Misuse Of Our Data
Last week, we learned about a striking piece of malware called
Regin
that has been infecting computer networks worldwide since 2008. It's
more sophisticated than any known criminal malware, and everyone
believes a government is behind it. No country has taken credit for
Regin, but there's
substantial evidence that it was built and operated by the United States.
This isn't the first government malware discovered.
GhostNet is believed to be Chinese.
Red October and
Turla are believed to be Russian.
The Mask is probably Spanish.
Stuxnet and
Flame
are probably from the U.S. All these were discovered in the past five
years, and named by researchers who inferred their creators from clues
such as who the malware targeted.
I dislike the "cyberwar" metaphor for espionage and hacking, but
there is a war of sorts going on in cyberspace. Countries are using
these weapons against each other. This affects all of us not just
because we might be citizens of one of these countries, but because we
are all potentially collateral damage. Most of the varieties of malware
listed above have been used against nongovernment targets, such as
national infrastructure, corporations, and
NGOs. Sometimes these attacks are
accidental, but often they are
deliberate.
For their defense, civilian networks must rely on commercial security
products and services. We largely rely on antivirus products from
companies such as Symantec, Kaspersky, and F-Secure. These products
continuously scan our computers, looking for malware, deleting it, and
alerting us as they find it. We expect these companies to act in our
interests, and never deliberately fail to protect us from a known
threat.
This is why the recent disclosure of Regin is so disquieting. The first public announcement of Regin was from
Symantec,
on November 23. The company said that its researchers had been studying
it for about a year, and announced its existence because they knew of
another source that was going to announce it. That source was a news
site, the Intercept, which
described Regin and its U.S. connections the following day. Both
Kaspersky and
F-Secure
soon published their own findings. Both stated that they had been
tracking Regin for years. All three of the antivirus companies were able
to find samples of it in their files since 2008 or 2009.
So why did these companies all keep Regin a secret for so long? And why did they leave us vulnerable for all this time?
To get an answer, we have to disentangle two things. Near as we can
tell, all the companies had added signatures for Regin to their
detection database long before last month. The VirusTotal website has a
signature for Regin as of
2011. Both
Microsoft security and
F-Secure started detecting and removing it that year as well. Symantec has protected its users against Regin since
2013, although it certainly added the VirusTotal signature in 2011.
Entirely separately and seemingly independently, all of these
companies decided not to publicly discuss Regin's existence until after
Symantec and the Intercept did so. Reasons given vary. Mikko Hyponnen of
F-Secure said that
specific customers
asked him not to discuss the malware that had been found on their
networks. Fox IT, which was hired to remove Regin from the Belgian phone
company Belgacom's website, didn't say anything about what it
discovered because it "
didn't want to interfere with NSA/GCHQ operations."
My guess is that none of the companies wanted to go public with an
incomplete picture. Unlike criminal malware, government-grade malware
can be hard to figure out. It's much more elusive and complicated. It is
constantly updated. Regin is made up of multiple modules -- Fox IT
called it
"a full framework of a lot of species of malware" -- making it even
harder to figure out what's going on. Regin has also been used
sparingly, against only a select few targets, making it hard to get
samples. When you make a press splash by identifying a piece of malware,
you want to have the whole story. Apparently, no one felt they had that
with Regin.
That is not a good enough excuse, though. As nation-state malware
becomes more common, we will often lack the whole story. And as long as
countries are battling it out in cyberspace, some of us will be targets
and the rest of us might be unlucky enough to be sitting in the blast
radius. Military-grade malware will continue to be elusive.
Right now, antivirus companies are probably sitting on incomplete
stories about a dozen more varieties of government-grade malware. But
they shouldn't. We want, and need, our antivirus companies to tell us
everything they can about these threats as soon as they know them, and
not wait until the release of a political story makes it impossible for
them to remain silent.
