Hacker News Reader

Comment by rando444 | Hacker News Reader

Before this article was published I don't think it was alleged that Kaspersky ever did anything.

All the public knew is that allegedly Israel hacked Kaspersky and noticed the Russian government using Kaspersky's tools to try and dig out secret documents.

I mean who knows, maybe the Russian government had a backdoor that they were abusing, maybe they hacked Kaspersky themselves, or maybe they were just given access.

I would have given Kaspersky plausible deniability before this article.. now I just don't believe them.

At face value their explanation sounds reasonable.

However, the original claim is that the Israelis were watching in real-time as agents searched computers around the world for secret codenames [0]... which is a world away from the explanation given in the submitted article.

[0] https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...

View on HN

Also this part from WSJ article remains:

"For many months, U.S. intelligence agencies studied the software and even set up controlled experiments to see if they could trigger Kaspersky’s software into believing it had found classified materials on a computer being monitored by U.S. spies, these people said. Those experiments persuaded officials that Kaspersky was being used to detect classified information."

https://www.wsj.com/articles/russian-hackers-scanned-network...

As a spy agency, this is how you put the middle finger up to a a remote spy agency. You report their malware to an antivirus database.

It's basically saying 'ha ha, we caught you, and now the whole world can look at what you were up to'.

Presumably, the NSA will have automated monitoring tools scanning every bit of AV software and AV databases looking for any of their own tools there, so they know right away when someone has publically outed them.

I wouldn't be surprised if these weren't even hooked up to automated self-removal logic so that NSA malware could remove itself in seconds worldwide if an AV database were updated to detect it.

"Israelis were watching in real-time as agents searched computers around the world for secret codenames"

is just a highly misleading way of saying

"Kaspersky added strings/.text/.rodata from the analysed malware sample to their virus database"

And no shit, a antivirus will then search computers "around the world" (this qualifier is here.. why?) for that data. That is why you paid for it.

The objectionable part here is "Iraelis were watching" but nobody seems all too concerned any more with economic espionage.

Is Eugene Kaspersky going the way of Julian Assange, or is he just another Deep State 33rd Degree Freemason casualty? Who knows.

Either way the flavor of the comments on this thread are really, really unusual for Hacker News and YCombinator in general.

Reply on news.ycombinator.com