Title: LANDMARK

Release Date: 2014-08-15

Description: Undated CSEC slides describe LANDMARK, a tool which is used to expand the Five Eyes’ network of Operational Relay Boxes (ORBs) and other compromised machines located outside of Five Eyes territory. Another tool, OLYMPIA, automates the process of pursuing leads identified using the HACIENDA post scanning tool: see the Heise article The HACIENDA Program for […]

Document: Abbildung17-4271ef23aec87e86.png:
TOP SECRET//COMINT

■ ju ■ Communications Security Centre de la sécurité ■ “ ■ Establishment des télécommunications
Presentation Outline

* LANDMARK - automated tradecraft to further expand CNE
covert infrastructure

*

CanadaAbbildung18-632df782fe449c6f.png:
TOP SECRET//COMIINT

Communications Security Centre de la !

LANDMARK

* CSEC's Operational Relay Box (ORB) covert
infrastructure used to provide an additional level of
non-attribution; subsequently used for exploits and
exfiltration

* 2-3 times/year, 1 day focused effort to acquire as many

new ORBs as possible in as many non 5-Eyes countries
as possible____________________________________

CanadaAbbildung19-7e51ea450ded8b67.png:
TOP SECRET//COMINT

Communications Security Centre de la s©

LANDMARK - the recent past....

* February 2010

* Operation encompassing the whole of LONGRUN solely
using OLYMPIA (CSEC's network knowledge engine with
automated tradecraft)

* 8 teams of 3 network exploitation analysts busy for 5-8
hours

* A list of 3000+ potential ORBs

CanadaAbbildung20-61ff4bfacd891ebc.png:
TOP SECRET//COMINT

I Ju ■ Communications Security
Establishment

Centre de la sécurité
des télécommunications

XI Olympia vet sien 0.5.0

Zork ‘¿¡rdc* **)

*°Cçp ünr* Jsojtt:

9 Girre al ?oc oit # CrrK al voj co: 6y Cor&v c-i

$«rd>

Cental, rt y I
Ccirr r Irva \¿|
C«teftarçr IftstJOdws v
StoftOole: I|127XtCCAN
n>3 Cuca: HTG7W» vj| 11:5ftSO PM ; |
Crjrmrto

□ 9w*re

□ àÿ'Jv^C>t06^r
□ |s 9»7Ari^i-»0n^eC%rnr5
□ y 3»* rauto cotIqlí ofoi «brrätem (TIWL SlRCT;

Q ” P CtmjKjW

□ % ÎVA'Gwixom ïibrrttm

□ V Neî*»cr k Irfama üon

Q I fttt* SCNT Ctttt vâtta Fiaixt fcfardtti

□ ji ÏT7«rJTSV< Ir^çrn^lc^

□ % dmvCfectocBien vao

□ g a**« cri ia*uï

0 :29wArt$c*^onP

[ Sdecta llttedecta

~ P Aí>sró*e*UU¿(lWMj

1

Sauça Spin*

GCM? naoreb
GCK Hxwrte
GCK *N»nfc
GCK* na«jva
o:K Ksfcrtâû

GO*? ftíúrta

GCK *xxrcte
GCK n»srrte
GCK* Haoyvsa
CCK naoendû

**wxte

Wyr»

H5WVM

«ûs>a

naranda

njcwxb

*****

H3«rVÂ

*aaa*to

naorcb

*****

*305*0

«Û5>3a

ruando

*****

*****

HaGs**

Haùenda

naorcb

*****

*****

*aôo*b

wûar»

Rui

GCK

GCK

GCK

ÛCK

CCH?

GCK

GCK

GCK

ÛCK

CCH?

GCK

GCK

GCK

GCK

CCH?

GCK

GCK

W

ÛCK

ccK

GCK

GCK

g:k

ÛCK

ccK

GCK

GCK

&2K

ûck

ccK

GCK

GCK

GCK

ÔCK

ccK

GCK

GCK

W

ÛCK

ccK

GCK

GCK

GCK

CCK

CCK

GCK

trun

<

*****

*****

Kaôo^fla

«Û3ÜÛ

*****

Haôs>&

«úíOa

n«o^d*

*****

*****

HsGs**

«ûûrto

*****

K»5V8

Kaôoxto

naxrcb

*****

first See«

Tu*Na*750a:tt:03(»TTMW

Tc*N©v290î:lt:03 8«TMW
TueNav 2? 33:11:03 (HT MW
Ti*Nôy *903:11:03 (HT MW
TuANiy 7503:11:03 (HT MW

TucN»v?5.H:it;CU(MTMW
Tl*N©v 2905:07:29 9*T MW
TUNav »04:15:01 (HT 30»
Tu* N* r904:lS0î(HTMW

¿N-Y ?j')t

Tu*N*tf04:l5c0l(HT»W
Tl*N*v 2904:1*0] (HT MW
TUNôv2904îlSt01TteNôy 29û4:l£0l(MTM0S
Tu*N*,*75û4:lSiÛl(HTMW
TueM»v??0Ti«Nav2904:l*0]HTMW
TUCNay 2904:17528 (HT MW
TueNôyl904:t?.2a(HTMW
Tu*Na* ?5û4:l7i23(HTMW
Tl*N* 2904:1*20 HT MW
Tl«n«v2904:1*Z0HTMW
TueNav2904:L?::3(HTMW
TueNôv 7904:17.23 HT MCO
Tu*Na* 7504:17:23 HT MW
Tue N*v 1904:17:20 HT MW
Ti*N«v 2904:1?» HT MW
Tu*Nôyl904:i?.-«5H7M»
TueNôy 7904:1?.-« OIT MW
Tu* Na* 75 04:17:40 OIT MW
TL*N*v »04:17:40 HT MW
TueN*v»0*:l?-aoonMW
TueNô> 2904.L?.40H7MW
Tu*Nûv 2904:1?/« OIT MW
Tu.N»v75 04:tX4ÛHTMW
Tl*n*v»04:1?4QHTMW
Tc*N«*2904:l?40HTMW
TueNôy 29011*24 HTM»
Tu*Xnt7Cfcl3:l3GMT2ÎÛ3
Tu»Xr!l?Cfcl3:>5CMT21Û3
TieXr l7Cfc]2:49GMT2C05
TueXr 17CC03:»GMTZC05
Tue An 17 CCi 23.59 GMT 2C03
Tu*Xnt7 0?.(M:»GMT2Îû3
Tu» Itrt 17 07:03:13 CMT 2CÛ3
Tue Xr 17 07:01:12GMT £03
TueW070^30'«3CHT2CC9
Tue Xi 07O7.32.M CMT 2009
Tue Xi 070?.31:22 GMT 2CW
Tu» Xi 070X33:23 CMT 21to
TleXi070^30:17CMT2C09
Tie Xi 070*3*54 GMT 309
Tu* Xi 07«..49.57CMT2«
Tu*Xi07C*47:l7CMT2ÎOÎ
Tu» Xi 07 ce 1303 CMT 2ÍM
Tl* X« 17 CO >3:20 GMT £03

T. » >1 n7rotf*K r.vr -r«o

U3! Sien

TuJ Kif 73 0a:ll:035

T«K„tf«:U;G3
neKff »03:lL-03Tt>sNjf :3 03::i'030Tuî Na, Î9M:1L030T3W9
Tuû Na, ?3 03:11:03 05

T«N,,tfCW:n;G3
Ti*N5f Î9(MJ)^2?0*79
TOeNif »04::5c0IOT3»9
Tue Na, 73 04:i5cOUWTM»



T«N5,î)04:35c0iO(Ti)»
Ti* N?, 2904:!:<01<3YT?W?
TOCNjf 2304:15c0lO(ra»9
Tue Na, rîOi:i5cûlOTua Na, ?3 04:i*0l0(T »>5
Ti*N,ffl04:35c0ln*N9, »04:13cOl4T3M9
Tus Nj/ .-3 04::7:X<7Tue Na, 73 04:i?.aOTua Na, 73 04:]^OiTM>5
ToeNj, »04:17:3aT* Na, »04:1*»^ 3W?
Tue Nj, .'3 04:i7:3(3Tue Na, T3û4:l?.aaTuJ Na, 73 0l:l7i^O4T 3»5
Ti* Nj, »04;l7:acynM7?
T*Nj, »04:]7:2»a^T?M9
Tu: Na, :3 04.:7«xrny?
Tue Na, l3 04:i?.Tua Na, J304:i7t4DQfr M>5
Ti* Nj, »04;]7Kl^T* N?, »04:l^Tue Na, ;'3 04.:?.«*T»>3
Tue Na, rî04:i7.Tu. N», 73 04:l>.a004T>»5
n*N5, »04:17.«ä004TM79
T* Nj, »04:17400^ M79
Tue Ma. .’3 04.^24047
Tueln l7tXr.Ü:î3GMT^Cé;
Tu. Xji 170X13:33 CMT CÍC6
TueXr 170X12:^ GMT 2cce
Tt*Xrl70CH3:WGMT2Cce
Tue X/i 170G. 13.53 GMT
Tue X* 1707.W:M GMT 2C6
Tu. Xr» 170>.03:13 CMT 2CC6
T* Xr 1707.01:12 GMT 2îce
•.V«JPflb03 3]î]?>4(94TM30
'•V^3Fd>03 ilil«%S5«T3330
WedPeb03 11:1*34(HT M>5
W«dftb03 11:1* W (HT M75
*.¥edreb03 31:15clt(HTM)0
'.v^3Peb03 31:1* IS (HT M)0
'f'^5Peb03 21.1AS0 (HT M>2
.vgdFabOl 11.-14W (HT M>5
'.'^f^bOl 12:0*0? (HT Mlû
TUeXrl7i>XX:MGMT2C
UA-c-Km nwvjnmr yvn

W-24M47^3.re\er»

W-247-147-4i.te\ oîc. ret |
Éû'24?*i47-42.ie\0’ie.nf^ei.fet
ÉÛ-3 47-I4743.re\w*.nr»*»..r»t
W 247-l-a j-M.rtNü^.nr/i^ej.ret
EC-247-147-45,rveviAe5.r«t I
W-24?-i47-45.(e%o^f>:<>xi.fet |
fcO •247- la 7-47.f tNírií. .fi<

P302-pv.ere*'ec\net

Par: (rottd Slate * m
50 *0 Itfcd 0
no >3» «*r«J 0
111 n> n>y«i 0
lél » fierce 0
162 « ^ia-«3 0
443 « l)i*3 0
5(0 to «»red 0
0 irtimn irriMtfub* 0
110 » r 0
-HI >:p 0
60 *3) wet 0
21 >3) 0
22 » ewee 0
23 >3) ctoed 0
lit « cteao 0
161 13) ct«d 0
1« 13) cttffd 0
21 13) eweo 0
22 13) ckied 0
23 13) ekead 0
25 >3) 0
» 13) 0
110 13) ewed 0
111 13) ckied 0
161 13) úuad 0
IK 13) d»ed 0
13) CtW’ 0
21 13) Owed 0
22 13) Owed 0
23 13) cuad 0
25 13) ckaed 0
30 13) a?r 0
110 13) Owed 0
111 13) Owed 0
161 tep ck».d 0
IK 13) ctoed 0
*45 13) q*n 0
0 aitamn irveoOiaL« 0
0 i«*».« urMOvsW: 0
0 infaw-n ur»»c4W5ta 0
0 irrecdvst^ 0
0 ir&mn irrwOxsCi? 0
0 uiW»/.n irreaOvaW: 0
0 arta»».« UT«dvi* 0
0 u!bw.n ur»»cfW3ii 0
0 inbm^ irre-d^aWe 0
0 iDnr/.n irre.**** 0
0 in»Wftfl ureoOvabie 0
0 ureeOvat* 0
0 irbw,n ur»»íhá5ii 0
0 itWja« irrwdvjWc 0
0 irtavr/.n irrevtvC* 0
0 vnloTAfi ureaOvaWc 0
0 irYaa*hab«6 0
0 irbr.,n 0
23 13) 0
n n

m CVodei
c/ènc^i
uHrc-v^
urtre*^
urtrcATi
urine**
urine**

urinc*^

urtnc*«

Kero Va*5er.«f PCf3 Sentr

KffoMa&a*t -.reural

M*jow*t IK *ebwritjow4î ♦t«

urine**
urine**
urine**
urine*«
urine*«
urffe**
urine**
u/inc**
urine*«
urine*«
urine**
urine**
urine**
urine*«
urine*«
urine**
urine**
urine**
urine*«
urine*«
urine**
urine**

urine*«

urine*«
urine*«
urine**
urine**

urirc*«

urine*«
urine*«
urine**
urine**

urine*«
urine*«
urine*«
urine**
urine**

urine*«

urine*«
ur*c*«
urine**
urine**

urine*«

OX0"X»fcf
i rfo**n

urtrevn

ur*rc»»i

urtrc*n

urijw

e.0

urtrc»fi

irtrcvn

urtrc^i
urire#*

irirw

ur*7cwi

jrtircm

urtrewr

irtsc*\

ur*7c»n

urtrc*n

urtrevn

ur*rc»»i

urtrc»*i

urirc^n

irirc*n

isi/cm

urfcro»!

ur*rc*n

uri7w

irtrw

urt/o»!

urirown

ur*rw

urtrc^i

uTi/im

ur*rc»n

ir*rc*»i

ur*rc»»i

irire*»!

UTÍ70*n

irire*«

urtje»«

irire*»!

UTÍ7W

irire*«

irt/ewi

irire*«

irire*»!

irire*«

Bü®

»

4lS2.LMZ7M1719i^J\T

irire*«

irire*«

Jiré*«
irire*«
irire*«
irire*«
irire*«
irire*«
irire*«
irire*«
irire*«
irire*«

irire*«

irire*«

irire*«

irire*«

irire*«

irire*«

irire*«

irire*«

irire*«

irire*«

uire*«

irire*«

irire»»!

irire*«

irire*«

uire*«

irire*«

irire*»!

irire*«

irire*«

irire*«

irire*«

irire*»!

irire*«

irire*«

irire*«

irire*«

irire*»!

irire*«

irire*«

uire*«

irire*«

irire»»!

irire*«

1

* BUT, network analysis still manual!Abbildung21-6d5c0274874ca75c.png:
1*1

TOP SECRET//COMINT

LANDMARK today...

* Network analysis tradecraft to determine vulnerable
devices has been encoded within OLYMPIA

CanadaAbbildung22-9cc784f4f26425fc.png:
TOP SECRET//COMIINT

Communications Security Centre de la

GSM provider

* NSA TAO requested assistance gaining access to the
network

* Network analysis using OLYMPIA:

* DNS query to determine IP address

* IP address to network range

* Network range to port scan

* Are there any vulnerable devices in that range?

* Duration: < 5 minutes

Canada

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh