Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

What is "NSA_Inspected_Folder"?


  • Please log in to reply
23 replies to this topic

#1 quadraginta

quadraginta

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:06 AM

Posted 07 March 2014 - 04:52 PM

Not sure if I'm asking in the right place.

 

Please forgive if I haven't.

 

I have a Passport USB HDD plugged into my Asus RT-N66U router as a network accessable drive.

 

Everything has been hunky-dory since I installed it ~a year ago.

 

I don't use it specifically very often, but happened to be looking today for something I had archived and found that nearly every folder on the drive had somehow become "NSA_Inspected_Folder_****" where "****" is a hex number.  All of them were date/time stamped the same, 2/23/2014 2:08am.

 

In each there was this link -

 

" file:///Z:/NSA_Inspected_Folder_2729/0_NSA_Inspection_Notice-UNCLASSIFIED-FOUO.html"

 

date/time stamped 2/23/2014 2:18am, which opened on a page with this document            ;

 

  1. Classification U//FOUO (Unclassified, For Official Use Only)

    National Security Agency Domestic Inspection Notice

    FM-DIM-144A

    The National Security Agency has inspected the contents of your computer storage devices for national security reasons.

    This data inspection is authorized under the USA PATRIOT Act and subsequent amendments. The NSA works to keep us safe from our enemies, including terrorists as part of the Global War on Terror.

    As part of counterterrorism and intelligence operations, ALL FILES INDICATED were inspected and duplicated. Copies will be deleted from NSA servers on 2024-02-24. The NSA is unable to assist end users with backup and retrieval requests.

    Network Address: ***.**.**.*** [I deleted this address.]
    Country: United States No warrant needed: TRUE (4)
    Accessed folders: /My_Passport/A31 backup and all subfolders
    Reason for access: (Top Secret//NOFORN)
    X-Incident-ID: 04330-22384653824761

    For more information, please visit us at http://www.nsa.gov.

    Sincerely,

    Brian O'Callaghan
    Domestic Civil Liberties Compliance

    Classification U//FOUO (Unclassified, For Official Use Only)

    END OF DOCUMENT

     

    •  

Can anybody tell me what this is about.

 

Is it legit, or some sort of troll?

 

I can't think of any reason the NSA would give a hoot about me.  I'm a 59 yr. old construction worker who's been on disability for four years.  Aside from posting on a few JREF subforums I don't don't even mention anything political on the web, and even those aren't particularly controversial.

 

Also, it only happened on the network drive, not on my laptop's primary drive.

 

WTF???

 

Thanks for reading.  Any comments will be welcome.


Edited by quadraginta, 07 March 2014 - 05:31 PM.


BC AdBot (Login to Remove)

 


#2 Without_A_Monitor

Without_A_Monitor

  • Members
  • 339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:teh bleepinverse
  • Local time:02:06 AM

Posted 07 March 2014 - 05:17 PM

I don't know. I wish that I had an answer for you. My guess would be that it is a sham because it just seems to be a wee bit outlandish. I could be wrong, but your thread is most likely in the most appropriate section.

 

 

 

Some expert will arrive and help you out soon enough.


Edited by Without_A_Monitor, 07 March 2014 - 05:19 PM.


#3 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,233 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 PM

Posted 07 March 2014 - 05:23 PM

The NSA wouldn't inform you they were spying on you, or it wouldn't be spying would it?...



#4 Without_A_Monitor

Without_A_Monitor

  • Members
  • 339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:teh bleepinverse
  • Local time:02:06 AM

Posted 07 March 2014 - 05:37 PM

The NSA wouldn't inform you they were spying on you, or it wouldn't be spying would it?...

 

 

Touché

 

 

I say this somewhat sarcastically...the NSA might not define it as "spying," but rather label the action as "surveillance," "monitoring," or "security and safety measures," etc.



#5 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:07:06 AM

Posted 07 March 2014 - 05:42 PM

Your router is one of those mentioned as being vulnerable to being hacked.  It's possible your computer has been compromised.



#6 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,233 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 PM

Posted 07 March 2014 - 05:43 PM

A malware removal specialist will come along to help you soon enough. My hands are tied due to my 'student' status.

 

if you wish to take the first step start here.



#7 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:04:06 PM

Posted 07 March 2014 - 05:57 PM

https://www.eff.org/nsa-spying << Not sure if this is related in any way, but it makes good reading. :)

Mark Klein provided EFF with eyewitness testimony and documents describing one such secret room located at AT&T’s Folsom Street facility in San Francisco, California

The Klein documents reveal the specific equipment installed at the AT&T facility and the processing power of the equipment within the secret rooms. One type of machine installed is a Narus Semantic Traffic Analyzer, a powerful tool for deep packet inspection.

 

There is almost no way to tell the exact reason behind those files, but what happens if you try to Delete any of them ??

 

 

Download Screen317 Security Check and save it to your Desktop.
* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Please post the contents of that document.
Note:: If a security program requests permission to access the Internet, allow it to do so.

 

Is any of this causing a problem, or just "bugging" you ??



#8 NickAu

NickAu

    Bleepin' Fish Doctor


  • Moderator
  • 13,246 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:127.0.0.1 Australia
  • Local time:04:06 PM

Posted 07 March 2014 - 06:05 PM

Do you know that by copy pasting that you may have broken a law???

 

Stand still the black helicopter will be over head shortly, Non descript men in dark suits with automatic weapons will be breaking your door down in 10..9..8..7..

 

Just kidding

 

Maybe somebody at the NSA got sloppy and forgot to clean up?

 

 

Aside from posting on a few JREF subforums

hmmm, Wonder if that has anything to do with it.

 

Ps on some of the forums I go to that folder would be enough for some guys to start destroying hard drives.. Tin Foil hats anybody lol.


Edited by NickAu1, 07 March 2014 - 06:14 PM.

Arch Linux .
 
 Come join the fun, chat to Bleeping computer members and staff in real time on Discord.
 
The BleepingComputer Official Discord Chat Server!


#9 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:06 AM

Posted 07 March 2014 - 06:28 PM

A malware removal specialist will come along to help you soon enough. My hands are tied due to my 'student' status.

 

if you wish to take the first step start here.

I couldn`t really translate what sophomore is.



#10 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,233 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 PM

Posted 07 March 2014 - 06:35 PM

 

A malware removal specialist will come along to help you soon enough. My hands are tied due to my 'student' status.

 

if you wish to take the first step start here.

I couldn`t really translate what sophomore is.

 

Noob would be the best description, on the internet of things.



#11 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:06 AM

Posted 07 March 2014 - 06:46 PM

I know you can better with high esteem. :thumbup2:



#12 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:04:06 PM

Posted 07 March 2014 - 06:48 PM

I would try to call sophomore as a first year school person, who is trying hard - :) (or useless noob)

 

The NSA link takes you to the Genuine site, but "We will not tell you anything" is the policy.

They tell you who the boss is a few other related things in too much detail, and that's it -

 

My first post had 100 times more information in it ........

 

Country: United States No warrant needed: TRUE (4)
Accessed folders: /My_Passport/A31 backup and all subfolders

 

Did you try and get a Passport about that time ?? Only real answer I can give -


Edited by noknojon, 07 March 2014 - 06:51 PM.


#13 buddy215

buddy215

  • Moderator
  • 13,195 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:01:06 AM

Posted 07 March 2014 - 07:17 PM

The OP's NSA message is stored here: ASUSGATE - NSA Warning - Pastebin.com

 

What I don't know is who is trying to fool who.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#14 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,233 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 PM

Posted 07 March 2014 - 07:21 PM

It's not verbatim... the logs are different. Someone else has encountered this too.



#15 quadraginta

quadraginta
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:06 AM

Posted 07 March 2014 - 07:54 PM

 

The NSA wouldn't inform you they were spying on you, or it wouldn't be spying would it?...

 

 

Touché

 

 

I say this somewhat sarcastically...the NSA might not define it as "spying," but rather label the action as "surveillance," "monitoring," or "security and safety measures," etc.

 

 

 

Yeah.  I didn't really (well, mostly) think it was the Ebil NSA, but it sure is weird.

 

I just want to be sure it isn't worse than a troll.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users