Slashdot Mirror
Former Employees Accuse Kaspersky Lab of Faking Malware
An anonymous reader writes: Reuters reports that two former employees of Moscow-based Kaspersky Lab faked malware to damage the reputations of their rivals. The alleged campaign targeted Microsoft, AVG, Avast, and others, tricking them into classifying harmless files as viruses. The ex-employees said co-founder Eugene Kaspersky ordered some of the attacks as retaliation for emulating his software. The company denied the allegations, and Kaspersky himself reiterated them, adding, "Such actions are unethical, dishonest and their legality is at least questionable." The targeted companies had previously said somebody tried to induce false positives in their software, but they declined to comment on the new allegations. "In one technique, Kaspersky's engineers would take an important piece of software commonly found in PCs and inject bad code into it so that the file looked like it was infected, the ex-employees said. They would send the doctored file anonymously to VirusTotal." The alleged attacks went on for more than 10 years, peaking between 2009 and 2013.
There don't seem to be very many good free alternatives other than microsoft's default package. I've wondered if it's possible for me to make my own security system, but I've never given it a good amount of thought.
If classification is the name of the game, couldn't you use some machine learning techniques based on what malware does and write your own classifier?
It would not surprise me if *ALL* so-called antivirus software companies did this, with very few exceptions.
If you want news from today, you have to come back tomorrow.
>> chief task was to reverse-engineer competitors' virus detection software to figure out how to fool them into flagging good files as malicious
Why is this a bad thing? This is pretty much what a large chunk of the "grey hatter" world does on a regular basis (figure out how to trick AV). Shouldn't we be cheering on a little AV-on-AV competition instead of letting them all group-think themselves into a pool of mediocre results?
(This is also why running different AV engines in your network has generally been a good defense-in-depth measure in the past...I don't WANT them all to agree.)
If you could only install one you'd be better off installing an ad blocker than an anti-virus product.
People telling you different are trying to sell you something :)
... with how rotten companies are these days you can never tell if its a genuine issue or some other competitor running a smear campaign.
Either way there's no perfect AV software and as always the arms race will continue.
What Kaspersky expects from users:
"woah this non-Kaspersky AV is crap it gives false positives!!"
Reality:
"woah, Kaspersky is crap it doesn't detect this virus that this other AV found!!"
Was there a need to point that out?
The fear mongering and marketing ploys of business today is disturbing. Would not put anything past a web security company to taint the water of other competitors for an advantage. Just as I would not be surprised to find a security company producing targeted malware that affects only certain products.Wink, Wink.
At least most people have learned that your almost just as safe with a free version of security as the paid. The only real security they provide is the definitions of known malware circulating. Everything else just produces false positives or lame attempts at suppressing potential malware signatures. Now, Kaspersky is not any worse then a Symantec, or Trend Micro or any of the dozen's of anti malware companies out there. This is only one tale of what one company might be doing.
In fact for me I never run live security monitoring ever! I use Malwarebytes frequently and have yet to be infected with anything. If you keep up on updates, stop using malware magnets like Flash player. You run far less risk of ever getting anything nasty. I know plenty of idiots who click on everything and can infect the most protected device on earth. I also know some who run no security and have no problems. What is the key? Being smart and self protecting about your internet use.
"Such actions are unethical, dishonest and their legality is at least questionable."
Remember Enron? Yeah, what they did was somewhat unethical as well. Remember the subprime crisis? Plenty of ethically shady bankers in that as well. Stop pretending you care at all, because you don't. You only have to appear like you didn't know for PR reasons.
... where you analyze the executable and then based off that determine if it's malicious or not.
That's provably impossible. It's trivial to convert it to the halting problem.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
This is really greasy behaviour.
See subject & APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. browser addons & locally installed DNS servers @ home + fixes DNS' redirect security issues - obtaining its data vs. online threats & adbanner blocking from 10 reputable sites in the security community, using a tool you already have (hosts)!
* :)
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
---
"The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"...
APK
P.S.=> By "yours truly" - "The Lord of Hosts" so-to-speak:
PERTINENT QUOTE/EXCERPT:
"The image this title brings to mind is of a mighty military commander, one who can at a mere word summon rank upon rank of protective power" from https://answers.yahoo.com/ques... & THAT WORD = hosts!
(Accept NO substitutes!)
...apk
The summary is a mess
Then read the effing linked Reuters article. It's pretty clear.
DIY _really_ isn't an option for anti-virus. You can get some protection by having good backups, good host security such as SELinux, and maybe even a host-based IDS similar to Tripwire watching for any changes, but AV (scanning files looking for potentially malicious ones) is a big, big job. Lots of things are DIY, but AV isn't one of them.
I just started work for a company that does something related. We have a full time TEAM of people just entering new threats all day long. Another team maintains the backend of the engine, and another team does the GUI - all full-time. Plus some man-hours to maintain the systems used to find and enter vulnerabilities, source control systems, the test network, WA, etc. With 20-30 full time developers, you can have something roughly as effective as one of the major brands after several years of development effort.
Dice has an ongoing policy of running stories that demonise Iran and Russia, and lionise Israel and Saudi Arabia. Go check Slashdot's history across the last two years if you don't believe me.
The GRAIN of truth here is the tedious fact that many anti-trojan programs throw up false-positives (quite deliberately) when spotting common code-morphing, or too many DLL hooks in a .exe. CLEAN game cracks used to play pirate copies are notorious for being FALSELY flagged as trojan infected code- and you can guess who pays for this state of affairs.
The NSA infamously produced a 'witness' to Saddam's NON-EXISTENT WMD program, and this witness (later fully discredited in even the press Dice wishes you to read) was the justification for Tony Blair's invasion of Iraq. Part of the job of the NSA is to CREATE fake witnessed to claimed malfeasance by target nations and companies. So here we have "BORIS THE CODER" telling us what 'bad boys' Putin's software companies are.
Which of you Betas are so mega-stupid, you'll fall for Dice's crude psy-ops tricks.
"The company denied the allegations, and Kaspersky himself reiterated them,"
WTF? So Kaspersky "reiterated" the allegations? Fucking American idiots.
Kaspersky is one of the only anti-virus you can trust. And the best at detecting malware.
I know for certain, from a McAfee employee, that they collect info in the telemetry for NSA. This is done in the consumer's version of the software, and can be disabled only for corporations.
Can adblock+ do 16 things hosts do for speed, security, & reliability:
1.) Protect vs. malicious sites/servers (past ads)
2.) Protect vs. fastflux botnets + stop C&C communique
3.) Protect vs. dynamic dns botnets + stop C&C communique
4.) Protect vs. DGA botnets + stop C&C communique
5.) Protect vs. downed DNS (adds reliability)
6.) Protect vs. DNS redirect poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam
9.) Protect vs. phish
10.) Protect vs. caps
11.) Get you past a dnsbl
12.) Keep you off dns request logs
13.) Speed up surfing by adblocks & hardcoded fav. sites
14.) Work on anything webbound (ie email programs) multiplatform.
15.) Give you easily controlled data
16.) Do all that & block ads better than addons more efficiently in cpu cycles + memory usage
* ANSWER ="NO" to each above on ab+ doing it + hosts = already on every device natively.
APK
P.S.=> Ab+ does less than hosts & less efficiently - hosts do MORE w/ less + Hosts start w/ the IP stack before REDUNDANT inefficient addons BEGIN to operate (as 1st resolver queried):
Ab+'s 128mb memory inefficiency http://cdn.ghacks.net/wp-conte... (hosts consume 3-11mb using my program initially).
+
ClarityRay defeats it by dumping addons in use in a browser via native browser methods!
+
Ab+'s paid to not do its job http://finance.yahoo.com/news/...
Ab+ adds complexity from a slower mode of operations (usermode = more messagepassing overheads vs. hosts in kernelmode).
What's best?
APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model too https://www.virustotal.com/en/...
... apk
Can PrivacyBadger do 16 things hosts do for speed, security, & reliability:
1.) Protect vs. malicious sites/servers (past ads)
2.) Protect vs. fastflux botnets + stop C&C communique
3.) Protect vs. dynamic dns botnets + stop C&C communique
4.) Protect vs. DGA botnets + stop C&C communique
5.) Protect vs. downed DNS (adds reliability)
6.) Protect vs. DNS redirect poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam
9.) Protect vs. phish
10.) Protect vs. caps
11.) Get you past a dnsbl
12.) Keep you off dns request logs
13.) Speed up surfing by adblocks & hardcoded fav. sites
14.) Work on anything webbound (ie email programs) multiplatform.
15.) Give you easily controlled data
16.) Do all that & block ads better than addons more efficiently in cpu cycles + memory usage
* ANSWER ="NO" to each above on PrivacyBadger doing it + hosts = already on every device natively.
APK
P.S.=> PrivacyBadger does less than hosts & less efficiently - hosts do MORE w/ less + Hosts start w/ the IP stack before REDUNDANT inefficient addons BEGIN to operate (as 1st resolver queried):
PrivacyBadger's Adblock+ codebase 128mb memory inefficiency http://cdn.ghacks.net/wp-conte... (hosts consume 3-11mb using my program initially).
+
ClarityRay defeats it by dumping addons in use in a browser via native browser methods!
+
PrivacyBadger adds complexity from a slower mode of operations (usermode = more messagepassing overheads vs. hosts in kernelmode).
What's best?
APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model too https://www.virustotal.com/en/...
... apk
Can ublock do 16 things hosts do for speed, security, & reliability:
1.) Protect vs. malicious sites (past ads)
2.) Protect vs. fastflux botnets + stop C&C communique
3.) Protect vs. dyndns botnets + stop C&C communique
4.) Protect vs. DGA botnets + stop C&C communique
5.) Protect vs. downed DNS (4 reliability)
6.) Protect vs. redirect poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam
9.) Protect vs. phishing
10.) Protect vs. caps
11.) Get you by dnsbl
12.) Keep you off dns request logs
13.) Speed up surfing by adblocks & hardcoded favs
14.) Work on anything webbound (ie email programs) multiplatform.
15.) Give you easily controlled data
16.) Do those & block ads better than addons more efficiently in cpu + memory use
* ANSWER ="NO" to each on UBlock doing it as well or @ all!
APK
P.S.=> UBlock does less than hosts & less efficiently - hosts do MORE w/ less + Hosts start w/ the IP stack before REDUNDANT inefficient addons BEGIN to operate (as 1st resolver queried):
Ublock's NOT as efficient:
Hosts @ 3mb-11mb w/ current data vs. threats + ads - test yourself using my program.
UBlock uses 63++ MB -> http://www.ghacks.net/2014/06/...
SCREENSHOT -> http://cdn.ghacks.net/wp-conte...
+
ClarityRay defeats it detecting it by dumping addons in use in a browser via native browser methods to do so!
+
UBlock adds complexity/room for breakdown/exploit + from a slower mode of operations (usermode = more messagepassing overheads vs. hosts in kernelmode).
What's better?
APK Hosts File Engine 9.0++ SR-2 32/64-bit -> http://start64.com/index.php?o...
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
... apk
Can ghostery do 16 things hosts do for speed, security, & reliability:
1.) Protect vs. malicious sites (past ads)
2.) Protect vs. fastflux botnets + stop communique to C&C servers
3.) Protect vs. dynamic dns botnets + stop communique to C&C servers
4.) Protect vs. DGA botnets + stop communique to C&C servers
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS redirect poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam
9.) Protect vs. phishing
10.) Protect vs. bandwidth caps
11.) Get you by a dnsbl
12.) Keep you off dns request logs
13.) Speed up surfing by adblocks & hardcoded fav. sites
14.) Work on anything webbound (e.g. stand-alone email programs) multiplatform.
15.) Give you easily controlled data
16.) Block ads more efficiently in cpu + memory use vs. addons
* ANSWER ="NO" to each on Ghostery doing all that let alone as well as hosts do!
APK
P.S.=> Addons do FAR less than hosts do & FAR less efficiently - hosts by way of comparison, do MORE w/ less + Hosts start w/ the IP stack before REDUNDANT inefficient addons BEGIN to operate (as 1st resolver queried):
Ghostery (Advertiser owned) - "Fox guards henhouse" -> http://en.wikipedia.org/wiki/G...
Addons add complexity/room for breakdown/exploit + from a slower mode of operations (usermode = more messagepassing overheads vs. hosts in kernelmode).
ClarityRay DETECTS browser addons like Ghostery & blocks them (not hosts) via native browser methods.
What's better than ghostery by FAR?
APK Hosts File Engine 9.0++ SR-2 32/64-bit -> http://start64.com/index.php?o...
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
... apk
Known KGB company that helped Iran fight attacks against its secret nuclear bomb program. I'm not surprised.
Anti-virus companies could (or have an incentive to) create virus-infected software and release it into the world, and then come up with detection for them faster then their competitors.
Don't recall if it was a joke, speculation, or a vague accusation, much less who made it. (It was years ago.)
So this claim seems more than a little familiar.
There's no time like the present. Well, the past used to be.