Northwestern Polytechnical University was attacked by American NSA network: the United States gradually infiltrated and stole secrets for a long time.
Cctv newsOn September 27th, the National Computer Virus Emergency Response Center issued a document "Investigation Report on Northwestern Polytechnical University Attacked by NSA Network (Part II)".
On June 22, 2022, Northwestern Polytechnical University issued a "Public Statement" saying that the school was attacked by overseas cyber attacks. The Beilin Branch of the Public Security Bureau of Xi ‘an, Shaanxi Province immediately issued the "Alert Bulletin", which confirmed that a number of trojans and malicious programs originated from abroad were found in the information network of Northwestern Polytechnical University, and the Xi ‘an police have officially filed an investigation.
China National Computer Virus Emergency Response Center and 360 Company participated in the technical analysis of this case. The technical team has successively extracted Trojan samples from many information systems and Internet terminals of Northwestern Polytechnical University, comprehensively used existing domestic data resources and analysis methods, and got the full support of partners in some countries in Europe and Southeast Asia, which completely restored the overall overview, technical characteristics, attack weapons, attack paths and attack sources of related attacks. It is preliminarily determined that the related attack activities originated from the "Office of Specific Invasion Operations" of the National Security Agency (NSA) (namely, the Office of Tailored Access Operation, hereinafter referred to as "TAO").
This series of research reports will publish the important details of some specific attacks in thousands of cyber attacks launched by TAO against Northwestern Polytechnical University, and provide useful cases for countries around the world to effectively discover and prevent TAO’s subsequent cyber attacks.
First, the process of TAO attack infiltrating Northwestern Polytechnical University
TAO’s cyber attacks launched by other countries are highly targeted, adopting semi-automatic attack flow, single-point breakthrough, gradual infiltration and long-term stealing.
(A) a single breakthrough, cascading infiltration, control of the network of Northwestern Polytechnical University
After long-term careful preparation, TAO used the "acid fox" platform to carry out man-in-the-middle hijacking attacks on the internal hosts and servers of Northwestern Polytechnical University, deployed "anger jet" remote control weapons, and controlled several key servers. By using the way of Trojan horse cascade control penetration, it deeply penetrated into the internal network of Northwestern Polytechnical University, successively controlled the core network equipment, servers and terminals of the operation and maintenance network and office network, and obtained the control rights of some important network node equipment such as routers and switches in Northwestern Polytechnical University, stole the authentication data, and further implemented penetration expansion, and finally achieved the hidden control of the internal network of Northwestern Polytechnical University.
(2) Concealed residence, "legal" monitoring and stealing core operation and maintenance data.
TAO uses the cover weapon "Precision Surgeon" and the remote control Trojan NOPEN to realize the overall "invisibility" of the process, files and operation behavior, and secretly control the operation and maintenance management server of Northwestern Polytechnical University for a long time. At the same time, it adopts the way of replacing three original system files and three types of system logs to eliminate the trace and avoid the traceability. TAO has stolen several network device configuration files from the server. Using the stolen configuration files, TAO remotely "legally" monitored a number of network devices and Internet users, providing data support for the subsequent expansion and penetration of these targets.
(3) Collecting authentication data, building channels and infiltrating infrastructure.
By stealing key sensitive data such as account passwords, operation records and system logs of remote business management of operation and maintenance technicians in Northwestern Polytechnical University, TAO has mastered a number of account passwords of network boundary devices, access rights of business devices, configuration information of routers and other devices, and information of FTP server documents. According to the characteristics of TAO attack link, penetration mode and Trojan horse samples, it is found that TAO illegally attacked infrastructure operators in China, and a "legal" channel for remote access to the core data network of infrastructure operators was constructed, which realized the penetration control of infrastructure in China.
(four) control of important business systems, the implementation of user data theft
TAO entered the China infrastructure operator’s network as a "legitimate" by mastering the account passwords of Cisco PIX firewall, Tianrongxin firewall and other equipment, and then implemented intranet penetration and expansion, respectively controlled the service quality monitoring system and SMS gateway server of the relevant operators, and used the weapon tools specifically aimed at the operator’s equipment such as "Magic School" to query a group of sensitive identity personnel in China, and packaged and encrypted the user information and sent it back to the headquarters of the National Security Agency.
Second, stealing sensitive information from Northwestern Polytechnical University and China operators.
(1) Stealing key sensitive data such as passwords and operation records of remote business management accounts of Northwestern Polytechnical University.
TAO secretly sniffed and stole the remote maintenance management information of the operation and maintenance management personnel of Northwestern Polytechnical University for a long time by installing the sniffing tool "drinking tea" in the operation and maintenance management server of Northwestern Polytechnical University, including the account password of network boundary equipment, access rights of business equipment, router and other equipment configuration information.
The types of network devices that are sniffed include fixed Internet access network devices (routers, authentication servers, etc.), core network devices (core routers, switches, firewalls, etc.), and also important devices of communication infrastructure operators (data service platforms, etc.), including account numbers, passwords, device configurations, network configurations and other information.
1. Steal the account password and configuration information of the core network equipment of Xigong University.
At 6: 52 on December 11th, 20××× Beijing time, TAO used the proxy server (IP: 130.54 .××××××) located in Kyoto University of Japan as an attack springboard, illegally invaded the "telnet" management server of the operation and maintenance network of Northwestern Polytechnical University, uploaded and installed the NOPEN Trojan, and then controlled its intranet monitoring and management server in cascade. Both of the above servers had been installed with "tea drinking" sniffing in advance. TAO remotely controls the Trojan to retrieve and download the compressed and encrypted monitoring record file, and then clears the trace and exits. Stealing data includes the management account number, password, device configuration, network configuration and other information of routers and core network devices (core routers, switches, firewalls).
2. Stealing the account password and configuration information of the access network authentication device for many times.
(1) At 0: 28 on May 30th, 20××× Beijing time, TAO took the proxy server (IP: 210.135××××××) located in Japan as an attack springboard, illegally invaded the "telnet" management server of the operation and maintenance network of Northwestern Polytechnical University, uploaded and installed the NOPEN Trojan, and then controlled its intranet monitoring and management server in cascade. Both servers had been installed with "drinking tea" in advance. The stolen data includes the account number, password and configuration information of the access network authentication device.
(2) At 1: 12 on July 4th, 20××× Beijing time, TAO used the proxy server (IP: 141.57 ××××××) located in Leipzig Institute of Technology, Economics and Culture as an attack springboard, illegally invaded the "telnet" management server of the operation and maintenance network of Northwestern Polytechnical University, uploaded and installed the NOPEN Trojan tool, and cascade controlled its internal network monitoring and management server and other three servers. These four servers were in advance.
(3) At 10: 35 on October 11th, 20 ××× Beijing time, TAO used the proxy server (IP: 210.115 ×××××××) located at Gangwon National University in Seoul, South Korea as an attack springboard to illegally invade the monitoring and management server of the operation and maintenance network of Northwestern Polytechnical University, upload and install the NOPEN Trojan tool, and then cascade control its internal network backup server, authentication server and other four servers.
(4) At 2: 46 on October 19th, 20××× Beijing time, TAO used the proxy server (IP: 143.248 .×××××××) of the Institute of Advanced Science and Technology in Daejeon, South Korea as an attack springboard, illegally invaded the "telnet" management server of the operation and maintenance network of Northwestern Polytechnical University, and controlled its intranet supervision server and other two servers in cascade. All three servers had been installed with "tea drinking" in advance.
(2) Stealing configuration files and log files of network equipment operation and maintenance in Northwestern Polytechnical University.
The National Security Agency’s "Specific Invasion Action Office" (TAO) has long attacked and invaded the network operation and maintenance management server of Northwestern Polytechnical University, secretly stealing the configuration files and log files of network equipment operation and maintenance.
1. Steal the network operation log file of Northwestern Polytechnical University.
At 3: 41 on March 2, 20×× Beijing time, TAO illegally invaded and controlled a network operation and maintenance management server of Northwestern Polytechnical University through a proxy server (IP: 210.135 ××××××) located in Japan. At 3: 49, TAO moved horizontally from the operation and maintenance management server to another operation and maintenance monitoring server, searched the log files with specific character strings as keywords and stole a batch of system operation log files and backup files of system daily self-inspection reports.
2. Steal the regular task configuration script of Northwestern Polytechnical University server.
At 10: 41 on October 11th, 20××× Beijing time, TAO invaded and controlled an intranet server of Northwestern Polytechnical University through a proxy server located in Korea (IP: 210.115 ××××××). At 10: 48, after two lateral moves, TAO invaded another intranet server, accessed the regular task configuration scripts in a specific directory, and retrieved 14 configuration files for regular tasks. Subsequently, these 14 files were stolen at one time, which can be used to perform regular cleaning, backup, power check and other operations.
3. Steal the information file of the server system of Northwestern Polytechnical University.
At 1: 27 on June 6, 20 ××× Beijing time, TAO invaded and controlled an intranet server of Northwestern Polytechnical University through a proxy server located in Korea (IP: 222.122 ××××××). At 2: 04, after two horizontal moves, TAO invaded another intranet server, accessed the system files under the directory /var/, and stole 60 commonly used system information files. The contents of the stolen system information files included system release version, user password hash, user rights, local domain name resolution configuration, etc.
(C) Infiltration control of China infrastructure core equipment.
The Office of Specific Invasion Operations (TAO) of the National Security Agency of the United States used the password of the stolen network equipment account to enter the service network of an infrastructure operator in China as a "legitimate" identity, control the related service quality monitoring system, and steal the user’s private data.
1. Steal the privacy data of users in China.
At 22: 53 Beijing time on March 7, 20 ×××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××××
At 15: 02 on the same day, TAO saved the queried user data in the directory of the attacked server/var/tmp/.2e434fd8aaee73e1/ERF/out/f/,and then packaged it and sent it back to the attack springboard. Subsequently, the attack traces such as infiltration tools and user data uploaded during the process of stealing secrets were quickly removed by special tools.
The Office of Specific Invasion Operations (TAO) of the National Security Agency of the United States used the same method to attack and control another China infrastructure business server at 23: 22 on January 10th, 8: 41 on January 29th, 22: 00 on March 28th and 23: 58 on June 6th, respectively, and illegally queried, exported and stole the user information of many identity-sensitive personnel in batches.
2. Infiltrate and control the global telecommunications infrastructure
According to the analysis, the Office of Specific Invasion Operations (TAO) of the National Security Agency (NSA) used the same combination of weapons and tools to "legally" control the telecommunications infrastructure networks in no less than 80 countries around the world. The technical team cooperated with the partners in Europe and Southeast Asian countries, successfully extracted and fixed the samples of the above weapons and tools, and successfully completed the technical analysis, which is planned to be released to the public in due course to help the world jointly resist and prevent the network penetration attack of NSA.
Third, TAO exposed his identity during the attack.
In the process of cyber attack on Northwestern Polytechnical University, the Office of Specific Invasion Operations (TAO) of the National Security Agency exposed many technical loopholes and made many operational mistakes. Relevant evidence further proves that the behind-the-scenes action of cyber attack on Northwestern Polytechnical University is the NSA of the United States. Here are some examples:
(1) The attack time completely conforms to the law of work and rest time in the United States.
The National Security Agency’s Office of Specific Invasion Operations (TAO) must use manual operation when using the tipoff activation command and remotely controlling the NOPEN Trojan. From the attack time of these two tools, the actual working time of the network attacker can be analyzed.
First of all, according to the big data analysis of related cyber attacks, 98% of cyber attacks on Northwestern Polytechnical University are concentrated between 21: 00 and 4: 00 am Beijing time, which corresponds to 9: 00 to 16: 00 EST, and belongs to the domestic working time in the United States. Secondly, there was no cyber attack on Northwestern Polytechnical University on all Saturdays and Sundays in the United States. Thirdly, by analyzing the unique holidays in the United States, it is found that the "Memorial Day" in the United States has three days off, and the "Independence Day" in the United States has one day off. During these four days, the attacker did not carry out any attack and theft. Fourth, after a long period of close tracking of the attacks, it was found that all cyber attacks were silent during the Christmas period. Judging from the above working hours and holiday arrangements, those who attack and steal secrets against Northwestern Polytechnical University are unscrupulous and undisguised in their activities according to the schedule of working days in the United States.
(B) Language behavior habits are closely related to the United States.
During the long-term tracking and reverse osmosis of network attackers, the technical team found that the attackers have the following language characteristics: first, the attackers have the habit of using American English; Second, the internet devices associated with the attackers are all equipped with English operating systems and various English-language applications; Third, the attacker uses the American keyboard for input.
(3) The working path of exposing the mistakes in weapon operation
At 5: 36 (Beijing time) on May 16th, 20 ×××, the cyber attackers attacked Northwestern Polytechnical University again by using the springboard machine (IP:222.122.××.××) located in South Korea. When trying to invade and control a network device after the third-level infiltration of the intranet of Northwestern Polytechnical University, there was a human error when running the upload PY script tool, and the specified parameters were not modified. After the script is executed, an error message is returned, which reveals the working directory and corresponding file name of the attacker’s online terminal. From this, it can be known that the system environment of the Trojan control terminal is Linux system, and the corresponding directory name "/etc/autoutils" is the special name of TAO’s network attack weapon tool directory.
The error message is as follows:
Quantifier follows nothing in regex; marked by <– HERE in m/* <– HERE .log/ at https://news.cctv.com/2022/09/etc/autoutils line 4569
(D) A large number of weapons are highly homologous to the exposed NSA weapons genes.
Of the 41 different cyber attack weapons used in the attack on the secrets of Northwestern Polytechnical University, 16 tools are completely consistent with the TAO weapons exposed by the "shadow broker"; Although 23 tools are not exactly the same as those exposed by the "shadow broker", their genetic similarity is as high as 97%, and they belong to the same type of weapons, but their related configurations are different; The other two tools can’t correspond to the "Shadow Broker" exposure tool, but they need to be used together with other cyber attack weapons tools of TAO, so these weapons and tools obviously have homology and belong to TAO.
(E) Some cyber attacks occurred before the exposure of "shadow brokers".
The comprehensive analysis of the technical team found that in the tens of thousands of cyber attacks against targets in China, especially the thousands of cyber attacks launched against Northwestern Polytechnical University, some weapons used in the attack process were implanted with Trojan horses before the "shadow broker" exposed NSA weapons and equipment. According to NSA’s behavior habits, the above weapons and tools are likely to be used by TAO employees themselves.
Fourth, TAO network attacks the IP list of weapon platform of Northwestern Polytechnical University
During the technical analysis and traceability investigation, the technical team found a number of IP addresses of servers hosting related weapons and equipment used by TAO in the network invasion of Northwestern Polytechnical University. Examples are as follows:
V. IP list of springboard used by TAO network to attack Northwestern Polytechnical University
After continuous attack, the research team successfully locked the target node, multi-stage springboard, main control platform, encrypted tunnel, attack weapon and original terminal that launched the attack on Northwestern Polytechnical University, found the identity clues of the attacker, and successfully identified the true identities of 13 attackers.