Hacker News Reader

Comment by drzaiusapelord | Hacker News Reader

Kaspersky is aligned with Putin's FSB:

http://www.bloomberg.com/news/articles/2015-03-19/cybersecur...

http://www.wired.com/2012/07/ff_kaspersky/

You'd be a little crazy to run this outside of Russia. I suspect there are more backdoors disguised as "vulnerabilities we knew nothing about, totally, its news to us!" This reads like a trivial overflow which would have been found with some basic testing. This is a common ploy with untrustworthy software.

Maybe Kaspersky was safe to run once, but with Russia's new brazen anti-West attitude, its a liability now.

View on HN

Well obviously anti-Russia type arguments make sense, as it is a Russian product. But most of these "popular anti-virus" programs are riddled with issues. This is not just a Kaspersky thing, Norton has it's own set of issues, and so does McAFee. And I'm sure the others are not bullet proof.

Indeed, most of all software is riddled with issues

Yes, but we should hold programs purporting to increase security to a higher standard.

Not most. All. All programs have bugs and most people can't write even a simple "hello world" program that doesn't contain bugs (in the program itself, the runtime or, underlying OS or even hardware firmware below it). Fact is: execute a program and there will be an exploitable bug somewhere. Fact of life. The system is fucked - royally!

I guess it would be more correct to speak of hidden or embedded biases or conflicts of interest.

I don't use their products and the place I used to work was a little surprised when I pointed out his multiple connections to the current regime.

I also thought it was odd he always seemed to have no problem catching US nation state malware, but all of those Russian state cyber weapons other companies keep finding seem to allude him and his team.

Coincidence?

> but all of those Russian state cyber weapons other companies keep finding seem to elude him and his team

Kaspersky blog has written up analyses of malware campaigns from many different countries. Here are some Russian-origin APT campaigns.

1. https://blog.kaspersky.com/turla-apt-exploiting-satellites/9...

2. https://securelist.com/blog/research/69731/the-cozyduke-apt/

3. http://www.kaspersky.com/about/news/virus/2014/crouching-yet...

I was reading about how Estonia and Ukraine were victims to all these client side hacks from the Russian government which Kaspersky magically couldn't detect. I think its pretty obvious they're in cahoots. I imagine these governments are no longer running Kaspersky.

Brian Krebs also writes about popular malware that first does a check to see if its being run on a computer in Russia. If so, it stops running. There's a lot of government sponsored malware coming from Russia. There's a public private partnership to put profitable malware on non-Russian computers and Russian officials turn a blind eye due to corruption, bribes, etc. Its all fairly ugly.

Every security vendor is aligned with it's "host" nation, that is how business works. Not to mention that it's one of the only few sources for these types of enterprises to recruit from in the first place. Most of the security software coming out of Israel like Checkpoint goes even beyond that and it's actual code that was written in the IDF and was released for commercial use. The NSA also has a technology transfer program that enables commercialization of many technologies which were invented or developed by the NSA, they also release quite a abit of their TTP software as open source.

I think you're certainly overstating the case here. We don't see US derived malware being ignored by the USG. In fact, almost all high profile hacker arrests stem from US investigations. US researchers are the ones who take out Russian and Chinese botnet C&C servers. We see almost no action on the nation states that profit from malware, namely Russia and China.

On a cyber weapons level, who knows, but citing things like TTP which releases to FOSS or Israel's defense industry as a sign of corruption is asinine and not remotely comparable to what is the status quo in Russia. Cyber weapons will always be here and, when used correctly, can't be detected by signature based AV because they have no idea what to look for and the exploits they use are typically zero days. Stuxnet used, I believe, 3 or 4 different zero day attacks.

Nor did you bother to read the Kaspersky articles where the proof is laid out in a pretty obvious way. I think its foolish to knee-jerk to "Oh Russia does this, so must everyone else." Certainly there are degrees of corruption, and Russia is on the extreme end of this scale. Brian Krebs and Tavis Ormandy aren't on some NSA payroll to make Russia look bad. Russians do that for free. Lets stop playing the "every government is the same" card. Its been historically untrue.

>Every security vendor is aligned with it's "host" nation

Also, I really doubt the guys writing rules for Snort, ClamAV, or mod_security or OSSEC are aligned with anyone. Your view is incredibly cynical and very much an example of the disingenious tactic of "whataboutism" Russians use to defend their wrongdoings. Those rules are public, pray tell, which ones are NSA backdoors? I suggest you come up with some proof if you're making such accusations. The articles I linked to about Kasperky are significant and well-researched.

edit: I cant reply below so I'll type it here. Clinton-era crypto limitations are a non-issue. Clinton lost the crypto wars after the Clipper chip was never passed or funded and after Phil Zimmerman wrote PGP and helped end crypto restrictions. I'm talking about things happening right now. 20+ years ago whining is not helping nor relevant. Use whatever crypto you like.

Ok, every commercial security vendor of significance better? RSA and other security vendors had to introduce work reducers for the NSA in the 90's because that's what was mandated to them to be able to export their software. Being aligned with national interests doesn't mean introducing backdoors it means cooperating with them, considering the breath of knowledge that a national organization has and their resources it's a mutual beneficial relationship in most cases. It's not conspiracies it's the simple fact it's like universities doing research for national defense that's a given fact, but you don't expect saint petersburg polytechnic to perform research for DARAP just like you don't expect caltech doing research for the Russians. Nowhere did i hinted that it's a sign of corruption or that i even see this as negative thing as i don't on both count. This is the simple reality of how businesses and academia work for national interests and I'm not sure what surprising about this.

We do see US government malware being ignored by US security firms. Why do you think it's always Kasperskey and other non-US companies that report stuff like Duqu?

I wouldn't go as far as claiming that US agencies are putting gag orders on such investigations.

Symantec did a very extensive study on Stuxnet they were the ones that confirmed that it was intended to damage the centrifuges by fooling the industrial motor controllers.

What is more likely is that a national intelligence organization will use the local security vendors for counter intelligence purposes i.e. tipping them to suspected cyber intelligence operations that they've identified through other means.

This is a much more likely scenario than simply telling them not to talk about certain malware, it's easier to enforce and it provides them with both deniability and a more favorable outcome.

Geopolitics also play an important role here, different vendors have different market share in different regions. Kaspersky for example is more common in lower income countries, as well as countries that are under direct US sanctions like Syria or Iran, or countries to which US companies will have hard time exporting too or developing their market due to past relations.

So when you have a virus that infects many machines in Iran or Syria it's if any of the computers will be running fully licensed and supported commercial anti-virus software it wont be Symantec or McAfee that they'll be running but rather Kaspersky or any other non-US/Western software.

I feel pretty much this is the case as well, hence my relative trust for Kaspersky for my own use. US/Israel never detected Stuxnet either :), its a big geopolitical chessboard and anti-virus companies are knights that fight with their own color, they're not neutral.

Maybe he doesn't like polonium.

Sounds pretty circumstantial. Adobe for example has had many security vulnerabilities in flash over the years. I doubt that they were intentional back doors.

This is getting into conspiracy territory, but we are talking about a government that intercepts networking equipment while it's being shipped, disassembles it, installs hardware back-doors, and then delivers it. Strong arming any US software company that has a near universal install base isn't really a stretch of imagination.

I believe most AV vendors, if/when persuaded by powerful agencies, won't need to introduce an specially crafted backdoor.

An average antivirus software has everything necessary already. Personal licenses as a way to identify the specific machine or person, automatic streaming software updates as a way to deliver the payload and almost unrestricted privileges on the target system enough to infiltrate and stay concealed.

I agree with you on the Adobe software issues, particularly PDF reader. But you raise a question: how can we tell if a security vulnerability is an intentional back door or a goof? It's pretty easy to say "intentional" in some cases, and "goof" in others, but what about the vast majority that will inevitably lie between the easy-to-tell ends of the spectrum?

As an example, there's still room for argument about the Dual_EC_DRBG algorithm, and RSA making that the default PRNG for some or all of their products. RSA denies taking money for it. Nobody can make an airtight case for the NSA deliberately weakening it. Yet we still all kind of view Dual_EC_DRBG with suspicion.

The RSA deal was 10M, this was after its acquisition by EMC so 10M out of 25 billion in revenue makes it a bit an odd sum to introduce a backdoor.

Not that RSA hasn't done so in the past, but it was public when encryption software could not be exported RSA cam to an agreement with the US government to export it's 64bit encryption, it would use a 40bit private key and append the message with an additional 24bits which are transmitted in clear text and complete the private key to it's 64bit size.

This was a government mandated "work reducer" so the NSA if need be could decrypt the message as they had the ability to break 40bit encryption and the rest of the 24 bit of the 64bit encryption key was known for each message. This wasn't hidden, this was even released in a conference with great pride that RSA could now export it's mail encryption suit to Europe. Germany made a fuss about this 5 years after the fact, but everyone pointed and said well they announced it in a conference.

People are trivially easy to bribe. The KGB bought an FBI agent for 22 years for a total of only $1.4M.[1] And an army intelligence officer for only $250K over 25 yeas.[2]

It's strange to think that corporate employees would be that much harder to corrupt, especially for their own country.

1: https://en.wikipedia.org/wiki/Robert_Hanssen 2: https://en.wikipedia.org/wiki/George_Trofimoff

Corrupting an RSA employee sure, making a deal with a corporation for measly 10M nope.

Human assets is a different story, 1.4 and even 250K while not being a large sum is quite a large amount of money. Those assets are usually developed by other means, in most cases the money is largely irrelevant even if the asset refuses to take money tradecraft mandates that they'll be forced to take it it just to leave a money trail that they could then be threatened with if they no longer with to comply. Additionally being paid also makes the asset more invested in their duty because it creates a link like with a would be employer, and allows them to quantify their assignment with a positive reinforcement no matter how big or small it is. So money which is paid to long term assets isn't really a bribe, an initial sum might be used to turn the asset in the first place but it also usually require them to be in a position to need it e.g. gambling debts, medical bills etc. Generally assets that can be bribed will not be farmed in such manner as the cases you've mentioned, people that can be easily bribed cannot be trusted which isn't a trait you want in an asset.

Eh are we sure the 10M was the only thing being paid? Perhaps the NSA sweetened the deal for key decision makers.

Even without that - it's free money for a benign reason, while doing the security services a favour. "Hey we've got this new crypto thing that's amazing but people don't believe us. Add it to your product, and we'll give you token compensation. Also we'll also make a note of what great guys you are."

Way to risk too much for a measly 250k.

Yet he got away with it! They only popped him after he got greedy in retirement and they setup a sting!

I know of employees busted for internal schemes they cooked up (it was pretty cool working with BigCorp to setup an international sting to get them). It simply cannot be that hard to find people that need or want money and get them to compromise things for relatively small amounts of money.

And Dropbox is aligned with the US government as you surely know. Does that matter though?

Well that is a reason that people choose not to use it. Any non-US state would be silly to store their documents there.

Reply on news.ycombinator.com