Slashdot Mirror
Russian Hackers Exploited Kaspersky Antivirus To Steal NSA Data on US Cyber Defense: WSJ (wsj.com)
An NSA contractor brought home highly classified documents that detailed how the U.S. penetrates foreign computer networks and defends against cyberattacks. The contractor used Kaspersky antivirus on his home computer, which hackers working for the Russian government exploited to steal the documents, the WSJ reported on Thursday (the link could be paywalled; alternative source), citing multiple people with knowledge of the matter. From the report: The hackers appear to have targeted the contractor after identifying the files through the contractor's use of a popular antivirus software made by Russia-based Kaspersky Lab, these people said. The theft, which hasn't been disclosed, is considered by experts to be one of the most significant security breaches in recent years. It offers a rare glimpse into how the intelligence community thinks Russian intelligence exploits a widely available commercial software product to spy on the U.S. The incident occurred in 2015 but wasn't discovered until spring of last year, said the people familiar with the matter. Having such information could give the Russian government information on how to protect its own networks, making it more difficult for the NSA to conduct its work. It also could give the Russians methods to infiltrate the networks of the U.S. and other nations, these people said. Ahead of the publication of WSJ report, Kaspersky founder Eugene Kaspersky tweeted, "New conspiracy theory, anon sources media story coming. Note we make no apologies for being aggressive in the battle against cyberthreats."
OK fanboys, I've got the popcorn out, what is your new excuse why they should still be trusted? The nonsense people said last week was so rich, I'm waiting for it to grow even more absurd today as the cognitive dissonance builds and blinds them to the quality of their arguments.
The problem here isn't Kaspersky and Russian hackers, they're just being opportunistic.
The REAL problem here is a dumb @$$ contractor who stole classified information and brought it home.
Why isn't the contractor, both company and employee, being punished for breach of secure information? Any other countries' spooks would want this info, including our allies.
Ahh that's right, let's just take this as an opportunity to bash Russia some more while our real enemy China is cleaning out both our industrial trade and military secrets! /sarcasm
Although doesn't this:
Note we make no apologies for being aggressive in the battle against cyberthreats.
Sound like a tacit admission?
The idiot Hal Smith, former NSA employee, apparently put stuff that shouldn't have been seen outside a SCIF on his home system. His content was exfiltrated, presumably by Russians. But now it's the vector of the exfiltration's fault that classified material was stolen.
News flash: the system was broken the moment the stuff saw a computer outside of an airgapped network. For that matter, Mr. Smith put himself in criminal jeopardy at that moment.
If the guy had been using Avast or Bitdefender, would that have made you feel better? Do you really think the Russians couldn't penetrate the firms providing those products? Think again.
While we're at it, do you really think that the Russians are the only people soaking up data from the US like a sponge? Why so much focus on their activities? You'd think people had a political axe to grind, almost...
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
"targeted the contractor after identifying the files through the contractor's"... duh ? Wait! What the hell is a contractor doing with classified files on his home computer. Sounds so dumb, it looks like someone Wants to have Kaspersky AV software blamed.
And very likely with pretty much the methods described, I think this cannot get much more hypocritical. And while we _know_ the NSA does this, we only have a scare-story that may turn out to be a complete fantasy on the Russians and Kaspersky.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I’m a bit puzzled: aren’t highly confidential documents stored, viewed and edited only on secured computers? Is it really that easy for a contractor (or even an employee) to grab a copy and leave with it, entirely unnoticed?
1) Any intelligence agency that doesn't look for exploits in commonly used tools isn't doing their job.
2) Kaspersky is a great target for exploit research no matter who you are.
3) Its common practice to keep identified exploits secret for high value zero day attacks JUST like this.
4) Also standard practice to request (or steal) source from domestic (or vulnerable) corps to make exploit location easier.
Not to defend Kaspersky (cause who knows?) but this just sounds like a normal day at the office for this problem space...
is the fact the employee brought home classified documents which somehow found their way onto their home ( read that: Unlikely certified to handle classified information ) computer.
Normally, I would consider this unlikely, but apparently keeping classified info on private systems / servers is all the rage these days :|
"An NSA contractor brought home highly classified documents"
^^^ THIS
"An NSA contractor brought home highly classified documents" Anything after this point is just blah, blah, blah. It is illegal for this to happen, unless the contractor's home is designated at the correct classified level. Which is highly unlikely. Good cybersecurity is impossible if people don't follow policy and procedure upon which much cybersecurity depends.
So many fucking Russians, holy shit.
It's a great story. It never gets old.
True dat.. Been going on for almost 80 years now...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
So any idea of the company he worked for?
Booz Allen had been running up a nice streak but lost that with reality winner, so have that pushed forward and tried to start streak two?
Russians drank all my beer! Just the other day I bought a six-pack, and now it's gone. Goddammit I blame the Russians!
Am I understanding correctly? Of course I didn't read TFA, but from the summary I'm guessing that dude had Kapersky antivirus, and when he loaded the files it sent them home for scanning, and since they're a Russian company the Russian government has access to the files. This doesn't really make sense to me. It would make sense that it could send the checksums back home to compare, except even that doesn't make a lot of sense, since the "virus database" (aka a list of checksums of flagged blocks) should be local. Maybe he was using some sort of browser plugin version?
The only other way this could make sense is if the Russian government forced K to insert a backdoor into its software, which they used to gain access. So far I've only heard of the USA doing this, so it would be a big deal if this were the case, but since the summary doesn't have some clickbait about massive hole in K products discovered, I also don't think this is the case.
Most likely this is just more stupid "Russia bad, because... Russia!" garbage being spewed by folks who really don't understand or want to understand how things work. Can someone clarify if this isn't the case and I missed something?
In my years working on "highly classified" things, we NEVER, EVER brought that stuff home, because we couldn't without breaking all kinds of rules and safeguards. It was a major operation just to get it transferred to another secure facility to work on it. But time after time now we get the story that this or that person had a laptop full of stuff in their car, their house, on the bus, etc. When did the rules change that you can just walk out with extremely sensitive data, or are these lunkheads simply violating all the rules?
This is what happens when you outsource or hire visa workers to do your IT.
It would not surprise that the outsource/visa workers absconded with data themselves.
An NSA contractor stole highly classified documents, but before he could sell them, they got stolen.
Because he had no other reason to take home classified documents.
The story isn't saying that the anti malware program is a front for cyber warfare. It is saying that the program was hacked. No evidence that they were willingly hacked or assisted in undermining their own product. And it was an older version of Kaspersky. Hacking an antivirus is a big target, it gets you past the front door and into the bedroom.
Was he in FSB? KGB collapsed with the collapse of the USSR. Modern Russian state was born out of a rebellion against the USSR. So you would not necessarily expect the modern Russian state's security apparatus to have priorities matching anything even close that of the USSR.
Any guest worker system is indistinguishable from indentured servitude.
Honest question for someone who dropped Windows decades ago. How do admins even take their security seriously when their tools have these issues. Something similar happened with, I believe it was, ccleaner a couple months ago. I mean what is the rationale behind infosec in Windows shops?
Kaspersky's proprietary anti-malware software was never trustworthy. Kaspersky's anti-malware didn't recently become untrustworthy, and the year-plus long Russophobia didn't change anything nor does that craze amongst the war profiteers inform the current situation.
We judge software's trustworthiness by software freedom—the freedom to run, inspect, share, and modify published computer software. If a program is non-free (proprietary, user-subjugating) that program is untrustworthy regardless of what it purports to do, who wrote it, or who distributes it. No review program can ever truly evaluate the trustworthiness of non-free software because either they don't review the program's source code (thus the reviewers don't really know what the program can or will do), or they are under some non-disclosure agreement (in which case the reviewers can't be trusted). You need software freedom even if you don't program (as most computer users don't) so you can give a copy of the free software to someone you trust and ask them for a proper review. This can also be a commercial opportunity (jobs!).
Digital Citizen
I'm still amazed at how "Ivan" has turned into a racist epithet, especially insofar as liberals are now proud of modding up posts that contain nothing more substantial.
Then again, they pretty much invented the N-word, too, along with seceding from the Union over slavery and filibustering the Civil Rights Act, so maybe I shouldn't be too surprised.
So why are people rushing to defend this attack on our country?
I'm not sure people are, as much as they're not impressed with our country's attack on We The People, even by foreign nationals in CIAs hire.
Plus, is it proven beyond doubt and Hanlon's razor that there was an attack on the attackers?
You say that as if nothing replaced the KGB. Hell, Putin was KGB. Who do you think his cronies are?
Just another day in Paradise
How is it this can suddenly be discovered 2 years after it allegedly occurred?
Is it not just a slikely that these wholly incompetent agencies need to point a finger elsewhere?
Show me the proof! And any excuse about revealing secrets if proof is revealed is, obviously, bullshit!
Dear fellow citizen of the USA: While it is expected of nation states to seek as much intelligence as possible, including the USA,
current finger-pointing, which is likely unfounded, has got to be nothing short of redirecting attention away from internal incompetence!
Our society is now fraught with BS - consider that NBC claims Tillerson called Trump a moron. Yet, I have yet to see that proof as well.
Self-importance and self-indulgence is the root of ALL evil.
This was almost certainly intentional mishandling of classified materials, and that is normally prosecuted as a felony.
The line between prosecution and no prosecution is normally if the violation was done deliberately or not. This looks awfully deliberate.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Putin was in politics long before he was President. He left KGB with the title of Lieutenant Colonel -- hardly a high profile operative. He became a mid-level politicl operative after the collapse of the USSR operative. As for whether anything replaced KGB, that's irrelevant. Wehrmacht was replaced by the East German and West German militaries after WWII. That doesn't mean that one would expect a mid-level officer of Wehrmacht to serve in either West German of East German army. I would not expect most of USSR operatives to retain any kind of power in the post-USSR Russia. Yeltsin went so far as to ban and defund the former Communist party institutions after the collapse. He also had to disband the parliament and force a new election after pro-Communist parties got the majority and tried to muscle him from power. If anything, being anti-communist was the only was to rise to any kind of political power in the post USSR Russia. Modern Russian state is not pro-Soviet. It's national socialist. But it's difficult to imagine how anyone who remained committed to pro-soviet agenda could have remained anywhere even close to power.
Any guest worker system is indistinguishable from indentured servitude.