Analytics
11/16/2017
01:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

121 Pieces of Malware Flagged on NSA Employee's Home Computer

Kaspersky Lab's internal investigation found a backdoor Trojan and other malware on the personal computer of the NSA employee who took home agency hacking tools.

The personal computer used by the National Security Agency (NSA) employee who reportedly took classified tools from the office and loaded them onto that home machine was infected with a backdoor associated with Russian underground forums. Another 120 pieces of malware were flagged on the machine.

That's the latest finding of an internal investigation published today by Kaspersky Lab, which has been under scrutiny amid allegations that its software assisted Russian nation-state actors in stealing the NSA hacking tools off the employee's home computer, which was running Kaspersky Lab antivirus software. The security company has vigorously denied the allegations.

According to the security firm's investigation, the NSA employee's PC was infected with the Mokes backdoor, aka Smoke Bot and Smoke Loader. The information-stealing backdoor Trojan has been for sale since 2014 in Russian cybercrime underground forums, and from September to November 2011, its command-and-control servers were "registered to presumably a Chinese entity going by the name “Zhou Lou”," Kaspersky Lab's report says.

The NSA worker's machine was breached on Oct. 4, 2014, after he installed what appeared to be a pirated Office 2013 application, and Kaspersky Lab's AV later detected the malware as Mokes.

"At a later time after installation of the supposed MS Office 2013, the antivirus began blocking connections out on a regular basis to the URL “http://xvidmovies[.]in/dir/index.php”. Looking into this domain, we can quickly find other malicious files that beacon to the same URL. It's important to note that the reason we know the system was beaconing to this URL is because we were actively blocking it as it was a known bad site. This does however indicate the user actively downloaded / installed malware on the same system around the same time frame as our detections on the Equation files," Kaspersky Lab said in its report.

To have installed and run the malware in the first place, the victim would have had to disable Kaspersky Lab's AV program, the company said.

During the period of September 11 and November 17, 2014, some 121 pieces of malware including Mokes and not including the NSA tools, were flagged by Kaspersky Lab's software. The malware included other backdoors, Trojans, adware, and exploits. "All of these alerts, combined with the limited amount of available telemetry, means that while we can confirm our product spotted the threats, it is impossible to determine if they were executing during the period the product was disabled," the report says.

The AV operated normally when it flagged the tools created by the Equation Group, Kaspersky Lab says. Equation Group is the moniker the security firm uses for the NSA since it steers clear of attribution of actual attack groups.

"In no way was the software used outside of this scope to either pull back additional files that did not fire on a malware signature or were not part of the archive that fired on these signatures," the report says. "What is believed to be potentially classified information was pulled back because it was contained within an archive that fired on an Equation specific malware signatures."

The security firm said it found no evidence that its researchers attempted to set up rogue signatures to search for classified or top-secret files on the NSA worker's machine.

Given the discovery of the Mokes backdoor infection and possible infections from other malware on the machine, Kaspersky Lab concluded that the data "could have been leaked to an unknown number of third-parties as a result of remote access to the computer." 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidLycope
50%
50%
DavidLycope,
User Rank: Apprentice
11/21/2017 | 6:37:45 PM
Re: Human error?
Is this a joke ? how can you be so greedy ? 9.95$ huh
JackDilon
100%
0%
JackDilon,
User Rank: Apprentice
11/21/2017 | 6:00:26 PM
Re: Human error?
Maybe too greedy ? Joke aside, can't understand.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
11/21/2017 | 8:57:07 AM
Re: Human error?
Let's dig that logic deeper - a pirate version of most anything is a risk one takes.  Let alone a major applicatoin like Office.  I would imagine the policy quoted for usage by NSA staff is valid - I have used specific keys purchased by organizations for Office and run a subscript Office 2016 at home - legit.   So for an NSA staffer to run and use ANYTHING PIRATE BASED is or should be means for termination of employment.  Pure and simple.   Secondly, flagged in 2014 and NOBODY DID ANYTHING ABOUT IT?  For this should have stomped on THE NEXT DAY.   In the malware forensics group I work for, we have had many employees terminated for code of conduct violation.  

Kudos for Kapersky for finding the threats and bad NSA on everything else.   Do hope the staffer is no longer at the NSA and serving ice cream at Dairy Queen.

Money making opportunity here - remember those outfits to report unauthorized, stolen, pirate software too?  Now what about the entire NSA itself using stolen software.  Reward per seat?????
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:19:41 PM
Re: Human error?
Even so, I don't expect the scapegoating of the Russians -- all Russians -- to stop anytime soon. Good on Kaspersky, though, for vigilantly defending its brand.
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
11/17/2017 | 1:11:38 PM
Re: Human error?
I know, right? This really makes no sense from an NSA employee perspective. So many more questions about what really went down here.
Dan Euritt
50%
50%
Dan Euritt,
User Rank: Apprentice
11/17/2017 | 1:09:18 PM
Human error?
"...after he installed what appeared to be a pirated Office 2013 application"

The latest version of MS Office is $9.95, for federal imployees? MS HUP

Why pirate the program, when he could get the latest version for next to nothing.

 
BlueBorne Attack Highlights Flaws in Linux, IoT Security
Kelly Sheridan, Associate Editor, Dark Reading,  12/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.