Slashdot Mirror
Internal Kaspersky Investigation Says NSA Worker's Computer Was Infested with Malware (vice.com)
A reader shares a report: The personal computer of an NSA worker who took government hacking tools and classified documents home with him was infected with a backdoor trojan, unrelated to these tools, that could have been used by criminal hackers to steal the US government files, according to a new report being released Thursday by Kaspersky Lab in response to recent allegations against the company. The Moscow-based antivirus firm, which has been accused of using its security software to improperly grab NSA hacking tools and classified documents from the NSA worker's home computer and provide them to the Russian government, says the worker had at least 120 other malicious files on his home computer in addition to the backdoor, and that the latter, which had purportedly been created by a Russian criminal hacker and sold in an underground forum, was trying to actively communicate with a malicious command-and-control server during the time Kaspersky is accused of siphoning the US government files from the worker's computer. Costin Raiu, director of the company's Global Research and Analysis Team, told Motherboard that his company's software detected and prevented that communication but there was a period of time when the worker had disabled his Kaspersky software and left his computer unprotected. Raiu says they found evidence that the NSA worker may have been infected with a second backdoor as well, though they saw no sign of it trying to communicate with an external server so they don't know if it was active on his computer.
In Russia, anti virus scans you
Exactly how did Kapersky Lab determine this?
I am American and I can see now that they have fully investigated and have found that they are not to be blamed. Case is closed so now can we go to get back to real problems?
So first they admitted they retrieved the documents and patted themselves on the back for pulling down the documents that were leaked because they obviously involved data related to hacking.
NOW they're claiming there was malware on his system (oh, and that's not Kapersky's fault either because the user allegedly turned Kapersky off for a bit) so the leaks might have come from the malware and not from them?
I dunno... I would've led with the latter story FIRST...
What possible reason would Kaspersky have to lie?
Also, in Soviet Russia, antivirus software installs you.
You are welcome on my lawn.
I'm so confused. I thought Russia was bad.
No, I'm sure they're paying you a decent rate with benefits as a government employee.
What is that in Russia anyway? $247 a month?
Slashdot should examine the IP addresses of the downmods of this sarcasm.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Every country has spooks. None of them should be trusted, even if they have your best interests in mind, which if you're American the Russian SVR probably doesn't.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Sounds like Kaspersky is either trying to deflect or didn't do a good job of prevention/protection. Were I Kaspersky, at this point, I think I might have kept my mouth shut.
Anything you say will be held against you.
That looks like some NSA worker used a private USB stick to transfer some of the "internal tools" from his computer to another, forgot about it, stuck it into his computer at home that ran Kaspersky, Kaspersky scanned the stick, the AV heuristics determined the stuff looked kinda fishy, did a closer scan, and eventually sent a copy to Russia. Whether that happened after asking "Hey, dude, something's kinda odd about this file, mind if we analyzed it?" or not is kinda moot now.
And since it would be kinda embarrassing to admit such a blunder and that the NSA, of all agencies, handed their valuable zero days to the Russians... let's rather say those damn Russkies in general and Kaspersky in particular are "hacking" us.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
From the summary: "Raiu says they found evidence that the NSA worker may have been infected with a second backdoor as well..."
I thought computers only had one asshole, and it was generally referred to in polite society as "User".
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Kaspersky's antivirus doesn't protect against malware? Now you've really thrown down the gauntlet!
It doesn't protect when it's turned off. From TFA:
So... he's a developer for NSA creating malware, and it detected malware? Sounds about right. The guy was probably testing explicitly if Kapersky could detect the malware since that's what the Russian targets would use. And it did. And now they're pissed / backroom deal with American anti-virus companies to ensure only their shittier software is used (which likely doesn't detect NSA's malware, or has explicit exemptions built-in).
I'm so confused. I thought Russia was bad.
All governments are "bad", they just use different methods.
That said, if any government gets to spy on me, I'd rather it be a foreign one, simply because they don't have as many opportunities to mess up my life, or terminate it.
It is, but being windows it probably crashed partway through the job.
... he brought home non-government malware that might have stolen the government malware he was working on?
I am sure that there are many other solipsists out there.
All governments are "bad"...
... but most of them are so grotesquely incompetent it doesn't matter too much.
As Bertrand Russell once observed, ancient Greece was somewhat redeemed by the fact that the police were so inefficient that most decent people were able to escape their attentions.
I am sure that there are many other solipsists out there.
This is starting to resemble MAD magazine's Spy vs Spy.
The NSA does not care what anti virus program you use, as long as it is one that is in their pocket. The fact that they claim that the Russians have hacked it is meaningless as it is both unproven and irrelevant.
If they have, I will assume they have done so with the others as well.
We are at a time that when the NSA asks not to use something doe not mean that that something is bad, just that they won't benefit if you do.
Don't fight for your country, if your country does not fight for you.
Kaspersky's antivirus doesn't protect against malware? Now you've really thrown down the gauntlet!
It doesn't protect when it's turned off. From TFA:
I hope this dork got fired for such incompetence....
You're messin' with my Zen Thing, man.....
Those guys are supposed to have a semi-infinite annual budget. They are supposed to hire the best of the best. And they keep getting caught on all sorts of fracas. How incompetent can they be?
Now the NSA chickens are coming home to roost.
sudo rm -r -f --no-preserve-root /
There's even more reason to be distrustful of Russian companies after the recent Olympics scandals where the head of the Russian anti-doping organization was told by the state to actually dope and then help to conceal doping for Russian athletes in advance of the Sochi. If Russia can put pressure on people and organizations to do that kind of stuff, there's plenty of reason that they could make Kaspersky operate below board. It's not even that Kaspersky want to do this or are somehow evil, merely that rule of law is quite tenuous in Russia and Putin has enough power that it's not feasible for companies to outright oppose him.
Yes, the U.S. government doesn't try to act much better or actively tries to get away with the same type of crap, but at least the court systems keep them in check to some degree, although I would argue nowhere near enough.
I feel safe knowing the quality of the personnel that spy on us and can have anyone they wish killed by a drone strike without a trial.
FTFY
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
LOL yeah, I'm surprised they even bothered to throw this out there to the neckbeards at this point. It doesn't seem to have much potential purpose other than lulz.
So it was like that scene in Ghostbusters where everything was under control until EPA Inspector Walter Peck shutdown the containment facility.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
The contractor's computer was a honeypot. NSA hacking tools are being released on the dark web and they want to find out how they are being leaked. One theory was that Kaspersky was the culprit. So the NSA intentionally had a contractor put some NSA tools on a laptop that has Kaspersky, and had him put some other malware on there so that Kaspersky antivirus would detect it and wake up, then they watched to see if anyone scanned the NSA hacking tools and downloaded them.
What is happening now is the ensuing PR war. The public won't really learn the truth for years, if ever.
... mock the NSA guy for this?
E.g. the Kaspersky guys could say "Look out! Here comes Typhoid Mary!" whenever they saw him. That shit would never get old.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Oh, the irony of your "(-1: Post disagrees with my already-settled worldview) is not a valid mod option." sig.
And my grandfather, my dad, and I never served in units fighting Russian operatives during the Cold War(s).
Suuuure.
Try another one.
Maybe they'll byte.
-- Tigger warning: This post may contain tiggers! --
Why didn't it alert the user after it was re-enabled? We are to believe the software detected the Trojan, you don't think it should have alerted the user if not automatically remove it? Fucking useless software if it can only detect the installer and not the installation. The only way to read this is either the software is garbage, or they are lying.
I'm so confused. I thought Russia was bad.
All governments are "bad", they just use different methods.
That said, if any government gets to spy on me, I'd rather it be a foreign one, simply because they don't have as many opportunities to mess up my life, or terminate it.
Really?
You don't think that a foreign government can:
1. Leak sensitive data online and make it look like it came from your computer?
2. Tell the US that you are a mole for them?
3. Send a foreign operative into your house to kill you?
Your own country is tasked to protect you. At the very least, it wants your taxes.
A foreign government doesn't give a hoot about you, your life, or your family.
I hope this dork got fired for such incompetence....
Fired? He should be arrested for removing classified information without authorization. As a matter of fact anyone else find it kind of weird that we haven't heard of this happening yet? With all the other leaks, even if this one wasn't intentional they should have come down on him like the hand of god itself to make an example.
I browse on +1 so AC's need not respond, I won't see it.
It seems like the United States Postal Service network is becoming more secure that that of the NSA.
E Proelio Veritas.
Kaspersky AV was installed on a machine full of malware and NSA hacking tools. Kaspersky AV then did its job perfectly, and retrieved samples of all the malware.
America then got wind of this, and because this is 1) embarassing to the NSA, and 2) proves that Kaspersky is a top product, America is now in a full head-on propaganda assault, spreading lies and misinformation that Kaspersky and the Russians (all of them, apparently) are hacking into your computers.
Wake the F up. The only two AV-suites you can trust to not be compromised and do their job at this point is F-secure and Kaspersky. You won't be better off if you let America kill Kaspersky, and eventually other foreign AV-suites.
Esli ti schitaesch normalinim pitki v politsii, ubiystva geev, korruptsiu na samom verhu vlasti
While "civilized" countries outsource their torture to Syria or Guantanamo Bay, the end result is similar. The Russians may be more overt, but that is because the west finds different methods of controlling the populace to be more effective (or possibly more cost-effective).
As for the gays, you may want to read up about Alan Turing, who never set foot in Russia.
Corruption is rife everywhere.
tebe konechno ponravitsya rossia.
What does it have to do with anything? I live in Canada, not in Russia, so I care more about CSIS than the FSB.
Russia is no paradise and Putin is no saint, but there are almost 200 countries in the world and a good number of them have a worse track record. Is that an excuse? Of course not, but I prefer to concentrate on what is happening in the country I live in and in those in which I have relatives and friends.
And come to think of it, so do you, since I didn't hear you complaining about Kim Jong-un's reign of terror or the atrocities of Bashar al-Assad.
Rasskazati kak ubili Litvinenko? A vedi on bil v foreign government.
Litvinenko was an ex FSB officer and a personal thorn in Putin's side, hardly a good example.
International assassinations are nothing new. Some countries use Polonium-210, other use drones.
Think what you wish for.
I did not "wish" for anything.
Really?
You don't think that a foreign government can:
1. Leak sensitive data online and make it look like it came from your computer?
2. Tell the US that you are a mole for them?
3. Send a foreign operative into your house to kill you?
What for? Why expend the resources? Why bother with me? Don't they have enough domestic problems?
Your own country is tasked to protect you.
Tell that to Maher Arar.
A foreign government doesn't give a hoot about you, your life, or your family.
And that's the main reason I am less concerned about them than I am about my own.
As far as I know all those people were either in Russua, Russian citizens, or both.
Therefore, they were terminated by their government (or a local one), which is exactly my point.
I criticize Putin quite vocally, but I doubt he's going to send assassins to Canada to silence me.
On the other hand, an encounter with the local police can easily ruin my day.
Even joking about this is sad. Learn how to have an argument. Attack the argument, not the source.
You are oversimplifying a complex problem. It's much simpler to block the backdoor than to create a removal tool. Many of these malware programs actively thwart removal attempts.
Why does slashdot keep mentioning Kaspersky? The world needs to just forget they exist. Kind of like the country they are in. The world doesn't need it at all, but it needs the world. Let's just ignore the whole bunch.
Echoing the sentiments of such security giants as Howlin' Wolf, Willie Dixon and Chicken Shack, Mr. Morrison, CEO of security company "Doors" was crystal clear about an increased role for women in protecting certain software and hardware ports from unanticipated penetration.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
"The men don't know/But the little girls understand.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
You forgot that a foreign government can also manipulate your country's electorate into choosing a monumentally unsuitable, incompetent, damaging and divisive leader.
And this would have anything to do with anti-virus...how? I don't like it when Russians try to mess with US elections. (I don't like it when the US messes with other countries' elections, but I seem to be in a minority here.)
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I was adding to the ways in which a foreign government can mess up someone's life.
Tangential maybe but this is about Kaspersky who are defending themselves from the accusation of being, hosting, or being used as a vector by, Russian spies.
We have this NSA analyst who has access to the source code of their spying tools, copies a zip file containing it and the tools themselves to a USB drive, takes it home and plugs it into his PC which is running antivirus software from a non-friendly state but that's OK because he's not meant to take classified info home.
Then the Kaspersky scan discovers this malware in a zip file and downloads it as a sample.
Why didn't the NSA analyst notice the big Kaspersky warning about malware on his PC? Maybe because they used a silent signature. Kaspersky have a patent on that: "If the silent signature coincides with malware signature, a user is not informed".
But now Kaspersky say there was other malware on the PC. Easy enough for the NSA to verify.
Will the US government say fair enough maybe it wasn't you and sorry for the lost business?
Then again, maybe you believe this,
The most obvious route is for the Russian government to have a willing or unwilling accomplice inside Kaspersky.
Sorry for the misinterpretation. I agree that the US government should avoid Kaspersky, and that no classified information should be on a computer running Kaspersky.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes