NSAICSS Threat Operations Center Cyber Pro ling and Operations Support V43 A Covert Monitoring System for Operations Support TOP FVEY U Topics - U What is - U What are the benefits - U How does it work - U Architecture - U Future Work TOP SECRETIICOMINTIIREL FVEY U What is MORECOWBELL MCB is a V43 developed system used to support V3 and JFCC-Network Warfare Operations Built on the PACKAGEDGOODS infrastructure and cover mechanisms Deployed on a covered infrastructure on the public Internet Performs DNS lookups and HTTP requests against targets on regular intervals Used to track changes to DNS resolution as well as up down status of websites TOP SECRETIICOMINTIIREL FVEY U Benefits - MCB enables the NTOC to monitor thousands of Internet websites in near real- time Foreign government websites Terrorist Extremist web forums Malware Domains callback or beacon addresses US Government websites via Request for Technical Assistance from Homeland Security - Currently used to support Battle Damage Indication after CNA and for Situation Awareness - OPSEC unattributable to the USS TOP SECRETIICOMINTIIREL FVEY U How Does it Work U Consists of Central tasking system housed in V43 office Spaces Several covertly rented web servers referred to as bots in Malaysia Germany and Denmark The MCB bots utilize open DNS resolvers to perform thousands of DNS lookups every hour MCB bots have the ability to perform HTTP GET requests mimicking a user s web browser The data is pulled back to the NSA every 15-30 minutes Data Currently available on via web services TOP SECRETIICOMINTIIREL FVEY                     National Security Archive    Suite 701  Gelman Library  The George Washington University    2130 H Street  NW  Washington  D C  20037    Phone  202 994‐7000  Fax  202 994‐7005  nsarchiv@gwu edu