Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

11/16/2017
01:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

121 Pieces of Malware Flagged on NSA Employee's Home Computer

Kaspersky Lab's internal investigation found a backdoor Trojan and other malware on the personal computer of the NSA employee who took home agency hacking tools.

The personal computer used by the National Security Agency (NSA) employee who reportedly took classified tools from the office and loaded them onto that home machine was infected with a backdoor associated with Russian underground forums. Another 120 pieces of malware were flagged on the machine.

That's the latest finding of an internal investigation published today by Kaspersky Lab, which has been under scrutiny amid allegations that its software assisted Russian nation-state actors in stealing the NSA hacking tools off the employee's home computer, which was running Kaspersky Lab antivirus software. The security company has vigorously denied the allegations.

According to the security firm's investigation, the NSA employee's PC was infected with the Mokes backdoor, aka Smoke Bot and Smoke Loader. The information-stealing backdoor Trojan has been for sale since 2014 in Russian cybercrime underground forums, and from September to November 2011, its command-and-control servers were "registered to presumably a Chinese entity going by the name “Zhou Lou”," Kaspersky Lab's report says.

The NSA worker's machine was breached on Oct. 4, 2014, after he installed what appeared to be a pirated Office 2013 application, and Kaspersky Lab's AV later detected the malware as Mokes.

"At a later time after installation of the supposed MS Office 2013, the antivirus began blocking connections out on a regular basis to the URL “http://xvidmovies[.]in/dir/index.php”. Looking into this domain, we can quickly find other malicious files that beacon to the same URL. It's important to note that the reason we know the system was beaconing to this URL is because we were actively blocking it as it was a known bad site. This does however indicate the user actively downloaded / installed malware on the same system around the same time frame as our detections on the Equation files," Kaspersky Lab said in its report.

To have installed and run the malware in the first place, the victim would have had to disable Kaspersky Lab's AV program, the company said.

During the period of September 11 and November 17, 2014, some 121 pieces of malware including Mokes and not including the NSA tools, were flagged by Kaspersky Lab's software. The malware included other backdoors, Trojans, adware, and exploits. "All of these alerts, combined with the limited amount of available telemetry, means that while we can confirm our product spotted the threats, it is impossible to determine if they were executing during the period the product was disabled," the report says.

The AV operated normally when it flagged the tools created by the Equation Group, Kaspersky Lab says. Equation Group is the moniker the security firm uses for the NSA since it steers clear of attribution of actual attack groups.

"In no way was the software used outside of this scope to either pull back additional files that did not fire on a malware signature or were not part of the archive that fired on these signatures," the report says. "What is believed to be potentially classified information was pulled back because it was contained within an archive that fired on an Equation specific malware signatures."

The security firm said it found no evidence that its researchers attempted to set up rogue signatures to search for classified or top-secret files on the NSA worker's machine.

Given the discovery of the Mokes backdoor infection and possible infections from other malware on the machine, Kaspersky Lab concluded that the data "could have been leaked to an unknown number of third-parties as a result of remote access to the computer." 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidLycope
50%
50%
DavidLycope,
User Rank: Apprentice
11/21/2017 | 6:37:45 PM
Re: Human error?
Is this a joke ? how can you be so greedy ? 9.95$ huh
JackDilon
100%
0%
JackDilon,
User Rank: Apprentice
11/21/2017 | 6:00:26 PM
Re: Human error?
Maybe too greedy ? Joke aside, can't understand.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
11/21/2017 | 8:57:07 AM
Re: Human error?
Let's dig that logic deeper - a pirate version of most anything is a risk one takes.  Let alone a major applicatoin like Office.  I would imagine the policy quoted for usage by NSA staff is valid - I have used specific keys purchased by organizations for Office and run a subscript Office 2016 at home - legit.   So for an NSA staffer to run and use ANYTHING PIRATE BASED is or should be means for termination of employment.  Pure and simple.   Secondly, flagged in 2014 and NOBODY DID ANYTHING ABOUT IT?  For this should have stomped on THE NEXT DAY.   In the malware forensics group I work for, we have had many employees terminated for code of conduct violation.  

Kudos for Kapersky for finding the threats and bad NSA on everything else.   Do hope the staffer is no longer at the NSA and serving ice cream at Dairy Queen.

Money making opportunity here - remember those outfits to report unauthorized, stolen, pirate software too?  Now what about the entire NSA itself using stolen software.  Reward per seat?????
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
11/19/2017 | 5:19:41 PM
Re: Human error?
Even so, I don't expect the scapegoating of the Russians -- all Russians -- to stop anytime soon. Good on Kaspersky, though, for vigilantly defending its brand.
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
11/17/2017 | 1:11:38 PM
Re: Human error?
I know, right? This really makes no sense from an NSA employee perspective. So many more questions about what really went down here.
Dan Euritt
50%
50%
Dan Euritt,
User Rank: Apprentice
11/17/2017 | 1:09:18 PM
Human error?
"...after he installed what appeared to be a pirated Office 2013 application"

The latest version of MS Office is $9.95, for federal imployees? MS HUP

Why pirate the program, when he could get the latest version for next to nothing.

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Healthcare Industry Sees Respite From Attacks in First Half of 2020
Robert Lemos, Contributing Writer,  8/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: It's a technique known as breaking out of the sandbox kids.
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20383
PUBLISHED: 2020-08-13
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.
CVE-2020-24348
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
CVE-2020-24349
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
CVE-2020-7360
PUBLISHED: 2020-08-13
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was r...
CVE-2020-24342
PUBLISHED: 2020-08-13
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.