Tailored Access Operations

Snowden leak

A document leaked by former NSA contractor Edward Snowden describing the unit's work says TAO has software templates allowing it to break into commonly used hardware, including "routers, switches, and firewalls from multiple product vendor lines".^[11] TAO engineers prefer to tap networks rather than isolated computers, because there are typically many devices on a single network.^[11]

Virtual locations

Details^[17] on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host.^[18] This enables an NSA computer to generate false geographical location and personal identification credentials when accessing the Internet utilizing QUANTUMSQUIRREL.^[19]

Leadership

From 2013 to 2017,^[20] the head of TAO was Rob Joyce, a longtime employee who had previously worked in the NSA's Information Assurance Directorate (IAD). In January 2016, Joyce made a rare public appearance, giving a presentation at the Usenix’s Enigma conference.^[21]

QUANTUM attacks

The TAO has developed an attack suite they call QUANTUM. It relies on a compromised router that duplicates internet traffic, typically HTTP requests, so that they go both to the intended target and to an NSA site (indirectly). The NSA site runs FOXACID software, which sends back exploits that load in the background in the target web browser before the intended destination has had a chance to respond, although it is unclear whether the compromised router facilitates this race on the return trip. Prior to the development of this technology, FOXACID software made spear-phishing attacks the NSA referred to as spam. If the browser is exploitable, further permanent "implants" (rootkits, etc.) are deployed in the target computer; e.g., OLYMPUSFIRE for Windows, which gives complete remote access to the infected machine.^[23] This type of attack is part of the man-in-the-middle attack family, though more specifically it is called man-on-the-side attack. It is difficult to execute without controlling some of the Internet backbone.^[24]

There are numerous services that FOXACID can exploit this way. The names of some FOXACID modules are given below:^[25]

By collaboration with the British Government Communications Headquarters (GCHQ) (MUSCULAR), Google services could be attacked too, including Gmail.^[25]

Finding machines that are exploitable and worth attacking is done using analytic databases such as XKeyscore.^[26] A specific method of finding vulnerable machines is interception of Windows Error Reporting traffic, which is logged into XKeyscore.^[27]

QUANTUM attacks launched from NSA sites can be too slow for some combinations of targets and services as they essentially try to exploit a race condition, i.e. the NSA server is trying to beat the legitimate server with its response.^[28] As of mid-2011, the NSA was prototyping a capability codenamed QFIRE, which involved embedding their exploit-dispensing servers in virtual machines (running on VMware ESX) hosted closer to the target, in the so-called Special Collection Sites (SCS) network worldwide. The goal of QFIRE was to lower the latency of the spoofed response, thus increasing the probability of success.^[29]

COMMENDEER [sic] is used to commandeer (i.e. compromise) untargeted computer systems. The software is used as a part of QUANTUMNATION, which also includes the software vulnerability scanner VALIDATOR. The tool was first described at the 2014 Chaos Communication Congress by Jacob Appelbaum, who characterized it as tyrannical.^[30][31][32]

QUANTUMCOOKIE is a more complex form of attack which can be used against Tor users.^[33]

Equation Group

The Equation Group, also known in China as APT-C-40,^[44][45] is a highly sophisticated threat actor that has been tied to the NSA and hence TAO. Kaspersky Labs describes them as one of the most sophisticated advanced persistent threats in the world and "the most advanced (...) we have seen", operating alongside the creators of Stuxnet and Flame.^[46][47] Most of their targets have been in Iran, Russia, Pakistan, Afghanistan, India, Syria and Mali.^[47]

The name originated from the group's extensive use of encryption. By 2015, Kaspersky documented 500 malware infections by the group in at least 42 countries, while acknowledging that the actual number could be in the tens of thousands due to its self-terminating protocol.^[47][48]

In 2017, WikiLeaks published a discussion held within the CIA on how it had been possible to identify the group.^[49] One commenter wrote that "the Equation Group as labeled in the report does not relate to a specific group but rather a collection of tools" used for hacking.^[50]

Link to IRATEMONK

F-Secure claims that the Equation Group's malicious hard drive firmware is TAO program "IRATEMONK",^[53] one of the items from the NSA ANT catalog exposed in a 2013 Der Spiegel article. IRATEMONK provides the attacker with the ability to have their software application persistently installed on desktop and laptop computers, despite the disk being formatted, its data erased or the operating system re-installed. It infects the hard drive firmware, which in turn adds instructions to the disk's master boot record that causes the software to install each time the computer is booted up.^[54] It is capable of infecting certain hard drives from Seagate, Maxtor, Western Digital, Samsung,^[54] IBM, Micron Technology and Toshiba.^[46]

2022 alleged Northwestern Polytechnical University hack

In 2022, an investigation conducted by the Chinese National Computer Virus Emergency Response Center [zh] (CVERC) and computer security firm Qihoo 360 attributed an extensive cyber attack on China's Northwestern Polytechnical University (NPU) to the NSA's Office of Tailored Access Operations (TAO),^[45][59] compromising tens of thousands of network devices in China over the years and exfiltrating over 140GB of high-value data.^[59]

The CVERC alleged that the attack involved a "longer period of preparatory work", setting up an anonymized attack infrastructure by leveraging SunOS zero-days to compromise institutions with large network traffic in 17 countries, 70% of which neighbored China. Those compromised machines were used as "springboards" to gain access into the NPU by leveraging man-in-the-middle and spear-phishing attacks against students and teachers. The report also claims the NSA had used two cover companies, "Jackson Smith Consultants" and "Mueller Diversified Systems", to purchase US-based IP addresses that would later be used in the FOXACID platform to launch attacks on the Northwestern.^[45][59]

CVERC and 360 identified 41 different tools and malware samples during forensic analysis, many of which were similar or consistent with TAO weapons exposed in the Shadow Brokers leak. Investigators also attributed the attack to the Equation Group due to a mixture of attack times, human errors and American English keyboard inputs. Forensic analysis on one of the tools, called "NOPEN", which required human input, indicated that 98% of all attacks occurred during U.S. working hours, with no cyber-attacks being logged during weekends or during American holidays such as Memorial Day and Independence Day.^[45]