Security researchers have developed a method for detecting breaches by the NSA's Quantum. Fox-IT have developed and provide free open-source tools for detecting double HTTP packets that have different data sizes, which are the main characteristics of the Quantum Insert attack.
Quantum Insertis a hacking technique used by intelligence agencies, first exposed by Edward Snowden. It is essentially an “HTML redirection” attack and works by injecting malicious content into a specific TCP session. The session selected for injection uses a persistent tracking cookie that is specific to the person of interest.
You can see more details about the attack on the official Fox-IT.
Anyone capable of monitoring networks and sending forged packets can perform Quantum-type attacks, although in practice it is much easier for governments.
So it's not just the NSA and the UK's GCHQ that use the attack. China has recently been reported to have used this type of attack, as we reported in our Great Cannon.
«Detection is possible through searches for duplicate TCP packets that have different payloads, and other anomalies in TCP streams,” explained Lennart Haagsma, network security analyst at Fox-IT, adding that various countermeasures are already available besides the new detection tools they have developed.
«The use of HTTPS in combination with TGV can reduce the effectiveness of the QI [Quantum Insert] attack. Also, using a content delivery network (CDN) that offers low latency can make it very difficult for a QI packet to win the race against the real server,” said the researcher.
The leaks from Snowden include a slide from the Communications Security Establishment Canada that describes how Quantum Insert attacks are detected, and it is a useful tool highlighted by Fox-IT. 
The slide helped the Dutch company in its progress, for the development of Quantum Insert-sniffing tools.
Watch the presentation video
