceded as much, confirming what the NSA leaks have made quite clear: The United States hacks foreign targets. But Hayden portrayed US efforts in different terms. "I fully admit: we steal other country's secrets. And frankly we're quite good at it," he said. "But the reason we steal these secrets is to keep our citizens free, and to keep them safe. We don't steal secrets to make our citizens rich. Yet this is exactly what the Chinese do."

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Camp
50%
50%
Camp,
User Rank: Apprentice
5/19/2014 | 1:50:22 PM
Heading overseas?
I think there are quite a few of those 'tampered with' routers sitting in equipment racks in the US and on bookshelves/entertainment centers in our homes. Who are they kidding? (and with that comment, I assume the back door in my device was just activated!)
anon9930759556
50%
50%
anon9930759556,
User Rank: Apprentice
5/14/2014 | 1:55:30 PM
Re: Somewhere...
http://arstechnica.com/security/2014/01/backdoor-in-wireless-dsl-routers-lets-attacker-reset-router-get-admin/
cumulonimbus
50%
50%
cumulonimbus,
User Rank: Apprentice
5/14/2014 | 6:47:21 AM
Re: Stealng for freedom?
Good point, the end does not justify the means; credibility and trust cannot be discounted. It seems in the world's second oldest profession anything goes. However they have cover. Not to get too convoluted here, but isn't there also the possibility that the documents being released are fake since Snowden is now being manipulated by the Kremlin?

I am sure there is the IT equivalent of an arms race right now, because the first viable quantum computer is likely to be able to crack all the encryption protocols, notwithstanding the fact that quantum encryption itself is uncrackable; the uhderlying data disappearing in a puff of logic. Ah, the beauty!
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Moderator
5/13/2014 | 6:26:48 PM
Stealng for freedom?
Based on the last statement in the story by Michael Hayden, ex-CIA director, "We steal for freedom, they don't," I would say it would be wise to base the preservation of freedom on something other than stealing. 
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/13/2014 | 4:50:53 PM
Re: Somewhere...
Is any network equipment still made and assembled in the U.S.? I thought it had all gone overseas already.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
5/13/2014 | 4:28:50 PM
Somewhere...
...someone at Huawei is smiling.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.