Report: NSA not only creates, but also hijacks, malware

Documents leaked by Edward Snowden show the NSA hijacks botnets and computers infected with malware by other intelligence agencies

In addition to having its own arsenal of digital weapons, the U.S. National Security Agency reportedly hijacks and repurposes third-party malware.

The NSA is using its network of servers around the world to monitor botnets made up of thousands or millions of infected computers. When needed, the agency can exploit features of those botnets to insert its own malware on the already compromised computers, through a technology codenamed Quantumbot, German new magazine Der Spiegel reported Sunday.

One of the secret documents leaked by former NSA contractor Edward Snowden and published by Der Spiegel contains details about a covert NSA program called DEFIANTWARRIOR that's used to hijack botnet computers and use them as "pervasive network analysis vantage points" and "throw-away non-attributable CNA [computer network attack] nodes."

This means that if a user's computer is infected by cybercriminals with some malware, the NSA might step in, deploy their own malware alongside it and then use that computer to attack other interesting targets. Those attacks couldn't then be traced back to the NSA.

According to the leaked document, this is only done for foreign computers. Bots that are based in the U.S. are reported to the FBI Office of Victim Assistance.

The NSA also intercepts and collects data that is stolen by third-party malware programs, especially those deployed by other foreign intelligence agencies, if it is valuable. It refers to this practice as "fourth party collection."

In 2009, the NSA tracked a Chinese cyberattack against the U.S. Department of Defense and was eventually able to infiltrate the operation. It found that the Chinese attackers were also stealing data from the United Nations so it continued to monitor the attackers while they were collecting internal UN data, Der Spiegel reported.

It goes deeper than that. One leaked secret document contains an NSA worker's account of a case of fifth party collection. It describes how the NSA infiltrated the South Korean CNE (computer network exploitation) program that targeted North Korea.

"We found a few instances where there were NK officials with SK implants on their boxes, so we got on the exfil [data exfiltration] points, and sucked back the data," the NSA staffer wrote in the document. "However, some of the individuals that SK was targeting were also part of the NK CNE program. So I guess that would be the fifth party collect you were talking about."

In other words, the NSA spied on a foreign intelligence agency that was spying on a different foreign intelligence agency that had interesting data of its own.

Sometimes the NSA also uses the servers of unsuspecting third parties as scapegoats, Der Spiegel reported. When exfiltrating data from a compromised system, the data is sent to such servers, but it is then intercepted and collected en route though the NSA's vast upstream surveillance network.

The documents published by Der Spiegel also shine more light on the malware capabilities of the NSA and the rest of the Five Eyes partners -- the intelligence agencies of the U.K., Canada, Australia and New Zealand.

One leaked document from the Communications Security Establishment Canada (CSEC) describes a unified computer network exploitation platform codenamed WARRIORPRIDE that is used by all Five Eyes partners and can be extended through plug-ins.

Der Spiegel released samples of an old keylogger program dubbed QWERTY that likely acted as a WARRIORPRIDE plug-in, so that the security industry can analyze it and possibly find other connections. The keylogger was among the files leaked by Snowden to journalists.

Another leaked document dated June 2012 describes the technical accomplishments of a malware writer working for one of the Five Eyes agencies. One of the computer network attack (CNA) tools he developed is codenamed PITIEDFOOL and can be used to wipe data from computer hard disk drives at a preconfigured time after first disabling Volume Shadow Copy (VSS), a Windows backup service that can be used to restore data.

"I took a build of FUZZYEBOLA from last month, and without recompiling inserted the PITIEDFOOL binary with configuration details to execute it at a certain time," the tool's author wrote describing a test. "At that time I saw the process usage slightly increase (from 0% to around 2%) and a few minutes later the system rebooted and didn't come back up. Running a file recovery tool over the entire drive yielded some files (from scraping headers) but nearly the entire contents of the drive were irrecoverable, and if it had been configured to securely wipe every sector on the drive after killing the MFT and VSS it wouldn't have been able to recover anything at all. Success!"

If national security agencies are adopting such destructive file wiping malware programs, their use might become a frequent occurrence in the future. Wiper malware was used in August 2012 to destroy data on 30,000 computers at Saudi Aramco, the national oil company of Saudi Arabia; in March 2013 against South Korean banks and broadcasting organizations, and recently against Sony Pictures Entertainment in the U.S.

In each of those cases, previously unknown hacktivist groups claimed responsibility for the attacks. However, the FBI later attributed the attack against Sony to North Korea, resulting in new U.S. sanctions against the country.

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusionNational Security Agencyonline safetysecuritySony Pictures Entertainmentspywaremalware

More about AramcoFBINational Security AgencyNSASKSonySpiegelUnited Nations

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts