Cyber contractors ramp up new tools for NSA

WASHINGTON — On Florida’s Atlantic coast, cyber arms makers working for U.S. spy agencies are bombarding billions of lines of computer code with random data that can expose software flaws the U.S. might exploit.

In Pittsburgh, researchers with a Pentagon contract are teaching computers to scan software for bugs and turn them automatically into weapons. In a converted textile mill in New Hampshire, programmers are testing the combat potential of coding errors on a digital bombing range.

Nationwide, a new league of defense contractors is mining the foundation of the Internet for glitches that can be turned to the country’s strategic advantage. They’re part of a cybermilitary industrial complex that’s grown up in more than a dozen states and employs thousands of civilians, according to 15 people who work for contractors and the government. The projects are so sensitive their funding is classified, and so extensive a bid to curb their scope will be resisted not only by intelligence agencies but also the world’s largest military supply chain.

“An arms race”

“We’re in an arms race,” said Chase Cunningham, the National Security Agency’s former chief cryptologic technician. The competition to find exploitable bugs before an enemy does is as intense as “the space race and the Cold War combined.”

The U.S. has poured billions of dollars into an electronic arsenal built with so-called zero-day exploits, manipulations of missteps or oversights in code that can make anything that runs on a computer chip vulnerable to hackers. They go far beyond flaws in web encryption like SSL and OpenSSL, which the NSA has exploited for years without warning the public about it, according to people with knowledge of the matter.

The agency’s stockpile of exploits runs into the thousands, aimed at every conceivable device, and many are not disclosed even to units within the agency responsible for defending U.S. government networks, people familiar with the program said.

Heartbleed bug

Under a directive made public April 11, after Bloomberg News reported the NSA’s utilization of the infamous Heartbleed bug — a use the agency denied — the White House said exploits should in most cases be disclosed so computer users can protect themselves.

Michael Daniel, the White House cybersecurity coordinator, said in a blog post this week that “building up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.”

He said the U.S. would continue to develop and use those vulnerabilities to protect the country, however, and that the administration has established “a disciplined, rigorous and high-level decision-making process” when it comes to deciding whether to keep the flaws secret or disclose them so they can be fixed.

The NSA referred to the White House blog in response to a request for comment.

Because the White House directive said there should be exceptions for national security, the impact it will have is uncertain: Using just about any computer bug as a weapon can be justified as the Web plays an increasingly central role in intelligence gathering and kinetic conflict. During his confirmation hearing, Navy Vice Admiral Michael Rogers, director of the NSA and the U.S. Cyber Command, said it would be hard to imagine an international crisis not involving digital weaponry.

A valuable arsenal

It’s also hard to imagine the U.S.’s increasingly sophisticated cyberspying and cyberwar operations without its deep arsenal of software exploits, according to current and former arms makers. Those operations would be slower and more susceptible to detection without zero days.

And like giving up sophisticated missiles and bombers, giving up an arsenal of highly valuable computer exploits could leave the country more vulnerable in a future national security crisis, those experts say. Pentagon contractors are working on developing them for the CIA, the Army’s recently activated 780th Military Intelligence Brigade, the NSA’s Tailored Access Operations corps and other units.

Spending ramps up

As conventional military spending has been cut back and funding for cyber operations ramped up, Lockheed Martin, Northrop Grumman and others better known for jets and tanks are retooling for a new generation of armaments.

“Of countries that are developing industrial-strength cyber capabilities, certainly the U.S. is in the lead,” said Nate Freier, a research professor at the Army War College in defense and military strategy. “The question is whether we understand it well enough to use it without encountering a significant amount of blowback or unintended consequences.”

Spy agencies develop exploits themselves, buy them from contractors or steal them from rivals. And the arsenal must be constantly refreshed, as the software at which they’re aimed is updated and fixed. Some exploits are used for years; others only for a short time before the flaws on which they are based are patched.

Special tools

There are more than bugs in the government’s arsenal: Hackers at the NSA’s Tailored Access Operations, or TAO, have more than 1,000 special tools to aid them in stealing data or manipulating a rival’s electronics. As described by three people briefed on the technology, the tools enable rapid, mix-and-match attack capabilities against the most widely used computers, servers and software.

If TAO wants to switch on a microphone in a computer running Microsoft Windows, covertly recording conversations of anyone nearby, a custom module does the job. If it needs to hijack the system that communicates between computers and the controls that operate train-track switches or dam flow gates, there’s a plug-in for that too. Dozens of the plug-ins can be loaded onto a single digital warhead, customized to the needs of the mission at hand.

Private sector help

The private sector provides support at all levels. When intelligence agencies were looking three years ago for holes in commercial software that runs video conferencing systems, they reached out to several contractors. Endgame, an Atlanta- based company that once specialized in weaponizing software bugs, provided the exploits, allowing U.S. spies to tap into the systems, according to a person familiar with the contract.

Sara Conneighton, a spokeswoman for Endgame, which is also working on commercial security applications, said she had no comment on business the company may have done with the U.S. government.

Most defense contractors have launched cyber-weapons programs; many have grown through acquisitions of boutique security and Internet-intelligence firms.

Northrop Grumman, which makes the Global Hawk drones, purchased Essex, a NSA supplier, in 2006. Combat radio- maker Harris Corp. purchased Crucial Security, which develops hacking tools, in 2009.

“Cyber money is not shrinking the way the rest of the defense budget is,” said Dave Aitel, chief executive officer of Immunity, an offensive security firm in Miami. “That means that all the big beltway bandits must invest heavily to build their cyber teams and that this market is going to continue to grow.”

A 20 percent increase

In President Barack Obama’s proposed fiscal 2014 budget, the money for cyber operations jumped 20 percent, to $4.5 billion, and the Pentagon placed it on a list of priority programs, an unclassified comptroller’s presentation shows.

The Defense Department foresees spending $26.6 billion on cybersecurity efforts for the five years ending in 2019, and requested $5.06 billion for fiscal year 2015, according to Pentagon budget documents.

Of all the major defense contractors, Raytheon may be best positioned to take advantage of the shift through a little- noticed acquisition made six years ago. In 2008, it bought SI Government Solutions, the brainchild of a former computer science professor at the Florida Institute of Technology who developed a method to rapidly scan software code to find flaws that could be exploited by hackers. Since then, the Raytheon division has grown to become one of the most prolific U.S. cyber arms makers, said several people familiar with the subsidiary.

Its engineers develop exploits not only for computers but for every conceivable device with a microchip, from heating and air conditioning systems to printers to industrial computers used in manufacturing, according to a person who was recruited by the company and received a detailed description of the program.

Air-gapped computers

For the CIA, SI Government Solutions specializes in ways to gain access to computers that aren’t connected to the Internet, according to a second person familiar with the subsidiary’s government contracts. That includes the use of technology that can surreptitiously transfer data from so-called air-gapped computers, which often contain a rival country’s most sensitive secrets.

Jason Kello, a Raytheon spokesman, declined to comment on the company’s role or to identify its clients. Ed Wallach, who recruits prospective employees for SI Government Solutions, said high demand and the need for specialized skills makes his job difficult, even though the 250-person subsidiary offers a more lucrative benefits package than the rest of Raytheon.

“We may not be building ships, but it’s clear this is one area where the government is willing to spend money,” he said.

Finding software bugs

Finding bugs requires the creativity of human researchers as well as the power of computers, which relentlessly pound software programs with unpredictable data to spot a possible malfunction, a technique called fuzzing. The Finnish company Codenomicon was using an advanced fuzzing engine when it detected Heartbleed earlier this month, according to Mikko Varpiola, a Codenomicon co-founder. Researchers from Codenomicon and Google reported both the flaw and a fix for it.

ForAllSecure, a Pittsburgh company founded by researchers from Carnegie Mellon University, has a Pentagon contract to teach computers to scan for software vulnerabilities and automatically generate attack code. Its product, called Mayhem, has been used to analyze more than 37,000 off-the-shelf software programs and found 14,000 bugs in them, including 152 for which the company has developed exploits, said David Brumley, an assistant professor in computer science and engineering at Carnegie Mellon University who is leading the work. Without automation, it can take months to turn a coding mistake into a weapon.

If the U.S. wanted to use an exploit to gather intelligence and not disclose the underlying error’s existence, Brumley said he wouldn’t object. “We have to be free to be able to strategically and appropriately use cyber weapons,” Brumley said.

Unlike Tomahawk missiles, which do one thing and with a high degree of reliability, even the best-crafted exploits are unpredictable, because computer systems and software can come in almost endless combinations of configurations that could foil attacks. Siege Technologies, a startup in a converted 19th century textile mill along the Merrimack River in Manchester, New Hampshire, is working to change that with more than $10 million in contracts from the Department of Defense and other agencies.

Predicting success

For the last four years, Siege has been developing an algorithm that predicts the likelihood of a cyberattack’s success, a process that entails running attack code through thousands of test cases to generate models of how effective it would be in the real world, whether it’s breaking into power grids to hacking mobile phones. The company’s main product is Eprouvette, named after military equipment used to test the strength of gunpowder.

Siege Technologies is considering enhancements that would provide real-time feedback as to whether an exploit actually hit its target, said company founder Jason Syversen, whose background is in cryptography and hacking. Military commanders “want a smoking crater to prove an attack was successful,” he said. “We don’t have that in cyber.”

Syversen said he set out to create the equivalent of the military’s so-called probability of kill metric, a statistical analysis of whether an attack is likely to succeed.

“I feel more comfortable working on electronic warfare,” he said. “It’s a little different than bombs and nuclear weapons — that’s a morally complex field to be in. Now instead of bombing things and having collateral damage, you can really reduce civilian casualties, which is a win for everybody.”

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Local News

A firefighter stands in silence before a panel bearing the names of L. John Regelbrugge and Kris Regelbrugge during the ten-year remembrance of the Oso landslide on Friday, March 22, 2024, at the Oso Landslide Memorial in Oso, Washington. (Ryan Berry / The Herald)
‘Flood of emotions’ as Oso Landslide Memorial opens on 10th anniversary

Friends, family and first responders held a moment of silence at 10:37 a.m. at the new 2-acre memorial off Highway 530.

Julie Petersen poses for a photo with images of her sister Christina Jefferds and Jefferds’ grand daughter Sanoah Violet Huestis next to a memorial for Sanoah at her home on March 20, 2024 in Arlington, Washington. Peterson wears her sister’s favorite color and one of her bangles. (Annie Barker / The Herald)
‘It just all came down’: An oral history of the Oso mudslide

Ten years later, The Daily Herald spoke with dozens of people — first responders, family, survivors — touched by the deadliest slide in U.S. history.

Victims of the Oso mudslide on March 22, 2014. (Courtesy photos)
Remembering the 43 lives lost in the Oso mudslide

The slide wiped out a neighborhood along Highway 530 in 2014. “Even though you feel like you’re alone in your grief, you’re really not.”

Director Lucia Schmit, right, and Deputy Director Dara Salmon inside the Snohomish County Department of Emergency Management on Friday, March 8, 2024, in Everett, Washington. (Ryan Berry / The Herald)
How Oso slide changed local emergency response ‘on virtually every level’

“In a decade, we have just really, really advanced,” through hard-earned lessons applied to the pandemic, floods and opioids.

Ron and Gail Thompson at their home on Monday, March 4, 2024 in Oso, Washington. (Olivia Vanni / The Herald)
In shadow of scarred Oso hillside, mudslide’s wounds still feel fresh

Locals reflected on living with grief and finding meaning in the wake of a catastrophe “nothing like you can ever imagine” in 2014.

Everett mall renderings from Brixton Capital. (Photo provided by the City of Everett)
Topgolf at the Everett Mall? Mayor’s hint still unconfirmed

After Cassie Franklin’s annual address, rumors circled about what “top” entertainment tenant could be landing at Everett Mall.

Everett
Everett man sentenced to 3 years of probation for mutilating animals

In 2022, neighbors reported Blayne Perez, 35, was shooting and torturing wildlife in north Everett.

Dorothy Crossman rides up on her bike to turn in her ballot  on Tuesday, Aug. 1, 2023 in Everett, Washington. (Olivia Vanni / The Herald)
Everett leaders plan to ask voters for property tax increase

City officials will spend weeks hammering out details of a ballot measure, as Everett faces a $12.6 million deficit.

Starbucks employee Zach Gabelein outside of the Mill Creek location where he works on Friday, Feb. 23, 2024 in Mill Creek, Washington. (Olivia Vanni / The Herald)
Mill Creek Starbucks votes 21-1 to form union

“We obviously are kind of on the high of that win,” store bargaining delegate Zach Gabelein said.

Lynnwood police respond to a collision on highway 99 at 176 street SW. (Photo provided by Lynnwood Police)
Police: Teen in stolen car flees cops, causes crash in Lynnwood

The crash blocked traffic for over an hour at 176th Street SW. The boy, 16, was arrested on felony warrants.

The view of Mountain Loop Mine out the window of a second floor classroom at Fairmount Elementary on Wednesday, Jan. 10, 2024 in Everett, Washington. (Olivia Vanni / The Herald)
County: Everett mining yard violated order to halt work next to school

At least 10 reports accused OMA Construction of violating a stop-work order next to Fairmount Elementary. A judge will hear the case.

Imagine Children's Museum's incoming CEO, Elizabeth "Elee" Wood. (Photo provided by Imagine Children's Museum)
Imagine Children’s Museum in Everett to welcome new CEO

Nancy Johnson, who has led Imagine Children’s Museum in Everett for 25 years, will retire in June.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.