Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/9/2019
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Kaspersky Lab Helped US Nab NSA Data Thief: Report

But this new development unlikely to do much to clear government suspicions about security vendor's ties to Russian intelligence, analyst says.

Kaspersky Lab reportedly helped the National Security Agency catch a contractor who allegedly stole terabytes of classified data from the US government even as the security vendor itself was under mounting suspicion of spying for the Russians.

That's according to Politico, which this week published a report on what it described as Moscow-based Kaspersky Lab's unsung and unknown role in the August 2016 arrest of former NSA contractor Harold Martin. The report is based on input from unidentified sources and paints a picture of Kaspersky Lab that is somewhat at odds with the US government's own dour assessment of the vendor as a potential threat to national security.

"It's irony piled on irony that people who worked at Kaspersky, who were already in the sights of the US intelligence community, disclosed to them that they had this problem," Politico quoted former NSA general counsel Stewart Baker as saying.

In a brief statement, Kaspersky Lab said it had no comment to offer at this time on the contents of the Politico report.

Martin was arrested just days after a then unknown group calling itself Shadow Brokers began leaking highly classified NSA cyberattack tools and exploits in summer 2016. Shadow Brokers did not reveal the source of the classified NSA documents, but announced it had a whole larger tranche of NSA data that it was willing to auction off to the highest bidder.

A search of Martin's home near Baltimore showed him to be in possession of nearly 50 terabytes of misappropriated government data, including a large number of documents marked "Secret" and "Top Secret."  

Court documents released last month in connection with Martin's case—also first reported on by Politico—show that Martin was arrested shortly after he posted some Twitter messages hinting at his knowledge of the stolen NSA hacking tools. Two of the tweets were sent out literally minutes before the Shadow Brokers began dumping the NSA hacking tools, and led law enforcement to believe Martin was directly involved in the theft.

Last month's court documents do not make clear if the NSA hacking tools were part of the 50 terabytes of data that Martin is said to have misappropriated. Neither does it say whether he has been specifically charged in connection with the theft of the NSA hacking tools. 

Martin currently faces 20 counts of willfully retaining information of importance to national security. His trial is set to begin in June. He faces decades in jail if convicted on all counts.

According to Politico's sources, Martin's arrest did not result from the NSA's own investigations. Rather it was information from Kaspersky Lab that first pointed federal investigators in Martin's direction.

For reasons that are still unclear, Martin sent a total of five private Twitter messages to two security researchers at Kaspersky Lab shortly before the Shadow Brokers leaks began. The messages, all of which were obtained by Politico, were sent from an anonymous Twitter account with the handle 'HAL999999999'. 

Two of the messages suggested that Martin had valuable information on hand and wanted to meet with Kaspersky Lab's founder Eugene Kaspersky. The remaining three messages, sent a couple of days later to a second researcher, were more cryptic with allusions to a new Jason Bourne movie and a link to a YouTube video showing the final moments of the movie "Inception," Politico said.

When the researchers attempted to respond to Martin's messages he blocked them. However, by doing some basic online sleuthing the researchers were relatively easily able to tie the tweets back to Martin and discover he worked for the NSA.

Once Kaspersky Lab had the details, a company employee contacted an NSA employee and suggested the agency might want to investigate Martin. That tip and Kaspersky's evidence later led to Martin's arrest, Politico said.

The US government so far has not acknowledged Kaspersky Lab's reported role in Martin's arrest. Neither has the government softened its stance against the company.

Lingering Suspicions

In fact, since Martin's arrest, things have actually gotten worse for Kaspersky Lab as far as its relations with the US government are concerned. US federal agencies are currently banned from using Kaspersky Lab products and are under instructions to jettison any products of the company that they might have purchased previously.

The ban stems from suspicions that Kaspersky Lab is allowing Russian intelligence to spy on and scoop up data from computers running the company's anti-malware tools. Kaspersky Lab has vehemently denied the allegations against it and has said the ban has seriously hurt its reputation and its ability to sell to US customers. The company has even taken the extreme step of offering up its source code for inspection by third-parties to support its claims.

Some have suggested Kaspersky Lab is the unfortunate victim of the current geopolitical climate between the US and Russia.

John Pescatore, a former NSA analyst and currently director of emerging security trends at the SANS Institute ,says the new news does little one way or the other to clear Kaspersky Lab's reputation.

On the one hand, the US government has never released any actual evidence of wrongdoing by Kaspersky. And the company's rumored ties with Russia's intelligence agencies is probably no different from the involvement that many major US technology companies have with American intelligence agencies, Pescatore says.

"Pure speculation on my part but my guess is that Harold Martin believed that Kaspersky Lab could get him in touch with Russia," he notes.  

Instead of going to the press like Edward Snowden did, and eventually ending up in Russia anyway, Martin probably tried this route as a way of avoiding any surveillance on direct communication paths to Russian agencies, he says.  Kaspersky Lab did the right thing at that point in turning him in, Pescatore notes.

"However, that act of turning him in does not change the uncertainty about Kaspersky one way or the other," he says.

Kaspersky Lab had nothing to lose by turning Martin in; and some, in fact, could view the whole sequence of events as a clever play by Russian intelligence to take suspicion off the company, he says. "So, we are still where we were—no evidence Kaspersky Lab takes orders from Russian intelligence, but no real way to prove they don't."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.