Vulnerabilities / Threats

1/9/2019
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Kaspersky Lab Helped US Nab NSA Data Thief: Report

But this new development unlikely to do much to clear government suspicions about security vendor's ties to Russian intelligence, analyst says.

Kaspersky Lab reportedly helped the National Security Agency catch a contractor who allegedly stole terabytes of classified data from the US government even as the security vendor itself was under mounting suspicion of spying for the Russians.

That's according to Politico, which this week published a report on what it described as Moscow-based Kaspersky Lab's unsung and unknown role in the August 2016 arrest of former NSA contractor Harold Martin. The report is based on input from unidentified sources and paints a picture of Kaspersky Lab that is somewhat at odds with the US government's own dour assessment of the vendor as a potential threat to national security.

"It's irony piled on irony that people who worked at Kaspersky, who were already in the sights of the US intelligence community, disclosed to them that they had this problem," Politico quoted former NSA general counsel Stewart Baker as saying.

In a brief statement, Kaspersky Lab said it had no comment to offer at this time on the contents of the Politico report.

Martin was arrested just days after a then unknown group calling itself Shadow Brokers began leaking highly classified NSA cyberattack tools and exploits in summer 2016. Shadow Brokers did not reveal the source of the classified NSA documents, but announced it had a whole larger tranche of NSA data that it was willing to auction off to the highest bidder.

A search of Martin's home near Baltimore showed him to be in possession of nearly 50 terabytes of misappropriated government data, including a large number of documents marked "Secret" and "Top Secret."  

Court documents released last month in connection with Martin's case—also first reported on by Politico—show that Martin was arrested shortly after he posted some Twitter messages hinting at his knowledge of the stolen NSA hacking tools. Two of the tweets were sent out literally minutes before the Shadow Brokers began dumping the NSA hacking tools, and led law enforcement to believe Martin was directly involved in the theft.

Last month's court documents do not make clear if the NSA hacking tools were part of the 50 terabytes of data that Martin is said to have misappropriated. Neither does it say whether he has been specifically charged in connection with the theft of the NSA hacking tools. 

Martin currently faces 20 counts of willfully retaining information of importance to national security. His trial is set to begin in June. He faces decades in jail if convicted on all counts.

According to Politico's sources, Martin's arrest did not result from the NSA's own investigations. Rather it was information from Kaspersky Lab that first pointed federal investigators in Martin's direction.

For reasons that are still unclear, Martin sent a total of five private Twitter messages to two security researchers at Kaspersky Lab shortly before the Shadow Brokers leaks began. The messages, all of which were obtained by Politico, were sent from an anonymous Twitter account with the handle 'HAL999999999'. 

Two of the messages suggested that Martin had valuable information on hand and wanted to meet with Kaspersky Lab's founder Eugene Kaspersky. The remaining three messages, sent a couple of days later to a second researcher, were more cryptic with allusions to a new Jason Bourne movie and a link to a YouTube video showing the final moments of the movie "Inception," Politico said.

When the researchers attempted to respond to Martin's messages he blocked them. However, by doing some basic online sleuthing the researchers were relatively easily able to tie the tweets back to Martin and discover he worked for the NSA.

Once Kaspersky Lab had the details, a company employee contacted an NSA employee and suggested the agency might want to investigate Martin. That tip and Kaspersky's evidence later led to Martin's arrest, Politico said.

The US government so far has not acknowledged Kaspersky Lab's reported role in Martin's arrest. Neither has the government softened its stance against the company.

Lingering Suspicions

In fact, since Martin's arrest, things have actually gotten worse for Kaspersky Lab as far as its relations with the US government are concerned. US federal agencies are currently banned from using Kaspersky Lab products and are under instructions to jettison any products of the company that they might have purchased previously.

The ban stems from suspicions that Kaspersky Lab is allowing Russian intelligence to spy on and scoop up data from computers running the company's anti-malware tools. Kaspersky Lab has vehemently denied the allegations against it and has said the ban has seriously hurt its reputation and its ability to sell to US customers. The company has even taken the extreme step of offering up its source code for inspection by third-parties to support its claims.

Some have suggested Kaspersky Lab is the unfortunate victim of the current geopolitical climate between the US and Russia.

John Pescatore, a former NSA analyst and currently director of emerging security trends at the SANS Institute ,says the new news does little one way or the other to clear Kaspersky Lab's reputation.

On the one hand, the US government has never released any actual evidence of wrongdoing by Kaspersky. And the company's rumored ties with Russia's intelligence agencies is probably no different from the involvement that many major US technology companies have with American intelligence agencies, Pescatore says.

"Pure speculation on my part but my guess is that Harold Martin believed that Kaspersky Lab could get him in touch with Russia," he notes.  

Instead of going to the press like Edward Snowden did, and eventually ending up in Russia anyway, Martin probably tried this route as a way of avoiding any surveillance on direct communication paths to Russian agencies, he says.  Kaspersky Lab did the right thing at that point in turning him in, Pescatore notes.

"However, that act of turning him in does not change the uncertainty about Kaspersky one way or the other," he says.

Kaspersky Lab had nothing to lose by turning Martin in; and some, in fact, could view the whole sequence of events as a clever play by Russian intelligence to take suspicion off the company, he says. "So, we are still where we were—no evidence Kaspersky Lab takes orders from Russian intelligence, but no real way to prove they don't."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.