Slashdot Mirror
Kaspersky Source Code In the Wild
mvar writes "The source code of an older version of 'Kaspersky Internet Security' has been circulated on the internet. The code was created in late 2007 and was probably stolen in early 2008. Names contained in the source indicate that the stolen code was probably a beta version of the 2008 software package – the current release is Kaspersky Internet Security 2011. According to a Russian language report by CNews (Google translation), the code was copied by a disgruntled ex-employee. The thief has reportedly been trying to sell the code on the black market for some time, and Kaspersky says that the code archive already appeared in various private forums last November."
And, in other news, Microsoft has released Windows 95 to rapturous applause.
Is there a difference?
How many people (perhaps apart from malware writers) will really be affected by this disclosure of the source for some 4-year-old software?
Code to a 4 year old anti virus app, whats that going to be worth? Kaspersky was great until a few years ago. Then one release made my parents older p4 system near unusable. It went from firefox loading in a few seconds to close to 30 seconds. Forums were filled with the same complaints and no real fixes. I changed to Avast and its been great.
Only the State obtains its revenue by coercion. - Murray Rothbard
Another disgruntled employee. I wonder why he is disgruntled...
I wish them luck recovering it so they don't have to rewrite it from scratch.
(Copyright infringement is not theft.)
In general, it is safe and legal to kill your children. -- POSIX Programmer's Guide
Kaspersky users might need to think about ditching their antivirus. The good news is Ubuntu will welcome them with open arms.
"I'm taking this loop off." - Jack O'Neill
"The source code of an older version of 'Kaspersky Internet Security' has been circulated on the internet. The code was created in late 2007 and was probably copied in early 2008. Names contained in the source indicate that the copied code was probably a beta version of the 2008 software package - the current release is Kaspersky Internet Security 2011. According to a Russian language report by CNews (Google translation), the code was copied by a disgruntled ex-employee. The copier has reportedly been trying to sell the code on the black market for some time, and Kaspersky says that the code archive already appeared in various private forums last November."
Now, isn't that better?
I changed from XP to Windows 7 and skipped anti-virus on my computer. Gmail screens all my documents I receive for viruses, chrome browser has pretty good security, applications I download are from legitimate sources, good backup and archiving, and the occasional malwarebytes scan (yet to find anything in 18 months). Why did I go this route? Well I found I had malware despite having a fully updated Mcafee AV on my XP computer. I realized safe computing and a modern OS would likely be enough for an educated user -- thus far it has been.
In Soviet My House, wife beats me!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I have a lovely stapler at home.
Linux is not inherently more secure. Why would it be?
You might notice now and then that an exploit gets discovered in a Linux program. BIND and sendmail have for some time been the poster child for "yet another Linux security hole". Even BIND 9 has its issues. Now, why BIND and sendmail? Are they so horribly insecure compared to the rest of the system?
No. But compromising them is profitable. Simple as that.
Likewise, finding security holes in Windows is profitable. The average Windows user is less clued than the average Linux user. And that's not up for discussion. Not because Linux would need more knowledge, simply because to use Linux you'd first of all have to know it exists, something the average Joe Randombrowser doesn't even know, or he mistakes Linux for some sort of odd interface that runs on top of Windows.
Porting all those Joes to Linux now does not solve the problem. Because the problem stays the same: As long as users allow everything, disable all security and hand over root credentials to any program in exchange for Dancing Pigs, the system is powerless to defend against this.
And THIS is the core problem of security today. Not a hole in the technical security, it's a hole in the user's ability and awareness of security.
If you now move all those Joes to Linux, all that will change is that the same kind of malware crap we see today for Windows will start to pop up for Linux. The only reason why there is not more malware for Linux is simply that the market is too small. It's a bit like the game market. Why is there not more games for Linux? Simple: More money in making games for Windows. Simply because it's a bigger market.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Like Netscape, who released their source code so a bloated, unwieldy application could be improved upon and re-released as something that's actually functional, it seems Kaspersky are following suit. Good on them.
"We live in a global world" - Harvey Pitt, former Securities and Exchange Commission Chairman
Someone check this out to see the quality of this closed code!
Code quality is often a excuse for commercial software to sell VS OSS, and I am interested on how "higher" the quality of this stuff is.
Works nowdays anyhow so... i really dont care.
Besides, im on Linux.
NO SIG
I visited some of these forums today, and fair enough.. the source code is there. Here is what I found:
#include <stdio.h>
#include <kaspersky.h>
char make_prog_look_big[1600000];
main()
{
if (detect_cache())
disable_cache();
if (fast_cpu())
set_wait_states(lots);
set_mouse(speed, very_slow);
set_mouse(action, jumpy);
set_mouse(reaction, sometimes);
printf("Please wait, Kaspersky is scanning your computah)\n");
if (system_ok())
crash(to_dos_prompt);
else
system_memory = open("a:\swp0001.swp", O_CREATE);
while(1) {
sleep(5);
scan_a_single_file();
sleep(5);
update_progress_bar();
sleep(5);
if (rand() < 0.9)
crash(complete_system);
}
return(unrecoverable_system);
}
}
Been using Kaspersky for home and business for over ten years. Given that this is a company whose primary business is security, I find it beyond comprehension that a 'disgruntled employee' could steal and distribute source code. Trust destroyed...
If memory serves me correctly, someone at Kapersky stated that they didn't believe that people were entitled to privacy.
I wish nothing but the worst for their company.
https://www.youtube.com/c/BrendaEM