NSA and GCHQ Attacked Antivirus Companies
On Monday, the Intercept published a new story from the Snowden documents:
The spy agencies have reverse engineered software products, sometimes under questionable legal authority, and monitored web and email traffic in order to discreetly thwart anti-virus software and obtain intelligence from companies about security software and users of such software. One security software maker repeatedly singled out in the documents is Moscow-based Kaspersky Lab, which has a holding registered in the U.K., claims more than 270,000 corporate clients, and says it protects more than 400 million people with its products.
British spies aimed to thwart Kaspersky software in part through a technique known as software reverse engineering, or SRE, according to a top-secret warrant renewal request. The NSA has also studied Kaspersky Lab’s software for weaknesses, obtaining sensitive customer information by monitoring communications between the software and Kaspersky servers, according to a draft top-secret report. The U.S. spy agency also appears to have examined emails inbound to security software companies flagging new viruses and vulnerabilities.
Wired has a good article on the documents:
The documents…don’t describe actual computer breaches against the security firms, but instead depict a systematic campaign to reverse-engineer their software in order to uncover vulnerabilities that could help the spy agencies subvert it.
[…]
An NSA slide describing “Project CAMBERDADA” lists at least 23 antivirus and security firms that were in that spy agency’s sights. They include the Finnish antivirus firm F-Secure, the Slovakian firm Eset, Avast software from the Czech Republic. and Bit-Defender from Romania. Notably missing from the list are the American anti-virus firms Symantec and McAfee as well as the UK-based firm Sophos.
But antivirus wasn’t the only target of the two spy agencies. They also targeted their reverse-engineering skills against CheckPoint, an Israeli maker of firewall software, as well as commercial encryption programs and software underpinning the online bulletin boards of numerous companies. GCHQ, for example, reverse-engineered both the CrypticDisk program made by Exlade and the eDataSecurity system from Acer. The spy agency also targeted web forum systems like vBulletin and Invision Power Boardused by Sony Pictures, Electronic Arts, NBC Universal and othersas well as CPanel, a software used by GoDaddy for configuring its servers, and PostfixAdmin, for managing the Postfix email server software But that’s not all. GCHQ reverse-engineered Cisco routers, too, which allowed the agency’s spies to access “almost any user of the internet” inside Pakistan and “to re-route selective traffic” straight into the mouth of GCHQ’s collection systems.
There’s also this article from Ars Technica. Slashdot thread.
Kaspersky recently announced that it was the victim of Duqu 2.0, probably from Israel.
Subscribe to comments on this entry
Clive Robinson • June 26, 2015 8:19 AM
Aside from many AV engines make your systems a good deal less secure as they significantly increase the ring zero attack surface, and frequently don’t follow any secure coding practice so are easyy targets… You would expect the spys to apply techniques to render counter surveillance in effective, and AV is the nearest the vast majority of computers get to practicing counter surveillance.
As has been pointed out over and over again AV is the “lipstick end of the security pig”. White lists, read only memory, file tripwires etc catch the new malware, not the AV engines.
Whilst I can not quite call AV software “snake oil” in many cases it’s certainly failable enough to appear to be so.