Hard to believe it took so long, but it's positive to see this happening.
[1] - https://www.av-comparatives.org/test-results/
[2] - https://en.wikipedia.org/wiki/Equation_Group#Discovery
[3] - https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations...
Unless you have a reason to believe that somewhere the NSA is having a meeting where your name is getting mentioned this isn’t actually something you need to worry about.
Also worth noting that if you do happen to find yourself on a targeting list, no one brand of anti virus is going to make even the smallest bit of difference as to what the outcome of that decision was.
This angle you seem to be insinuating that this decision to ban them is somehow because “they are mad” is a child like understanding of the situation and is actively wrong.
Please explain to me what you think should be different.
The thread went like this:
- Someone: Kaspersky is arguably the best at the job, was the only one capable of detecting NSA malware at one point.
- You: NSA never targets anyone they don’t want to target, and antivirus is useless if you are a target.
- Someone: NSA malware also gets leaked into the wild and end up infecting millions.
- You: A single example?
- Me: A single example (that was arguably digital security story of the year at the time).
- You, two comments later: what should NSA do?
They don’t need to do shit. Antivirus companies should up their game. In practice though, word on the street (probably backed up by leaked documents too but I’m not sure) is they — including the targeted software vendors, notably Google and Microsoft — often just greenlight their allies’ operations, and issue a low profile patch when it’s really bad.
To me the only conversation to be had here is were there reasonable protections in place at the time and what is being done to prevent it happening in the future but just due to the fact that this is the NSA those conversations are not going to be public for obvious reasons.
What exactly do you want to see happen here?
> Unless you have a reason to believe that somewhere the NSA is having a meeting where your name is getting mentioned this isn’t actually something you need to worry about.
... unless the exploits leak (after use), which they do.
The CIA once proposed to commit terrorist attacks on American soil to create a justification for war a against Cuba. JFK turned them down but was anybody in the CIA ever punished for it? Hell no, and there is reason enough to think they may have even murdered him for that rejection. Even if you don't believe that, none of them have ever been punished for their abuses and there has never been reform.
How could you claim that without (a) having insider knowledge of the secret activities of the FISA court and (b) violating some sort of legal restriction on publicising your knowledge of said court? One of the major complaints about the US surveillance program (indeed any surveillance program) is almost nobody is allowed to know who the targets are or why.
> I think the most controversial thing on that front from memory was Angela Merkel and other EU heads of state
And I think the most controversial target to date was actually Trump.
Wasn't their plan with stuxnet "spread this as far as we can and eventually it'll hit what we want?"
Ignoring how frequently they will accidentally target the wrong people, that seems like intentionally creating something where there will be accidental victims.
>The worm initially spreads indiscriminately...
And most of the rest of the article. They made a worm that was only supposed to activate in incredibly specific circumstances, but spread indiscriminately to find that specific circumstance.
edit oh, and let's not forget those extremely specific circumstances still seemed to have hit a thousand other targets accidentally, which is the exact thing you said isn't ever going to happen.
There is an element of you are going after a very specific system or set of systems but they are all air gapped and you need to find a way to get your malware onto those systems somehow.
This part is actually how you describe it more or less. The plan was basically: spread everywhere you can but only do so if you are confident for some reason that you’re on a system belonging to the target country (I.e Iran) and if anyone ever sticks in a USB key to one of those systems you should take that as an opportunity to cross the air gap because people are sloppy and mistakes happen.
So in that sense, yeah it is somewhat true, that’s literally the strategy they used to get where they needed to go. However, the controls they had around it I think were also reasonable. I fully expect the NSA and Mossad (who would later somewhat fuck up the operation) to be doing exactly that and I think it’s consistent with their job.
The second part is the “actually malicious” payload. That had an entirely different set of checks and balances in place to make sure it wasn’t fucking up unreleated systems along the way but just using them as a launch point.
That full context I think still firmly fits my original definition that unless you’re actively on a target list for some reason you have no reason to view NSA malware as something you should have on your threat model. Not sure if you agree or not?
And that's forgetting that no matter how specific the NSA supposedly was, after launching their malware other groups will copy it, so an AV provider will need to view NSA malware as a threat model.
Plus, your original definition assumes the NSA either doesn't make mistakes, or an AV company shouldn't try to clean up their mistakes, both of which are nonsense
1000s of computers did indeed have malware on them. That’s true.
The malware was intentionally designed to do nothing other than trying to cross the airgap to where it was actively trying to go.
This is the entire reason I just explained why when you say “stuxnet infected thousands of machines” that you’re actually talking about a couple of different things here as though they were one.
The nuance in this particular debate matters quite a lot and I don’t think ignoring it for the sake of convenience is helpful.
If it only damaged the one system it was supposed to be targeting, why would we ever have heard of it?
I.e here is an example of what we consider to be legitimate use to compare and contrast with say North Korea’s Sony hack.
But also it lost a lot of its value as a secret once it was already done.
These rogue pieces of software do occasionally escape their intended target and do measurable damage to infrastructure. Many such cases.
The idea that "I don't need quality antivirus, because I have nothing to fear from such threats" has similar energy to "I don't care about my privacy, I have nothing to hide."
Malware is a real thing that people need to worry about.
Being targeted by the NSA doesn’t happen by mistake.
As some others have pointed out, there was an incident a few years ago where NSA lost a whole bunch of their malware thanks to I believe again it was a leaker in that case (Joshua Schulte if I remember correctly).
That did in turn end up getting used in a North Korean operation shortly thereafter which by contrast didn’t seem to have good controls in place and absolutely spread like wild fire.
But as far as I know it happened once, was an anomaly and just isn’t a thing that is likely to ever impact you which is why I’m making the argument that what the OP was saying that Kaspersky is the best anti virus just isn’t a good argument and people shouldn’t feel like they are missing out on anything in this instance.
Let me make another point.
Having access to multiple computer security firms is good, and the services Kaspersky provides do not end with their antivirus software. Security firms regularly publish their work and work with each other.
Perhaps I'm wrong here, but if memory serves, Kaspersky was one of the first firms to detect stuxnet and publish it's structure (I could be wrong here, trust but verify). Using this data, Symantec was able to begin studying the virus as well.
Walling off security research will lead to more parallel research, rather than international collaboration in computer security. Whether or not this is a good or a bad thing is arguable - but I believe international efforts are a net good while the Internet is an international affair.
Who knows, siloing of development might allow creativity and novel solutions in computer security like what happened with the USA/antibiotics and the USSR/phage theory - but I might be coping here.
Of course not. Only the criminals are punished. /s
also, it's not like the american-based companies will not do that with european data to america. :D
It'd be pretty easy to see if the software was missing Russian state malware both by inspecting the code, or simply installing it on a test machine and then running the scan. If this were the case, it's highly likely the news would be repeating it 24/7. So it seems safe to assume it's doing its job well.
[1] - https://www.kaspersky.com/about/press-releases/2020_kaspersk...
So what, exactly, is this press release supposed to prove?
And they asked for it just to be sure. /s