Chinese spies used code copied from America’s NSA for hacking operations, researchers say
- Features in malware so similar they could only have been stolen from break-in tools leaked online, according to Check Point Software Technologies
- Head of research describes the malicious ‘Jian’ software as ‘kind of a copycat, a Chinese replica’
Tel Aviv-based Check Point Software Technologies issued a report noting that some features in a piece of China-linked malware it dubs “Jian” were so similar they could only have been stolen from some of the National Security Agency break-in tools leaked to the internet in 2017.
Yaniv Balmas, Check Point’s head of research, called Jian “kind of a copycat, a Chinese replica”.
The find comes as some experts argue that American spies should devote more energy to fixing the flaws they find in software instead of developing and deploying malicious software to exploit it.
The NSA declined to comment. The Chinese embassy in Washington did not respond to requests for comment.
A person familiar with the matter said Lockheed Martin Corp – which is credited as having identified the vulnerability exploited by Jian in 2017 – discovered it on the network of an unidentified third party.
In a statement, Lockheed said it “routinely evaluates third-party software and technologies to identify vulnerabilities”.
Suspected Chinese hackers used SolarWinds bug to spy on US agency, insiders say
Countries around the world develop malware that breaks into their rivals’ devices by taking advantage of flaws in the software that runs them. Every time spies discover a new flaw they must decide whether to quietly exploit it or fix the issue to thwart rivals and rogues.
That dilemma came to public attention between 2016 and 2017, when a mysterious group calling itself the “Shadow Brokers” published some of the NSA’s most dangerous code to the internet, allowing cybercriminals and rival nations to add American-made digital break-in tools to their own arsenals.
How the Jian malware analysed by Check Point was used is not clear. In an advisory published in 2017, Microsoft Corp suggested it was linked to a Chinese entity it dubs “Zirconium”, which last year was accused of targeting US election-related organisations and individuals, including people associated with President Joe Biden’s campaign.
Maybe it’s more important to patch this thing and save the world. It might be used against you
Check Point’s research is thorough and “looks legit”, said Costin Raiu, a researcher with Moscow-based antivirus firm Kaspersky Lab, which has helped dissect some of the NSA’s malware.
Balmas said a possible takeaway from his company’s report was for spymasters weighing whether to keep software flaws secret to think twice about using a vulnerability for their own ends.
“Maybe it’s more important to patch this thing and save the world,” Balmas said. “It might be used against you.”
