Kaspersky claims pirated Office software was behind NSA exploit leak

The company has released the early results of its investigation into the 2014 incident

NSA data

Kaspersky has refuted claims its software could be used by the Russian government to spy on US intelligence operatives, indicating that pirated Microsoft Office software is to blame instead.

Following allegations that Russia's FSB intelligence agency used its antivirus software to infiltrate the PC of an NSA contractor and steal top-secret exploit code, the Russian security firm released the preliminary results of its own investigation into the incident.

According to the company's detailed timeline, Kaspersky's antivirus software detected samples of malware created by the Equation group - a highly-sophisticated hacking group widely suspected of ties to the NSA - on the PC of a US user in September 2014.

Advertisement - Article continues below

"Following these detections, the user appears to have downloaded and installed pirated software on his machines, as indicated by an illegal Microsoft Office activation key generator," the company explained. "To install and run this keygen, the user appears to have disabled the Kaspersky products on his machine ... Executing the keygen would not have been possible with the antivirus enabled."

This keygen, the company claimed, was in fact a Trojan, which dropped a "full blown backdoor" onto the subject's PC, which "may have allowed third parties access to the user's machine".

Advertisement
Advertisement - Article continues below

After the user re-enabled their anti-virus installation, the software blocked the backdoor. It also began detecting previously unknown variants of the Equation malware, including a 7zip archive. This archive was promptly sent back to Kaspersky Lab HQ for analysis, at which point it was found to contain "multiple malware samples and source code for what appeared to be Equation malware".

Advertisement - Article continues below

Upon discovery, this was reported to CEO Eugene Kaspersky. The company said that the archive and its contents were deleted from all of Kaspersky's systems and was not shared with anyone else. It also stated that "Kaspersky Lab has never created any detection of non-weaponized (non-malicious) documents in its products based on keywords like 'top secret' and 'classified'."

In short, the company appears to be implying that its software was turned off by an NSA contractor in order to install a pirated version of Office 2013, which contained a backdoor. This backdoor could then have been used by the FSB to gain access to the NSA's Equation exploits, as opposed to the exploits being turned over by Kaspersky Lab itself exploits which were promptly deleted from its files, the company said, when it discovered what they were.

This story has drawn a mixed response from the cybersecurity community; F-Secure chief research officer Mikko Hypponen has subtly hinted that the lure of keeping hold of sophisticated nation-state malware may have been too much for Kaspersky to resist.

Ex-black hat-turned-pen-tester Kevin Mitnick, however, said that the company's account more plausible than alternative explanations.

"The investigation is still ongoing," Kaspersky stated, "and the company will provide additional technical information as it becomes available. We are planning to share full information about this incident, including all technical details with a trusted third party as part of our Global Transparency Initiative for cross-verification."

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020