Risky Bulletin - Episode Summary: Between Two Nerds: NSA's 9 to 5 Hacking Campaign

Release Date: March 3, 2025
Host/Author: risky.biz
Podcast Episode: Between Two Nerds: NSA's 9 to 5 Hacking Campaign

Introduction

In this episode of Risky Bulletin, hosts Tommy Ran and Grok delve into a detailed discussion about the NSA's alleged intrusion into Northwestern Polytechnical University (NPU) in China. The conversation is sparked by Lina Lau's blog post, which translates and interprets Chinese incident response reports concerning this specific NSA operation.

Background on the NSA Intrusion

Tommy introduces the episode by referencing Lina Lau's blog post, where she translated Chinese reports attributing an intrusion at Northwestern Polytechnical University to the NSA. This university is noted for its top-secret research and significant involvement in defense projects, making it a legitimate target.

Tommy Ran [00:12]: "This week's episode is brought to you by Prowler, the open source cloud security company... [we] thought we'd dive into some of the nuances..."

Lena’s Translation and Analysis

The discussion highlights how Lena collated various Chinese reports, rewrote them in a Western style, and published her findings. Tommy encourages listeners to check out the interview with Lena on the main Risky Business podcast for more in-depth insights.

Grok [00:59]: "It's a little bit of a peek behind the curtain. That's if you read between the lines."

Assessment of NSA’s Hacking Methods

Tommy and Grok express their surprise at the apparent lack of sophistication in the NSA's methods as described in Lena's translation. They note that the techniques seem "old school" and lack the automation expected from a top-tier intelligence agency.

Grok [05:50]: "So like what they're showing is that like a Chinese user... how does that work with SSL? I don't see how you can just hijack one side of a stream if it's ssl."

Grok [07:17]: "Yeah. I was hoping for the magic and you didn't see the magic."

Use of Standard Penetration Techniques

The hosts discuss the NSA's reliance on conventional hacking strategies such as phishing, credential theft, and manual intrusion processes. They criticize the lack of advanced automation, suggesting that the operations appear mundane rather than cutting-edge.

Tommy Ran [08:06]: "But it sort of tells you that everyone's playing on fundamentally the same landscape... These are sort of the fundamental things you have to do."

Grok [09:32]: "I think there's two things that go into... Standard stuff. But what it means to me is that there's no automation."

Bounce Servers and Obfuscation Tactics

A significant portion of the conversation focuses on the NSA's use of bounce servers—temporary servers used to obscure the origin of attacks. The discussion points out the use of generic company names like "Jackson Smith Consulting" and "Mueller Diversified Systems," which Grok finds embarrassingly simplistic.

Grok [16:07]: "They had IPs... Jackson Smith Consultants and Mueller Diversified Systems."

Tommy Ran [17:03]: "Like, at that point, I mean, the people in there would get a feeling and they'd speculate and they would build up these sort of chains of evidence."

Operational Priorities and Target Selection

The hosts reflect on the nature of the target—NPU—as being important yet not the highest priority. They suggest that the NSA's approach indicates a long-term, persistent operation rather than a high-intensity, short-term campaign.

Grok [22:32]: "So it's misdirecting. So you're saying, like, we did gain access... You're misdirecting."

Tommy Ran [30:10]: "Like, no one's working weekends for this target."

Misdirection and Deception in Reporting

Tommy and Grok explore the possibility that the NSA might be using phishing as a cover for more sophisticated intrusion methods. They discuss concepts of ambiguity and misdirection in cyber deception, suggesting that publicly attributing attacks to phishing could obscure the true methods employed.

Grok [25:41]: "So you're misdirecting... we did gain access... That's what you need to worry about."

Persistence Over Time

The conversation emphasizes the NSA's long-term presence within NPU, spanning over a decade. This persistence suggests a stable campaign aimed at maintaining ongoing access rather than sporadic attacks.

Tommy Ran [31:01]: "It's the Polytechnic University. It's not... it's the PLA or whatever."

Grok [31:55]: "If someone gets found, comes back, gets found, comes back..."

Conclusion and Reflections

Tommy and Grok conclude that the NSA's activities, as described in Lena's translation, appear to be routine and lack the sensationalism often associated with high-profile cyber espionage. They express a sense of disappointment, noting that the operations seem more like “nine to five” jobs rather than the highly secretive and advanced campaigns one might expect from a national intelligence agency.

Grok [34:25]: "It just doesn't feel NSA like, it doesn't feel special."

Tommy Ran [35:19]: "Not even."

Key Takeaways

• Mundane Operations: The NSA's intrusion methods at NPU appear conventional and lack advanced automation.
• Use of Bounce Servers: Simple and generic names for bounce servers raise questions about operational security.
• Long-Term Persistence: The decade-long campaign suggests steady, ongoing efforts rather than sporadic attacks.
• Misdirection Tactics: Possible use of phishing as a cover for more sophisticated methods.
• Lack of Sensationalism: Operations seem routine, lacking the high-profile nature typically expected from intelligence agency hacks.

Notable Quotes

• Grok [00:59]: "It's a little bit of a peek behind the curtain."
• Grok [05:50]: "I don't see how you can just hijack one side of a stream if it's ssl."
• Grok [07:17]: "I was hoping for the magic and you didn't see the magic."
• Grok [16:07]: "Jackson Smith Consultants and Mueller Diversified Systems."
• Grok [22:32]: "So it's misdirecting. So you're saying, like, we did gain access... That's what you need to worry about."
• Grok [34:25]: "It just doesn't feel NSA like, it doesn't feel special."

This episode provides an insightful yet sobering look into the NSA's cyber operations, highlighting the blend of standard techniques and long-term strategies employed in intelligence gathering. While lacking the flashiness often associated with espionage, the discussion underscores the persistent and methodical nature of such campaigns.