|
by Joseph Menn
February 16, 2015
from
Reuters Website
A National Security
Agency (NSA) data gathering facility
is seen in Bluffdale,
about 25 miles (40 kms) south of Salt Lake City, Utah,
December 17, 2013.
Photo: REUTERS/Jim
Urquhart
(Reuters)
The U.S.
National Security Agency (NSA)
has figured out how to hide spying software deep within hard drives
made by Western Digital, Seagate, Toshiba and other top
manufacturers, giving the agency the means to eavesdrop on the
majority of the world's computers, according to cyber researchers
and former operatives.
That long-sought and closely guarded ability was part of a cluster
of spying programs discovered by
Kaspersky Lab, the Moscow-based
security software maker that has exposed a series of Western
cyber-espionage operations.
Kaspersky said it found personal computers in 30 countries infected
with one or more of the spying programs, with the most infections
seen in Iran, followed by Russia, Pakistan, Afghanistan, China,
Mali, Syria, Yemen and Algeria.
The targets included,
...Kaspersky said:
The firm declined to publicly name the country behind the spying
campaign, but said it was closely linked to
Stuxnet, the NSA-led cyber-weapon
that was used to attack Iran's uranium enrichment facility.
The NSA is the agency responsible for
gathering electronic intelligence on behalf of the United States.
A former NSA employee told Reuters that Kaspersky's analysis was
correct, and that people still in the intelligence agency valued
these spying programs as highly as Stuxnet.
Another former intelligence operative
confirmed that the NSA had developed the prized technique of
concealing spyware in hard drives, but said he did not know which
spy efforts relied on it.
NSA spokeswoman Vanee Vines declined to comment.
Kaspersky published the technical details of its research on Monday,
which should help infected institutions detect the spying programs,
some of which trace back as far as 2001.
Employees work at the
headquarters of Kaspersky Labs,
a company which
specializes in the production of
antivirus and
internet security software,
in Moscow July 29,
2013.
Credit: REUTERS/Sergei Karpukhin
The disclosure could further hurt the NSA's surveillance abilities,
already damaged by massive leaks by former contractor Edward
Snowden. Snowden's revelations have hurt the United States'
relations with some allies and slowed the sales of U.S. technology
products abroad.
The exposure of these new spying tools could lead to greater
backlash against Western technology, particularly in countries such
as China, which is already drafting regulations that would require
most bank technology suppliers to proffer copies of their software
code for inspection.
Peter Swire, one of five members of U.S. President Barack Obama's
Review Group on Intelligence and Communications Technology,
said the Kaspersky report showed that it is essential for the
country to consider the possible impact on trade and diplomatic
relations before deciding to use its knowledge of software flaws for
intelligence gathering.
"There can be serious negative
effects on other U.S. interests," Swire said.
TECHNOLOGICAL
BREAKTHROUGH
According to Kaspersky, the spies made a technological breakthrough
by figuring out how to lodge malicious software in the obscure code
called firmware that launches every time a computer is turned on.
Disk drive firmware is viewed by spies and cyber-security experts as
the second-most valuable real estate on a PC for a hacker, second
only to the BIOS code invoked automatically as a computer boots up.
"The hardware will be able to infect
the computer over and over," lead Kaspersky researcher Costin
Raiu said in an interview.
Though the leaders of the still-active
espionage campaign could have taken control of thousands of PCs,
giving them the ability to steal files or eavesdrop on anything they
wanted, the spies were selective and only established full remote
control over machines belonging to the most desirable foreign
targets, according to Costin Raiu.
He said Kaspersky found only a few
especially high-value computers with the hard-drive infections.
Kaspersky's reconstructions of the spying programs show that they
could work in disk drives sold by more than a dozen companies,
comprising essentially the entire market.
They include,
Western Digital, Seagate and Micron said
they had no knowledge of these spying programs. Toshiba and Samsung
declined to comment. IBM did not respond to requests for comment.
GETTING THE
SOURCE CODE
Raiu said the authors of the spying programs must have had access to
the proprietary source code that directs the actions of the hard
drives.
That code can serve as a roadmap to
vulnerabilities, allowing those who study it to launch attacks much
more easily.
"There is zero chance that someone
could rewrite the [hard drive] operating system using public
information," Raiu said.
Concerns about access to source code
flared after a series of high-profile cyber-attacks on Google Inc
and other U.S. companies in 2009 that were blamed on China.
Investigators have said they found
evidence that the hackers gained access to source code from several
big U.S. tech and defense companies. It is not clear how the NSA may
have obtained the hard drives' source code.
Western Digital spokesman Steve
Shattuck said the company,
"has not provided its source code to
government agencies."
The other hard drive makers would not
say if they had shared their source code with the NSA.
Seagate spokesman Clive Over said it has,
"secure measures to prevent
tampering or reverse engineering of its firmware and other
technologies."
Micron spokesman Daniel Francisco
said the company took the security of its products seriously and,
"we are not aware of any instances
of foreign code."
According to former intelligence
operatives, the NSA has multiple ways of obtaining source code from
tech companies, including asking directly and posing as a software
developer.
If a company wants to sell products to
the Pentagon or another sensitive U.S. agency, the government can
request a security audit to make sure the source code is safe.
"They don't admit it, but they do
say, 'We're going to do an evaluation, we need the source
code,'" said Vincent Liu, a partner at security consulting firm
Bishop Fox and former NSA analyst.
"It's usually the NSA doing the
evaluation, and it's a pretty small leap to say they're going to
keep that source code."
Kaspersky called the authors of the
spying program "The Equation Group," named after their embrace of
complex encryption formulas.
The group used a variety of means to spread other spying programs,
such as by compromising jihadist websites, infecting USB sticks and
CDs, and developing a self-spreading computer
worm called Fanny, Kasperky said.
Fanny was like Stuxnet in that it exploited two of the same
undisclosed software flaws, known as "zero days," which strongly
suggested collaboration by the authors, Raiu said.
He added that it was "quite possible"
that The Equation Group used Fanny to scout out
targets for Stuxnet in Iran and spread the virus.
|
