blog.pjhoodsco.org

PJHoodsCo Blog

Monthly Archives December 2014

NSA Device – HOWLERMONKEY

12/15/2014 | By: Preston Hood | No Comments

(TS//SI//REL) HOWLERMONKEY is a custom Short to Medium range implant RF Transceiver. It is used in conjunction with a digital core to provide a complete implant. (TS//SI//REL) HOWLERMONKEY is a COTS-based transceiver deigned to be compatible with CONJECTURE/SPECULATION networks and STRIKEZONE devices running a HOWLERMONKEY personality. PCB layouts are tailored to individual implant space requirements and can vary greatly in form factor. Status: Available — Delivery 3 months Unit Cost: 40 units: $750/ each, 25 units: $1,000/ each Thank you for taking the time to read this article! As always keep the faith! The NSA’s original documentation on
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: HOWLERMONKEY, NSA, and NSA Devices.

NSA Device – HEADWATER

12/12/2014 | By: Preston Hood | No Comments

(TS//SI//REL) HEADWATER is a Persistent Backdoor (PDB) software implant for selected Huawei routers. The implant will enable covert functions to be remotely executed within the router via an Internet connection. (TS//SI//REL) HEADWATER PBD implant will be transferred remotely over the Internet to the selected target router by Remote Operations Center (ROC) personnel. After the transfer process is complete, the PBD will be installed in the router’s boot ROM via an upgrade command. The PBD will then be activated after a system reboot. Once activated, the ROC operators will be able to use DNT’s HAMMERMILL Insertion Tool (HIT) to control the
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: HEADWATER, NSA, and NSA Devices.

NSA Device – HALLUXWATER

12/11/2014 | By: Preston Hood | No Comments

(TS//SI//REL) The HALLUXWATER Persistence Back Door implant is installed on a target Huawei Eudemon firewall as a boot ROM upgrade. When the target reboots, the PBD installer software will find the needed patch points and install the back door in the inbound packet processing routine. (TS//SI//REL) Once installed, HALLUXWATER communicates with an NSA operator via the TURBOPANDA Insertion Tool (PIT), giving the operator covert access to read and write memory, execute an address, or execute a packet. (TS//SI//REL) HALLUXWATER provides a persistence capability on the Eudemon 200, 500, and 1000 series firewalls. The HALLUXWATER back door survives OS upgrades and automatic
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: HALLUXWATER, NSA, and NSA Devices.

NSA Device – GOURMETTROUGH

12/10/2014 | By: Preston Hood | No Comments

(TS//SI//REL) GOURMETTROUGH is a user configurable implant for certain Juniper firewalls. It persists DNT’s BANANAGLEE implant across reboots and OS upgrades. For some platforms, it supports a minimal implant with beaconing for OS’s unsupported by BANANAGLEE. (TS//SI//REL) For supported platforms, DNT may configure without ANT involvement. Except for limited platforms, they may also configure PBD for minimal implant in the case where an OS unsupported by BANANAGLEE is booted. Status: GOURMETTROUGH is on the shelf and has been deployed on many target platforms. It supports nsg5t, ns50, ns25, isg1000(limited). Soon- ssg140, ssg5, ssg20 Unit Cost: $0 Thank you
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: GOURMETTROUGH, NSA, and NSA Devices.

NSA Device – GOPHERSET

12/09/2014 | By: Preston Hood | No Comments

(TS//SI//REL) GOPHERSET is a software implant for GSM (Global System for Mobile communication) subscriber identity module (SIM) cards. This implant pulls Phonebook, SMS, and call log information from a target handset and exfiltrates it to a user-defined phone number via short message service (SMS). (TS//SI//REL) Modern SIM cards (Phase 2+) have an application program interface known as the SIM Toolkit (STK). The STK has a suite of proactive commands that allow the SIM card to issue commands and make requests to the handset. GOPHERSET uses STK commands to retrieve the requested information and to exfiltrate data via SMS. After the
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: GOPHERSET, NSA, and NSA Devices.

NSA Device – GINSU

12/08/2014 | By: Preston Hood | No Comments

(TS//SI//REL) GINSU provides software application persistence for the CNE implant, KONGUR, on target systems with the PCI bus hardware implant, BULLDOZER. (TS//SI//REL) This technique supports any desktop PC system that contains at least one PCI connector (for BULLDOZER installation) and Microsoft Windows 9x, 2000, 20003, XP, or Vista. (TS//SI//REL) Through interdiction, BULLDOZER is installed in the target system as a PCI bus hardware implant. After fielding, if KONGUR is removed from the system as a result of an operation system upgrade or reinstall, GINSU can be set to trigger on the next reboot of the system to restore the software
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: GINSU, NSA, and NSA Devices.

NSA Device – GENESIS

12/05/2014 | By: Preston Hood | No Comments

(S//SI//REL) Commercial GSM handset that has been modified to include a Software Defined Radio (SDR) and additional system memory. The internal SDR allows a witting user to covertly perform network surveys, record RF spectrum, or perform handset location in hostile environments. (S//SI//REL) The GENESIS systems are designed to support covert operations in hostile environments. A witting user would be able to survey the local environment with the spectrum analyzer tool, select spectrum of interest to record, and download the spectrum information via the integrated Ethernet to a laptop controller. The GENESIS system could also be used, in conjunction with an
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: GENESIS, NSA, and NSA Devices.

NSA Device – FEEDTHROUGH

12/04/2014 | By: Preston Hood | No Comments

(TS//SI//REL) FEEDTROUGH is a persistence technique for two software implants, DNT’s BANANAGLEE and CES’s ZESTYLEAK used against Juniper Netscreen firewalls. (TS//SI//REL) FEEDTROUGH can be used to persist two implants, ZESTYLEAK and/or BANANAGLEE across reboots and software upgrades on known and covered OS’s for the following Netscreen firewalls, ns5xt, ns25, ns50, ns200, ns500 and ISG 1000. There is no direct communication to or from FEEDTROUGH, but if present, the BANANAGLEE implant can receive and transmit covert channel comms, and for certain platforms, BANANAGLEE can also update FEEDTROUGH. FEEDTROUGH however can only persist OS’s included in its databases. Therefore this is best
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: FEEDTHROUGH, NSA, and NSA Devices.

NSA Device – ENTOURAGE

12/03/2014 | By: Preston Hood | No Comments

(S//SI//REL) Direction Finding application operating on the HOLLOWPOINT platform. The system is capable of providing line of bearing for GSM/UMTS/CDMA2000/FRS signals. A band-specific antenna and laptop controller is needed to compliment the HOLLOWPOINT system and completes the ground based system. (S//SI) The ENTOURAGE application leverages the 4 Software Defined Radio (SDR) units in the HOLLOWPOINT platform. This capability provides an “Artemis-like” capability for waveforms of interest (2G,3G,others). The ENTOURAGE application works in conjunction with the NEBULA active interrogator as part of the Find/Fix/Finish capabilities of the GALAXY program. (S//SI//REL) Features: • Software Defined Radio System • Operating range 10MHz
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: ENTOURAGE, NSA, and NSA Devices.

NSA Device – EBSR

12/02/2014 | By: Preston Hood | No Comments

(S//SI//REL) Multi-purpose, Pico class, tri-band active GSM base station with internal 802.11/GPS/handset capability. (S//SI//REL) Operational Restrictions exist for equipment deployment. (S//SI//REL) Features: • LxT Model: 900/1800/1900MHz • LxU Model: 850/1800/1900MHz • Pico-class (1Watt) Base station • Optional Battery Kits • Highly Mobile and Deployable • Integrated GPS, MS, & 802.11 • Voice & High-speed Data • SMS Capability (S//SI//REL) Enclosure: • 1.9″H x 8.6″W x 6.3″D • Approximately 3 lbs • Actively cooled for extreme environments (S//SI//REL) EBSR System Kit: • EBSR System • AC/DC power converter • Antenna to support MS, GPS, WIFI, & RF • LAN, RF,
Read More

Categories: Information Technology, IT Security, and Preston Hood.
Tags: EBSR, NSA, and NSA Devices.