Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

11/16/2017
01:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

121 Pieces of Malware Flagged on NSA Employee's Home Computer

Kaspersky Lab's internal investigation found a backdoor Trojan and other malware on the personal computer of the NSA employee who took home agency hacking tools.

The personal computer used by the National Security Agency (NSA) employee who reportedly took classified tools from the office and loaded them onto that home machine was infected with a backdoor associated with Russian underground forums. Another 120 pieces of malware were flagged on the machine.

That's the latest finding of an internal investigation published today by Kaspersky Lab, which has been under scrutiny amid allegations that its software assisted Russian nation-state actors in stealing the NSA hacking tools off the employee's home computer, which was running Kaspersky Lab antivirus software. The security company has vigorously denied the allegations.

According to the security firm's investigation, the NSA employee's PC was infected with the Mokes backdoor, aka Smoke Bot and Smoke Loader. The information-stealing backdoor Trojan has been for sale since 2014 in Russian cybercrime underground forums, and from September to November 2011, its command-and-control servers were "registered to presumably a Chinese entity going by the name “Zhou Lou”," Kaspersky Lab's report says.

The NSA worker's machine was breached on Oct. 4, 2014, after he installed what appeared to be a pirated Office 2013 application, and Kaspersky Lab's AV later detected the malware as Mokes.

"At a later time after installation of the supposed MS Office 2013, the antivirus began blocking connections out on a regular basis to the URL “http://xvidmovies[.]in/dir/index.php”. Looking into this domain, we can quickly find other malicious files that beacon to the same URL. It's important to note that the reason we know the system was beaconing to this URL is because we were actively blocking it as it was a known bad site. This does however indicate the user actively downloaded / installed malware on the same system around the same time frame as our detections on the Equation files," Kaspersky Lab said in its report.

To have installed and run the malware in the first place, the victim would have had to disable Kaspersky Lab's AV program, the company said.

During the period of September 11 and November 17, 2014, some 121 pieces of malware including Mokes and not including the NSA tools, were flagged by Kaspersky Lab's software. The malware included other backdoors, Trojans, adware, and exploits. "All of these alerts, combined with the limited amount of available telemetry, means that while we can confirm our product spotted the threats, it is impossible to determine if they were executing during the period the product was disabled," the report says.

The AV operated normally when it flagged the tools created by the Equation Group, Kaspersky Lab says. Equation Group is the moniker the security firm uses for the NSA since it steers clear of attribution of actual attack groups.

"In no way was the software used outside of this scope to either pull back additional files that did not fire on a malware signature or were not part of the archive that fired on these signatures," the report says. "What is believed to be potentially classified information was pulled back because it was contained within an archive that fired on an Equation specific malware signatures."

The security firm said it found no evidence that its researchers attempted to set up rogue signatures to search for classified or top-secret files on the NSA worker's machine.

Given the discovery of the Mokes backdoor infection and possible infections from other malware on the machine, Kaspersky Lab concluded that the data "could have been leaked to an unknown number of third-parties as a result of remote access to the computer." 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidLycope
50%
50%
DavidLycope,
User Rank: Apprentice
11/21/2017 | 6:37:45 PM
Re: Human error?
Is this a joke ? how can you be so greedy ? 9.95$ huh
JackDilon
100%
0%
JackDilon,
User Rank: Apprentice
11/21/2017 | 6:00:26 PM
Re: Human error?
Maybe too greedy ? Joke aside, can't understand.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
11/21/2017 | 8:57:07 AM
Re: Human error?
Let's dig that logic deeper - a pirate version of most anything is a risk one takes.  Let alone a major applicatoin like Office.  I would imagine the policy quoted for usage by NSA staff is valid - I have used specific keys purchased by organizations for Office and run a subscript Office 2016 at home - legit.   So for an NSA staffer to run and use ANYTHING PIRATE BASED is or should be means for termination of employment.  Pure and simple.   Secondly, flagged in 2014 and NOBODY DID ANYTHING ABOUT IT?  For this should have stomped on THE NEXT DAY.   In the malware forensics group I work for, we have had many employees terminated for code of conduct violation.  

Kudos for Kapersky for finding the threats and bad NSA on everything else.   Do hope the staffer is no longer at the NSA and serving ice cream at Dairy Queen.

Money making opportunity here - remember those outfits to report unauthorized, stolen, pirate software too?  Now what about the entire NSA itself using stolen software.  Reward per seat?????
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:19:41 PM
Re: Human error?
Even so, I don't expect the scapegoating of the Russians -- all Russians -- to stop anytime soon. Good on Kaspersky, though, for vigilantly defending its brand.
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
11/17/2017 | 1:11:38 PM
Re: Human error?
I know, right? This really makes no sense from an NSA employee perspective. So many more questions about what really went down here.
Dan Euritt
50%
50%
Dan Euritt,
User Rank: Apprentice
11/17/2017 | 1:09:18 PM
Human error?
"...after he installed what appeared to be a pirated Office 2013 application"

The latest version of MS Office is $9.95, for federal imployees? MS HUP

Why pirate the program, when he could get the latest version for next to nothing.

 
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9351
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with a verbose error showing where the application resides (the a...
CVE-2020-9352
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.
CVE-2020-9353
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML ...
CVE-2020-9354
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. pat...
CVE-2020-9355
PUBLISHED: 2020-02-23
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.