Slashdot Mirror

← Back to Stories (view on slashdot.org)

We Live In The Dark Ages of Internet Security, Says Kaspersky Labs CEO

Posted by msmash on from the security-woes dept.

An anonymous reader cites a report on TheMerkle: It is never a positive sign when one of the world's leading security firms mentions how the world is currently in the "Dark Ages" of computer security. That particular statement was made by Kaspersky Labs CEO Eugene Kaspersky during the NCSC One conference in The Hague. Enterprises and consumers need to step up their protection sooner rather than later, as the number of security threats keeps increasing. Update: 04/05 18:41 GMT by M :Reader Rob MacDonald has posted the following insightful comment (slightly edited for clarity and length): We're in the dark ages by design. We've allowed the alphabet agencies to compromise our security, at every level, including hardware. The one that doesn't have an exploit at shipping, gets intercepted and modified in transit. The encryption algorithms we've been using were compromised at such a level it took this long to see it.

83 comments

  1. Only if you force yourself to live in the dark. by Anonymous Coward · · Score: 4, Informative

    That's only true if you force yourself to live in the dark.

    If you don't want to, you can always use OpenBSD. If security is what you care about, then OpenBSD is your best choice. Its developers have proven time and time again that they put security first and foremost, and this has resulted in one of the most trustworthy operating systems to have ever have existed. Best of all, it's free and open source! There's really no reason not to use it, especially if you want and need security.

    The one thing that I think really sets OpenBSD apart from its peers is that the OpenBSD team will go out of their way to secure software they didn't even write. They'll fork, fix, maintain and improve third-party software that doesn't meet their standards. LibreSSL is a superb example of this, but they've done it with other software in the past, too.

    Nobody claims that OpenBSD is perfect, but it's as close as anyone is going to get today. As we become more and more aware of the risks that we face, it becomes clearer that OpenBSD is the operating system that's best poised to stand strong against these threats.

    OpenBSD is where it's at. If you want to live in the dark, then by all means ignore OpenBSD. But if security is what matters to you, then OpenBSD is the light.

    1. Re:Only if you force yourself to live in the dark. by Anonymous Coward · · Score: 2, Insightful

      BULLSHIT

      An operating system is as secure as its administrator makes it. OpenBSD with it's inferior performance due to lack of tuning (stop blaming it on "being more secure" because that's a straight up lie,) lack of a reliable modern filesystem (good grief, port ZFS already...oh wait, you can't because it's almost literally impossible...THANKS THEO,) and a project "leader" who is actually an impossible to work with asshole who thinks he knows everything and knows better than everybody else what his little operating system needs.

      And don't even get me started on how fucking hard it is to install and run even the most common software in that bastardized environment, which was made that way by a bunch of change "for the sake of security" that was in reality change for the sake of change. If you don't know what I'm on about then you've never gone through the experience of trying to set up apache, pgsql, and a CMS of any complexity. The fight to compile is only the first of many battles that don't need to be fought on any other OS.

      So, I repeat. An operating system is as secure as its admins make it, and a competent admin can mitigate the security risks of any OS, even Windows.

    2. Re:Only if you force yourself to live in the dark. by Anonymous Coward · · Score: 0

      LibreSSL is a superb example of this, but they've done it with other software in the past, too.

      LibreSSL was also an example of the OpenBSD developers acting in the most petulant manner possible by putting up a website specifically to make fun of OpenSSL. Doesn't matter what kind of issues OpenSSL had or has, it was an excellent example of their utterly unprofessional attitude. I don't look for secure software from people who think security is something to be made fun of, good or bad.

    3. Re:Only if you force yourself to live in the dark. by Anonymous Coward · · Score: 0

      by putting up a website specifically to make fun of OpenSSL.

      And which web site would that be?

    4. Re:Only if you force yourself to live in the dark. by SoftwareArtist · · Score: 1

      Sure, as long as you only care about the security of devices you personally control, and you can install any software you want on them. For most people, the world is a little broader than that. Practically every week we hear about another website that got hacked, and they were storing user information in plaintext. Or a router that has a hardcoded administrative password. Or a "smart" TV that opens up an unsecured gateway into your home network. Running OpenBSD on your laptop might protect the laptop itself (but probably not once the hackers are into your home network). But tons of other devices and services you interact with every day still have pathetically bad security.

      That's the biggest threat to security right now. It isn't the spy agencies planting back doors in hardware. It's companies that don't even bother to lock the front door.

      --
      "I'm too busy to research this and form an educated opinion, but I do have time to tell everyone my uninformed opinion."
    5. Re:Only if you force yourself to live in the dark. by zixxt · · Score: 1

      OpenBSD and it's security is vastly overrated. FreeBSD and Linux are more Secure than OpenBSD has ever been.

      --
      ---- GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
  2. Before anyone says it.... by phishybongwaters · · Score: 5, Insightful

    Yes, they are Russian. Yes it's a fucking solid, quality, AV solution for enterprise. In fact, there's a shit load of functionality there that most people wouldn't expect from an AV solution. So yeah, when one of the world leaders in the industry says that, he's not talking out of his ass. The point not stated, at least in the summary, is the fact that we're in the dark ages BY DESIGN. We've allowed the alphabet agencies (not google you dolt) to compromise our security, at every level, including hardware. That which doesn't have an exploit at shipping, gets intercepted and modified in transit. The encryption algorithms we've been using were compromised at such a level it took this long to see it. TLS, SSL, sha. all compromised at the core. Jesus we can't even trust random number generators. We can't trust encryption based on primes as it's proven these can be broken if you have the hardware (they do) and the time (they do). Nothing short of a do over can fix this. The infrastructure is compromised, the undersea trunks are tapped, they can even decipher passwords and information from an AIR GAPPED COMPUTER. Seriously. I can't see a way out of this. Encryption for all!!!!! FBI much? Encryption is a joke when they've helped build the encryption system. We hae been pwnd from day 1.

    1. Re: Before anyone says it.... by Anonymous Coward · · Score: 0

      But how would you know it's rock solid? How would you know it didn't have back doors? They write anti virus, they certainly know how to defeat anti virus. I'm not saying Kaspersky is a bad product; I'm just saying you really have no idea whether or not it's trustworthy. Same goes for all anti virus products.

    2. Re: Before anyone says it.... by phishybongwaters · · Score: 1

      Because we run it where I work and have a pretty solid network team. We understand 100% of what it's doing. I'm not suggesting anyone install security center and the av client and just assume it's awesome. We actually know what we're doing, if Kaspersky was able to slip through our monitoring AND Qradar, then I'd buy them a beer. And as such, it doesn't matter if it has back doors, we have it locked down tight.

    3. Re: Before anyone says it.... by Anonymous Coward · · Score: 0

      Sounds like a challenge to me. If you're so confident, you'll tell us where you work.

    4. Re:Before anyone says it.... by Anonymous Coward · · Score: 0

      Bang on.

    5. Re:Before anyone says it.... by fustakrakich · · Score: 1

      Then we just have to turn it around and spy on them and air their dirty laundry. As long as they don't have the advantage, it's all good.

      --
      “He’s not deformed, he’s just drunk!”
    6. Re: Before anyone says it.... by Marginal+Coward · · Score: 1

      Luckily, the IT folks wherever you work are smarter, more knowledgeable, and have more resources than us Kaspersky guys. (BTW, we're headquartered in Moscow...hint, hint...)

      Note to self: don't forget to turn on that Trojan horse on Cybergeddon Day.

      (Note to humor-impaired moderators: it's just a joke. :-)

    7. Re: Before anyone says it.... by cyber-vandal · · Score: 1

      Your user name makes me hear your posts in Groundskeeper Willie's voice.

    8. Re: Before anyone says it.... by swb · · Score: 1

      We understand 100% of what it's doing

      Can you explain why it grinds a machine to a halt when it does a simple definition update? Why I can run the free Malwarebytes on a machine with Kaspersky on it and still find malware?

      IMHO it's an OK product, probably no worse than anything else, but too often I think it tries too hard to be a management product instead of a security product, but doing both sometimes haphazardly.

    9. Re:Before anyone says it.... by 110010001000 · · Score: 1

      Uh bullshit. I wouldn't trust Kapersky Labs with anything. I am astonished anyone actutally runs it in an Enterprise.

    10. Re:Before anyone says it.... by mlts · · Score: 5, Insightful

      I wouldn't say it was alphabet agencies.

      The real culprit, in my experience, is the "security has no ROI" philosophy which has been part of many companies since 2000. When told by a previous manager that "a lock brings no money except to the lock maker", with the implications that security is, at best, an afterthought in product design.

      Now combine that with the fact that so far, there have been no real consequences for security breaches. All a company has to do is tell the Windows admin to do a "dsquery user | dsmod user -mustchpwd yes", pay for the victims to have a year of LifeLock, toss some PR ads, and stock prices will be back to normal in 90 days or less, even for the most egregious breaches. Even regulations have no teeth. HIPAA is rarely used. The only person who went to jail by Sarbanes-Oxley law was someone fishing who went over their bag limit with grouper, and that use of the law got tossed overboard by SCOTUS. The only "regulation" that has any respect whatsoever is PCI-DSS3.x, and that is because Visa will pull merchant status.

      It is common to criticize blaming the victim... but with security being an afterthought at best in many places, it is actually astounding that far more attacks have not happened.

      How can this be fixed? Well, right now, there still isn't any interest or caring for the most part in general. It is going to take an event like GM's OnStar being compromised and disabling all vehicles during a hurricane evacuation, causing astounding casualties, before something actually will get done.

      The ironic thing is that, of all places, security is where the TLAs are actually on the ball. NIST has a lot of security guidelines on their website, from basic stuff like killing the guest user, but there are a lot more useful and esoteric things as well (for example, using trustchk on AIX to keep unauthorized libraries from being loaded.)

    11. Re: Before anyone says it.... by cez · · Score: 1

      MacDonalds, duh

      --
      Walk with Music;
    12. Re:Before anyone says it.... by TheGratefulNet · · Score: 1

      intel yellow books on their processors.

      never heard of them? again, by design. dell, asus and those guys are rumored to have them, in order to truly design motherboards.

      you and I could not design a motherboard that actually WORKS using only public info from intel or amd. you NEED that yellow book. the one that no one has any photos of or can even prove exist.

      yeah, we are fucked down to the logic gate level. no way out, either.

      --

      --
      "It is now safe to switch off your computer."
    13. Re: Before anyone says it.... by Anonymous Coward · · Score: 0

      I would like an explanation of why the header was edited to accommodate McDonald's post, as if his words were a groundbreaking revelation. Is he that important? How come I don't know him?

    14. Re:Before anyone says it.... by Anonymous Coward · · Score: 0

      yeah, we are fucked down to the logic gate level. no way out, either.

      Not if you have plenty of pre-2000 processors, like me. You cluster them and make little badasses machines. Looks like the one who have things *really* 'tight' it's me. Sorry, helpless people.

    15. Re:Before anyone says it.... by Tom · · Score: 2

      with the implications that security is, at best, an afterthought in product design.

      And that, exactly, is the reason everything is going to shit (and has been doing so for 30+ years).

      If you would design security into your product, not afterwards as a fix, but from the very beginning, from the first stroke on the drawing board, the whole thing would be twice as good and five times less expensive and you could integrate it into your normal design and implementation workflows.

      As it is, you pay a shitload of money to people like me so we tell you afterwards where and how much you've fucked up and then you pay a shitload more to your developers to patch it. And usually you do it after some bad press has already hit you in the face.

      on the other side:

      The only person who went to jail by Sarbanes-Oxley law

      yes, but SOX had big corporations scared shitless and if the big consulting companies wouldn't have seen $$$ and turned a simple thing into this monster that brings them a neverending supply of income because you need to hire one of them to implement this impossibly convoluted "standard" to be compliant (where the standard is written by those same guys, and the actual law is so much more easy to comply with - been there, done that) - well, if that consulting money-grab hadn't happened, SOX could have brought so much security into corporations, because for the first time upper management actually was accountable, and if they don't understand security, they do understand accountability.

      --
      Assorted stuff I do sometimes: Lemuria.org
    16. Re: Before anyone says it.... by Anonymous Coward · · Score: 0

      Maybe this Rob MacDonald is a psuedonym for Rob Malda?

    17. Re:Before anyone says it.... by Anonymous Coward · · Score: 0

      It is common to criticize blaming the victim... but with security being an afterthought at best in many places, it is actually astounding that far more attacks have not happened.

      Counterpoint: the locks you buy at the hardware store can be very easily picked, there are even tradespeople who make a living unlocking the locks people lost the keys to. Why isn't everyone's house constantly broken into? Sometimes the facade of security works. Sometimes minimal security works. In combination with other techniques of course, including keeping an eye out and actively disuading attackers.
      Of course, you can just plop a camera and have visual security on a physical property but this doesn't work very well for computers, however, there is such a thing as honeypots.

    18. Re:Before anyone says it.... by Agripa · · Score: 1

      I wouldn't say it was alphabet agencies.

      I would.

      The NSA in cooperation with NIST undermined various internet security protocols like IPSEC to either weaken them or prevent them from being deployed. Neither agency can ever be trusted as far as security related issues again. I now believe they were never trustworthy to start with.

    19. Re: Before anyone says it.... by phishybongwaters · · Score: 1

      It's trivial to monitor and control the NETWORK activities of the application in question, any administrator would not only know this, they would agree. So to be clear, again... Our Kaspersky implementation doesn't do anything on our NETWORK that we aren't aware of and actively allowing. This isn't to say the endpoint protection client isn't doing something nefarious, it could be. It isn't, but sure, it could be. The concern, at least here, is infiltration and data ex-filtration. None of which will be taking place via Kaspersky on our network. Understand now?

    20. Re: Before anyone says it.... by phishybongwaters · · Score: 1

      If you thought you even had a chance of getting in, you'd already have ALL the information you'd need. I'm willing to confirm it, but not reveal it, I think that's a pretty fair deal. But not to an anonymous coward.

    21. Re: Before anyone says it.... by phishybongwaters · · Score: 1

      Fair question, I really don't know. When I noticed that I assumed I'd come over here and see a bunch of mod points on that post, but there aren't. So your guess is as good as mine. It's not the worst edit or summary addition you'll see on /.

    22. Re:Before anyone says it.... by phishybongwaters · · Score: 1

      I don't recall saying I trust them. I trust our ability to monitor and control our network traffic. But again, to each their own, Trend Micro is installed by many idiots. There's always forefront too, but good luck actually maintaining a large base of machines running that.

    23. Re: Before anyone says it.... by Marginal+Coward · · Score: 1

      Note to humor-impaired commenters: it's just a joke. :-)

    24. Re: Before anyone says it.... by Anonymous Coward · · Score: 0

      If the AV is on even 1 laptop on your network, it could easily upload whatever payload it has from an end users home or other off-site location. Your network monitoring wouldn't know. It's really silly to sit and say "my team is awesome and never makes a mistake". That's kind of bravado leads to many of the bigger breaches.

  3. What leading firm? by xxxJonBoyxxx · · Score: 0

    >> one of the world's leading security firms mentions how the world is currently in the "Dark Ages" of computer security

    What leading firm? All I saw here was "Kaspersky." (Ducks.)

    (And of course, they're going to say that. What else would they say: "you guys can pull back a bit on IT security spending - things are getting better?")

  4. And the fault lies with... by Anonymous Coward · · Score: 0

    Google, Microsoft, Mozilla, Apple and Opera.

    Script kiddies gonna script. But it's 2016 and XSS still happens. That's not acceptable. At least Google offers bounties... so they get some slack. The rest though.. come on.

  5. From three directions ... by gstoddart · · Score: 4, Interesting

    We're getting this stuff from three directions:

    1) The manufacturers of products are lazy and incompetent, and carry no liability for that;
    2) Organizations take short cuts from within, and don't realize just how vital security is;
    3) Entities like the FBI want to undermine our security so they can be assured access to our stuff, while stupidly refusing to accept they're causing security to suck even more;

    As long as these things keep happening, we basically live in a world where security is an afterthought, or too complicated, or something to be actively undermined to allow idiots to bypass it.

    And all three of those combine to more or less ensure that having real security is almost impossible. Because no matter what the assholes who want to spy on us say, leaving it open for them also leaves it open for everyone else.

    The people who claim to be protecting are as much fault for this as anybody else. Only they're too stupid to accept that the world doesn't recognize that only the good guys will bypass security when it's been built to have holes in it.

    This is why we can't have nice things.

    --
    Lost at C:>. Found at C.
  6. Yeah, do they remember the past? by JMZero · · Score: 5, Informative

    Does he remember the dance you had to do to install Windows 2000 on an unfiltered connection (if you didn't want it to be instantly owned)? You had to install completely disconnected, disable a bunch of services, and then try to connect and download patches as quickly as you could in order to get to a viable state. And everyone else's Windows computer you used had 9 layers of browser toolbars and adware and anti-anti-anti-adware that made their system effectively unusable?

    I'm sure there's lots of security battles to come - maybe even a World War or two - but the real dark ages of security are in the past.

    --
    Let's not stir that bag of worms...
    1. Re:Yeah, do they remember the past? by phishybongwaters · · Score: 1

      Yes but that's a half assed battle against kids with slingshots. We're in a battle against state sponsored agents, and indeed, governments and intelligence agencies actively circumventing our protections.... to protect us. It's not the same battle, and I'd go as far as to say this one is a hell of a lot worse than what we dealt with back then. But yeah, I recall having to pull some shenanigans to grab all of the updates for offline installation. This was before WSUS existed, or at least I never heard of it.

    2. Re:Yeah, do they remember the past? by JMZero · · Score: 1

      Well, that's the point - there's bigger stakes now, and the actors are more significant using more sophisticated tools.

      It used to be more like the Dark Ages, with nobody really knowing what was going on, and lots of petty squabbles and dangerous streets and what not.

      --
      Let's not stir that bag of worms...
    3. Re:Yeah, do they remember the past? by rtkluttz · · Score: 1

      I see the single biggest threat to security is that decision makers in companies feel they should be able to do whatever the fuck they want and should never have to ask for anything. I work in security. Security is only made difficult by the fact that security people are forced to make security utterly transparent to the "entitled ones". Whitelist based security in layers is exceedingly easy to keep secure. When you configure layered systems so that only truly needed things work and everything else fails by default you protect yourself from almost all known vulnerabilities and even purposeful backdoors in any one layer. But Fuck no, executive level thinks its an attack on their manhood if they have to request something to be whitelisted because it isn't a documented and approved use of a system.

      --
      Digital is, by definition, imperfect. Analog is the way to go.
    4. Re:Yeah, do they remember the past? by JMZero · · Score: 1

      I remember having these conversations with corporate IT departments in the mid 90s. We had services we wanted to run between companies, and we wanted them to open up corresponding firewall rules, so both parties could manage the traffic. They wouldn't. They said, "if we open up holes for everyone who wants one, our firewall will be Swiss cheese [actual quote]". So we made all our services run over the web, and so did everyone else in a similar place. By trying to stay in tight control of security, corporate IT effectively let go of it completely.

      I often wonder what the internet would have been like if all those conversations had gone the other way, if people ran different services on different ports with explicit destinations, and effectively had a whitelist that covered all of their significant business traffic. It seems quaint now, I guess, but it could have shaken out that way.

      --
      Let's not stir that bag of worms...
    5. Re:Yeah, do they remember the past? by rtkluttz · · Score: 1

      Ridiculous. I'm talking even whitelist the sites that people should be going to as part of their work day and nothing else. Not opening 80 and 443 wide open to everything. That is part and parcel of the problem. I am saying whitelist EVERYTHING. Apps, ports, sites, everything. It works. It works for work, but it is not politically sensitive to the executive level because they are too good for that.

      --
      Digital is, by definition, imperfect. Analog is the way to go.
    6. Re:Yeah, do they remember the past? by nuckfuts · · Score: 1

      You had to install completely disconnected, disable a bunch of services, and then try to connect and download patches as quickly as you could...

      Or you could perform the installation from behind a firewall that blocks inbound connections like a sane person.

    7. Re:Yeah, do they remember the past? by JMZero · · Score: 1

      Well sure. Most home users have a hardware firewall by default now, configured by their ISP - it's the norm.

      Many/most home users didn't have any such thing in 1999, and many still wanted to have a Windows PC connected to the Internet. That's why it was the dark ages of Internet security. That's my point.

      --
      Let's not stir that bag of worms...
    8. Re:Yeah, do they remember the past? by Tom · · Score: 1

      He remembers, but he's talking about something else. Not script kiddies attacking you, but government agencies breaking into your system before it even reaches the shop that you'll eventually buy it from.

      That's a little bit of a different threat.

      --
      Assorted stuff I do sometimes: Lemuria.org
    9. Re:Yeah, do they remember the past? by Tom · · Score: 1

      I see the single biggest threat to security is that decision makers in companies feel they should be able to do whatever the fuck they want and should never have to ask for anything.

      Go to a better company, yours is going to go under.

      Good management understands that it needs to lead by example, and if management needs special rules, that is fine as long as they are special rules, i.e. properly documented parts of the official policy.

      --
      Assorted stuff I do sometimes: Lemuria.org
    10. Re:Yeah, do they remember the past? by Tom · · Score: 2

      Well, that's the point - there's bigger stakes now, and the actors are more significant using more sophisticated tools.

      No, you missed the entire point.

      When we were up against script kiddies, we would start with a system in a secured and defined state. Our task as security people was to keep it in that state.

      Now that we're up against our own governments fucking us over, the system you freshly unpacked from its box is already compromised. You don't know how and by whom (plural, you also don't know how many), and you need to bring it into a secured and defined state that you do not know how to verify because you don't have a defined clear baseline.

      That's a different game.

      --
      Assorted stuff I do sometimes: Lemuria.org
    11. Re:Yeah, do they remember the past? by Anonymous Coward · · Score: 0

      Funny you should mention that. I was just thinking about it the other day, learning the hard way trying to install and update a Win2k box in mid 2004 for a friend (well, not really a friend...I was just in her life because I wanted to fuck her daughters, but that's a story for another time) and things went bad after literally 10 minutes. I wound up having to take it home, image the drive and extract the files I wanted to keep, reformat and reinstall from behind a firewall. It turned an afternoon thing into a three day thing.

      Yeah, things are so very different now from back then. It's a new set of threats we face, but things (at least PCs) are so much more hardened by default now, because they need to be.

    12. Re:Yeah, do they remember the past? by Anonymous Coward · · Score: 0

      thats why I used windowsME, no one would ever wanna 'instantly own' it!

    13. Re:Yeah, do they remember the past? by JMZero · · Score: 1

      Yes there's scary stuff, but "The Dark Ages" is a terrible, terrible metaphor to express the current state of affairs. Dark Ages doesn't imply "lots of things look nice and peaceful on the surface, but there are threats from sophisticated players that is likely soon to result in serious large scale conflict".

      The Dark Ages implies that there isn't a bunch of big established powers, there's lots of disorganization, nobody has any idea what's going on, few people are recording a detailed state of affairs, and someone is going to shiv you to take your bread and deface your Geocities page. Like the Internet was =2000, not so much 2016.

      --
      Let's not stir that bag of worms...
    14. Re:Yeah, do they remember the past? by JMZero · · Score: 1

      Yeah, but it's more like 1984 than the bloody Dark Ages. I'm not saying things were worse then, I'm saying they were more like the Dark Ages. This is really, really a simple point.

      --
      Let's not stir that bag of worms...
  7. Dark ages indeed... by Anonymous Coward · · Score: 0

    So we are living in the dark ages, but it feels like we're trusting our 'security' to a bunch of mercenaries where the highest bidder gets to take your money and walk away when newer threats usurp their protection abilities.

    It's a vicious cycle, and there are no shortage of participants willing to take your money to 'protect' you.

    1. Re:Dark ages indeed... by phishybongwaters · · Score: 1

      Kaspersky is actually a world leader here. Many of the CVEs and fixes you've read about, you can thank Kaspersky Labs for that. Trust no one, that's the only advice that matters

  8. Nothing Kapersky States Should Be Trusted by BrendaEM · · Score: 0

    Wasn't it Kapersky who stated something to the effect that people don't need privacy?

    --
    https://www.youtube.com/c/BrendaEM
  9. You just did, no. by Anonymous Coward · · Score: 0

    There is also the minor point that Eugene "internet passport" Kaspersky is just as much a supplier of imperial clothing as the rest of the industry. Nice of him to say this now but he's made a fortune being part of the problem, so no, he might not be talking out of his ass, I don't trust him either. He doesn't deserve my trust, or anyone else's.

  10. more like the dark ages of refusal to learn. by Anonymous Coward · · Score: 2, Interesting

    I've had a PC on the internet since the early-mid 1990's, and so far have had precisely zero security problems with this.

    But then, I don't do a bunch of stupid shit, either. I don't let random web sites run javascript. I don't run "HotBabe.jpg.exe". In fact, I've never even run Windows on an internet connected computer, due to the security clusterfuck of that ecosystem. If I ever want to do something that could potentially be risky, I'll use a VM jail. And to more modern issues, I won't let IoT devices have the run of my internal network.

    Net result? Zero security issues, zero loss of data, zero malware, zero ransomware. The people I see with weekly or monthly malware infestations are the ones absolutely refusing to learn. Even after the 20th time they do Stupid Thing X and get infected yet again, that doesn't seem to stop them from doing the very same thing again next week. Yet they act bewildered about what could have happened.

    I'm not the only person I know who has had zero problems with internet security. Far from it. If you have one population that has constant problems, and another that has none, maybe just maybe the population having all the problems should ask themselves, "What are we doing wrong, that those other guys are not? Why are we having so many problems, and those guys are not having any problems at all? What should we be learning?"

    Have there been real security flaws? Sure... but that's like 0.001% of the problem. The vast majority of the problem is people's own behavior.

    1. Re:more like the dark ages of refusal to learn. by jenningsthecat · · Score: 2

      I've had a PC on the internet since the early-mid 1990's, and so far have had precisely zero security problems with this... But then, I don't do a bunch of stupid shit, either.

      Sure. But do you have credit cards and/or bank accounts? Medical records? Employment records? A social security number? It's great that your own personal hardware and software are housed in a citadel of common sense and best practices bolstered by specialized knowledge probably not attainable by Joe and Jane Average; but what about your personal data, out there in the hands of people who don't know and/or don't care about security?

      The people I see with weekly or monthly malware infestations are the ones absolutely refusing to learn. Even after the 20th time they do Stupid Thing X and get infected yet again, that doesn't seem to stop them from doing the very same thing again next week. Yet they act bewildered about what could have happened.

      Too true. And in the physical world we have pressure, and sometimes laws, to get vaccinated against communicable diseases. We also enforce driver education and licensing. So as distasteful and problematic as I find the concept, maybe we need to seriously look at the suggestion made by some pariahs that we require testing and licensure before using the web. Then again, how can we effectively police it? 'Cause at that point we're back to square one, security-wise.

      If you have one population that has constant problems, and another that has none, maybe just maybe the population having all the problems should ask themselves, "What are we doing wrong, that those other guys are not? Why are we having so many problems, and those guys are not having any problems at all? What should we be learning?"

      The 'population with problems' should wise up, but most of them probably won't, ever. In the absence of their enlightened and disciplined involvement, how do you suggest we proceed?

      --
      'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
    2. Re:more like the dark ages of refusal to learn. by nuckfuts · · Score: 1

      I don't do a bunch of stupid shit, either. I don't let random web sites run javascript. I don't run "HotBabe.jpg.exe". In fact, I've never even run Windows on an internet connected computer...

      When you're done patting yourself on the back, take a moment to consider that none of the things you mention address the issues of backdoors in hardware or weaknesses in prevalent encryption protocols.

      have had precisely zero security problems...

      That you're aware of.

  11. Living in the dark by fustakrakich · · Score: 2

    And Kaspersky's use of an adware site (softonic.com) to download their software is not helping any.

    --
    “He’s not deformed, he’s just drunk!”
  12. The dark ages of Internet security? by khz6955 · · Score: 1

    There's nothing defective about Internet security, it does exactly what it was designed to do, that is connect computers using an ubiquitous networking protocol. The problem lies with the defective computers that are at either end of the connection.

  13. Need to solve one of two problems by Anonymous Coward · · Score: 0

    Technology is to hard for a small group. Trust is to difficult for large groups.

    1. Re:Need to solve one of two problems by Locke2005 · · Score: 1

      Correct word choice is too hard for Anonymous Cowards...

      --
      I've abandoned my search for truth; now I'm just looking for some useful delusions.
  14. We live in the internet dark ages... by Anonymous Coward · · Score: 0

    And the Russian and Chinese are the Visigoths.

  15. Re: Only if you force yourself to live in the dark by cfalcon · · Score: 3, Funny

    > OpenBSD cost me everything with its lackluster security.

    Even your slashdot login! The humanity!

  16. We sure do ... by farble1670 · · Score: 1

    http://www.bbc.com/news/techno...

  17. alphabet agencies, huh? by Anonymous Coward · · Score: 0

    Does the FSB count as an "alphabet agency"? Because they're the ones who run Kaspersky.

  18. Also the invisible hand... by Ungrounded+Lightning · · Score: 2

    The manufacturers of products are lazy and incompetent, and carry no liability for that;

    It's worse than that.

    The manufacturers are in a race to get new products and features to market. First through the window collects the customer base and market share. First three or so through the window slam it and everyone behind them crashes and burns. (For a startup that's IT. Go find more money and do another one - and have the same pathology.)

    So doing things securely (which is hard and time consuming) means you miss the window. Thus only insecure stuff makes it to market. Maybe they fix it later, once they're established. Usually not, though. That's when you get the big breaches when somebody finds the holes.

    The invisible hand has slapped down the players who tried to do it "right" - and thus did it too late.

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
    1. Re:Also the invisible hand... by Tom · · Score: 1

      So doing things securely (which is hard and time consuming) means you miss the window.

      Only because you're doing it wrong. Security is like plumbing: Easy to do when you think about it from the start, a shitty mess if you need to add it in later when you've already moved in and only then realize you forgot something important.

      Maybe they fix it later, once they're established.

      At which stage it will cost 5 times as much and be half as good as if they had thought about it from the start. I'm not complaining, it's why I earn good money. But sometimes you go home shaking your head and saying "really?" to yourself for an hour or so.

      --
      Assorted stuff I do sometimes: Lemuria.org
  19. not surprising by jbmartin6 · · Score: 1

    "It is never a positive sign when one of the world's leading security firms mentions how the world is currently in the "Dark Ages" of computer security. " Well what to do you expect a security firm to say? "There is no need for our products."?

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    1. Re:not surprising by Tom · · Score: 2

      I expected about that, but it turns out the guy said something smarter then I had thought.

      Yes, the problem very much is that when you buy a device today, you don't know anymore who has backdoors to it already, before it's even in your hands.

      That is a very real and very serious problem, and it makes pretty much everything you do afterwards, including buying his products, completely pointless.

      --
      Assorted stuff I do sometimes: Lemuria.org
    2. Re:not surprising by jbmartin6 · · Score: 1

      "it makes pretty much everything you do afterwards, including buying his products, completely pointless" LOL well said!

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
  20. kaspersky by Anonymous Coward · · Score: 0

    Kaspersky lives there for sure

  21. He doesn't even know what he's saying by JohnStock · · Score: 1

    The Dark Ages had nothing to do with ignorance, naivety or any other way he's using the phrase. It's called the Dark Ages because it's dark, ie, we have very little recorded information about that period in history.

    1. Re:He doesn't even know what he's saying by Anonymous Coward · · Score: 0

      It's called the Dark Ages because it's dark, ie, we have very little recorded information about that period in history.

      Because they were ignorant, naive, superstitious?

    2. Re:He doesn't even know what he's saying by gweihir · · Score: 1

      Fascinatingly stupid and insightless comment. We do actually have a lot of recorded information from that time, and it basically says all the same: Suppression of most science and advancement of society by the church. This makes mots of the recorded information (recorded by the church) tedious and exceptionally boring, but it is there. It is just that nothing much did happen.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  22. Re:Something old helps a lot today, for less & by Anonymous Coward · · Score: 0

    That won't help. Here's what will help: ubuntu.com, linuxmint.com.

  23. Re:Something old helps a lot today, for less & by Anonymous Coward · · Score: 0

    Hosts originate on NIX. Using his exported hosts data from windows works there too on a simple principle: what you can't touch can't harm you using hosts.

  24. Re:Something old helps a lot today, for less & by Thor+Ablestar · · Score: 1

    https://www.eff.org/deeplinks/...

    I'd better download a minimal flash installation of FreeBSD and build the rest from source. It does not save me from the source-level malware but at least make it much less probable.

  25. "You gotta buy more meat" by Anonymous Coward · · Score: 0

    says the butcher. A-hah.

    Now we could do more for our security, definitely. But we can't buy it, not from Kaspersky and not from elsewhere. We gotta learn it.

    Still, most PHBs will go buy some security and then go to sleep. I'm just hoping that each and everyone of those has to face the consequences.

  26. An age is called Dark... by Anonymous Coward · · Score: 0

    An age is called Dark not because the light fails to shine,
    but because people refuse to see it.
            -- James Michener, "Space"

  27. Irony is. . . . by Salgak1 · · Score: 1

    . . . . a RUSSIAN firm complaining about computers being pwned by "Alphabet Agencies". . .

  28. No OS can workaround x86 backdoors by dolmen.fr · · Score: 1

    OpenBSD (or any other OS) can't workaround backdoors in Intel/AMD hardware or firmwware.
    http://mail.fsfeurope.org/pipe...

  29. Something old helps today for less & free by Anonymous Coward · · Score: 0

    APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...

    Less power/cpu/ram+ IO use vs. local DNS servers + addons w/ less security issues vs. DNS + routers. Less complex vs firewalls (needing layered filtering drivers - hosts don't + firewalls block less used IP addresses, hosts block more used host-domain names) complimenting 'em. Antivirus = reactive. Hosts = FAR more proactive, blocking infection BEFORE you get it. Gets its data from 10 reputable security community sites.

    * My program protects hosts vs. corruption in usermode (effectively 'locks' hosts vs. writes) & kernelmode threats (via updates).

    APK

    P.S. - Hosts get you more speed (hardcodes + adblocks) & faster vs. addons, security (vs. bad sites/dns security issues), reliability (vs. downed/poisoned dns), & anonymity (dns requestlogs/trackers) vs. other "so-called -solutions'" w/ what you natively have. Unlike Adblock/UBlock/Ghostery, hosts != blockable by ClarityRay/BlockIQ... apk