Documents
XKS, Cipher Detection, and You!
Jul. 1 2015 — 9:52 a.m.
TOP SECRETIICOMINTHREL TO USA, FVEY
Cipher Detection, and You!
.
Mathematice Research Group
21 August 2008
TOP SECRETUCOMINTHREL TO USA, FVEY
The Protocol Stack
Application Layer (HTTP, FTP, etc.)
Transport Layer (TCP, UDP)
Network Layer
Data Link Layer
K/i?
Physioai Layer (Copper, Fiber)
TOP SECRETNCOMINTHREL TO USA, FVEY
Data Sources
. FORNSAT (downlink)
Overhead (uplink)
Special Source
Tailored Access
F6
1' FISA (limited)
3rd party
TOP SECRETHCOMINTHREL TO USA, FVEY
TO USA, FVEY
Front-end Processing
TURMOH.
SECRETHCOMINTHREL TO USA, FVEY
TO USA,
What does .1
Selection of tanked UTT terms.
Send hits; to PRESSUREWAVE.
Tipping t0 TRAFFICTHIEF.
Fingerprinting.
SIGINT development using two roiling buffers:
Metadata
1' Cnntent (data)
SECRETHCOMINTHREL TO USA,
TOP SECRETIICOMINTHREL TO USA, FVEY
Retrospective Searching
etad ata Centth
Buffer Buffer
30 days ?t 7 days
Searehable Retriesable
data are stirred, net Archived
just hits. database en disk
Queries are distributed
te entire netwe-Tk ei? sites.
TOP SECRETHCOMINTHREL TO USA, FVEY
Fingerprinting
. Pattern matching against the data.
Session is marked} but not sent to PINWALE.
Fingerprint stored as metadata.
1* Have to search for it.
1' Rich set of patterns
Strings have a minimum otithreeii? anchors (fixed bytes)
Exception: Two bytes at the beginning session]
Regular expressions allowed (require nonoptional string of
three* bytes within regex)
Context?dependent terms.
reserves the right to in this to four.
Examples
-
7.0)
I 3.0)
and
and
(port(443) 0r port(80));
i
'helix stronghold file'
I-
Syntax Features
0 Case Sensitivity
fingerprint certificate/digital_id'
-BEGIN CERTIFICATE-
1' F1111 Boolean logic
Granping with parantheses
Operators: and, or, not
Variables
$udp
$udp and 'openan_wera'c;
Available Functions
port
first
'lbex
pos
pos('CPAD1'c) 4000;
Distance (Similar to pos, but for distance between tokens)
LpoS
Spop_basie or
First
. ?rst('ehlo') and
Last (Similar to first)
Follows (one token after another)
Between (one token between two others)
Order
Other Features
. Fingerprint de?nitions updated hourly throughout the entire
enterprise.
Work?ows
Submit through user interface.
Standing queries that run like cron jobs.
Limited follow?on processin?.
1' User interface For Fingerprint submission (coming soon).
Currently done by XKS personnel.
Plug?ins
. Full power of for when pattern matching does not
suffice.
Usuall}I limited to certain file types
II Huge volume from web surfing
1' Current steg/ plugins that fingerprint seSSions:
PHOSPHORESSENCE library of? steg detectors
Steg detection
SEDENA indigenous software
Drawbaek: Must wait for site upgrade to deploy.
Trade?off
. Fingerprints easily deployed, but limited to pattern
matching.
Plug?ins slow to deploy, but allow for complex testing.
New compromise:
Snippets of? code in fingerprint
Deployed hourly like Fingerprint with most of the Flexibility of a
full plug?in.
Very eomplieated tests probabl}I still need to be plug?ins.
Currently stood up at only a few sites.
Example
eenet uint8_t *ptr
if (ptr NULL)
return false;
if 64)
return false;
if 0x04)
return false;
if 0380)
return false;
return true;
Advanced Feature
. Follow-0n Check with anchorless regexes:
%dhcp_?heck regex
3.0)
from;port(68) and te_Port(67)
%dhcp_check;
Releasability Issues
. Nearly all XKS personnel have PICARESQUEI
Those that don?t have PRIVAC.
1' XKS distribution comes in twe flavors
1* 1st 3i 2nd part}?
3rd party
No NOFORN capabilities permitted.
1* Special dispensation from?fer some capabilities to
SMOKYSIN K.
Can keep PICARESQUE code running on R1 is rednet if
absolutely necessary.