Slashdot Mirror
Kaspersky Admits To Reaping Hacking Tools From NSA Employee PC (zdnet.com)
Kaspersky has acknowledged that code belonging to the US National Security Agency (NSA) was lifted from a PC for analysis but insists the theft was not intentional. From a report: In October, a report from the Wall Street Journal claimed that in 2015, the Russian firm targeted an employee of the NSA known for working on the intelligence agency's hacking tools and software. The story suggested that the unnamed employee took classified materials home and operated on their PC, which was running Kaspersky's antivirus software. Once these secretive files were identified -- through an avenue carved by the antivirus -- the Russian government was then able to obtain this information. Kaspersky has denied any wrongdoing, but the allegation that the firm was working covertly with the Russian government was enough to ensure Kaspersky products were banned on federal networks. There was a number of theories relating to what actually took place -- was Kaspersky deliberately targeting NSA employees on behalf of the Kremlin, did an external threat actor exploit a zero-day vulnerability in Kaspersky's antivirus, or were the files detected and pulled by accident? According to Kaspersky, the latter is true. On Wednesday, the Moscow-based firm said in a statement that the results of a preliminary investigation have produced a rough timeline of how the incident took place. It was actually a year earlier than the WSJ believed, in 2014, that code belonging to the NSA's Equation Group was taken.
WSJ, MSM,..... WMD anyone?
Smear, smear, smear, its the russian!!! Oh wait its the DNC!!!! Squirrel with Tits just ran behind that tree!!!
Their version of events is much more believable than the others offers so far. Guy takes home the NSA malware, disables Kaspersky to install some warez and then realizes his machine has been p0wned, so does multiple full scans. The NSA malware is picked up during those scans and automatically submitted for analysis (the default behaviour). During this time his machine had an open backdoor.
What really worries me here is that Kaspersky apparently deleted the NSA malware and source code once they realized what it was. They should have analyzed it, generated signatures and published details. Failure to do so is far worse than simply sharing it with the Russian government, who I'd assume already had copies anyway given how leaky the NSA is.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
No surprise here,
Source: https://arstechnica.com/information-technology/2017/10/worker-who-snuck-nsa-secrets-home-had-a-backdoor-on-his-pc-kaspersky-says/?comments=1
Direct quote:
The NSA worker's computer ran a home version of Kaspersky AV that had enabled a voluntary service known as Kaspersky Security Network. When turned on, KSN automatically uploads new and previously unknown malware to company Kaspersky Lab servers. The setting eventually caused the previously undetected NSA malware to be uploaded to Kaspersky Lab servers, where it was then reviewed by a company analyst.
Some bullshit about the product working only as intended. Hackers have been practicing obfuscated, "looks good but has a malicious side-channel" code since forever, and you'd be an utter dimwit (or vatnik!) to think that Mr. Kaspersky himself of the KGB's technical school doesn't know how to put these ideas into practice both programmatically AND socially.
But guess what? Even if Kaspersky has the most honest intentions in the world, which they don't, that still doesn't prevent SORM from capturing everything, or from the business from being coerced into providing those telemetry, binaries, and incidentally collected files. Same reason Russia wisely banned Pokemon GO from their country: it's not Niantic you worry about hoovering up all that telemetry and incidental data. It's the government who inspect and grab that traffic over top of them for mass collection and analysis to map out a country's signals with useful idiots.
NSA->employee->Home system->Kaspersky AV->Kaspersky Lab servers --------> Russian Govt?
If Kaspersky isn't working with the Russian govt, how did their Lab data end up with the Russian govt?
Oh, and the NSA dude needs some jail time as well.
So it looks like what happened is what I suspected, that Kaspersky's Heuristic analysis found the file and submitted it for analysis. Which is fine since that's what it's supposed to do.
The real question is why wouldn't Kaspersky submit it to other AV Firms or even Microsoft for analysis instead of just deleting it? From what it sounds like they had full source code on a virus. I would think that would be the equivalent of striking gold in the AV community regardless of the virus's source, Unless Kaspersky was afraid that the US would Pressure the heck out of them if they disclosed, which is not much different from what's happening now.
In Soviet Russia, Trojan exploits YOU!
So basically, commercial software, namely an antivirus, proceeded as intended (detected malicious/suspicious code). Nothing new.
Then the Russian gov., just like the US or the UK govs. pulled that software/information based on the principle of screwing anyone's privacy (especially foreigners) over national security concerns (which when you look at it from an impartial point of view, like me (someone who literally stands between both countries in western Europe), it's a contextually solid argument, even though I am completely opposed to this relegation of privacy to second place. This is also not new, and the US knows this happens frequently. They know it because they also do it. How many Sillicon Valley corps. are sueing the US gov. to prevent just that? (Well, Microsoft just dropped it because, well, the government had a bad case and decided to pull back).
At least they're not loading Linksys hardware with trojans for deployment to China and Russia's top tier installations.
Seems like a very plausible explanation from Kaspersky, clearly not at fault, and will be a clear case of hypocrisy by whichever government decides to slander private business of the company. Not only is the government at fault (that was bad BAD behavior from the employee, unless he was whistleblowing something, like Snowden), but they also do this.
Demand local servers, just like Brasil did to Facebook, if you are worried about your info being offshored to jurisidictions you can't control the full chain of behavior.
It took the NSA 3 years to notice or 3 years to let everyone else know...
After discovering the suspected Equation malware source code, the analyst reported the incident to the CEO. Following a request from the CEO, the archive was deleted from all our systems. The archive was not shared with any third parties.
To be fair, this puts them in a bind. They acquired NSA malware source code but they got it because their product uploaded it to them. If they keep it and use it they are breaching the trust of their client. I trust and give Kaspersky permission to scan for viruses and pull their executables. I don't give them permission to look through various source code on my computer. This isn't about saving or shielding the NSA, it's about the integrity of their contract with their users. Screw the NSA but Kaspersky showed more integrity here than the NSA has ever shown in its entire existence.
Exactly -- once the thickheaded ignoramuses and dumbasses spend one second thinking about it, they will finally realize that in fact Kaspersky did everyone a favor by learning how to keep those tools from breaking into everyone's computers.
I mean are you REALLY naive enough to believe that Windows is
1) an even slightly secure OS
2) Microsoft (and therefore the NSA) really don't/aren't using their own backdoors built right into Windows (and maybe Intel's IME) to conduct ongoing scans, analysis and upload of anything/everything of "interest" that you ever have on your PC ?
The problem is clearly the NSA employee who took the code home and put it on his Windows PC in the first place. He of all people should have known WAAAY better.
I'm willing to bet that Kaspersky had an employee who was also an unknown intelligence spy on the payroll.
The intelligence agency figured out the US Govt was using software - submitted resume for spy to open job - and spy reported to work as instructed. Aren't we worried that the NSA is asking Google/Apple/ISP (cough AT&T) to open the door a crack?
Isn't this the fear of many in security? - that an unknown group could change the C compiler source code to ignore or replace certain instructions. Then modify the encryption software with a backdoor that matches the pattern the compiler is looking for - and thus inject a backdoor? Said backdoor is not visible/obvious in the encryption software.
And the method to do this is have spies report to work at legitimate businesses. with external orchestration of their activities.
Also possible that said spy figured out the zero-day which was put to use from another group outside. OR coded said backdoor or side-channel vector.
Because it would be the interrest of the FSB to get the new malware and signature for two reasons (and I would not be surprised the NSA do the same ) 1) be made aware of new zero day exploit and find counter for the russian's firm/gov security 2) get new exploitable weapons they themselves did not come up with , why otusource when some civilian can build something
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
The sarcasm begins in part 2 of the rationale, with "Only the copyright holder has the legal authority to authorized copying the software." The copying would almost certainloy be found, by any court, to be defensible as Fair Use.
The purpose of the copying is to analyze the malware, not to use/enjoy the malware in the usual manner.
The nature of the copyrighted work is functional, not artistic. And it's already published and shared with whomever the NSA has chosen to investigate.
The effect of the copying on the marketability of the malware is zero. Anyone who didn't want the malware before, still won't want it.
And finally, it shouldn't be copyrightable anyway, because the NSA does not need a government-granted monopoly in order to have incentive to create and publish the malware. Even PD or GPLed malware would be good enough for their purposes.
You still have to prove the most-likely hypothesis is correct. And a less-likely (more complicated) hypothesis can still turn out to be the correct one.
Rational people assume the most-likely until reasonable evidence proves otherwise.
Here's another thought about why it happened -- is it possible that NSA treats some of their more brilliant analysts the same way companies treat executives? Everywhere I've worked, security policies apply to absolutely everyone except the C-level and senior VP ranks. Execs just tell IT to plug whatever new shiny thing they got at a conference or Best Buy into the network, override password policy so they don't have to log in to their machines, and a whole bunch of other things that would get ordinary workers fired. Maybe if you're a super-brilliant borderline autistic cybersecurity genius, the NSA decides it's not worth it to try to enforce policy?
I'm sure a lot of the safeguards around classified information are the equivalent of "security theatre" but I'm kind of surprised NSA would let their analysts casually walk out the door with unreleased exploit code and bring it home with them. People I know who work for defense contractors on much more mundane stuff can't even mount USB drives on their computers read-only, let alone copy files, but it seems like they just let things like this happen once you get a certain level of access beyond the perimeter. Some of the things I've heard described are totally security theatre, like covering whiteboards when the janitor comes through or insisting that every piece of garbage be burned _and_ shredded...but at least they have the common sense to prohibit employees from taking confidential data home and employees I've spoken with are well-trained to not talk about exactly what they're working on. I have a feeling we'd never know about this if it hadn't gotten to a machine without Internet access.
Almost all companies work like this too -- once you're inside everything is trusted and can talk to everything else. That's absolutely the wrong thing to do, but rebuilding the network and walling things off to an "assumed-compromised" posture is super expensive and hard to implement. Lots of companies don't even have internal PKI right yet so port-level authentication on network gear isn't even possible. And the app landscape is so vast and much of it is so old that totally locking down some things would take tons of research and effort...all of which the company won't pay for. You would think NSA would be all over that though, given what they work on.
"if we accidentally get some of your files, we delete them immediately-- any files of any type, no matter what they are or what they do."
But if it got malware, how are they supposed to know if YOU wrote the malware (and thus the policy would be to delete it) or if you just downloaded it (and thus their policy should be to catalogue and hash)?
We are assuming here that Kaspersky is not actually clueless.
Among other things, the fact that you have source code and several previous versions of the file might serve as a clue.
http://www.geoffreylandis.com
Yes, that's a different question. I was addressing the post by AmiMoJo stating that what they should have done was copied the customer's files, analyzed them, and published them.
http://www.geoffreylandis.com
Iâ(TM)m pretty sure nobody got executed for mishandling cyber weapons a few decades ago.
Oh, and I corrected that annoying spelling error in the subject that everyone else has been ignoring.
If only they'd listened to you APK, NSA could've stopped this leak if only they'd just black holed Kaspersky's servers with hosts file :(
You still have to prove the most-likely hypothesis is correct. And a less-likely (more complicated) hypothesis can still turn out to be the correct one.
Rational people assume the most-likely until reasonable evidence proves otherwise.
The problem with all conspiracy theories, which to me is when the people employing them work their way backwards, picking and choosing what they accept, and miraculously, it just so happens to align with their world view. They will even manage to deny it when Kaspersky admits they accessed the idiot's computer.
So this is what happened, So this is how it was found, This is who did it, this is how it happened, and the people who did it admitted they did it.
The only thing left is that somehow the person heading up the company didn't do what his training instructed him to do, which is pass it up the line. And that makes so little sense as to be completely dismissible.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
In the era when literally everything is networked and you can crash a country's economy or power grid with the right cyber weapon, they are the WMD of the modern era, and we did execute the Rosenbergs for stealing US nuclear bomb technology for the Russians.
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like