An incredible sequence of security mistakes led to a US National Security Agency contractor leaking his own confidential hacking tools to Russian cybersecurity firm Kaspersky Lab, the Moscow-based company has alleged.
The claim comes as part of an internal investigation into allegations that the company helped Russian spies discover and steal the NSA files, by locating and flagging the contractor.
Kaspersky Lab does not dispute that it discovered hacking tools on the computer of a user of one of its consumer antivirus products. But the timeline it lays out is one of multiple serious security errors on the part of the user, believed to be an NSA contractor.
According to Kaspersky’s report, the contractor was using the company’s home antivirus software when it detected a piece of malware attributed to the “Equation Group” (the security firm’s internal codename for what is believed to be the NSA’s hacking team) on 11 September 2014.
Some time after that, the contractor apparently disabled the Kaspersky antivirus software, the company says, but is unable to pinpoint the exact date as that information is not logged. On 4 October 2014, it appears that the contractor turned the antivirus software back on – because he had downloaded and installed some malware while trying to pirate Microsoft Office.
“The user appears to have downloaded and installed pirated software on his machines, as indicated by an illegal Microsoft Office activation key generator,” Kaspersky says. “The malware dropped from the trojanised keygen was a full blown backdoor, which may have allowed third parties access to the user’s machine.”
When the user turned his antivirus software back on, and “scanned the computer multiple times”, it correctly detected and blocked the malware. But it also detected some NSA hacking tools, again flagging them as malware. This time, because the hacking tools were “new variants”, the antivirus made use of a second security feature that the contractor had enabled, uploading the file to Kaspersky Lab for analysis.
Speaking to the Guardian, Eugene Kaspersky, the company’s founder and chief executive, said that from there, the issue was elevated directly to him. “The analyst who received the archive reported it to me and the decision was made to delete the archive from all the company’s systems. Nothing was shared with anyone and no further detections from this user have been received.”
Kaspersky Lab’s narrative matches with the initial allegations in a number of ways, but leaves some puzzling discrepancies. For one, the initial report by the Wall Street Journal alleged the events occurred in 2015; Kaspersky describes a the series of events as happening in late 2014.
But the bigger unknown is whether and how Kaspersky’s acknowledged discovery and acquisition of NSA hacking tools resulted in Russian intelligence agencies discovering the NSA contractor, and targeting him for further, apparently successful, attacks.
Mr Kaspersky vehemently denies the allegation. “No credible evidence has been presented to substantiate the claim of the company’s involvement in the alleged incident,” he said.
In an earlier statement, Mr Kaspersky had implied that a successful hack of Kaspersky Lab’s systems by Russian spies might have resulted in the breach; now, he has gone back on that theory too. “If there is any indication that the company’s systems may have been exploited, we respectfully request relevant parties to responsibly provide the company with verifiable information,” he said.
Kaspersky Lab has acknowledged being hacked by a nation state once before: in 2015, it discovered that dozens of machines in its networks had been infected by the Duqu 2.0 spyware, which is believed to be linked to Israel.
“We are confident that we have identified and removed all the infections that happened during that incident,” Eugene Kaspersky now says. “Furthermore, Kaspersky Lab publicly reported the attack, and the company offered its assistance to affected or interested organisations to help mitigate this threat.”
On Monday, Kaspersky Lab announced a new initiative to try and win back some of the trust lost as a result of the allegations. The “global transparency initiative” sees it opening up the source code to its software to a panel of independent experts, as well as submitting to a full audit of its internal security practices.
“Trust is essential in cybersecurity,” said Mr Kaspersky, “which depends on collaboration between vendors, researchers, clients.” That trust is also crucial because of the nature of antivirus programs, which must be given total access to the user’s computer, and the ability to check back with a central server to update definitions, to do their job effectively.
That efficacy is what Kaspersky hopes to renew focus on. “I always choose the best. With cybersecurity any trade-offs in favour of origin, price or any other feature may lead to unpredictable and sad consequences.
“As a result of a single successful cyber-attack a person may lose all data, a critical infrastructure may stop working and even lead to human casualties. In my opinion cybersecurity tolerates no compromises.”
