Russian antivirus firm faked malware to harm rivals, say ex-employees

"VirusTotal had no immediate comment."

"[...], Kaspersky denied using this technique. It said it too had been a victim of such an attack in November 2012, when an "unknown third party" manipulated Kaspersky into misclassifying files [...]"

"The former Kaspersky employees said Microsoft was one of the rivals [...] They declined to give a detailed account of any specific attack."

"In a subsequent interview on Wednesday, Batchelder declined to comment on any role Kaspersky may have played in the 2013 printer code problems or any other attacks. Reuters has no evidence linking Kaspersky to the printer code attack."

"Avast Chief Operating Officer Ondrej Vlcek told Reuters in April that he suspected the offenders were well-equipped malware writers and "wanted to have some fun" at the industry's expense. He did not respond to a request on Thursday for comment on the allegation that Kaspersky had induced false positives."

So, no one says it's Kaspersky, someone called "former employees" says it was, but can't provide any example...

I would be very skeptical of this entire article, having worked with researchers from Kaspersky for many years. They are terrific partners and care deeply about infosec.

Also, Kaspersky has been known in the past, which they have disclosed, for planting red herrings in malware archives, because they accused (and were right) of other vendors just looking at what Kaspersky blocks and just automatically copying it, without actually doing AV research. That's not what they are being accused of here...

Finally, Joseph is a great journalist, but this article stinks in terms of providing actual evidence.

(Web Archive shows this topic — initially about Avast breaking Windows by blocking tcpip.sys but turned into flame about “shitty free antiviruses”, their lack of analytics team, and pirated software quite soon — existed in 2012.)

He explains it had been done a couple of years back to demonstrate the problem to Computer Bild journalists. A number of executable files with “funny” code that could not do any actual harm were made and 50% of them were added to Kaspersky's detection list under distinctive names. Then they all were shared on VirusTotal (and thus with other vendors). Surprisingly enough, only those “viruses” that triggered Kaspersky Antivirus on VirusTotal started spreading through others' databases, often with the same name. Still, there was no article written on that for some reason. These results were later presented to analytics and investors visiting Kaspersky's conference (Security Analyst Summit 2012).

So what's left is to ask Computer Bild if they participated in something like that test and/or someone who was on that conference.

"Avira Antivirus update cripples millions of Windows PCs ..." "Broken McAfee DAT update cripples Windows workstations" "Update gone wrong. Panda antivirus removing system files ..." "Bad BitDefender Antivirus Update Hobbles Windows PCs ..."

Kaspersky labs has defended against US government malware so they might also get into trouble for that.

Kaspersky has demonstrated a weakness: that the firms copy each other's data and blindly trust each other as well as the initial submissions. They have a submission process for infected files which can be demonstrably abused to inject false positives.

Also this:

> Then, when competitors ran this doctored file through their virus detection engines, the file would be flagged as potentially malicious. If the doctored file looked close enough to the original, Kaspersky could fool rival companies into thinking the clean file was problematic as well.

What?? Infected files are always similar to clean files. An infected MS Word 2010 still looks mostly like MS Word 2010 and is even usable as such. Knowing clean from infected is the bread and butter of anti-virus. They are supposed to take doctored files, and register them as malicious, while recognizing clean ones as clean. If similarity between dirty and clean them causes a false positive, you would think that this is a fundamental problem. It shows they are using some weak heuristics to guess that files are clean instead of, say, strong checksums. They are guessing whether that DLL belonging to MS Word 2010 is clean or not because they have no idea what clean looks like, and Kaspersky has shown that they can be induced to guess wrong.

A proper implementation would detect so much as a single bit difference between a clean file and an altered one. Rather, they must be working off the assumption that there is some minimum difference between a viable infection and the clean file. In keeping with this, there is a database of the known dirty files only, and not of the clean reference files. Anything close to the dirty example within some small "edit distance" is just a variation on dirty and is declared dirty. Anything distant is either a different, unknown form of dirty, or clean. Either way it is declared clean. If that's how things work in an AV program, it has a weakness. Competitors should be merciless in identifying and exposing that weakness, because that's good for the consumer in the end.

>Then, when competitors ran this doctored file through their virus detection engines, the file would be flagged as potentially malicious. If the doctored file looked close enough to the original, Kaspersky could fool rival companies into thinking the clean file was problematic as well.

I don't quite understand - what about hashes? VirusTotal doesn't work as they say it works.

Most worrisome is what other unscrupulous behavior is he willing to engage in? Is he willing to do the bidding of the motherland at the expense of the trust customers put into the product?

The signatures that triggered it were in 3rd party installer code that we used. If you think of it, it is a perfect attack method as by targeting shared installer many products were made false positive with little effort.

Perhaps a mod should step in and cleanup the title a bit? I realize it's technically the original, but it's still misleading.

Accusation is presented as fact.

This would be a better title: "Russian antivirus firm faked malware to harm rivals - say ex-employees"

It's "principle", not "principal". They are very different.

I see this a lot, used in the other direction, on job postings "Principle Engineer" as opposed to "Principal Engineer".

I'd certainly reconsider my Kaspersky license if I had one.