TEXAS: Texas-based Exodus Intelligence (EI) believed India used its “zero-day”, security vulnerabilities that hackers can use to attack systems, spy on Pakistan and China, according to a report published in Forbes.
Exodus CEO Logan Brown said, after an investigation, that he believes India handpicked one of the Windows vulnerabilities from the feed—allowing deep access to Microsoft’s operating system—and Indian government personnel or a contractor adapted it for malicious means, according to the media report.
Earlier this year, researchers at Russian cybersecurity firm Kaspersky witnessed a cyber espionage campaign targeting Microsoft Windows PCs at government and telecom entities in China and Pakistan. They began in June 2020 and continued through to April 2021.
The Exodus CEO maintained that India was subsequently cut off from buying new zero-day research from his company in April and it has worked with Microsoft to patch the vulnerabilities.
The Indian use of his company’s research was beyond the pale, though Exodus does not limit what customers do with its findings, Brown said, adding, “You can use it offensively if you want, but not if you are going to be . . . shotgun blasting Pakistan and China. I don’t want any part of that.”
The US company also looked at a second vulnerability Kaspersky had attributed to Moses, another flaw that allowed a hacker to get higher privileges on a Windows computer. It was not linked to any particular espionage campaign, but Brown confirmed it was one of his company’s, adding that it would “make sense” that India or one of its contractors had weaponised that vulnerability too.
Beyond the two zero days already abused, according to Kaspersky, “at least six vulnerabilities” made by Moses have made it out “into the wild” in the last two years. Also according to Kaspersky, another hacking crew known as DarkHotel—believed by some cybersecurity researchers to be sponsored by South Korea—has used Moses’ zero days. South Korea is not a customer of Exodus.
“We are pretty sure India leaked some of our research,” Brown said. “We cut them off and haven’t heard anything since then . . . so the assumption is that we were correct.”
Exodus, when asked by Five Eyes countries, an alliance of intelligence-sharing countries that includes the US, UK, Canada, Australia, and New Zealand or their allies, will provide both information on a zero-day vulnerability and the software required to exploit it. But its main product is akin to a Facebook news feed of software vulnerabilities, sans exploits, for up to $250,000 a year.
