Slashdot Mirror
FBI Warns US Private Sector To Cut Ties With Kaspersky (cyberscoop.com)
An anonymous reader quotes CyberScoop:
The FBI has been briefing private sector companies on intelligence claiming to show that the Moscow-based cybersecurity company Kaspersky Lab is an unacceptable threat to national security, current and former senior U.S. officials familiar with the matter tell CyberScoop... The FBI's goal is to have U.S. firms push Kaspersky out of their systems as soon as possible or refrain from using them in new products or other efforts, the current and former officials say.
The FBI's counterintelligence section has been giving briefings since beginning of the year on a priority basis, prioritizing companies in the energy sector and those that use industrial control (ICS) and Supervisory Control and Data Acquisition (SCADA) systems. In light of successive cyberattacks against the electric grid in Ukraine, the FBI has focused on this sector due to the critical infrastructure designation assigned to it by the Department of Homeland Security... The U.S. government's actions come as Russia is engaged in its own push to stamp American tech giants like Microsoft out of that country's systems.
Meanwhile Bloomberg Businessweek claims to have seen emails which "show that Kaspersky Lab has maintained a much closer working relationship with Russia's main intelligence agency, the FSB, than it has publicly admitted" -- and that Kaspersky Lab "confirmed the emails are authentic."
Kaspersky Lab told ZDNet they have not confirmed the emails' authenticity. A representative for Kaspersky Lab says that the company does not have "inappropriate" ties with any government, adding that "the company does regularly work with governments and law enforcement agencies around the world with the sole purpose of fighting cybercrime."
The FBI's counterintelligence section has been giving briefings since beginning of the year on a priority basis, prioritizing companies in the energy sector and those that use industrial control (ICS) and Supervisory Control and Data Acquisition (SCADA) systems. In light of successive cyberattacks against the electric grid in Ukraine, the FBI has focused on this sector due to the critical infrastructure designation assigned to it by the Department of Homeland Security... The U.S. government's actions come as Russia is engaged in its own push to stamp American tech giants like Microsoft out of that country's systems.
Meanwhile Bloomberg Businessweek claims to have seen emails which "show that Kaspersky Lab has maintained a much closer working relationship with Russia's main intelligence agency, the FSB, than it has publicly admitted" -- and that Kaspersky Lab "confirmed the emails are authentic."
Kaspersky Lab told ZDNet they have not confirmed the emails' authenticity. A representative for Kaspersky Lab says that the company does not have "inappropriate" ties with any government, adding that "the company does regularly work with governments and law enforcement agencies around the world with the sole purpose of fighting cybercrime."
For months trying to destroy this company in an attempt to validate their bogus claims of russian hacking.
Given that the FBI has repeatedly made it plain that they want unrestricted and owner-involuntary access to every piece of hardware on this planet, I'd take any cybersecurity recommendation they make with a grain of salt the size of the Benjamin Franklin.
Cut all ties with Microsoft and you won't even need ties to Kaspersky Lab. We should all cut ties with Microsoft.
Anons need not reply. Questions end with a question mark.
I wonder if Russia can fight that at World Trade Organization's dispute settlement body? This is a flavor of protectionism US vowed to end when signing WTO treaties, after all.
Symantec and the like have outright admitted cooperation with US spooks. At this point, if I were in charge of security I would be buying all computer hardware from outside sources like Huawei and Kaspersky, at least they've indicated unwillingness to cooperate with US stooges and Chinese/Russians infiltration would both be easy to detect and any positive evidence would seriously damage their reputation. Symantec and Microsoft have plainly given NSA and even BSA access to their information.
Custom electronics and digital signage for your business: www.evcircuits.com
Government is telling you which software to use. You wouldn't want people to think you were a terrorist, would you?
Seven puppies were harmed during the making of this post.
Maybe the question to ask Kaspersky is what exactly would an inappropriate relationship with the FSB look like according to them? It seems like there is some pretty damning evidence that a bad actor state (Russia) has been working closely with Kaspersky in a way that violates the expectation of most of the free world. If Kaspersky is serious about clearing it's name, it should clearly define and limit it's relationship with the FSB and the Russian government. Unfortunately for Kaspersky, being based in Russia, a country without a constitution or bill of rights limits what they can actually back up with action, unless they shift the bulk of their organization out of Russia, and I don't see that happening.
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
Considering Kaspersky has been distressed enough about this negative publicity to directly offer both the FBI and CIA access to it's source code and these offers have been rebuffed, I'm not exactly sold on anything the FBI has to say here as being anything more than a stunt
... sever ties with the NSA.
It little behooves the best of us to comment on the rest of us.
>Your ignorance indicates that you're probably a russian shill.
You are probably right. Just checked his comments, says very often something like "we (USA)" as he is speaking in the name of an US Citizen (Who the f*ck will non stop remember where he is form). And soon after takes position in favor of China, Russia, Iran, ... Anybody but US. Some other technical comments to hide, but very clear on the political side...
Well between Microsoft, Apple and now Kaspersky seems there are little trust with Proprietary Software with vendors outside of the country of origin. And who knows what is embedded in modern cell phones.
Maybe this will finally convince people and businesses to move to Free Software. And more importantly, convince companies like Nvidia to release source of their drivers and firmware. one can always hope :)
And meanwhile, someone weaponized a couple exploits developed by the NSA, and, lo and behold, Wannacry is born...
Coño, no te jode?!
I live in Venezuela. If I have to get spied, I will better be spied by the most efficent and cost effective solution. If Kaspersky's products cathes the most Virii (NSA developed ones included), then that's the solution I'll use...
And, as an aside (or full disclosure, as you preffer), I worked for Huawei a long time ago, and I do freelance technical training for them from time to time, and yes, a long while ago (late 2000's) there was a case of some big honking telco routers phoning home to china. That was quickly rectified. From then on, no more (that I know off).
But guess what? So it happens with other provider's gear...
Again. If is not the Chinese, is the FSB (russia), or the NSA (USoA), or the MI6 (England), or the five eyes (USoA, England, Australia, New Zealand, Canada), or apple, or AWS, or Microsoft, or Google, or Opera [remember, Opera mini is a MITM browser, developed by sweedes, owned nowadays by the chinese], but someone is always able to spy on you. So, do not be moronic about it, and get the gear which is most efficient (and cost/effcient) for the task at hand.
The FBI and NSA are just pissed that is not THEIR backdors in the SW, but the FSB backdoors instead...
JM2C YMMV
*** Suerte a todos y Feliz dia!
Symantec and the like have outright admitted cooperation with US spooks.
In other news, protectionism is all the rage in any nation's trade policy. It's much more sensible to appease your home government than a foreign one. General Motors and Ford are implying Toyota exhibits greater fealty to the Japanese government than to the wishes of their American counterpart.
Crazy how much power we still afford imaginary lines on the earth.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
So they've finally started giving the same advice I started giving my clients over a month ago. Boy, these guys are just Johnny-on-the-spot, aren't they?
:::The Spear in the heart of the Other is the Spear in the heart of You; You are He - Surak of Vulcan:::
... public sector and the goddam government sector?
When the shit hit the fan, I'd download Kasperky's stuff just long enough to haul an infected computer out of the ditch because it was some good shit.
It little behooves the best of us to comment on the rest of us.
about ClamAV (Cisco), McAfee (or whatever it is called now.), Symantec (Garbage since the Norton buy and ruination.), and Defender (Microsoft, who according to the EULA for Windows, nevermind Defender, can scan all your files and report believed infringing files to whoever they want as well as remotely access any of your files for any reason including Law Enforcement usage.)
Given all of these, and Kaspersky's overall good (but definitely not perfect) reputation as an AV company dating back 15+ years, they seem far more trustworthy than 90 percent of the field. And given that most of that 90 percent of the field is intentionally or unwillingly stooges of the US Intelligence apparatus, I would say trusting Kaspersky, as long as you have a backup a/v application/network monitoring tool, is probably far safer than most of the alternatives you can currently get free or paid for.
As stated by pp and others: the FBI/NSA/CIA have all shown a lazy interest in compromising both domestic and foreign information security for their own purposes, while doing nothing to ensure even domestic services are sufficiently hardened to keep out foreign or domestic adversaries, of which there are thousands dedicated and with resources, and millions of 'fleas' who just need that one 'big score' to move up to the big leagues. Giving them those opportunities by compromising system integrity at the hardware, firmware, and os level is a crime against humanity. But it won't be until the digital equivalent of 9/11 happens that we will see even a half assed attempt to secure those backdoors, and no doubt it will only resort in less convenience to the owner of the device, while the hackers will still have the same level of fettered access that they did in the past.
It probably has more to do with AV definitions and white-listing than a willingness to hand over code. Not only does the US government probably feel Kaspersky could whitelist Russian malware/heuristics, they also can't strong arm a Russian company to white-list their own.
I guess this one really works!!
"Your ignorance indicates that you're probably a russian shill." His point is still more valid than your attempt at making this ad hominem. How does one become a "shill"? Does it pay well? I would like to know because he does have a valid point even if he is ignorant of the structure of government bodies and if I could get paid for telling the truth I would be happy to do it.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
FBI does not give a fuck about external affairs. You are full of crap.
The FBI most certainly does "give a fuck about external affairs". They interact extensively with law enforcement in other nations. Sometimes that law enforcement is the nation's Military. Or some other agency that blurs the lines between espionage and crime.
When it comes to US Citizens, there is a line drawn between the FBI and agencies like the CIA. But that line doesn't exist when it comes to other foreign nationals.
If we want to return to secure for the user.....
computing, the only option at this point is fabbing new chips with end user configurable management engines, with no built in manufacturer keys, and electron microscope verification of the final fabbed chips to ensure that remains so.
I'm not sure either country has the willingness or ability to, but Venezuela+Cuba would be the perfect pair of countries to start a computing rebellion, assuming they could buy all the necessary fab gear and get a unit spun up.
If they could and were willing to work at fully verifiable consumer grade processors, even if they ~2009 era performance, I know I for one would buy them.
Ousting dangerous tech from our CPUs, our Motherboards, and our GPUs are the first steps towards taking back our systems. Without this, we are on a slow decline into the sort of dystopian nightmares that sci-fi writens have been pushing for years.
I think the problem with this specific approach is that Cuba and Venezuela are knee-deep with the Chinese. Everything from cellular tech to routers to buses to new cars to oil and gas rigs are China-sourced in Cuba in particular. I suspect that the US's realization that it may already be too late to displace China's influence in these two nations might be behind efforts to normalize relations with Cuba, while there is still a chance of US influence.
Again, since Washington apparently need demons to distract us from the other ones we already know about, lets choose the ones who could possibly have been our allies instead. Microcosm for the entire US-Russian relationship. Fucked up.
Speak for yourself.
all the time is, if and when you really are telling the truth, you can't get anyone to believe you.
It is a simple lesson the US Government has failed to grasp.
I don't trust my own government any more or less than a foreign one at this point.
As a result, I've simply tuned it all out.
By comparison, so is a bottle of water in an airport, so that claim doesn't actually carry much weight anymore.
...to be able to block WannaCry from the beginning (aka: crying wolf.) Of course without Kaspersky, NSA, CI, FBI, DHS, TSI will have much easier job to brutally violate your digital devices.
The part that really tweaks me is that a Russian company that has the capacity of Kaspersky was actually on GSA Schedule. In case you are wondering that means they were permitted and preferred for US government contracts! I'm sure you can figure out where those back doors could lead! https://www.govconwire.com/201... Not surprisingly, many commercial businesses look to the government to lead in their selection in security vendors. You know, the reasoning that if the US government trusts them they must be okay. It is truly baffling how this can happen.
That's completely idiotic. The CIA is one of many foreign intelligence agencies, and the FBI is the primary generic federal law enforcement agency. They don't divide any duties at all between foreign/domestic. The FBI is the agency that investigates violations of US law all around the world. If you hack a bank in New York from Germany, it is the FBI that is coming for you. They really don't care about where you are, they have access to travel. It has to do with if the job is a law enforcement job, or not.
Get some fucking internet and you can learn shit.
Gordguide is right.
And also, the sorry state of science missmanagement (please understand that is a management problem, the scientists are fine) will impede any directed long time efforts into this. I could tell you stories abut the Nanotechnology lab in my alma mater (hint - Non Existent). The guy behind the effort worked for me at one time (before we went to his masters degree) and is now working in Fishkill in GloFo, on the push to develop 7nm litho.
So no, do not pin your hopes on Cuba-Venezuela. Or Iran. Something like that could come from a place like singapore/indonesia, or a place like India/southAfrica/Brazil (if you notice, three of the brics).
*** Suerte a todos y Feliz dia!
You shouldn't rely solely on antivirus, but many companies require it as part of a complete security pantheon, sadly, too many people still run Windows on the desktop and click on anything that itself says is trustworthy.
Symantec, Norton etc has in the past whitelisted NSA malware like FinFisher and R2D2 which were quite crude and readily detected by "foreign" AV like Kaspersky and ESET and we also know NSA has developed malware for Mac, Windows and Linux/BSD such as the recent Samba vulnerabilities.
Custom electronics and digital signage for your business: www.evcircuits.com
The solution is to just open source licence the source code and publish in a Reproducible format. The Virus matching data and backend can be kept a proprietary service. This could open up a new business model, scanning source code for potential hostile actions and vulnerabilities.