I was reading the Wikipedia article about TAO and there is written that:

Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host. This enables an NSA computer to generate false geographical location and personal identification credentials when accessing the Internet utilizing QUANTUMSQUIRREL.

I know that of course is possible to spoof the IP address of a packet. That is, to send out a packet with a fake "sender" IP address. But then the answer by the server should arrive to the "sender" IP address it sees, not the "real" one.

  1. How, from a technical point of view, can the NSA act as an arbitrary IP address, meaning they can send and receive packets from and to and IP address?

    What is the computer science technique they are using?

  2. When they open the terminal, what are the commands they type? What third party utilities they are using?

  3. Would the NSA require cooperation from other parties to achieve this?

  • 2
    They may be doing this at the BGP layer. See schneier.com/blog/archives/2018/10/chinas_hacking_.html. – mti2935 Mar 17 at 1:10
  • @user253751I mean, at a deeper level than that, but not so deep as to Kernel calls. Let's say what third-party user-space software they use – robertspierre Mar 17 at 10:38
  • @user253751 I have clarified my questions – robertspierre Mar 17 at 11:01
  • @raffaem well it's probably first-party software. You think someone else has made software to intercept traffic to arbitrary IP addresses? – user253751 Mar 17 at 11:14
  • 1
    I googled "QUANTUMSQUIRREL" and got this result: theintercept.com/document/2014/03/12/… It appears to be part of the QUANTUM INSERT functions. They simply infect a victim browser and use that as a pivot point – schroeder Mar 17 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.