HOW ANTIVIRUS SOFTWARE CAN BE TURNED INTO A TOOL FOR SPYING.
It has been a secret, long known to intelligence agencies but rarely to consumers, that security software can be a powerful spy tool.
Security software runs closest to the bare metal of a computer, with privileged access to nearly every program, application, web browser, email and file. There’s good reason for this: Security products are intended to evaluate everything that touches your machine in search of anything malicious, or even vaguely suspicious.
By downloading security software, consumers also run the risk that an untrustworthy antivirus maker — or hacker or spy with a foothold in its systems — could abuse that deep access to track customers’ every digital movement.
“In the battle against malicious code, antivirus products are a staple,” said Patrick Wardle, chief research officer at Digita Security, a security company. “Ironically, though, these products share many characteristics with the advanced cyberespionage collection implants they seek to detect.”
Mr. Wardle would know. A former hacker at the National Security Agency, Mr. Wardle recently succeeded in subverting antivirus software sold by Kaspersky Lab, turning it into a powerful search tool for classified documents.
Mr. Wardle’s curiosity was piqued by recent news that Russian spies had used Kaspersky antivirus products to siphon classified documents off the home computer of an N.S.A. developer, and may have played a critical role in broader Russian intelligence gathering.
“I wanted to know if this was a feasible attack mechanism,” Mr. Wardle said. “I didn’t want to get into the complex accusations. But from a technical point of view, if an antivirus maker wanted to, was coerced to, or was hacked or somehow subverted, could it create a signature to flag classified documents?”
That question has taken on renewed importance over the last three months in the wake of United States officials’ accusations that Kaspersky’s antivirus software was used for Russian intelligence gathering, an accusation that Kaspersky has rigorously denied.
Last month, Kaspersky Lab sued the Trump administration after a Department of Homeland Security directive banning its software from federal computer networks. Kaspersky claimed in an open letter that “D.H.S. has harmed Kaspersky Lab’s reputation and its commercial operations without any evidence of wrongdoing by the company.”
For years, intelligence agencies suspected that Kaspersky Lab’s security products provided a back door for Russian intelligence. A draft of a top-secret report leaked by Edward J. Snowden, the former National Security Agency contractor, described a top-secret, N.S.A. effort in 2008 that concluded that Kaspersky’s software collected sensitive information off customers’ machines.
The documents showed Kaspersky was not the N.S.A.’s only target. Future targets included nearly two dozen other foreign antivirus makers, including Checkpoint in Israel and Avast in the Czech Republic.
At the N.S.A., analysts were barred from using Kaspersky antivirus software because of the risk it would give the Kremlin broad access to their machines and data. But excluding N.S.A. headquarters at Fort Meade, Kaspersky still managed to secure contracts with nearly two dozen American government agencies over the last few years.
Last September, the Department of Homeland Security ordered all federal agencies to cease using Kaspersky products because of the threat that Kaspersky’s products could “provide access to files.”
A month later, The New York Times reported that the Homeland Security directive was based, in large part, on intelligence shared by Israeli intelligence officials who successfully hacked Kaspersky Lab in 2014. They looked on for months as Russian government hackers scanned computers belonging to Kaspersky customers around the world for top secret American government classified programs.
In at least one case, United States officials claimed Russian intelligence officials were successful in using Kaspersky’s software to pull classified documents off a home computer belonging to Nghia H. Pho, an N.S.A. developer who had installed Kaspersky’s antivirus software on his home computer. Mr. Pho pleaded guilty last year to bringing home classified documents and writings, and has said he brought the files home only in an attempt to expand his résumé.
Kaspersky Lab initially denied any knowledge or involvement with the document theft. But the company has since acknowledged finding N.S.A. hacking software on Mr. Pho’s computer and removing it, though the company said it had immediately destroyed the documents once it realized they were classified.
The company also said in November that in the course of investigating a surveillance operation known as TeamSpy in 2015, it had tweaked its antivirus program to scan files containing the word “secret.” The company said it had done this because the TeamSpy attackers were known to automatically scan for files that included the words “secret,” “pass” and “saidumlo,” the Georgian translation for the word secret.
Kaspersky continues to deny that it knew about the scanning for classified United States programs or allowed its antivirus products to be used by Russian intelligence. Eugene Kaspersky, the company’s chief executive, has said he would allow the United States government to inspect his company’s source code to allay distrust of its antivirus and cybersecurity products.
But Mr. Wardle discovered, in reverse-engineering Kaspersky antivirus software, that a simple review of its source code would do nothing to prove its products had not been used as a Russian intelligence-gathering tool. (Watch how he reverse-engineered the software.)
Mr. Wardle found that Kaspersky’s antivirus software is incredibly complex. Unlike traditional antivirus software, which uses digital “signatures” to look for malicious code and patterns of activity, Kaspersky’s signatures are easily updated, can be automatically pushed out to certain clients, and contain code that can be tweaked to do things like automatically scanning for and siphoning off classified documents.
In short, Mr. Wardle found, “antivirus could be the ultimate cyberespionage spying tool.”
Mr. Wardle said it was relatively easy to use a vulnerability in Microsoft’s Windows software to manipulate the Kaspersky software. Because officials routinely classify top secret documents with the marking “TS/SCI,” which stands for “Top Secret/Sensitive Compartmented Information,” Mr. Wardle added a rule to Kaspersky’s antivirus program to flag any documents that contained the “TS/SCI” marker.
He then edited a document on his computer containing text from the Winnie the Pooh children’s book series to include the marking “TS/SCI” and waited to see whether Kaspersky’s tweaked antivirus product would catch it.
Sure enough, as soon as the Winnie the Pooh text was saved to his machine, Kaspersky’s antivirus software flagged and quarantined the document. When he added the same TS/SCI marker to another document containing the text “The quick brown fox jumps over the lazy dog,” it, too, was flagged and quarantined by Kaspersky’s tweaked antivirus program.
“Not a whole lot of surprise that this worked,” Mr. Wardle said, “but still neat to confirm that an antivirus product can be trivially, yet surreptitiously, used to detect classified documents.”
The next question was: What happens to these files once they are flagged? Mr. Wardle stopped short of hacking into Kaspersky’s cloud servers, where suspicious files are routinely uploaded.
However, he noted that antivirus customers, including Kaspersky’s, agreed by default to allow security vendors to send anything from their machine back to vendors’ servers for further investigation.
There are legitimate reasons for this: By uploading these items to Kaspersky’s cloud, security analysts can evaluate whether they pose a threat, and update their signatures as a result.
Kaspersky Lab said Mr. Wardle’s research did not reflect how the company’s software works.
“It is impossible for Kaspersky Lab to deliver a specific signature or update to only one user in a secret, targeted way because all signatures are always openly available to all our users; and updates are digitally signed, further making it impossible to fake an update,” the company said in a statement.
The company added that it applied the same security standards and maintained the same levels of access as other security vendors, and reiterated that it was willing to make its source code, threat detection rules and software updates available for audit by independent experts.
But, as Mr. Wardle’s research demonstrated, an untrustworthy vendor, or hacker or spy with access to that vendor’s systems, can abuse its deep access to turn antivirus software into a dynamic search tool, not unlike Google, to scan customers’ computers for documents that contain certain keywords.
“And no one would ever know,” he added. “It’s the perfect cybercrime.”
FOR ADVERTISED IN OUR WEBPAGE CONTACT firstname.lastname@example.org OR visit www.ghanamediaworld.com
WE PUBLISHED 99% GHANA NEWS AND THE REST 1% IS FOR OUTSIDE WORLD NEWS, GHANA FIRST,PUBLISHED YOUR OWN FIRST TO WIN BETTER FUTURE.
DISCLAIMER: “The views expressed in this article are the sole responsibility of the author and do not neccessarily reflect those of Ghana Media World. The contents of this article are of sole responsibility of the author(s). Ghana Media World will not be responsible or liable for any inaccurate or incorrect statements contained in this article.” © GHANAMEDIAWORLD.COM
HAVE A SAY. WHAT DO YOU THINK? DROP COMMENTS!
@ghanamediaworld on Twitter / lnstagram ghanamediaworld
Do you have a story for The Ghanameiaworld Online news team? Email us at email@example.com Or call us:
THE NEWS ITEMS ARE REAL AND WE ARE NOT FAKE MEDIA,WE ARE HERE FOR YOU BECAUSE OF TRUELY MEDIA. IF NOT BECAUSE OF YOU, WE CANNOT BE GHANA MEDIA WORLD. OR WHAT WE HAVE REACH TO BE NOW.WE PUBLISH WHAT IS TRUELY INSIDE THE MEDIA OF THE WORLD, FROM JOURNALIST NEWS,MEDIA NEWS, STARS NEWS, PERSONAL PRIVATE ADVERTISED AND CELEBRATIES NEWS,AND FROM THE PEOPLE WE GET TO KNOW,THE REAL NEWS FROM AND TO GHANA MEDIA WORLD, WITHOUT HIDDEN THINGS FROM YOU AND FROM THE TRUTH THAT WE GET FROM MEDIA AND JOURNALIST.AND ALSO SOMEWHERE WE GET TO KNOWN.OUR MEDIA PAGE IS STILL NOT COMPLETED,THERE IS A LOTS TO BE DONE IN GHANA MEDIA WORLD PAGE ONLINE. PUBLISHED NEWS,WE ADVERTISE FOR PEOPLE,ETC.LISTEN TO MANY RADIO STATIONS IN OUR PAGE BY CLICK.
READ MORE @ WWW.GHANAMEDIAWORLD.COM
CONTACT OF MEDIA AND ADVITISED IN OUR WEBPAGE ,IF YOU NEED PROFECTIONALS RADIO STATION LIVE STREAMING FOR BROADCASTING TOOLS PLUS WEBPAGE,DOMAIN,WE ARE NUMBER ONE PROFECTIONALS TO HELP YOU,NEWS,RADIOS,MEDIA,MAGAZINES,ADVERTISMENTS.LIVE STREAMING PROVIDER.
WE ARE HUGE BIG COMPANY.
ONLINE RADIO SETUP FOR YOUR FM STATION ONLINE.
FOR YOUR ONLINE RADIO – Also for Your Media , FM Station, Church or As well as online Internet Radio Station.
We do it profectional.Its is your dream to set up an online radio station that will turn you into a major media hub in this country and the world as well as to enable promote your goods and services Globally.Then contact us immediately at firstname.lastname@example.org or call us 004915218034976 OR 004917648327355 – 0023354294897
We are running an express and affordable online radio set up for all.
Contact us and have a feel of what it feels to own an online radio and what we have for you.
Call or Whats App 004915218034976 NOW
THE ONLINE RADIO STATION DEVELOPED BY GHANAMEDIAWORLD.COM
CONTACT OUR E-MAIL ADDRESS email@example.com
SHARE OUR PAGE AND LIKE US IN FACEBOOK,INSTAGRAM,WHATSAPP,PINTEREST,YOUTUBE,LINKEDIN.
WE ARE NUMBER ONE TRUELY MEDIA.