On June 22 this year, Northwestern Polytechnical University issued a "Public Statement" saying that the school was attacked by overseas cyber attacks, and then the Xi ‘an police officially filed an investigation. The China National Computer Virus Emergency Response Center and 360 Company jointly formed a technical team to participate in the technical analysis of the case, and on September 5, the first "Investigation Report on Northwestern Polytechnical University’s Cyber Attacks by NSA in the United States" was released. The investigation report pointed out that the source of this cyber attack was the specific intrusion action office under the National Security Agency (NSA). Today (27th), the technical team released the investigation report on related cyber attacks again. The report revealed that during the cyber attack on Northwestern Polytechnical University, the Office of Specific Invasion Action (TAO) built a (so-called) "legal" channel for remote access to the core data network of infrastructure operators in China, and achieved the infiltration control of China’s infrastructure.Details > >
A number of evidences show that the National Security Agency (NSA) is behind the scenes.
The investigation report revealed that the Office of Specific Invasion Operations (TAO) under the National Security Agency (NSA) exposed a number of technical loopholes and made many operational mistakes in the process of cyberattacks on Northwestern Polytechnical University. Relevant evidence further proved that the behind-the-scenes attack on Northwestern Polytechnical University was the NSA.
The investigation found that when using tipoff activation command and remote control of NOPEN Trojan, the Office of Specific Invasion Operations (TAO) under the National Security Agency (NSA) must operate manually, and the actual working time of network attackers can be analyzed from the attack time of these two tools.
First of all, according to the big data analysis of related cyber attacks, 98% of cyber attacks on Northwestern Polytechnical University are concentrated between 21: 00 and 4: 00 am Beijing time, which corresponds to 9: 00 to 16: 00 EST, and belongs to the domestic working time in the United States. Secondly, there was no cyber attack on Northwestern Polytechnical University on all Saturdays and Sundays in the United States. Thirdly, by analyzing the unique holidays in the United States, it is found that the "Memorial Day" in the United States has three days off, and the "Independence Day" in the United States has one day off. During these four days, the attacker did not carry out any attack and theft. Fourth, after a long period of close tracking of the attacks, it was found that all cyber attacks were silent during the Christmas period. Judging from the above working hours and holiday arrangements, those who attack and steal secrets against Northwestern Polytechnical University are unscrupulous and undisguised in their activities according to the schedule of working days in the United States.
Du Zhenhua, Senior Engineer of National Computer Virus Emergency Response Center:TAO’s cyber attack on Northwestern Polytechnical University shows that the technical complexity is relatively high, the attack cycle is relatively long, and the workload of manual operation is relatively large, so under such conditions, the probability of human error is relatively high. Then these mistakes can be used by us to analyze the attribution. According to the attribution analysis, for example, the instruction string leaked in the accident this time, as well as some characteristic strings in the code, then the characteristics of this natural language reflected by it are in line with the characteristics of this English-speaking country.
During the long-term tracking and reverse osmosis of network attackers, the technical team found that the attackers have the following language characteristics: First, the attackers have the habit of using American English; Second, the internet devices associated with the attackers are all equipped with English operating systems and various English-language applications; Third, the attacker uses the American keyboard for input.
360 company network security expert Bian Liang:For example, we caught it once. During the attack, its command to send a script was wrong, wrong, and wrong. Then, this tool will prompt the attacker, and if something goes wrong, it will return the error information to the attacker to give him a hint. This information includes the attacker’s current operating system environment, which actually exposes that the attacker’s related information is the US War Office (TAO).
The technical team found that at 5: 36 on May 16th, 20 ××× Beijing time, the cyberattacker used the springboard machine located in South Korea (IP: 222.122. ××××××) and attacked Northwestern Polytechnical University again with the NOPEN Trojan. When trying to invade and control a network device after the third-level infiltration of the intranet of Northwestern Polytechnical University, there was a human error when running the upload PY script tool, and the specified parameters were not modified. After the script is executed, an error message is returned, which exposes the working directory and the corresponding file name of the attacker’s online terminal. From this, it can be known that the system environment of the Trojan control terminal is Linux system, and the corresponding directory name "/etc/autoutils" is the special name of the directory of network attack weapons tools of the specific intrusion action office (TAO).
The error message is as follows:
Quantifier follows nothing in regex; marked by <– HERE in m/* <– HERE .log/ at https://news.cctv.com/2022/09/etc/autoutils line 4569
The technical team found that 16 of the 41 different cyber attack weapons used in the attack on secrets of Northwestern Polytechnical University were completely consistent with the TAO weapons exposed by the "shadow broker" in 2016; Although 23 tools are not exactly the same as those exposed by the "shadow broker", their genetic similarity is as high as 97%, and they belong to the same type of weapons, but their related configurations are different; The other two tools can’t correspond to the "Shadow Broker" exposure tool, but they need to be used together with other cyber attack weapons tools of TAO, so these weapons and tools obviously have homology and belong to TAO.
360 company network security expert Bian Liang:Every program developer or author will have his related habits, for example, it is similar to our writing style, and he won’t easily change this habit in a day or two, so the program is the same. There are many such logics in it, and its algorithm includes its data structure, so we will grasp this habit through our analysis and make a comprehensive comparison to find out whether it belongs to such an attack weapon of the same type or the same family and gene.
The comprehensive analysis of the technical team found that in the tens of thousands of cyber attacks against targets in China, especially the thousands of cyber attacks launched against Northwestern Polytechnical University, some weapons used in the attack process were implanted with Trojans before the "shadow broker" exposed NSA weapons and equipment in 2016. According to NSA’s behavior habits, the above weapons and tools are likely to be used by TAO employees themselves.
NSA invades China’s infrastructure-related equipment and steals user privacy data.
It is understood that the technical team conducted forensic analysis on the traces of cyber attacks suffered by Northwestern Polytechnical University and the on-site environment through relevant technical means, and judged the attack methods and time of the specific intrusion action office (TAO) under the National Security Agency (NSA), and disclosed typical cases of related cyber attacks.
1. Steal key sensitive data such as password and operation record of remote business management account of Northwestern Polytechnical University.
According to the investigation report, the specific intrusion action office (TAO) under the National Security Agency (NSA) installed a sniffing tool "drinking tea" in the operation and maintenance management server of Northwestern Polytechnical University, and secretly sniffed and stole the remote maintenance management information of the operation and maintenance management personnel of Northwestern Polytechnical University for a long time, including the password of the network boundary device account, the access rights of business devices, the configuration information of routers and other devices.
The technical team found that the types of network equipment sniffed by Northwestern Polytechnical University include fixed Internet access network equipment (routers, authentication servers, etc.), core network equipment (core routers, switches, firewalls, etc.), and also important equipment (data service platforms, etc.) of communication infrastructure operators, including account number, password, equipment configuration, network configuration and other information.
At 6: 52 on December 11th, 20××× Beijing time, TAO used the proxy server (IP: 130.54 .××××××) located in Kyoto University of Japan as an attack springboard, illegally invaded the "telnet" management server of the operation and maintenance network of Northwestern Polytechnical University, uploaded and installed the NOPEN Trojan, and then controlled its intranet monitoring and management server in cascade. Both of the above servers had been installed with "tea drinking" sniffing in advance. TAO remotely controls the Trojan to retrieve and download the compressed and encrypted monitoring record file, and then clears the trace and exits. Stealing data includes the management account number, password, device configuration, network configuration and other information of routers and core network devices (core routers, switches, firewalls).
2. Steal the configuration files and log files of network equipment operation and maintenance in Northwestern Polytechnical University.
The specific intrusion action office (TAO) under the National Security Agency (NSA) of the United States has long attacked and invaded the network operation and maintenance management server of Northwestern Polytechnical University, secretly stealing network equipment operation and maintenance configuration files and log files.
At 10: 41 on October 11th, 20××× Beijing time, TAO invaded and controlled an intranet server of Northwestern Polytechnical University through a proxy server located in Korea (IP: 210.115 ××××××). At 10: 48, after two lateral moves, TAO invaded another intranet server, accessed the regular task configuration scripts in a specific directory, and retrieved 14 configuration files for regular tasks. Subsequently, these 14 files were stolen at one time, which can be used to perform regular cleaning, backup, power check and other operations.
3. Infiltration control of China infrastructure core equipment.
The specific intrusion action office (TAO) under the National Security Agency (NSA) of the United States used the password of the stolen network equipment account to enter the service network of an infrastructure operator in China as a "legitimate" status, control the related service quality monitoring system, and steal the user’s private data.
At 22:53 on March 7th, 20××× Beijing time, the Office of Specific Invasion Operations (TAO) of the National Security Agency of the United States attacked and controlled the service server of an infrastructure operator in China through the attack agent 148.208××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××
At 15:02 on the same day, TAO saved the queried user data in the directory of the attacked server/var/tmp/.2e434fd8aaee73e1/ERF/out/f/,and then packaged it and sent it back to the attack springboard. Subsequently, the attack traces such as infiltration tools and user data uploaded during the process of stealing secrets were quickly removed by special tools.
Du Zhenhua, Senior Engineer of National Computer Virus Emergency Response Center:TAO used many kinds of cyber weapons in this attack against Northwestern Polytechnical University, specifically, such as acid fox, so it belongs to a typical loophole-breaking weapon. Through this middleman attack, it can deliver other cyber weapons to the victimized host in the intranet, such as anger spraying and never disclosing such persistent control weapons. It can further attack and penetrate the intranet according to this control instruction sent by TAO remotely, and move horizontally. It can deploy weapons like sniffing and stealing secrets. By sniffing and stealing weapons like drinking tea, it can steal more remote management host account passwords.
360 company network security expert Bian Liang:Drinking tea is a weapon, which is similar to a spy in our war. It can eavesdrop on our traffic data in the network. Through the monitoring of network data, it can steal sensitive data and information related to us, just like there may be a third party listening through the wall when we are chatting.
According to the analysis of the technical team, the Office of Specific Invasion Operations (TAO) under the National Security Agency (NSA) of the United States used the same combination of weapons and tools to "legally" control the telecommunications infrastructure networks in no less than 80 countries around the world. The technical team cooperated with the partners in Europe and Southeast Asian countries, successfully extracted and fixed the samples of the above weapons and tools, and successfully completed the technical analysis, which is planned to be released to the public in due course to help the world jointly resist and prevent the network penetration attack of NSA.
Maintaining network security is the common responsibility of the international community.
After continuous hard work, the technical team successfully locked in the target node, multi-stage springboard, main control platform, encrypted tunnel, attack weapon and original terminal that launched the cyber attack on Northwestern Polytechnical University by the Specific Invasion Action Office (TAO) under the National Security Agency (NSA), found the identity clues of the attacker, and successfully identified the true identities of 13 attackers.
According to the report, the National Computer Virus Emergency Response Center and 360 Company jointly formed a technical team to participate in the technical analysis of this case. The technical team received the full support of partners from some countries in Europe and Southeast Asia, and comprehensively restored the overall profile, technical characteristics, attack weapons, attack paths and attack sources of the related attacks, and initially identified that the related attacks originated from the specific intrusion action office (TAO) of the National Security Agency (NSA). This series of research reports will provide reference cases for countries around the world to effectively discover and prevent TAO’s follow-up cyber attacks.
Professor Zuo Xiaodong, School of Cyberspace Security, School of Public Affairs, University of Science and Technology of China:Because the network attack is cross-border, it is extremely difficult to trace the source of the network attack, both technically and procedurally.
Experts say that cyberspace is the common home of mankind, cyber attacks are a common threat facing the whole world, and maintaining network security is the common responsibility of the international community. In response to such cyber attacks, it is even more necessary for relevant countries to work together to find out who is behind the scenes.
On September 8, Yang Tao, Director of the Department of American Studies of the Ministry of Foreign Affairs, made solemn representations to the US Embassy in China on the cyber attack and theft of secrets by the United States against our Northwestern Polytechnical University.
Yang Tao pointed out that a few days ago, China National Computer Virus Emergency Response Center and 360 Company released an investigation report on the cyber attack carried out by the subordinate departments of the National Security Agency in China, and the relevant facts were clear and the evidence was conclusive and sufficient. This is not the first time that the US government has carried out cyber attacks and stolen sensitive information against China institutions. The actions of the United States seriously infringe on the technical secrets of relevant institutions in China and seriously endanger the security of key infrastructure, institutions and personal information in China, and must be stopped immediately.
(CCTV reporter Hou Jun Chen Lei Zhang Gang Dong Liangyan Chen Qingbin Han Yuxu)