First, I don't think this is the NSA. It is far to sloppy for something like this. You probably wouldn't be able to detect them so easily. It is possible to be

First, I don't think this is the NSA. It is far to sloppy for something like this. You probably wouldn't be able to detect them so easily. It is possible to be from another nation state though, or smart attacker. Also, we know that the NSA tries to cover their tracks: http://arstechnica.com/tech-policy/2014/08/snowden-the-nsa-not-assad-took-syria-off-the-internet-in-2012/ http://arstechnica.com/tech-policy/2014/08/snowden-the-nsa-n... "Instead, the TAO’s hackers “bricked” the router, Snowden said. He described the event as an “oh shit” moment, as the TAO operations center team tried to repair the router and cover their tracks, to no avail." What I am confused about is that I assumed IOS images were signed. How are people creating backdoored IOS images without failing signature checking? Maybe they patched rommon?