NIGHTWATCH: NSA Exploit of the Day

Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

NIGHTWATCH (TS//SI//REL TO USA,FVEY) NIGHTWATCH is a portable computer with specialized, internal hardware designed to process progressive-scan (non-interlaced VAGRANT signals).
(U) Capability Summary
(TS//SI//REL TO USA,FVEY) The current implementation of NIGHTWATCH consists of a general-purpose PC inside of a shielded case. The PC has PCI digitizing and clock cards to provide the needed interface and accurate clocking required for video reconstruction. It also has:

• horizontal sync, vertical sync and video outputs to drive an external, multi-sync monitor.
• video output
• spectral analysis up to 150 kHz to provide for indications of horizontal and vertical sync frequencies.
• frame capture and forwarding
• PCMCIA cards for program and data storage
• horizontal sync locking to keep the display set on the NIGHTWATCH display.
• frame averaging up to 2^16 (65536) frames.

(U) Concept of Operation
(TS//SI//REL TO USA,FVEY) The video output from an appropriate collection system, such as a CTX4000, PHOTOANGLO, or general-purpose receiver, is connected to the video output on the NIGHTWATCH system. The user, using the appropriate tools either within NIGHTWATCH or externally, determines the horizontal and vertical sync frequencies of the targeted monitor. Once the user matches the proper frequencies, he activates "Sync Lock" and frame averaging to reduce noise and improve readability of the targeted monitor. If warranted, the user then forwards the displayed frames over a network to NSAW, where analysts can look at them for intelligence purposes.
Unit Cost: N/A
Status: This system has reached the end of its service life. All work concerning the NIGHTWATCH system is strictly for maintenance purposes. This system is slated to be replaced by the VIEWPLATE system.

Page, with graphics, is here. General information about TAO and the catalog is here.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Consumer Manipulation

Tim Harford talks about consumer manipulation:

Consider, first, confusion by design: Las Vegas casinos are mazes, carefully crafted to draw players to the slot machines and to keep them there. Casino designers warn against the "yellow brick road" effect of having a clear route through the casino. (One side effect: it takes paramedics a long time to find gamblers in cardiac arrest; as Ms Schüll also documents, it can be tough to get the slot-machine players to assist, or even to make room for, the medical team.) Most mazes in our economy are metaphorical: the confusion of multi-part tariffs for mobile phones, cable television or electricity. My phone company regularly contacts me to assure me that I am on the cheapest possible plan given my patterns of usage. No doubt this claim can be justified on some narrow technicality but it seems calculated to deceive. Every time I have put it to the test it has proved false.
I recently cancelled a contract with a different provider after some gizmo broke. The company first told me the whole thing was my problem, then at the last moment offered me hundreds of pounds to stay. When your phone company starts using the playbook of an emotionally abusive spouse, this is not a market in good working order.

This is a security story: manipulation vs. manipulation defense. One of my worries about our modern market system is that the manipulators have gotten too good. We need better security -- either technical defenses or legal prohibitions -- against this manipulation.

NIGHTSTAND: NSA Exploit of the Day

Today's device from the NSA's Tailored Access Operations (TAO) group implant catalog:

NIGHTSTAND (TS//SI//REL) An active 802.11 wireless exploitation and injection tool for payload /exploit delivery into otherwise denied target space. NIGHTSTAND is typically used in operations where wired access to the target is not possible.
(TS//SI//REL) NIGHTSTAND - Close Access Operations • Battlefield Tested • Windows Exploitation • Standalone System
System Details

• (U//FOUO) Standalone tool currently running on an x86 laptop loaded with Linux Fedora Core 3.
• (TS//SI//REL) Exploitable Targets include Win2k, WinXP, WinXPSP1, WINXPSP2 running Internet Explorer versions 5.0-6.0.
• (TS//SI//REL) NS packet injection can target one client or multiple targets on a wireless network.
• (TS//SI//REL) Attack is undetectable by the user.

(TS//SI//REL) Use of external amplifiers and antennas in both experimental and operational scenarios have resulted in successful NIGHTSTAND attacks from as far away as eight miles under ideal environmental conditions.
Unit Cost: Varies from platform to platform
Status: Product has been deployed in the field. Upgrades to the system continue to be developed.

Page, with graphics, is here. General information about TAO and the catalog is here.
Presumably, the NSA can use this "injection tool" in all the same ways it uses QUANTUM. For example, it can redirect users to FOXACID servers in order to attack their computers.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Questioning the Efficacy of NSA's Bulk-Collection Programs

Two reports have recently been published questioning the efficacy of the NSA's bulk-collection programs. The first one is from the left-leaning New American Foundation (report here, and one-page tabular summary here).

However, our review of the government’s claims about the role that NSA “bulk” surveillance of phone and email communications records has had in keeping the United States safe from terrorism shows that these claims are overblown and even misleading. An in-depth analysis of 225 individuals recruited by al-Qaeda or a like-minded group or inspired by al-Qaeda’s ideology, and charged in the United States with an act of terrorism since 9/11, demonstrates that traditional investigative methods, such as the use of informants, tips from local communities, and targeted intelligence operations, provided the initial impetus for investigations in the majority of cases, while the contribution of NSA's bulk surveillance programs to these cases was minimal. Indeed, the controversial bulk collection of American telephone metadata, which includes the telephone numbers that originate and receive calls, as well as the time and date of those calls but not their content, under Section 215 of the USA PATRIOT Act, appears to have played an identifiable role in initiating, at most, 1.8 percent of these cases. NSA programs involving the surveillance of non-U.S. persons outside of the United States under Section 702 of the FISA Amendments Act played a role in 4.4 percent of the terrorism cases we examined, and NSA surveillance under an unidentified authority played a role in 1.3 percent of the cases we examined.

The second is from Marshall Erwin of the right-leaning Hoover Institute (report here, and summary here).

My conclusion is simple: neither of these cases demonstrates that bulk phone records collection is effective. Those records did not make a significant contribution to success against the 2009 plot because at the point at which the NSA searched the bulk records database, the FBI already had sufficient information to disrupt the plot. It is also unlikely that bulk collection would have helped disrupt the 9/11 attacks, given critical barriers to information sharing and as demonstrated by the wealth of information already available to the intelligence community about al-Mihdhar.

List of minimalist frameworks

A list of minimalist frameworks (simple and lightweight). All in alphabetical order.

Index

• Framework for CSS
• Web Framework for C
• Frameworks for Front-end JS
• Web framework for Go
• Web framework for Haskell
• Web framework for Java
• Web framework for Javascript
• Web framework for Node.js
• Web framework for Perl
• Web framework for PHP
• Web framework for Python
• Web framework for Ruby
• Web framework for Scala
• Web framework for .NET (C#)

Framework for CSS

Use http://refresh-sf.com/yui/ to compress, and get size "after compression and gzip"/1024 = KiB

Name	Minimum size (base)	Repository	License
Atatonic	5.1 KiB (minified)	http://code.google.com/p/atatonic-css-framwork/	MIT
Cascade Framework	10.6 KiB (all modules)	https://github.com/jslegers/cascadeframework	MIT
Cascade Framework Light	2.0 KiB (all modules)	https://github.com/jslegers/cascadeframeworklight	MIT
Concrete	3.2 KiB	https://github.com/davidlumley/concrete	MIT
KNACSS	13.2 KiB (all modules)	https://github.com/raphaelgoetter/KNACSS	WTFPL
Kube	15.2 KiB	https://github.com/sashka/kube	Unknown
Min	0.9 KiB (minified and gzipped)	https://github.com/owenversteeg/min	MIT
Mistype	2.1 KiB	https://github.com/ZDroid/mistype	MIT
PocketGrid	0.5 KiB	https://github.com/arnaudleray/pocketgrid	MIT
Pure	4.3 KiB (gzipped)	https://github.com/yui/pure	BSD
RocketCSS	6.4 KiB	https://github.com/RocketCSS/RocketCSS	MIT
Simple Grid	1.1 KiB	https://github.com/ThisIsDallas/Simple-Grid	Unknown
Toast	1.2 KiB	https://github.com/daneden/Toast	Unknown

Web Framework for C

Name	Repository	License
Raphters	https://github.com/DanielWaterworth/Raphters	GPL

Frameworks for Front-end JS

Name	Bower Install	Repository	License
Aura	bower install aura	https://github.com/aurajs/aura	MIT
Kraken	Unknown	https://github.com/cferdinandi/kraken	MIT
Min.js	Unknown	https://github.com/remy/min.js	MIT
Reactive.coffee	bower install reactive-coffee	https://github.com/yang/reactive-coffee	MIT
Responsive	Unknown	https://github.com/JimBobSquarePants/Responsive	MIT
ScaleApp	bower install scaleapp	https://github.com/flosse/scaleApp	MIT
Spine	bower install spine	https://github.com/spine/spine	MIT
Stapes	bower install stapes	http://github.com/hay/stapes	MIT

Web framework for Go

Name	Repository	License
Beego Framework	https://github.com/astaxie/beego	Apache License V2
Gocraft/web	https://github.com/gocraft/web	MIT
Martini	https://github.com/codegangsta/martini	MIT
Traffic	https://github.com/pilu/traffic	MIT

Web framework for Haskell

Name	Cabal Install	Repository	License
Scotty	cabal install scotty	https://github.com/scotty-web/scotty	BSD3
Snap	cabal install snap	https://github.com/snapframework/snap	BSD3

Web framework for Java

Name	Repository	License
Play Framework	https://github.com/playframework/playframework	Apache License V2
Restlet	https://github.com/restlet/restlet-framework-java	Apache License V2
RestX	https://github.com/restx/restx	Apache License V2
Spark	https://github.com/perwendel/spark	Apache License V2
Stapler	https://github.com/stapler/stapler	BSD

Web framework for Javascript

Name	Repository	License
Meteor	https://github.com/meteor/meteor	MIT

Web framework for Node.js

Name	NPM Install	Repository	License
Express.js	[sudo] npm install express	https://github.com/visionmedia/express	MIT
Codekart	npm install codekart	https://github.com/myworld4059/Codekart	MIT
Flatiron	[sudo] npm install -g flatiron	https://github.com/flatiron	MIT
Hapi	npm install hapi	https://github.com/spumko/hapi	Unknown
Koa	[sudo] npm install koajs	https://github.com/koajs/koa	MIT
Meryl	npm install meryl	https://github.com/kadirpekel/meryl	MIT
Partial.js	[sudo] npm install -g partial.js	https://github.com/petersirka/partial.js	MIT
Restify	npm install restify	https://github.com/mcavage/node-restify	MIT
SocketStream	[sudo] npm install -g socketstream	https://github.com/socketstream/socketstream	MIT
Sails.js	[sudo]npm -g install sails	https://github.com/balderdashy/sails	MIT

Web framework for Perl

Name	cpan install	Repository	License
Dancer	cpan Dancer	https://github.com/PerlDancer/Dancer	Artistic or GPL v.1
Mojolicious	cpan Mojolicious	https://github.com/kraih/mojo	Artistic 2.0

Web framework for PHP

Name	Repository	License
Afro	https://github.com/jbrooksuk/Afro	MIT
AuraPHP	https://github.com/auraphp/Aura.Web_Kernel	BSD
Bullet	https://github.com/vlucas/bulletphp	MIT
Deano	http://github.com/colindean/deano	MIT
Fat Free	https://github.com/bcosca/fatfree	GPL 3
Flight	https://github.com/mikecao/flight	MIT
Hackwork	https://github.com/ZDroid/hackwork	MIT
Limonade	https://github.com/sofadesign/limonade	Unknown
MicroMVC	https://github.com/Xeoncross/MicroMVC	MIT
Nanite	https://github.com/nirix/nanite	LGPLv3
Phalcon Framework	https://github.com/phalcon/cphalcon	BSD3
polyframework	https://github.com/polymedio/polyframework	BSD3
Respect\Rest	http://github.com/Respect/Rest	BSD3
Silex	https://github.com/silexphp/Silex	MIT
Slim	https://github.com/codeguy/Slim	MIT
Swiftlet	https://github.com/ElbertF/Swiftlet	MIT
Yaf	https://github.com/laruence/php-yaf	PHP License v3.01

Web framework for Python

Name	PIP Install	Repository	License
Bobo	pip install bobo	https://github.com/zopefoundation/bobo	ZPL 2.1
Bottle	[sudo] pip install bottle	https://github.com/defnull/bottle	MIT
CherryPy	pip install CherryPy	https://bitbucket.org/cherrypy/cherrypy/overview	BSD
Cyclone	pip install cyclone	https://github.com/fiorix/cyclone	Apache License 2.0
Flask	pip install Flask	https://github.com/mitsuhiko/flask	BSD
Itty-Bitty	pip install itty	https://github.com/toastdriven/itty/	BSD3
Klein	pip install klein	https://github.com/twisted/klein	MIT
ObjectWeb	Unknown	https://github.com/aisola/ObjectWeb	LGPLv3
Pecan	pip install pecan	https://github.com/stackforge/pecan	BSD
Pyramid	pip install pyramid	https://github.com/Pylons/pyramid	BSD-derived
Tornado	pip install tornado	https://github.com/facebook/tornado	Apache License 2.0
Web.py	[sudo] pip install web.py	https://github.com/webpy/webpy	Public domain
Wheezy.web	pip install wheezy.web	https://bitbucket.org/akorn/wheezy.web	MIT

Web framework for Ruby

Name	Gem Install	Repository	License
Brooklyn	gem install brooklyn	https://github.com/luislavena/brooklyn	MIT
Camping	gem install camping	http://github.com/camping/camping	MIT
Cuba	gem install cuba	https://github.com/soveran/cuba	MIT
Grape	gem install grape	https://github.com/intridea/grape	MIT
Hobbit	gem install hobbit	https://github.com/patriciomacadden/hobbit	MIT
Kenji	gem install kenji	https://github.com/kballenegger/Kenji	Azure
Nancy	gem install nancy	https://github.com/guilleiguaran/nancy	MIT
New York, New York	gem install nyny	https://github.com/alisnic/nyny	MIT
Padrino	gem install padrino	https://github.com/padrino/padrino-framework	MIT
Ramaze	gem install ramaze	https://github.com/ramaze/ramaze	MIT
Sinatra	gem install sinatra	https://github.com/sinatra/sinatra/	MIT

Web framework for Scala

Name	Repository	License
Finatra	https://github.com/twitter/finatra	Apache License V2
Play Framework	https://github.com/playframework/playframework	Apache License V2
Scalatra	https://github.com/scalatra/scalatra	BSD
Spray	https://github.com/spray/spray	Apache License V2

Web framework for .NET (C#)

Name	Repository	License
Aurora	https://github.com/frankhale/aurora	GPL
Nancy	https://github.com/NancyFx/Nancy/	MIT

LOUDAUTO: NSA Exploit of the Day

Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

LOUDAUTO (TS//SI//REL TO USA,FVEY) Audio-based RF retro-reflector. Provides room audio from targeted space using radar and basic post-processing.
(U) Capabilities
(TS//SI//REL TO USA,FVEY) LOUDAUTO's current design maximizes the gain of the microphone. This makes it extremely useful for picking up room audio. It can pick up speech at a standard, ofice volume from over 20' away. (NOTE: Concealments may reduce this distance.) It uses very little power (~15 uA at 3.0 VDC), so little, in fact, that battery self-discharge is more of an issue for serviceable lifetime than the power draw from this unit. The simplicity of the design allows the form factor to be tailored for specific operation requirements. All components at COTS and so are non-attributable to NSA.
(U) Concept of Operation
(TS//SI//REL TO USA,FVEY) Room audio is picked up by the microphone and converted into an analog electrical signal. This signal is used to pulse position modulate (PPM) a square wave signal running at a pre-set frequency. This square wave is used to turn a FET (field effect transistor) on and off. When the unit is illuminated with a CW signal from a nearby radar unit, the illuminating signal is amplitude-modulated with the PPM square wave. This signal is re-radiated, where it is picked up by the radar, then processed to recover the room audio. Processing is currently performed by COTS equipment with FM demodulation capability (Rohde & Schwarz FSH-series portable spectrum analyzers, etc.) LOUDAUTO is part of the ANGRYNEIGHBOR family of radar retro-reflectors.
Unit Cost: $30
Status: End processing still in development

Page, with graphics, is here. General information about TAO and the catalog is here.
This one is kind of cool, I think.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

Adware Vendors Buy and Abuse Chrome Extensions

This is not a good development:

To make matters worse, ownership of a Chrome extension can be transferred to another party, and users are never informed when an ownership change happens. Malware and adware vendors have caught wind of this and have started showing up at the doors of extension authors, looking to buy their extensions. Once the deal is done and the ownership of the extension is transferred, the new owners can issue an ad-filled update over Chrome's update service, which sends the adware out to every user of that extension. [...]
When malicious apps don't follow Google's disclosure policy, diagnosing something like this is extremely difficult. When Tweet This Page started spewing ads and malware into my browser, the only initial sign was that ads on the Internet had suddenly become much more intrusive, and many auto-played sound. The extension only started injecting ads a few days after it was installed in an attempt to make it more difficult to detect. After a while, Google search became useless, because every link would redirect to some other webpage. My initial thought was to take an inventory of every program I had installed recently -- I never suspected an update would bring in malware. I ran a ton of malware/virus scanners, and they all found nothing. I was only clued into the fact that Chrome was the culprit because the same thing started happening on my Chromebook -- if I didn't notice that, the next step would have probably been a full wipe of my computer.