Internal Kaspersky Investigation Says NSA Worker's Computer Was Infested with Malware (vice.com)

A reader shares a report: The personal computer of an NSA worker who took government hacking tools and classified documents home with him was infected with a backdoor trojan, unrelated to these tools, that could have been used by criminal hackers to steal the US government files, according to a new report being released Thursday by Kaspersky Lab in response to recent allegations against the company. The Moscow-based antivirus firm, which has been accused of using its security software to improperly grab NSA hacking tools and classified documents from the NSA worker's home computer and provide them to the Russian government, says the worker had at least 120 other malicious files on his home computer in addition to the backdoor, and that the latter, which had purportedly been created by a Russian criminal hacker and sold in an underground forum, was trying to actively communicate with a malicious command-and-control server during the time Kaspersky is accused of siphoning the US government files from the worker's computer. Costin Raiu, director of the company's Global Research and Analysis Team, told Motherboard that his company's software detected and prevented that communication but there was a period of time when the worker had disabled his Kaspersky software and left his computer unprotected. Raiu says they found evidence that the NSA worker may have been infected with a second backdoor as well, though they saw no sign of it trying to communicate with an external server so they don't know if it was active on his computer.

Comments

Re:Wait a second

[Anonymous Coward]

Exactly how did Kapersky Lab determine this?

The computer in question was running Kapersky antivirus software, which logs when it discovers viruses and malware.

Doesn't work when it's turned off [Re:That's a low

[Anonymous Coward]

Kaspersky's antivirus doesn't protect against malware? Now you've really thrown down the gauntlet!

It doesn't protect when it's turned off. From TFA:

The worker's home machine got infected with the backdoor after he tried to install a pirated version of Microsoft Office. Not only is pirated software notorious for containing malware, but the worker apparently intentionally disabled his Kaspersky detection software to install the pirated software. The worker disabled it in order to run a tool known as a keygen that would generate a software key that would allow him to run the pirated Microsoft Office software on his machine. But that key-generation software turned out to contain a backdoor known as “Smoke Bot," “Smoke Loader,” and "Mokes" that was purportedly created by a Russian hacker in 2012 and sold on a Russian underground forum.