Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:45 PM
Connect Directly

Kaspersky Lab Helped US Nab NSA Data Thief: Report

But this new development unlikely to do much to clear government suspicions about security vendor's ties to Russian intelligence, analyst says.

Kaspersky Lab reportedly helped the National Security Agency catch a contractor who allegedly stole terabytes of classified data from the US government even as the security vendor itself was under mounting suspicion of spying for the Russians.

That's according to Politico, which this week published a report on what it described as Moscow-based Kaspersky Lab's unsung and unknown role in the August 2016 arrest of former NSA contractor Harold Martin. The report is based on input from unidentified sources and paints a picture of Kaspersky Lab that is somewhat at odds with the US government's own dour assessment of the vendor as a potential threat to national security.

"It's irony piled on irony that people who worked at Kaspersky, who were already in the sights of the US intelligence community, disclosed to them that they had this problem," Politico quoted former NSA general counsel Stewart Baker as saying.

In a brief statement, Kaspersky Lab said it had no comment to offer at this time on the contents of the Politico report.

Martin was arrested just days after a then unknown group calling itself Shadow Brokers began leaking highly classified NSA cyberattack tools and exploits in summer 2016. Shadow Brokers did not reveal the source of the classified NSA documents, but announced it had a whole larger tranche of NSA data that it was willing to auction off to the highest bidder.

A search of Martin's home near Baltimore showed him to be in possession of nearly 50 terabytes of misappropriated government data, including a large number of documents marked "Secret" and "Top Secret."  

Court documents released last month in connection with Martin's case—also first reported on by Politico—show that Martin was arrested shortly after he posted some Twitter messages hinting at his knowledge of the stolen NSA hacking tools. Two of the tweets were sent out literally minutes before the Shadow Brokers began dumping the NSA hacking tools, and led law enforcement to believe Martin was directly involved in the theft.

Last month's court documents do not make clear if the NSA hacking tools were part of the 50 terabytes of data that Martin is said to have misappropriated. Neither does it say whether he has been specifically charged in connection with the theft of the NSA hacking tools. 

Martin currently faces 20 counts of willfully retaining information of importance to national security. His trial is set to begin in June. He faces decades in jail if convicted on all counts.

According to Politico's sources, Martin's arrest did not result from the NSA's own investigations. Rather it was information from Kaspersky Lab that first pointed federal investigators in Martin's direction.

For reasons that are still unclear, Martin sent a total of five private Twitter messages to two security researchers at Kaspersky Lab shortly before the Shadow Brokers leaks began. The messages, all of which were obtained by Politico, were sent from an anonymous Twitter account with the handle 'HAL999999999'. 

Two of the messages suggested that Martin had valuable information on hand and wanted to meet with Kaspersky Lab's founder Eugene Kaspersky. The remaining three messages, sent a couple of days later to a second researcher, were more cryptic with allusions to a new Jason Bourne movie and a link to a YouTube video showing the final moments of the movie "Inception," Politico said.

When the researchers attempted to respond to Martin's messages he blocked them. However, by doing some basic online sleuthing the researchers were relatively easily able to tie the tweets back to Martin and discover he worked for the NSA.

Once Kaspersky Lab had the details, a company employee contacted an NSA employee and suggested the agency might want to investigate Martin. That tip and Kaspersky's evidence later led to Martin's arrest, Politico said.

The US government so far has not acknowledged Kaspersky Lab's reported role in Martin's arrest. Neither has the government softened its stance against the company.

Lingering Suspicions

In fact, since Martin's arrest, things have actually gotten worse for Kaspersky Lab as far as its relations with the US government are concerned. US federal agencies are currently banned from using Kaspersky Lab products and are under instructions to jettison any products of the company that they might have purchased previously.

The ban stems from suspicions that Kaspersky Lab is allowing Russian intelligence to spy on and scoop up data from computers running the company's anti-malware tools. Kaspersky Lab has vehemently denied the allegations against it and has said the ban has seriously hurt its reputation and its ability to sell to US customers. The company has even taken the extreme step of offering up its source code for inspection by third-parties to support its claims.

Some have suggested Kaspersky Lab is the unfortunate victim of the current geopolitical climate between the US and Russia.

John Pescatore, a former NSA analyst and currently director of emerging security trends at the SANS Institute ,says the new news does little one way or the other to clear Kaspersky Lab's reputation.

On the one hand, the US government has never released any actual evidence of wrongdoing by Kaspersky. And the company's rumored ties with Russia's intelligence agencies is probably no different from the involvement that many major US technology companies have with American intelligence agencies, Pescatore says.

"Pure speculation on my part but my guess is that Harold Martin believed that Kaspersky Lab could get him in touch with Russia," he notes.  

Instead of going to the press like Edward Snowden did, and eventually ending up in Russia anyway, Martin probably tried this route as a way of avoiding any surveillance on direct communication paths to Russian agencies, he says.  Kaspersky Lab did the right thing at that point in turning him in, Pescatore notes.

"However, that act of turning him in does not change the uncertainty about Kaspersky one way or the other," he says.

Kaspersky Lab had nothing to lose by turning Martin in; and some, in fact, could view the whole sequence of events as a clever play by Russian intelligence to take suspicion off the company, he says. "So, we are still where we were—no evidence Kaspersky Lab takes orders from Russian intelligence, but no real way to prove they don't."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-16
AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI.
PUBLISHED: 2020-02-16
Abbott FreeStyle Libre 14-day before February 2020 and FreeStyle Libre 2 before February 2020 allow remote attackers to enable write access via a specific NFC unlock command.
PUBLISHED: 2020-02-15
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies ...
PUBLISHED: 2020-02-14
Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed...
PUBLISHED: 2020-02-14
In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).