3 ms·
One thing the NSA is very good at is getting access to virtually every type of networking card. If they achieve access to a target, it's likely they control a p
by shawn 8y ago
One thing the NSA is very good at is getting access to virtually every type of networking card. If they achieve access to a target, it's likely they control a path to it.
If the target is a wifi device, the custom protocol becomes doubly effective: Exfiltration is a matter of having a receiver anywhere in the vicinity. And that receiver can amplify the signal to blast it a few miles. There are tools to sweep the EM spectrum looking for anomalies like this, but they seem to be rare, for the moment.
- viraptor 8y ago> If they achieve access to a target, it's likely they control a path to it. Without specific, documented cases this is speculation of course. But I don't see why they'd use a link level protocol. 1. It requires patching multiple networking devices in the path, which is not very quiet. 2. It sticks out in any monitoring (via mirror ports) more than a UDP packet to a random host. DNS or ntp as a transport would be much simpler to hide.
- amoshi 8y agoAnd what exactly would be the problem for the NSA with patching networking devices? They even mention how it's useful specifically for these hard targets >"some of the most productive operations in TAO because they pre-position access points into hard target networks around the world." https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...