Hacker News Reader

Comment by jimmyed | Hacker News Reader

Aside: Kaspersky is a Russian company.

Not sure it's really meaningful to simply say they're a "Russian company". More specifically, they're a company that has been accused of cooperating with the FSB in attacks against the US government.

https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations...

Whatever the case, it's probably wise to take their statements with some skepticism of bias in this regard.

Role reversal: If a US antivirus company's heuristic and file analysis uploaded a trove of russian zero-day exploits they are using against their adversaries, you better damn well believe they're going to hand that over to the CIA/NSA and the CIA/NSA may weaponize them against our adversaries.

When it comes to US crafted malware, I trust the Russians in detecting it and telling the world more than I would any US-based company.

It is now. After decades of state lying "russian" has a well defined meaning now.

Or: "they're a company that has been accused without evidence of cooperating with the FSB in attacks against the US government by US entities aligned to the US-based actors that they have exposed".

FTFY.

> without evidence of cooperating with the FSB

That isn't true. This "without evidence" shit is rather silly when it comes to top-secret sources and methods. Blow decades of work and risk getting people killed to Prove that an ex-KGB officer helps an authoritative regime thats known to poison its enemies. People said the same shit about Huawei, then all the KPN shit.

Link: https://www.bloomberg.com/news/articles/2017-07-11/kaspersky...

The problem with that is that those agencies also lie all the time. You can't have your cake and eat it too with a just trust us attitude and also make stuff up when it's convenient.

"We'll know our disinformation program is complete when everything the American public believes is false." - William J. Casey, former CIA Director

That said, I think the safest default assumption is both that any large national intelligence agency lies all the time, and also that any entity that a national intelligence agency has the means and motive to compromise is probably compromised. So Kaspersky is probably an FSB asset (but so too is Amazon a CIA/NSA asset) but the CIA is probably lying 99% of the time too.

> This "without evidence" shit is rather silly when it comes to top-secret sources and methods.

"We lie, we cheat, we steal". Literally from the mouth of the guy who ran it to your ears.

I'm not sure how you find these source legitimate sans evidence, other than possibly they are you team.

PS. Doesn't make the other jerks legitimate either.

> sans evidence

You're talking about an entity with the ability to fake any evidence that they would be able to provide you. So no matter what "evidence" they provide you would still need to make a choice to believe them.

I used the word "accused" intentionally. My pointing out a potential bias here is not a diminishment of anyone else's potential bias.

I find it interesting that this and a few other investigations have been released around times of great geopolitical tensions related to Russia. I think there are legitimate questions as to how/where this activity was observed and what led them to investigate it.

Personally, I don't know how closely they coordinate with Russian intelligence services, but some of the samples they get and the background/context they get can only be obtained if you are very close to the investigation. The way they phrase things like "we found this in a multi-engine scanner" raise the hair on the back of my neck, since I work in malware analysis and you don't just run across these types of samples by chance. They are either doing IR for organizations that were targeted (which you would just mention), or they are getting tipped off on where to look.

Whether or not this is intentional, or just happens to be a coincidence, it is something to be aware of.

Examples of suspicious timing: Flame paper released while there were massive protests in Russia around 2012, Regin/Equation Group/Duqu 2.0 paper released during Ukranian invasion circa 2014/15, and now this paper also released while tensions in Ukraine are ramping up and after the fallout from the SolarWinds stuff.

I think it would be less suspicious if places like Sputnik (a known propaganda arm of Russia) didn't immediately start pushing a specific narrative when Kaspersky has these malware releases.

Which makes them one of relatively few companies in this space that would publicly expose CIA ops.

It's definitely reasonable to be sceptical here, but that goes both ways.

I think you make a valid point here - there are not a lot of companies willing to expose something like this. Even less so second time around.

[meta] I would REALLY love for people down-voting something to explain why they do this. Maybe as HN feature for the first 200 downvotes, you have to reply to the post or upvote one below that explains it...

So? Doesn't make their claim anymore invalid.

You might as well say they are an AV firm and there is a conflict of interest just by saying there is some x malware.

Either way they need to proof it.

And this of course means that CIA does not make malware.

Dude, it is well known that US is the single most powerful cyber warfare practitioner. They even had a few very successful operations in Iran and may be in China and Russia (you can guarantee that those countries won't disclose the incidents).

TBH, one should be happy that US possess such power. US might be biased, but the country is at least rational.

> Dude, it is well known that US is the single most powerful cyber warfare practitioner. They even had a few very successful operations in Iran and may be in China and Russia (you can guarantee that those countries won't disclose the incidents).

I don't follow that logic:

> >1: The US is the single most powerful cyber warfare practitioner

> >2: Successful operations in Iran, China and Russia

> >3: But those countries won't disclose such incidents

So how you can be so sure about point 1?

About eighty years ago, the US assembled the top minds of nuclear physics, and the US military knew the potential of creating a weapon out of physics, then BOMB. Now the situation is the same, it's reasonable to think the US is the most advanced nation in cyber weaponary.

Things were different in the era immediately after WW2 and now. Power and wealth is distributed amongst more countries now. The US cannot do much with the Taiwan situation for example.

Whose products are sanctioned against use in US government systems because of ties to Russian intelligence services.

But you should take both these statements with a grain of salt when either side of the field stands to gain (or lose) something.

Aside: therecord.media is CIA propaganda. https://gcn.com/articles/2010/07/29/inqtel-google-fund-web-a...

Recorded Future = CIA? Solely based on them taking money from IQT?

IQT funds a ton of different companies, it doesn't make them fronts for the CIA. Cloudera, FireEye and a ton of others have taken money from IQT, it doesn't make them propaganda.

>Cloudera, FireEye and a ton of others have taken money from IQT, it doesn't make them propaganda.

Though I won't say for sure that Recorded Future is CIA propaganda, there are obvious reasons why the CIA would fund a software development or computer security company besides propaganda. For what other reason would they fund a media company?

Recorded Future isn't a media company... They are a threat intel/osint/reporting platform.

TheRecord is essentially their blog/news site, just like ThreatPost is Kasperskys blog/news site. Just like I wouldn't consider Kaspersky a media company, just like I wouldn't consider Recorded Future to be a media company.

Reply on news.ycombinator.com