Slashdot Mirror
Former Employees Accuse Kaspersky Lab of Faking Malware
An anonymous reader writes: Reuters reports that two former employees of Moscow-based Kaspersky Lab faked malware to damage the reputations of their rivals. The alleged campaign targeted Microsoft, AVG, Avast, and others, tricking them into classifying harmless files as viruses. The ex-employees said co-founder Eugene Kaspersky ordered some of the attacks as retaliation for emulating his software. The company denied the allegations, and Kaspersky himself reiterated them, adding, "Such actions are unethical, dishonest and their legality is at least questionable." The targeted companies had previously said somebody tried to induce false positives in their software, but they declined to comment on the new allegations. "In one technique, Kaspersky's engineers would take an important piece of software commonly found in PCs and inject bad code into it so that the file looked like it was infected, the ex-employees said. They would send the doctored file anonymously to VirusTotal." The alleged attacks went on for more than 10 years, peaking between 2009 and 2013.
http://tot-ltd.org/techinf.htm...
Project I've been working on for the past 15 years. Take it or leave it.
There don't seem to be very many good free alternatives other than microsoft's default package. I've wondered if it's possible for me to make my own security system, but I've never given it a good amount of thought.
If classification is the name of the game, couldn't you use some machine learning techniques based on what malware does and write your own classifier?
If I remember right Thunderbyte Antivirus did something much like that. At some point Thunderbyte was bought-out and I honestly have no idea what happened after that.
In my opinion, the best approach for malware that is pulled-in by the user is to restrict what the user can do to the computer. Yes, that means annoying issues installing software such that a privileged account has to be logged into, but it also means that if the user makes serious mistakes the solution is to back up their non-executable data, delete their account and its files, and recreate and restore the data.
On all of my Windows boxes I set up the user to have only minimal permissions. I reserve administrative functions for an admin account.
Do not look into laser with remaining eye.
It would not surprise me if *ALL* so-called antivirus software companies did this, with very few exceptions.
If you want news from today, you have to come back tomorrow.
There don't seem to be very many good free alternatives other than microsoft's default package.
at risk of stating the obvious ... er ... linux? :)
I've wondered if it's possible for me to make my own security system, but I've never given it a good amount of thought.
it's possible. it's also hard. start giving it some good amount of thought and stop making yourself a target by using the 'default package'. it will be easier from there ...
>> chief task was to reverse-engineer competitors' virus detection software to figure out how to fool them into flagging good files as malicious
Why is this a bad thing? This is pretty much what a large chunk of the "grey hatter" world does on a regular basis (figure out how to trick AV). Shouldn't we be cheering on a little AV-on-AV competition instead of letting them all group-think themselves into a pool of mediocre results?
(This is also why running different AV engines in your network has generally been a good defense-in-depth measure in the past...I don't WANT them all to agree.)
If you could only install one you'd be better off installing an ad blocker than an anti-virus product.
People telling you different are trying to sell you something :)
Thanks ill give it a try next time I run across an infected system.
Minimum threshold fixed. Thanks!
... with how rotten companies are these days you can never tell if its a genuine issue or some other competitor running a smear campaign.
Either way there's no perfect AV software and as always the arms race will continue.
In regards to Thunderbyte, they were acquired by Norman ASA (www.norman.com). In 2014, Norman ASA was acquired by AVG.
Second reality (no, not the one from Future Crew):
"Wow Kaspersky are fucking assholes, I'm not going to use their software anymore."
You are missing the point, and it was even in the article.
Those false positives occasionally led to vital Windows components being quarantined, I remember a reboot loop caused this way.
Mielipiteet omiani - Opinions personal, facts suspect.
If they really wanted to point it out, they would have made a link to Google Maps.
There don't seem to be very many good free alternatives other than microsoft's default package.
Signature-based anit-malware solutions require an industrial-scale operation to identify new threats and add them to the signatures. That's very costly: Those workers have to eat, so they have to be paid somehow.
Since Microsoft is pretty much the only company with a revenue stream that is substantially improved by protecting Microsoft systems generally, it is similarly pretty much the only operation that can profit by spending such industrial-scale money deploying new defences "for free".
But there are still a few who find ways to make it possible. One of the best after-infection malware-removal tools out there is Malwarebytes. They distribute a stripped-down, manually-operated, nagware version of their product for free, in the hopes that you'll subscribe to the full-function version (to get additional functionality, including automated scheduled execution, and/or spare your attention from constantly closing their popups that covered your working window. B-) )
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
A hacker can really screw with someone without elevating to admin. All the juicy stuff is in the user accounts anyway. In a few seconds they can get your financial information, passwords, email contacts, the screenplay you're working on, any photos of an adult nature that happen to be there...
In contrast, the admin account is quite dull. You already know what's on that. I get the point that once you get admin you can install your badware and stick around for a while, but once you've got all the really good stuff is in the user accounts why bother.
"Such actions are unethical, dishonest and their legality is at least questionable."
Remember Enron? Yeah, what they did was somewhat unethical as well. Remember the subprime crisis? Plenty of ethically shady bankers in that as well. Stop pretending you care at all, because you don't. You only have to appear like you didn't know for PR reasons.
... where you analyze the executable and then based off that determine if it's malicious or not.
That's provably impossible. It's trivial to convert it to the halting problem.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Antivirus software demands permission to run as root so it can properly quarantine and delete infected files that are modified or added by malicious software running as administrator (which gets that right by either manipulating the users, or a privilege escalation script). At this level of permission, no OS has OS/app separation.
Why not? Microsoft is noted as the "Redmond, Washington-based company." When legality is in question, it's critical to know where the companies are based. What is legal in Russia is very different than what's legal in the U.S., or even Washington state.
Some obscure group of dudes that call themselves "Temple of Transgression" and develop an antivirus (ok, ok, only the frontend) in VB6 are fighting hard for not being taken seriously.
And no, I didn't know "VTE Virus Scanner".
Open Source Network Inventory for the masses! Kuwaiba
And if you actually read further, you'll notice a few URLs listed.
http://tot-ltd.org/blacklist/
http://tot-ltd.org/whitelist/
http://tot-ltd.org/files-wl/
http://tot-ltd.org/installatio...
http://tot-ltd.org/ports
http://tot-ltd.org/API
http://tot-ltd.org/packer.db
No, leave that to Terry Davis. Besides, any sane person knows that next to L Ron Hubbard and HP Lovecraft, King James was the greatest fiction writer of all time.
The summary is a mess
Then read the effing linked Reuters article. It's pretty clear.
DIY _really_ isn't an option for anti-virus. You can get some protection by having good backups, good host security such as SELinux, and maybe even a host-based IDS similar to Tripwire watching for any changes, but AV (scanning files looking for potentially malicious ones) is a big, big job. Lots of things are DIY, but AV isn't one of them.
I just started work for a company that does something related. We have a full time TEAM of people just entering new threats all day long. Another team maintains the backend of the engine, and another team does the GUI - all full-time. Plus some man-hours to maintain the systems used to find and enter vulnerabilities, source control systems, the test network, WA, etc. With 20-30 full time developers, you can have something roughly as effective as one of the major brands after several years of development effort.
Microsoft Security Essentials / Windows Defender has been falling behind for years now. It used to be pretty good. But now, it unfortunately doesn't catch a lot newer malware. Microsoft dropped the ball and stopped putting the proper R&D into their product.
Bitdefender Free is my new favorite these days:
http://www.bitdefender.com/sol...
Fast, effective, and low impact. Bitdefender Free is not free for commercial use, however. And they don't have a free version that support Windows 10 yet. Bitdefender scores at or near the top in most AV comparison tests for malware detection.
Best free commercial AV is Avast for Business:
https://www.avast.com/avast-fo...
Not quite as low-impact as Bitdefender, and not quite as effective, but it's OK. I've used Avast for years as well. (It used to be my standard free AV, and I still use it on some systems.) Their free business AV is basically their paid AV business product stripped down to just AV, not firewalls, and anti-spam, and other cruft. The Windows firewall is just fine these days, and is you have a decent mail server spam isn't a problem. (And there are other decent free anti-spam products, like Cloudmark Desktop One.) So a plain-old just-AV product is fine with me. Includes a cloud-based console system as well, so you can centrally keep track of your AV clients -- which is GREAT for a free product.
Good luck!
"What versions of Windows will TT Livescan run under? Windows 98 through Windows 10."
I don't see anyone clamoring to pay my bills either, so I'm not really inclined to care what I use beyond notepad.
Kaspersky is one of the only anti-virus you can trust. And the best at detecting malware.
I know for certain, from a McAfee employee, that they collect info in the telemetry for NSA. This is done in the consumer's version of the software, and can be disabled only for corporations.
Anti-virus companies could (or have an incentive to) create virus-infected software and release it into the world, and then come up with detection for them faster then their competitors.
Don't recall if it was a joke, speculation, or a vague accusation, much less who made it. (It was years ago.)
So this claim seems more than a little familiar.
There's no time like the present. Well, the past used to be.
I've been using MalwareBytes (as suggested above) then installing Comodo Internet Security http://comodo.com/ (free for personal use) if needed, and finally CCleaner from Piriform http://piriform.com/ to rescue peoples PCs after disaster has struck.
I'm thinking of making it a standard "pack" of software for anyone who asks at the Library where I volunteer.
Don't blame me, it's usually 2 in the morning when I post