CHINA yesterday released a new investigation report in which it said further evidence has been found to show the U.S. National Security Agency (NSA) is behind “thousands of cyberattacks” on a Chinese university.

With the technical support from a number of European and Southeast Asian countries, Chinese experts were able to retrace the technical features, attack weapons and paths used in the cyberattack against China’s Northwestern Polytechnical University, according to the report published by China’s National Computer Virus Emergency Response Center in collaboration with internet security company 360.

They have found that those attacks originated from the NSA-affiliated Office of Tailored Access Operation (TAO), which had exposed its own technical loopholes and operational missteps during the attack, the report said.

Earlier probe has found that 41 types of cyberweapons were used by TAO in the recently exposed cyberattacks against the university.

Among the 41 types of cyberattack tools, 16 are identical to the TAO’s weapons that have been exposed by hacker group “Shadow Brokers,” and 23 share a 97% genetic similarity with those deployed by TAO, said the report.

The remaining two types need to be used in conjunction with other cyberattack weapons of TAO, the report said, adding that the homology of the weapons suggests they all belong to TAO.

Technical analysis found that the cyberattackers’ working time, language and behavior habits, and operation miss have also exposed their links with TAO.

The report detailed the process of TAO’s infiltration into the Chinese university’s internal network. TAO first used “FoxAcid,” a man-in-the-middle attack platform, to hack into the university’s internal host computer and servers, and then gained control over several key servers with remote control weapons.

It then controlled some important network node equipment including the university’s internal routers and switches, and stole authentication data.

Hiding in the university’s operation and maintenance servers, TAO stole several key configuration files of network equipment, which were used to “validly” monitor a batch of network equipment and internet users.

The Chinese investigation team found that TAO captured personal information of some people with sensitive identity on the Chinese mainland. The information was sent back to headquarters of the NSA via multiple jump servers.

The report said the true identities of 13 attackers have been found out.

The report, revealing details of the U.S. cyberattacks against the Chinese university, was released to offer lessons to countries across the world so that they can more effectively identify and prevent cyberattacks by TAO.

(Xinhua)