Kaspersky: Hackers used backdoored MS Office key-gen to steal NSA exploits

According to Kaspersky, the PC was hacked after the NSA employee installed a backdoored key generator for a pirated copy of Microsoft Office.

More details emerge from the story of the hack of the Kaspersky antivirus that allowed Russian intelligence to stole secret exploits from the personal PC of the NSA staffer.

The PC was hacked after the NSA employee installed a backdoored key generator for a pirated copy of Microsoft Office.

Kaspersky Lab, published a detailed report on the case that explains how cyber spies could have easily stolen the software exploits from the NSA employee’s Windows PC.

In October many media accused Kaspersky of helping the Russian intelligence for the detection of the US cyber-weapons on the PC via its security solutions, but according to the security firm the situation is quite different.

According to the telemetry logs collected by the Russian firm, the staffer temporary switched off the antivirus protection on the PC, and infected his personal computer with a spyware from a product key generator while trying to use a pirated copy of Office.

On September 11, 2014, Kaspersky antivirus detected the Win32.GrayFish.gen trojan on the NSA employee’s PC, some time later the employee disabled the Kaspersky software to execute the activation-key generator

Then the antivirus was reactivated on October 4, it removed the backdoored key-gen tool from the NSA employee’s PC and uploaded it to Kaspersky’s cloud for further analysis.

“Our telemetry does not allow us to say when the antivirus was disabled, however, the fact that the keygen malware was later detected as running in the system suggests the antivirus had been disabled or was not running when the keygen was run. Executing the keygen would not have been possible with the antivirus enabled.” continues Kaspersky.

Kaspersky pointed out that users can configure its software to not send suspicious samples back to its served for further analysis, however, in this case, the NSA staffer didn’t enable this option.

When the Kaspersky malware researchers analyzed the software discovered they were in presence of an NSA exploit, they alerted the CEO Eugene Kaspersky and deleted a copy of the data.

“The archive itself was detected as malicious and submitted to Kaspersky Lab for analysis, where it was processed by one of the analysts. Upon processing, the archive was found to contain multiple malware samples and source code for what appeared to be Equation malware.” reads the analysis published by Kaspersky.

“After discovering the suspected Equation malware source code, the analyst reported the incident to the CEO. Following a request from the CEO, the archive was deleted from all our systems. The archive was not shared with any third parties.”

Summarizing, any threat actor could have used the backdoored key generator to remotely log into the machine and steal the secret NSA exploits from the employee machine.

Kaspersky highlighted that the company didn’t pass the exploit to the Russian Intelligence.

The question is why delete the software instead of disclosing its discovery worldwide?

This seems to be the opinion of most prominent expert Mikko Hypponen who warned of risks of cyber weapons on many occasions.

The Kaspersky antivirus discovered several new strains of NSA code which appeared to be similar to the exploit in the arsenal of the NSA-linked Equation Group.

“At a later time, the user re-enabled the antivirus and the product properly detected (verdict: “Win32.Mokes.hvl“) and blocked this malware from running further. After being infected with the Win32.Mokes.hvl malware, the user scanned the computer multiple times which resulted in detections of new and unknown variants of Equation APT malware.” continues the report.

“The last detection from this machine was on November 17 2014. One of the files detected by the product as new variants of Equation APT malware was a 7zip archive. The archive itself was detected as malicious and submitted to Kaspersky Lab for analysis, where it was processed by one of the analysts. Upon processing, the archive was found to contain multiple malware samples and source code for what appeared to be Equation malware.”

Let’s close with the claims Russian spy agency FSB hacked Kaspersky’s systems to infiltrate computers worldwide. Well according to Kaspersky’s, apart from a Duqu attack in 2015, the firm has suffered no intrusions by attackers.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – NSA exploit, cyber espionage)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.