Analytics

11/16/2017
01:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

121 Pieces of Malware Flagged on NSA Employee's Home Computer

Kaspersky Lab's internal investigation found a backdoor Trojan and other malware on the personal computer of the NSA employee who took home agency hacking tools.

The personal computer used by the National Security Agency (NSA) employee who reportedly took classified tools from the office and loaded them onto that home machine was infected with a backdoor associated with Russian underground forums. Another 120 pieces of malware were flagged on the machine.

That's the latest finding of an internal investigation published today by Kaspersky Lab, which has been under scrutiny amid allegations that its software assisted Russian nation-state actors in stealing the NSA hacking tools off the employee's home computer, which was running Kaspersky Lab antivirus software. The security company has vigorously denied the allegations.

According to the security firm's investigation, the NSA employee's PC was infected with the Mokes backdoor, aka Smoke Bot and Smoke Loader. The information-stealing backdoor Trojan has been for sale since 2014 in Russian cybercrime underground forums, and from September to November 2011, its command-and-control servers were "registered to presumably a Chinese entity going by the name “Zhou Lou”," Kaspersky Lab's report says.

The NSA worker's machine was breached on Oct. 4, 2014, after he installed what appeared to be a pirated Office 2013 application, and Kaspersky Lab's AV later detected the malware as Mokes.

"At a later time after installation of the supposed MS Office 2013, the antivirus began blocking connections out on a regular basis to the URL “http://xvidmovies[.]in/dir/index.php”. Looking into this domain, we can quickly find other malicious files that beacon to the same URL. It's important to note that the reason we know the system was beaconing to this URL is because we were actively blocking it as it was a known bad site. This does however indicate the user actively downloaded / installed malware on the same system around the same time frame as our detections on the Equation files," Kaspersky Lab said in its report.

To have installed and run the malware in the first place, the victim would have had to disable Kaspersky Lab's AV program, the company said.

During the period of September 11 and November 17, 2014, some 121 pieces of malware including Mokes and not including the NSA tools, were flagged by Kaspersky Lab's software. The malware included other backdoors, Trojans, adware, and exploits. "All of these alerts, combined with the limited amount of available telemetry, means that while we can confirm our product spotted the threats, it is impossible to determine if they were executing during the period the product was disabled," the report says.

The AV operated normally when it flagged the tools created by the Equation Group, Kaspersky Lab says. Equation Group is the moniker the security firm uses for the NSA since it steers clear of attribution of actual attack groups.

"In no way was the software used outside of this scope to either pull back additional files that did not fire on a malware signature or were not part of the archive that fired on these signatures," the report says. "What is believed to be potentially classified information was pulled back because it was contained within an archive that fired on an Equation specific malware signatures."

The security firm said it found no evidence that its researchers attempted to set up rogue signatures to search for classified or top-secret files on the NSA worker's machine.

Given the discovery of the Mokes backdoor infection and possible infections from other malware on the machine, Kaspersky Lab concluded that the data "could have been leaked to an unknown number of third-parties as a result of remote access to the computer." 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidLycope
50%
50%
DavidLycope,
User Rank: Apprentice
11/21/2017 | 6:37:45 PM
Re: Human error?
Is this a joke ? how can you be so greedy ? 9.95$ huh
JackDilon
100%
0%
JackDilon,
User Rank: Apprentice
11/21/2017 | 6:00:26 PM
Re: Human error?
Maybe too greedy ? Joke aside, can't understand.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
11/21/2017 | 8:57:07 AM
Re: Human error?
Let's dig that logic deeper - a pirate version of most anything is a risk one takes.  Let alone a major applicatoin like Office.  I would imagine the policy quoted for usage by NSA staff is valid - I have used specific keys purchased by organizations for Office and run a subscript Office 2016 at home - legit.   So for an NSA staffer to run and use ANYTHING PIRATE BASED is or should be means for termination of employment.  Pure and simple.   Secondly, flagged in 2014 and NOBODY DID ANYTHING ABOUT IT?  For this should have stomped on THE NEXT DAY.   In the malware forensics group I work for, we have had many employees terminated for code of conduct violation.  

Kudos for Kapersky for finding the threats and bad NSA on everything else.   Do hope the staffer is no longer at the NSA and serving ice cream at Dairy Queen.

Money making opportunity here - remember those outfits to report unauthorized, stolen, pirate software too?  Now what about the entire NSA itself using stolen software.  Reward per seat?????
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:19:41 PM
Re: Human error?
Even so, I don't expect the scapegoating of the Russians -- all Russians -- to stop anytime soon. Good on Kaspersky, though, for vigilantly defending its brand.
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
11/17/2017 | 1:11:38 PM
Re: Human error?
I know, right? This really makes no sense from an NSA employee perspective. So many more questions about what really went down here.
Dan Euritt
50%
50%
Dan Euritt,
User Rank: Apprentice
11/17/2017 | 1:09:18 PM
Human error?
"...after he installed what appeared to be a pirated Office 2013 application"

The latest version of MS Office is $9.95, for federal imployees? MS HUP

Why pirate the program, when he could get the latest version for next to nothing.

 
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.