Earlier quoted context omitted.
The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, yo…
> which operates just above the physical layer. So at the link layer? If so, what you described does not sound like an effective technique to exfiltrate data over the internet, unless the NSA also controls the LAN/internal network the target device is on. Why? Because any non-standard protocol data will be thrown out by the first switch or router on the path out of the target LAN. In other words, the exfiltrated data…
That's not necessarily true. Misconfigurations and weird issues in networking gear caused vendors to be kind of permissive about some things. Depending on the vendor, they might drop it or pass it through. Network security folks in the field, in or away from NSA, probably have a good idea of what things make it through most often plus fall-back options. They might even keep current documentation of it based on field reports over time. They'd just use that stuff. Also, intelligence work is very difficult and opportunistic already. A method doesn't have to work all the time: just enough to keep trying it.