Kaspersky: Hackers used backdoored MS Office key-gen to steal NSA exploits

According to Kaspersky, the PC was hacked after the NSA employee installed a backdoored key generator for a pirated copy of Microsoft Office.

More details emerge from the story of the hack of the Kaspersky antivirus that allowed Russian intelligence to stole secret exploits from the personal PC of the NSA staffer.

The PC was hacked after the NSA employee installed a backdoored key generator for a pirated copy of Microsoft Office.

Kaspersky Lab, published a detailed report on the case that explains how cyber spies could have easily stolen the software exploits from the NSA employee’s Windows PC.

In October many media accused Kaspersky of helping the Russian intelligence for the detection of the US cyber-weapons on the PC via its security solutions, but according to the security firm the situation is quite different.

According to the telemetry logs collected by the Russian firm, the staffer temporary switched off the antivirus protection on the PC, and infected his personal computer with a spyware from a product key generator while trying to use a pirated copy of Office.

On September 11, 2014, Kaspersky antivirus detected the Win32.GrayFish.gen trojan on the NSA employee’s PC, some time later the employee disabled the Kaspersky software to execute the activation-key generator

Then the antivirus was reactivated on October 4, it removed the backdoored key-gen tool from the NSA employee’s PC and uploaded it to Kaspersky’s cloud for further analysis.

“Our telemetry does not allow us to say when the antivirus was disabled, however, the fact that the keygen malware was later detected as running in the system suggests the antivirus had been disabled or was not running when the keygen was run. Executing the keygen would not have been possible with the antivirus enabled.” continues Kaspersky.

Kaspersky pointed out that users can configure its software to not send suspicious samples back to its served for further analysis, however, in this case, the NSA staffer didn’t enable this option.

When the Kaspersky malware researchers analyzed the software discovered they were in presence of an NSA exploit, they alerted the CEO Eugene Kaspersky and deleted a copy of the data.

“The archive itself was detected as malicious and submitted to Kaspersky Lab for analysis, where it was processed by one of the analysts. Upon processing, the archive was found to contain multiple malware samples and source code for what appeared to be Equation malware.” reads the analysis published by Kaspersky.

“After discovering the suspected Equation malware source code, the analyst reported the incident to the CEO. Following a request from the CEO, the archive was deleted from all our systems. The archive was not shared with any third parties.”

Summarizing, any threat actor could have used the backdoored key generator to remotely log into the machine and steal the secret NSA exploits from the employee machine.

Kaspersky highlighted that the company didn’t pass the exploit to the Russian Intelligence.

The question is why delete the software instead of disclosing its discovery worldwide?

This seems to be the opinion of most prominent expert Mikko Hypponen who warned of risks of cyber weapons on many occasions.

Let’s close with the claims Russian spy agency FSB hacked Kaspersky’s systems to infiltrate computers worldwide. Well according to Kaspersky’s, apart from a Duqu attack in 2015, the firm has suffered no intrusions by attackers.

Pierluigi Paganini

(Security Affairs – NSA exploit, cyber espionage)

[adrotate banner=”5″]

[adrotate banner=”13″]