20150117-Spiegel-APEX Method of Combining Passive With Active Methods to Exfiltrate Data ...

55 Pages·2015·7.67 MB·English

OP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
go apex
STDP: S32354 & T112, NCSC/C91
August 2009
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
This presentation is classified
TOP SECRET//COMINT//REL TO
USA, AUS, CAN, GBR,
NZL//20291123
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
Motivation:
CES needs VPN keys!
NCCJnçrement 3 Planning
1. NCC CA Service Rett^eSt^Deci^^peuietn^aggregate for all VPN exploitation-enabled systems).
Q4 FY09 (Risk ReçUieitbn) 1,000
Q4 FY10 10,000
Q4 FY11 100,000 r — —^
2. NCC front end systems sj/iajWully j&rocess^eydecrypt and re-inject) at least 20% of CA service requests (-20% Reinject Rate?)
3. For tasked IP addresses, NCu front em systems shall identify relevant IPSec sessions and generate attack requests (Rates?)
4. NCC front end systems shall buffer VPN data for up to 15 minutes (900 seconds) while waiting for response from Attack Orchestrater (AO)
5. After successful key rStsyery and decryption Pig services shall re-inject decrypted VPN for Stagel & Stage2 processing
6. Aggregate VPN buffering\nap>rQ^essinVrate pCTTTVIL/system (Assumptions - LPT? T16? U64?)
Q4 FY09 (Risk Reduction)^ 4 VPN Systems ——Concurrent VPN Flows I System 100 Mbps Aggregate VPN Data I System
Q4 FY10 \ 10 VPN Systems 100 Concurrent VPN Flows I System 100 Mbps Aggregate VPN Data I System
Q4 FY11 100 VPN Systems V -^90 Concurrent VPN Flows I System 500 Mbps Aggregate VPN Data I System
• CES r e c e i v ^ / v l^ IKE packets from passive collection
(TURMOIL) and recovers VPN keys.
• TURMOIL receives VPN ESP packets and decrypts them
using the keys recovered by CES.
• But there are many VPNs that TURMOIL(s) can't see.
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123 3
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
Motivation: Leverage TAO
• TAO/DNT active implants have a powerful Man-in-
the-Middle capability to access data deep within
target networks.
• They can select packets and exfiltrate them back to the
Common Data Receptor (CDR) at the Remote Operations
Center (ROC).
• HAMMERSTEIN: target any 5-tuple packet
• {SrclP, SrcPort, DstIP, DstPort, Protocol}
• IKE: VPN key exchanges
• ESP: VPN encrypted tunnels
• HAMMERCHANT: target VoIP phone numbers
• Process SIP/H.323 VoIP signaling
• Forward targeted phone call RTP media sessions
• But CDR has limited input bandwidth.
4
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
Hmmmm
Maybe... Combine Active & Passive?
5
SECRET//COMINT//20291123
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
Agenda
• Motivation: Why?
•TURBULENCE High Level Concept: What?
• Details: How?
• FASHIONCLEFT Exfiltration Protocol
• Definition
• Processing Required
• Turmoil Architecture
• Turmoil Implementation
• Packet Reinjection: Stage 1 Prime
• Packet Processing Framework: AEG/SEG
• Packet Routing: different Transform Engines
• Complexity
• Challenges
• Phased Development
6
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
S ECRET//CO MINT//20291123
(U) TURBULENCE Architecture
ne
TRAFFICTHIEF
Tipping
SECRET//COMINT//2Q291123
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123
(U) Sensors: Passive Collection
Accesses (S//SI//REL) High-speed passive collection
systems intercept foreign target satellite, microwave,
TURMOIL
and cable communications as they transit the globe.
if
TUTELAGE
Implants (TAO)
J
Internet
H'
Cloud
Internet
* Cloud
Internet
4 Cloud
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123 8
^U J O CI I D UL OI M V/ U VC IJVM^Ë«M)LUXFJIEL TO USA, AUS, CAN, GBR, Nzu/20291123
Management
(TS//SI//REL) TURBINE enables the
Accesses
automated management and control of a
large network of active implants
TURMOIL
m TUTELAGE
0
Implants (TAO)
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123 9
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR,
APEX VPN IKE Mission
Iii e ra al
Network
VoIP server
VPN
TAO Inside
Exfi Path
Tailored Access
Office Remote
Operations Center
Tasking
Muli» , wmm^^m
Tas kin
% - M H s Í l í fl
S AW
TOP