9 ms·

"Everything else is speculation" ignores the well sourced "speculation" about Kaspersky's next step: letting the FSB know about this contractor so they could ta

by kharms 9y ago

"Everything else is speculation" ignores the well sourced "speculation" about Kaspersky's next step: letting the FSB know about this contractor so they could target and breach his machine. It's speculative in the sense that we weren't there, but the information comes from the same source as all of those facts.

acqq 9y ago
Where did you read "letting the FSB know about this contractor so they could target and breach his machine." I somehow missed to see that anybody but you claims that, so please give some link. I also, like the parent poster, only read that the antvirus program, as it should, collected the virus to the company servers.
- kharms 9y ago
  I read that in the WSJ article that first revealed the security breach. https://www.wsj.com/articles/russian-hackers-stole-nsa-data-on-u-s-cyber-defense-1507222108 https://www.wsj.com/articles/russian-hackers-stole-nsa-data-... >The hackers appear to have targeted the contractor after identifying the files through the contractor’s use of a popular antivirus software made by Russia-based Kaspersky Lab, these people said.
  - acqq 9y ago
    It is behind a paywall but the quote you give has no sense in the context of the rest of the information I've read. That narration would be different then. Israelis hacked Kaspersky offices, discovered what the antivirus automatically transferred. It is not claimed they discovered anything else there. NSA obviously didn't know what their worker did at home, until Israelis informed them, so how do they know he was targeted afterwards and that Kaspersky was directly involved? Something is still missing.
    - lurker69 9y ago
      Here is sans paywall link: https://archive.is/hB3eo https://archive.is/hB3eo No mention of FSB in that article.
      - acqq 9y ago
        Thanks. There is however: "Investigators did determine that, armed with the knowledge that Kaspersky’s software provided of what files were suspected on the contractor’s PC, hackers working for Russia homed in on the machine and obtained a large amount of information, said the people familiar with the matter." But that sounds very implausible, which entry would "the hackers" use? Note that nobody claims that Kaspersky did that "obtaining" that way (by hacking). But it appears to me that Kaspersky software simply first detected suspicious files and then also send them to the servers, which is what the software of most antivirus vendors does. And then the "hackers" story was invented to make it more dramatic. That better fits with the story of the NSA trojan files found on Kaspersky servers by the Israeli, as they hacked Kaspersky.
        ganoushoreilly 9y ago
        The implications may be that the FSB provided specific signatures for them to look for, they came back when they popped up on a machine located at this contractors house, then further assessments were performed. In context that’s not far fetched at all.
        acqq 9y ago
        How do you think FSB "came back" to the machine of the NSA malware developer who's in the USA? I think that's exactly what is not plausible. He surely isn't going to open a trojan named isthatyou.jpg.exe in the e-mail sent by them to him. He actually made such stuff (trojans or something) himself as he let Kaspersky's software automatically collect the sample of his "work in progress." Now the unnamed government sources "leak" this as a case of apparent "Russian hackers" whereas the only known hackers in the story are the NSA and the Israel's hackers who hacked the office computers of Kaspersky. Kaspersky's software just did what other antivirus software does too.
  - bobwaycott 9y ago
    That quote doesn’t say anything at all that indicates Kaspersky “let the FSB know”, as you keep stating.
morsch 9y ago
There is no single source for the article. It refers to a "person familiar with the case" when they explain how an NSA guy exposed his malware to Kaspersky. It refers to different sources which discuss how any malware might have made its way from Kaspersky to the NSA -- unnamed "information security analysts" (they think the KGB hacked Kaspersky), "other experts" (they say the Russian's version of PRISM picked it up) and Steven Hall, a former spook with no disclosed ties to the case (he says Kaspersky is "likely to be beholden to the Kremlin").
- thewhitetulip 9y ago
  Why would a hacker not use Mac or Linux for sensitive stuff?
  - andreif 9y ago
    Why would a NSA guy use Russian security software?
    - leereeves 9y ago
      Why would an NSA guy put secret government tools on his personal laptop?
      - marcusjt 9y ago
        User error
      - YouKnowBetter 9y ago
        Stupid as it may sound, but my experience with many many "why did you take the data there" dramas, the answer is: To get things done you can not do at the office or you just lack the office time to get it done.
      - marcosdumay 9y ago
        Too restrictive corporate policies?

by kharms 9y ago

acqq 9y ago

Where did you read "letting the FSB know about this contractor so they could target and breach his machine." I somehow missed to see that anybody but you claims that, so please give some link. I also, like the parent poster, only read that the antvirus program, as it should, collected the virus to the company servers.

kharms 9y ago
I read that in the WSJ article that first revealed the security breach. https://www.wsj.com/articles/russian-hackers-stole-nsa-data-on-u-s-cyber-defense-1507222108 https://www.wsj.com/articles/russian-hackers-stole-nsa-data-... >The hackers appear to have targeted the contractor after identifying the files through the contractor’s use of a popular antivirus software made by Russia-based Kaspersky Lab, these people said.
- acqq 9y ago
  It is behind a paywall but the quote you give has no sense in the context of the rest of the information I've read. That narration would be different then. Israelis hacked Kaspersky offices, discovered what the antivirus automatically transferred. It is not claimed they discovered anything else there. NSA obviously didn't know what their worker did at home, until Israelis informed them, so how do they know he was targeted afterwards and that Kaspersky was directly involved? Something is still missing.
  - lurker69 9y ago
    Here is sans paywall link: https://archive.is/hB3eo https://archive.is/hB3eo No mention of FSB in that article.
    - acqq 9y ago
      Thanks. There is however: "Investigators did determine that, armed with the knowledge that Kaspersky’s software provided of what files were suspected on the contractor’s PC, hackers working for Russia homed in on the machine and obtained a large amount of information, said the people familiar with the matter." But that sounds very implausible, which entry would "the hackers" use? Note that nobody claims that Kaspersky did that "obtaining" that way (by hacking). But it appears to me that Kaspersky software simply first detected suspicious files and then also send them to the servers, which is what the software of most antivirus vendors does. And then the "hackers" story was invented to make it more dramatic. That better fits with the story of the NSA trojan files found on Kaspersky servers by the Israeli, as they hacked Kaspersky.
      - ganoushoreilly 9y ago
        The implications may be that the FSB provided specific signatures for them to look for, they came back when they popped up on a machine located at this contractors house, then further assessments were performed. In context that’s not far fetched at all.
        acqq 9y ago
        How do you think FSB "came back" to the machine of the NSA malware developer who's in the USA? I think that's exactly what is not plausible. He surely isn't going to open a trojan named isthatyou.jpg.exe in the e-mail sent by them to him. He actually made such stuff (trojans or something) himself as he let Kaspersky's software automatically collect the sample of his "work in progress." Now the unnamed government sources "leak" this as a case of apparent "Russian hackers" whereas the only known hackers in the story are the NSA and the Israel's hackers who hacked the office computers of Kaspersky. Kaspersky's software just did what other antivirus software does too.
- bobwaycott 9y ago
  That quote doesn’t say anything at all that indicates Kaspersky “let the FSB know”, as you keep stating.

morsch 9y ago

There is no single source for the article. It refers to a "person familiar with the case" when they explain how an NSA guy exposed his malware to Kaspersky. It refers to different sources which discuss how any malware might have made its way from Kaspersky to the NSA -- unnamed "information security analysts" (they think the KGB hacked Kaspersky), "other experts" (they say the Russian's version of PRISM picked it up) and Steven Hall, a former spook with no disclosed ties to the case (he says Kaspersky is "likely to be beholden to the Kremlin").

thewhitetulip 9y ago
Why would a hacker not use Mac or Linux for sensitive stuff?
- andreif 9y ago
  Why would a NSA guy use Russian security software?
  - leereeves 9y ago
    Why would an NSA guy put secret government tools on his personal laptop?
    - marcusjt 9y ago
      User error
    - YouKnowBetter 9y ago
      Stupid as it may sound, but my experience with many many "why did you take the data there" dramas, the answer is: To get things done you can not do at the office or you just lack the office time to get it done.
    - marcosdumay 9y ago
      Too restrictive corporate policies?