Recently, we have reported several claims (here, here, and here) made by the Russian security software manufacturer Kaspersky Lab that they have discovered 'evidence' of NSA involvement in malware. Now, Bloomberg claims that the Moscow-based computer security company has effectively been taken over by the FSB. Company founder Eugene Kaspersky was educated at a KBG-run school, which was never a secret, but the new report describes a much more current and intimate connection.
Kaspersky Lab is denying the allegations, as one might expect, and counter with the statement:
It's not as though the US has clean hands in all of this. The CIA has funded the development of security software firms like FireEye, Veracode, and Hytrust though its In-Q-Tel investment fund, and American firms have been noticeably silent when it comes to investigating suspected US state-sponsored malware.
We are unlikely to hear the truth from either side, nor should we realistically expect a confession from the NSA or the FSB. Nevertheless, it is possible that the security industries on both sides are 'guilty' of looking after their respective government's interests and what we are seeing is just another day in the world of intelligence collection and cyber-security, the world of claim and counter-claim.
[Editor's Comment: Typo fixed at 15:39 UTC]
Related Stories
Three stories have been received which describes Kaspersky's malware analysis and their findings. Perhaps of equal interest is that all three reports suggest that the malware may be linked to the NSA. One also notes CDs sent through the USPS (United States Postal Service) seem to have been intercepted and replaced with modified CDs. I'll let you draw your own conclusions and I look forward to the ensuing discussion.
The Newly-Discovered "Equation Group" Deemed World's Top Hackers
Kaspersky declined to publicly name the country behind the spying campaign, but Wired points some possible NSA connections:
Although the researchers have no solid evidence that the NSA is behind the tools and decline to make any attribution to that effect, there is circumstantial evidence that points to this conclusion. A keyword—GROK—found in a keylogger component appears in an NSA spy tool catalog leaked to journalists in 2013. The 53-page document details—with pictures, diagrams and secret codenames—an array of complex devices and capabilities available to intelligence operatives. The capabilities of several tools in the catalog identified by the codenames UNITEDRAKE, STRAITBAZZARE, VALIDATOR and SLICKERVICAR appear to match the tools Kaspersky found. These codenames don’t appear in the components from the Equation Group, but Kaspersky did find “UR” in EquationDrug, suggesting a possible connection to UNITEDRAKE (United Rake). Kaspersky also found other codenames in the components that aren’t in the NSA catalog but share the same naming conventions—they include SKYHOOKCHOW, STEALTHFIGHTER, DRINKPARSLEY, STRAITACID, LUTEUSOBSTOS, STRAITSHOOTER, and DESERTWINTER.
[More after the break.]
Ars Technica reports that Kaspersky Labs have released further details tying the NSA to a group of expert hackers dubbed "Equation Group".
The Kaspersky researchers once again stopped short of saying the hacking collective they dubbed Equation Group was the handiwork of the NSA, saying only that the operation had to have been sponsored by a nation-state with nearly unlimited resources to dedicate to the project. Still, they heaped new findings on top of a mountain of existing evidence that already strongly implicated the spy agency. The strongest new tie to the NSA was the string "BACKSNARF_AB25" discovered only a few days ago embedded in a newly found sample of the Equation Group espionage platform dubbed "EquationDrug." "BACKSNARF," according to page 19 of this undated NSA presentation [PDF], was the name of a project tied to the NSA's Tailored Access Operations.
Similarities have been noted in the procedures and capabilities of Equation Group and those detailed in Edward Snowden's disclosures concerning the NSA, most notably the the ability to interdict hardware and software during shipping to be replaced with duplicates infected with highly sophisticated malware. The article also points to timestamp analysis that indicates the authors of the captured malware worked regular office hours: 8-5, Monday-Friday in the UTC-3 and UTC-4 time-zones. The Kaspersky report discounted intentional manipulation of these timestamps and suggests that Equation Group are located in the eastern United States.
All of you knew that it could only get worse:
Kaspersky malware probers have uncovered a new 'operating system-like' platform that [they claim] was developed and used by the National Security Agency (NSA) in its Equation spying arsenal. The EquationDrug or Equestre platform is used to deploy [an estimated] 116 plug-in modules to target computers that can siphon data and spy on victims. So far, only 30 modules have been identified.
"It's important to note that EquationDrug is not just a trojan, but a full espionage platform, which includes a framework for conducting cyber-espionage activities by deploying specific modules on the machines of selected victims," Kaspersky researchers say in a report.
The article goes on to explain that Kaspersky further believes that the software is part of the "NSA's campaign to infect hard disk firmware". There is considerably more detail in the article.
I think I am going to get my old manual typewriter out of the garage, get a new ribbon, use U.S. Mail instead of e-mail, and buy more ink for my fountain pens.
According to emails from October 2009 obtained by Jordan Robertson and Michael Riley at Bloomberg it appears that Kaspersky Lab has been working with Russian Intelligence. Despite long standing rumours over these connections Eugene Kaspersky has always denied this to be the case, including as recently as last week in response to questions in the US Senate by Florida Republican Marco Rubio when he stated that "Claims about Kaspersky Lab's ties to the Kremlin are "unfounded conspiracy theories" and "total BS,"" on Reddit, and even offering to hand over the source code to the US Government for inspection.
While the exact nature of the co-operation with the FSB is still unclear, in the emails Kaspersky outlines a project undertaken in secret a year earlier "per a big request on the Lubyanka side," a reference to the FSB offices, that "includes both technology to protect against attacks (filters) as well as interaction with the hosters ('spreading' of sacrifice) and active countermeasures (about which, we keep quiet) and so on," Kaspersky wrote in one of the emails. Kaspersky Lab has confirmed that the emails are authentic. Whether this was legitimate work with the FSB in the prevention of cybercrime or securing FSB facilities or something more nefarious, it seems likely that this is not going to alleviate concerns over the use of their software putting further pressure on Kaspersky's business in other countries.
US officials: Kaspersky "Slingshot" report burned anti-terror operation
A malware campaign discovered by researchers for Kaspersky Lab this month was in fact a US military operation, according to a report by CyberScoop's Chris Bing and Patrick Howell O'Neill. Unnamed US intelligence officials told CyberScoop that Kaspersky's report had exposed a long-running Joint Special Operations Command (JSOC) operation targeting the Islamic State and Al Qaeda.
The malware used in the campaign, according to the officials, was used to target computers in Internet cafés where it was believed individuals associated with the Islamic State and Al Qaeda would communicate with their organizations' leadership. Kaspersky's report showed Slingshot had targeted computers in countries where ISIS, Al Qaeda, and other radical Islamic terrorist groups have a presence or recruit: Afghanistan, Yemen, Iraq, Jordan, Turkey, Libya, Sudan, Somalia, Kenya, Tanzania, and the Democratic Republic of Congo.
The publication of the report, the officials contended, likely caused JSOC to abandon the operation and may have put the lives of soldiers fighting ISIS and Al Qaeda in danger. One former intelligence official told CyberScoop that it was standard operating procedure "to kill it all with fire once you get caught... It happens sometimes and we're accustomed to dealing with it. But it still sucks. I can tell you this didn't help anyone."
This is good malware. You can't expose the good malware!
Related: Kaspersky Claims to have Found NSA's Advanced Malware Trojan
Ties Alleged Between Kaspersky Lab and Russian Intelligence Agencies
Kaspersky Willing to Hand Source Code Over to U.S. Government
Kaspersky Lab has been Working With Russian Intelligence
FBI Reportedly Advising Companies to Ditch Kaspersky Apps
Federal Government, Concerned About Cyberespionage, Bans Use of Kaspersky Labs Products
Kaspersky Lab and Lax Contractor Blamed for Russian Acquisition of NSA Tools
(Score: -1, Flamebait) by Anonymous Coward on Sunday March 22 2015, @02:08PM
The Free Software Foundation ("GNU") is controlled by the Communist Party of China through the Loongson spy processor in Richard Stallman's Lemote Yeeloong laptop.
(Score: 5, Informative) by Jeremiah Cornelius on Sunday March 22 2015, @03:15PM
Total propaganda bullshit.
Can't you people see the forest for the trees? The US is being herded like like sheep, back onto a "good 'ol days" cold war. Please, for your own sake, don't believe the hype.
It seems a shame that here at Soylent, there isn't more effort to at least recognize the hallmarks of a journalist's hit-piece. Here's Mr Kaspersky's own detailed and rational response to the Bloomberg aspersions:
http://eugene.kaspersky.com/2015/03/20/a-practical-guide-to-making-up-a-sensation/ [kaspersky.com]
This has been "ginned up" for a while - Wired ran with the same innuendo a couple years back:
http://eugene.kaspersky.com/2012/07/25/what-wired-is-not-telling-you-a-response-to-noah-shachtmans-article-in-wired-magazine/ [kaspersky.com]
You're betting on the pantomime horse...
(Score: 4, Insightful) by physicsmajor on Sunday March 22 2015, @03:40PM
I honestly don't care if they are. Actions speak louder than words. Let's rehash, shall we?
Kaspersky has been coming forth publicly with all sorts of technical malware disclosures which they found. They're shining light on the darker corners of the internet. As nobody else seems to want to do this, I'm OK with any light whatsoever. So if they preferentially target the NSA, well, we all know there's plenty of shit left to surface from that pool.
And, honestly, this would be stupid if they were. They could use this info better by co-opting or subverting the NSA's plans instead of public disclosure. Instead, they're increasing the security and knowledge of the world public.
(Score: 5, Insightful) by Jeremiah Cornelius on Sunday March 22 2015, @03:47PM
Kaspersky has results: Real forensic analysis of the biggest worldwide threat to privacy and security, in the context that will most directly affect the greatest number of people around the world.
Bloomberg has dubious allegations: Insinuations and poorly sourced or verified substitutes for "evidence".
You're betting on the pantomime horse...
(Score: 1, Insightful) by Anonymous Coward on Sunday March 22 2015, @05:00PM
Those two narratives are in no way mutually exclusive.
There is a lot of shit out there from Russia and the US (and China, and pretty much any country with a large enough budget). Kaspersky can be 100% correct in their revelations and disclosures and still be an organ of Putin's propaganda machine. When seeking truth it isn't the answers that matter so much as the questions. By choosing questions with answers that embarrass the USA they get to be 100% accurate and still achieve the goal of propaganda.
Politics is a battle of half-truths. Don't let one side's truths overshadow all the others.
(Score: 2, Informative) by Jeremiah Cornelius on Sunday March 22 2015, @03:41PM
The "Wired" piece, which really began this whisper campaign, was written by Noah Shachtman [sourcewatch.org] - Now a Brookings Institution [sourcewatch.org] fellow and noted Zionist hasbara promoter from his propaganda organs as editor at "Foreign Policy" and the "Daily Beast".
If there were a better profile describing the emergence and trajectory for the career of a neo-con propaganda agent than Mr. Shachtman, I have yet to see such.
You're betting on the pantomime horse...
(Score: 2) by Adamsjas on Sunday March 22 2015, @05:53PM
These carefully worded "rational" responses would look better if the company also revealed (or at least detected) some Russian government malware, backdoors, or viruses.
To date, their product only the typical rogue malware from non-government sources, typically what any other product detects. They aren't any better than the others.
Yes, there is a bunch of NSA/CIA exploits. Fully agreed. Lets not argue about that.
But why do they only publish those that have already been disclosed or hinted at by long published sources (Snowden releases), and none from their own government?
(Score: 4, Insightful) by Jeremiah Cornelius on Sunday March 22 2015, @06:15PM
Look at context - how many OTHER security research groups in the software industry have produced evidence of large-scale, highly sophisticated and subversive malware, clearly produced by Russian military or other state organizations?
None.
Not saying they DON'T exist - but the US has been especially pernicious and reprehensible in the extreme. This is not a position they occupy, only relative to the merits of any other state.
Snowden gave a roadmap of where to look. Naturally, one would expect a great deal of interest and effort spent on following the leads provided in these leaks. Like it or not? Kaspersky can publish their findings in a way that Qualys, Symantec or Intel Security (McAfee) would find potentially difficult - especially in the current era of the corporate military surveillance state as defacto US power establishment.
For instance, the SNOWGLOBE analysis came from GData - a German based, European outfit: https://blog.gdatasoftware.com/blog/article/babar-espionage-software-finally-found-and-put-under-the-microscope.html [gdatasoftware.com]. Earlier, REGIN was discovered by Symantec [cnn.com], concurrently with Kaspersky. [wikipedia.org] I know from experience, that researches at different companies share information. I
t appears at Kaspersky, they were less troubled to see "how far the rabbit-hole goes". That is something to celebrate, rather than denigrate.
You're betting on the pantomime horse...
(Score: 2) by c0lo on Sunday March 22 2015, @06:17PM
I guess from the goodness of their hearth. They let the US companies (Symantec, McAffee, etc) to make a name for themselves.</sarcasm>
(why do you take it for granted that such malware exists?)
https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
(Score: 0) by Anonymous Coward on Monday March 23 2015, @12:37PM
Because the majority of professional malware has been confirmed for years now to be coming from the eastern bloc and the Russian mafia, that's why. Duh.
(Score: 4, Insightful) by Nerdfest on Sunday March 22 2015, @02:09PM
At least they seem to help out citizens. The NSA keeps exploits to themselves and uses them against their citizens.
(Score: 1, Interesting) by Anonymous Coward on Sunday March 22 2015, @02:54PM
How do they help? Do you think they are revealing the Russian exploits that are in the wild, or do you just take it on faith that the only government-sponsored exploits are done by the US?
(Score: 4, Interesting) by q.kontinuum on Sunday March 22 2015, @04:06PM
How about NSA (or other US cyber-security related entities, be it government or commercial) start publishing information on Russian or Chinese exploits? They could also improve their reputation with their civilians (and with us).
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 0) by Anonymous Coward on Sunday March 22 2015, @05:10PM
Yeah, I think that's the best possible outcome. Let the different governments battle out the PR war by disclosing each other's exploits and in the meantime all the normal people benefit from the fallout of improved security. That would be a lot better than the fallout from an actual war.
Time for the NSA to step it up!
(Score: 2) by Adamsjas on Sunday March 22 2015, @05:28PM
I don't think the NSA wants those fixed. They probably use them for plausible deniability.
So maybe the solution is to run BOTH a US antivirus program and a Russian one?
Dueling Backdoors!
Twice the Pwnage.
(Score: 0) by Anonymous Coward on Sunday March 22 2015, @06:05PM
Doh. They're revealing the US ones.
Maybe it doesn't help you and whoever pays you. But it sure helps the rest of us.
(Score: 0) by Anonymous Coward on Monday March 23 2015, @02:43PM
They are revealing exploits PERIOD. That helps.
Yes they happen to be 'ours' or 'yours' but that's not the point. The point is that they are shedding light. It's not because 'we' do crappy shit that it's ok.
Go back to your cave and annoy people over there.
(Score: 1) by Mr Big in the Pants on Sunday March 22 2015, @07:28PM
Well that is how disinformation works most successfully and why the NSA are fools sitting on about zero credibility now.
You build credibility with the truth and then lie when its very important or in subtle ways that cannot be verified. The rest of the time you ensure you are a source of information.
This is what they are doing.
And did no one else immediately realize there was a 99% chance they were doing exactly this the first time they came out with their "discoveries" just as the US and Russia start bashing heads?
Security company in russia or china with no government collusion or interference? Comrade, please!?
I for one would NEVER have their software anywhere near my computer...
(Score: 3, Insightful) by cafebabe on Monday March 23 2015, @12:40PM
We live in interesting times when alleged agents of the Russian security services do more to secure US software than the US security services.
1702845791×2
(Score: 2, Insightful) by Anonymous Coward on Sunday March 22 2015, @02:14PM
That statement seems to be an admission rather than a denial.
(Score: 3, Insightful) by M. Baranczak on Sunday March 22 2015, @03:34PM
That statement seems to be an admission rather than a denial.
That statement is also part of a long and proud Russian tradition. [wikipedia.org]
And if you put your trust in any "security software" company, you're a sucker.
(Score: 2) by Adamsjas on Sunday March 22 2015, @05:37PM
Agreed, it does look like a case excuse via blame deflection.
Quote: It's not as though the US has clean hands in all of this.
You might expect that response from a Russian Government point of view.
But from Kaspersky is looks very suspicious. (Especially when they claim to be a British company.) If you sell a commercial anti-malware product you don't start out blaming the government, any government, especially when your software doesn't successfully detect any of those alleged government sponsored malware.
(Score: 5, Interesting) by SuperCharlie on Sunday March 22 2015, @03:20PM
Lately I've been getting a lot of news from Russia since I figure if it's stinky they will be the ones to publish it. This bloomberg thing is a direct retaliation for kaspersky calling out the nsa on creating some of the more virulent malware and industrial intrusion kits lately. Sure it's slanted. But at least it's another view and not the pre-washed force fed crap in our media.
(Score: 2) by Adamsjas on Sunday March 22 2015, @05:41PM
Yes It does seem a bit convenient to be coming out just now, doesn't it.
Like iPhone articles swamping the mainstream press trying to drowned out Android Lollypop release stories. Our Free Press seems to be pretty tightly controlled.
(Score: 0) by Anonymous Coward on Sunday March 22 2015, @06:35PM
I think it more likely that they are drawing attention to themselves, which draws the attention of journalists. One doesn't need to always invoke juvenile "teh lame stream media is p0wnd!" analysis. Aren't we always so quick to announce "Streisand Effect", so why doesn't it apply here?
(Score: 2) by HiThere on Sunday March 22 2015, @07:26PM
How about *both*. We don't live in a world where everything is either/or.
For that matter, even if Kaspersky Labs has ties to the FSB (probable) that doesn't make everything they say wrong, it just means that they aren't likely to say bad things about Russia, or good things about the US. Selective reporting is not (quite) the same as lying.
Javascript is what you use to allow unknown third parties to run software you have no idea about on your computer.
(Score: 2) by Hairyfeet on Sunday March 22 2015, @10:10PM
Telling lies for power is pretty much all our MSM is anymore. If you wanna know which ones are giving the most handjobs to the NSA? Just look up their coverage when all that nasty PMC dirty dealings was dumped on wikileaks and see how many instantly ignored that for "But Assange may not have used a condom, the filthy rapist!". you'll see that the Post and the Times were the worst, they even buried anything to do with that video of the chopper pilot killing that family while laughing and acting like he was playing Call of Dooky but practically screamed from the rooftops every tweet from the 24 hours Assange was with that girl and every "detail" of the later shown to be false charges against the head of the IMF...who wanted to get rid of the petrodollar...wow, what a coincidence, huh?
its sad to say but at this moment I'd trust Pravda more than I trust our own media, at least they don't pretend to be objective..
ACs are never seen so don't bother. Always ready to show SJWs for the racists they are.
(Score: 0) by Anonymous Coward on Monday March 23 2015, @12:32PM
What do those acronyms that you used mean? MSM? PMC?
(Score: 2) by wantkitteh on Sunday March 22 2015, @04:31PM
It bears repeating, the Russians excel at two things - developing exploitable vulnerabilities where they shouldn't be able to, and playing the human spy game. If they wanted to smear the NSA, they wouldn't stoop to using a domestic sock puppet to do it. They'd get someone from within the NSA to blow the lid off...
...wait a second....
Forget I said that and implement an edit post feature already!!
(Score: 2, Funny) by Balderdash on Sunday March 22 2015, @05:24PM
Kaspersky is sort of Russain-sounding!
Quick, get Bill O'Reilly on the line!
I browse at -1. Free and open discourse requires consideration and review of all attempts at participation.
(Score: 2) by Kilo110 on Sunday March 22 2015, @06:34PM
We hear a great deal from Kaspersky about NSA/Israel's evil software. Which is appreciated of course.
But we never hear about Chinese/Russian spyware. They're definitely making it and I'm sure a lot of it rivals what the NSA is making. So why doesn't Kaspersky draw attention to those?
(Score: 1) by EETech1 on Sunday March 22 2015, @11:10PM
1. write malware
2. profit!!!
3. write detection program for #1
4. profit!!!!!
5. BTW... #3 is now su(su) wherever installed
6. ??????
(Score: 4, Insightful) by jcross on Monday March 23 2015, @01:23PM
You know I hadn't really considered before how easy it would be for antivirus software to be crooked without anyone noticing. It's expected to contain a bunch of exploit code for detecting viruses. It's expected to repeatedly scan your file system and all downloads. It's expected to phone home regularly for updates. It's expected to run with a high privilege level. It's expected to use a ton of system resources, or at least it was the last time I ran Windows back in 2005 or so. Much like government "security" organizations, we allow all this because it's "keeping us safe" but who knows what these programs are really up to?
(Score: 2) by GungnirSniper on Sunday March 22 2015, @07:20PM
Eugene bought out the 20% owned by an American investment firm back in 2012. [reuters.com] I wonder how that buyback was financed?
Tips for better submissions to help our site grow. [soylentnews.org]
(Score: 0) by Anonymous Coward on Monday March 23 2015, @03:54AM
(Score: 0) by Anonymous Coward on Monday March 23 2015, @02:46PM
Shhh... it's code
(Score: 0) by Anonymous Coward on Monday March 23 2015, @08:10AM
I did not straight on believe the news, because Kaspersky can be easily made into a puppet, if they aren't already. I don't believe it about the spyware until some other than Russian company confirms it. But it's not like US hasn't done it before, so it could easily be true. I bet Kaspersky will not report Russian state spyware though, so if the NSA spyware is true, then it is as much probaganda as it is security.