Hacker News Reader

Comment by apexalpha | Hacker News Reader

Our company uses the enterprise version of Kaspersky. But if we drop this over surveillance issues then it would be a pretty hypocritical to switch to AV software from the USA. Since they are proven to do the exact thing that Kaspersky is now suspected / blamed of doing.

So, fellow Europeans, what now? Avast? Any other options?

EDIT: Ok so I found a pretty useful Wiki list[1] with European made AV products. I haven't used them so I can't judge to their effectiveness, especially the enterprise versions. But here are some alternatives to US / RU anti virus suites.

Czech Republic: AVAST, AVG, TrustPort

Finland: F-Secure

Germany: Avira, G-Data

Iceland: FRISK (F-PROT)

Romania: Bitdefender

Slovakia: ESET

Spain: PANDA security

[1] https://en.wikipedia.org/wiki/Comparison_of_antivirus_softwa...

View on HN

This is purely anecdotal, but back when I was doing a lot of Windows sysadmin work (and when viruses were rampant) I wound up tearing through a lot of AV vendors in short order.

Only a handful survived my tests, and now I see them all listed here as European AV vendors. Interesting.

Symantec, by the way, was by far the worst. It got to the point where I would immediately uninstall their products on sight. My favorite was when one of their automatic updates started causing boot failures. That sure kept me busy!

Hire a team from your native country to manually inspect each packet before it is passed on to the client machines.

This kind of Biological neural network isn't always the fastest approach but you can be sure it isn't forwarding all your traffic to the government.

Network security monitoring is fairly common in competent enterprises.

Your ridicule is misplaced. We truly cannot trust the computers we use, from the silicon up.

To call that paranoia isn't naivity anymore, it's foolhardiness.

Standard intelligence practice is to assume that your information is already compromised. All it takes is a mole, or a disgruntled employee and all the cybersecurity in the world is naught. You'd be foolish to think anything else.

Standard Practice is to have honeypots, and watch carefully who puts his paws where..

> Iceland: FRISK (F-PROT)

FRISK was bought by Israeli company Commtouch several years ago. They wound down operations in Iceland to the point that I doubt any real technical work goes on there.

What’s wrong with Windows Defender?

This is the real answer here. For the only alternatives you're forced to trust yet another party and with something like AV that basically equates to the third party having full control over your machine should they decide to do so. At least with Windows Defender you aren't adding another adversary although it seems pretty hypocritical to avoid American AV while still using an OS that the NSA can push updates to.

Get Windows Ten should have been an eye opener for everyone, vetting updates isn't anywhere close to good enough, if Microsoft is compelled to do so they can run whatever they want on your computer.

Use Linux :) there is no other option

Many open source projects are infiltrated. You may use Linux but if you run on x86 you are already owned.

Not via Linux, but via the IME that Intel puts on every CPU with full access to all memory and the network cards.

One source of entropy in Linux is the RDRND instruction. If you control or predict its output you can do a lot of harm.

It really depends on a lot of the software as well. Linux doesn't inherently trust just the CPU instructions for entropy. In fact, it recently borrowed a new feature from OpenBSD and added it called getrandom():

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Like what?

I think a Mac would work too, but that relies on trusting individuals.

How would switching to macOS provide any protection against an APT? Against Malware in general yeah sure but against the NSA or FSB in a targeted attack I don't see how that benefits you at all. If the NSA can put the screws on Microsoft then Apple should be no different. Apple refusing the FBI is one thing but faced with a gag order and an NSL their only recourse is to appeal to a secret court that basically always sides with the government.

Also as of late it seems like macOS has been nothing but security incident after security incident like the recent bug where encrypted disks had a password hint of the decryption password or when somebody found out that the system preferences app was basically using an undocumented API that had no authorization at all and gave root access. Or that keychain vulnerability that gave complete access to the entire keychain to anything running in a web browser!

I think an APT would have a field day if their targets started using macOS.

Everyone who think they are safe using macOS should see this presentation : https://www.youtube.com/watch?v=q7VZtCUphgg

Patrick Wardle has reversed the C2 com protocol and found it had "advanced" capabilities (remote exec, key and mouse sniffing, screenshot, etc.). The malware was found on several thousands Macs too (mostly in the US).

Any suggestion a good tools (good source one) on mac that can scan and detect this kind of malware?

the guy in the video has created a bunch of "osx sysinternals" tools for this exact purpose : https://objective-see.com/products.html.

Apple pays people to "astroturf" that they're immune from Viruses and backdoors. IMHO, that makes them much worse than Microsoft.

Well, nothing's totally secure. You can but reduce the odds of having problems and Macs seem to be hit less. For example in the N Korea hack on Sony the Macs survived https://9to5mac.com/2014/12/18/sony-hack/

>“Some people had to send faxes. They were dragging old printers out of storage to cut checks,” she said. “It was crazy.” ... "People using Macs were fine,” she said. She said most work is done on iPads and iPhones.

Perfect is the enemy of good and all that.

>Macs seem to be hit less.

Yes but my point is that this is completely irrelevant to an APT. When an attacker moves from opportunistic to targeted having an OS with a lower adoption rate isn't going to matter. They aren't going after the most amount of victims possible, they're going after you specifically.

Mac? No!! Apple controls every aspect of your life on a Mac. Linux and especially custom built ISO is your only option for privacy.

Plus if you assemble the RAM and processor by yourself, you never know how much viruses are there in our bootloader!

Linux is secure in the sense that nobody can use it.

Yeah - I agree EU software is the safest option: https://medium.com/@zby/the-safest-option-is-eu-software-abc...

Filter on the benchmarks and then dig into ownership and reputation. Bigger vendors have more to lose and more resources to fight legal and cybersecurity issues. Too big / multinational vendors then get leaned-on by national security services with an “include this and give us customer information or we blacklist you” offer.

https://www.av-comparatives.org/

That is assuming they're not infiltrated, hacked or voluntarily participating of some foreign surveillance/espionage program.

Of those, all but Finland are NATO members.

NATO is a military alliance, not a intelligence sharing agreement. We know that five-eyes intel doesn't go to NATO, and it is pretty doubtful that eg Turkey and Germany share their intel.

It's been shown somewhat recently[1], that German intelligence not just exchanged data with the US, but also collected data for the US services in Germany and worldwide.

[1] https://www.theguardian.com/world/2016/jun/28/germany-curb-s...

Indeed. But this isn't some NATO thing, it's a US/German agreement.

If you must use AV, better look for AV solutions with clear written policies on the information they collect https://www.f-secure.com/en/web/legal/privacy/security-cloud

eset

Reply on news.ycombinator.com