Slashdot Mirror
Moscow Has Turned Kaspersky Antivirus Software Into a Global Spy Tool, Using It To Scan Computers For Secret US Data (wsj.com)
WSJ has a major scoop today. From a report: The Russian government used a popular antivirus software to secretly scan computers around the world for classified U.S. government documents and top-secret information, modifying the program to turn it into an espionage tool (could be paywalled), according to current and former U.S. officials with knowledge of the matter. The software, made by the Moscow-based company Kaspersky Lab, routinely scans files of computers on which it is installed looking for viruses and other malicious software. But in an adjustment to its normal operations that the officials say could only have been made with the company's knowledge, the program searched for terms as broad as "top secret," which may be written on classified government documents, as well as the classified code names of U.S. government programs, these people said. The Wall Street Journal reported last week that Russian hackers used Kaspersky's software in 2015 to target a contractor working for the National Security Agency, who had removed classified materials from his workplace and put them on his home computer, which was running the program. The hackers stole highly classified information on how the NSA conducts espionage and protects against incursions by other countries, said people familiar with the matter. But the use of the Kaspersky program to spy on the U.S. is broader and more pervasive than the operation against that one individual, whose name hasn't been publicly released, current and former officials said. This link should get you around WSJ's paywall. Also read: Israeli Spies 'Watched Russian Agents Breach Kaspersky Software'
I've been telling you people that Kaspersky is nothing more than a tool to send the KGB (now FSB) your files for over a year.
You won't have seen my warning unless you brows at -1 because Slashdot is infested with Russian sock-puppets, idiots, and traitors.
It also has daily updates for my pleasure.
It's the weaponization of something considered a base necessity to the functioning of computers. It's the equivalent of poisoning a city's primary water supply. Yes there are others but this one is well known and been used for so long that many are dependent on it for what it provides.
The argument can be made that Slashdot's editors are Russian spies sent here on a mission to discredit Democrats.
We know already. Yes, there are some denialists but who cares. Give us some news.
Also, if you are of no interest to the Russian government but are afraid of NSA snooping, maybe it's time to install Kaspersky.
It's the mouthpiece of reality that you really object to.
I'm sorry that you are loyal to Russia instead of America, and that you want Americans to continue running Russian government spyware.
If you were a loyal American instead of a traitor you would understand that it's important to warn you fellow Americans of a hostile foreign adversary's attack on your country and your computers.
WSJ has a major scoop today.
From a report
according to current and former U.S. officials
How many times are we going to let this go? Every week there is something else.
Shocking news to grab your attention by a series of reputable outlets that have changed ownership or management in the last few years. From a report, sounds so official. With vague anonymous sources that are official in some way.
I am not saying this is entirely "fake news". That rarely exists whole-cloth, but just look into it a little closer when it looks like a duck and quacks like a duck.
The US government, and by extension the media sources that make their money by having cooperative contacts within it, got pissed off at Kaspersky for exposing their dirty Stuxnet secrets. Double points for Kaspersy being Russian at a time when anything remotely critical of Trump is made of ad impression gold.
So now they set the hounds against Kaspersky and we have to put up with a media blitz. Story after story with no real proof other than "trust us, we are the media and government" when we should be doing the opposite for the same reason.
Shocked, I tell you.
I said, oh, 3 or 5 years ago, or maybe it was 10? ...that an obvious vector was the antivirus product itself. Because trust has to start somewhere, and people tend to trust their antivirus software, because otherwise, what do you do? Throw out your computer and go back to books? (Now that I write that, it doesn't sound like a half bad idea.)
And this was even before the useless nagware McAfee Security Scan started being bundled in everything to hell and gone.
So, in a way, I'm glad this happened, because it might cause people (well, some people... well, a few people) to look a little more critically at their antivirus software.
So everyone should convert to Windows Defender. Just kidding.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
hasn't already done this with Microsoft, McAfee and Norton security software? Privacy and Internet Security is a myth in the 21st century. I'm sure that it won't be long before they will have the ability to listen to every home with a Amazon echo in it.
...WSJ has a major scoop today.:...
From the WSJ article itself:
...Israel’s spying on Kaspersky, which U.S. officials said provided crucial evidence that Kaspersky Lab was working with the Russian government, and the use of Kaspersky to scan for classified keywords was first reported Tuesday by the New York Times. ...
[my emphasis] The NYTimes may not be my favorite newspaper, but credit where credit isude, eh?
This reminds me of a sci-fi story where the NSA somehow created a code module sometime in the past that has made its way into every anti-virus software (lot of hand waving here). The idea being that most computers have anti-virus software running and the anti-virus software won't be looking at itself (who is watching the watchers?) This allows the NSA to make every computer a part of a giant botnet, basically a global super-computer using the free CPU cycles of billions of computers. They aren't using the computers to spy on individual computer users as much as using that raw computing power to ask questions and get answers. At some point I think the giant botnet becomes self-aware.
A decent piece by Hacker News (https://thehackernews.com/2017/10/kaspersky-nsa-russian-hackers.html) correctly points out that there is no evidence, just anonymous sources and nation state he said she said. Even if Russian ops did gain access through Kaspersky, Kaspersky might not have allowed access and are victims themselves. US intelligence does this all the time, ask Cisco about the backdoor added to their hardware mid route (thanks Edward Snowden for the revelation).
Blaming a company without any substantial proof at this time is just more fear mongering playing into the current narrative. The fact that it's easy to take previous known code from an intelligence program and re-purpose it/style to frame another country is never mentioned in theses "OMG THE BAD GUY HACKED US!" stories is very disingenuous. But I suppose after weeks of this allegation and congressional hearings, we'll still know nothing and the story will slowly fade away except for the occasional talking point of why we should sanction/hack/declare war with Russia.
Wrong. The Intel Management Engine being hacked doesn't "compromise" anything other than the US government's ability to compromise your computer at the hardware level. I'm sure you're well aware of that though.
Over here we say "boy who cried wolf." That "peter and the wolf" thing is pretty much strictly a Russian idiom. Just so you know, going forward.
Except that it was scanning for particular names and phrases, not just virus signatures.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Shill disinformation vector 3: doubt fork of FUD activated!
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I remember one day buying a computer from Best Buy and while I was paying for it the employee proceeded to open the brand new box saying he was about to install some anti-virus software. I don't know if it was Kaspersky, but I said something along the lines of "Hell no" and put an end to that.
So nowadays antivirus software has moved on from not doing anything useful to spying on you while not doing anything useful.
SlashdotMedia has turned Slashdot into the democrats' mouthpiece. You all are starting to make Trump look like a rational human being.
It used to be republicans were the ones who hated the Russians the most. Were do you get that Democrats like Russians? Russia doesn't care about republican vs. democrat, they want to do whatever they can, no matter the avenue to make America weaker.
How is Windows 10 any different? that openly collect every thing you make,open send. Every image, every doc, every email is scanned/collected.Every word spoken. So knowing this why hasn't every country in the world not blocking or not allow windows 10 to be installed on any government/employees PC? And those saying they don't do what i said lol
Jack of all trades,master of none
The _NSAKEY was discovered in Windows NT 4 in August 1999 by Andrew Fernandes of Cryptonym. It could be confirmed and reset by any hacker with a copy of NT. I did cleared mine and most of my tech colleagues did the same
https://en.wikipedia.org/wiki/...
Gates was interviews by BBC news and flout out denied its existence.
https://cryptome.org/nsakey-ms...
Indeed. The technique of the "Big Lie" (known a long time, but refined and documented by Goebbels) is to just tell people again and again what you want them to accept as truth. This technique is clearly employed here. The most obvious reason for this attack on Kaspersky is that they refuse to ignore NSA malware and do things that the tame US vendors would never dare to do. It does also not really matter whether Kaspersky gets hacked by Russian intelligence, as all other AV products are pretty likely to suffer exactly the same fate as Kaspersky. That they get singled out and that the proof presented so far is more than flimsy and stinks of having been manufactured fits the picture nicely.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Let's assume for a moment that you're a US citizen. What, exactly, can the FSB (or any other Russian agency) do to you personally that US agencies couldn't do to you with complete (or de-facto) legality (including things that harm you as 'collateral damage', even if they aren't targeting you specifically or accusing you of any wrongdoing)?
At least the FSB won't break into your back yard & kill your dog for barking at them while they execute a no-knock warrant against your neighbor. Or destabilize your computer (and the computers of 17 million other Americans) & cause it to randomly crash courtesy of their malware in the hope it'll assist them in catching 2 or 3 child molesters?
As others have noted, the feds are pissed at Kaspersky for getting in the way of their OWN malware. Anybody who thinks US agencies haven't done the same thing with American software is naive. That doesn't make what Russian intelligence agencies did *right*, but arguably, if having Russian malware on your PC means it's protected from American malware, it's debatable whether that's bad for an individual American.
Back in the paper days, physical access was controlled, so stamping them with an appropriate classification made sense.
Unfortunately as things went digital, < ENTITIES > used headers/footers embedded in the document to replace these stamps.
This makes it levels of magnitude easier to separate the wheat from the chaffe... just grep for secret|confidential|noforn|etc...
Eventually watermarks were used instead, but then you only need to look for those.
PGP has been around for what? 3 decades now?
That's plenty of time for even the slowest moving < ENTITIES > to implement a document request system based on need to know.
It uses proven technology with an adaptation that is obvious to practicing security professionals and would significantly minimize leaks.
But, hey, its not like many security professionals are volunteering to help so long as there are variations of the (Un-)Patriot Act.
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -Ben Franklin
Regarding the NSA contractor, it sounds like Kaspersky AV was working as designed. It detected the malware the contractor was working on and sent the file back to Kaspersky Labs for analysis. It sounds to me like the NSA's security policy needs some work if a contractor can download classified files to a non-secure computer.
Now as far as Kaspersky AV scanning for classified documents, that's certainly plausible but where's the evidence? Not running the software on sensitive computers sounds like good policy, but there's a lot of software that shouldn't be run on those types of systems. That being said, how do we know all foreign made computers themselves haven't been compromised at the factory?
Nation A spies on nation B. Nation A tells nation C about what it "found" deep in nation B.
Nation A and C then publish what they found from all their spying on nation B in near real time.
Nation B is then accused of "spying" to cover for what nation A and C really did.
In the real world nation A and C would have kept that a secret and created all kinds of fake litter for nation B to find and believe in.
If fantastic details are in the open media its just something fictional to publish and push national cyber talking points.
Real spy success stories stays secret for decades so a nation B never knew what really happened.
Domestic spying is now "Benign Information Gathering"
Thats what any normal gov, mil and spy agency would do.
They would feed code litter and junk to another nation for years with nobody finding out. No human spies to get a warning back, no network detection. Just a flow of quality networked disinformation for years.
Many, many decades later they would hint at that cyber success they had in a fictional movie. Archives get opened to the public a few decades later.
If the cyber story is in the media and random people are commenting about it in near real time.....
Domestic spying is now "Benign Information Gathering"
Why are there government computers running windows at all?
Wake up and smell the coffee, people.
Computers do not need to run virus scanners.
STEP 1:
Ban all MS Windows computers from government use
STEP 2:
There is no step 2.
http://www.stolk.org/tlctc
If you were watching that show this info is almost 2 weeks old already. And The White House bought the Anti Virus software big time. So.. There go our secrets!!
Remember years ago when the NSA was intercepting shipments of Cisco routers and adding spy stuff? Color me un-surprised.
I wonder why Israel would reveal that they had the capacity to eavesdrop on russian spies.
The Russians now know what kind of messed up porn I'm into! The shame!
...for business method patent violation
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
I suspect all AV as being partisan. Not that they're phoning home, just that they're ignoring particular other malware that IS phoning home.
This is all just for the build-up of a yet-unannounced Rocky remake.
Yet Another Major Russia Story Falls Apart. Is Skepticism Permissible Yet? https://theintercept.com/2017/...
This can only be good news. The world is sick of a 'strong America' striding the globe arrogantly, visiting war, mayhem, regime change and murderous interventions with impunity. The legacy, still continuing since WWII has been a global holocaust of peoples who've died, been injured as a result of the US's cult of impunity, acting as a rogue state outside international law. Many have got so used to US global behaviour they accept the rogue state to act as it wants, without constraint or recourse to international law.
A 'weak America' is good news NOT bad news. We can only hope that its aggressive foreign policy, and murderous military will one day diminish, and the US ceases to run amok, murder and maim, treating the rest of the world as its deadly playground.
The US is largely a corrupt and regressive backwater these days. Let's hope that the backwardness of US policies, both domestic and foreign, will face some credible opposition from more progressive countries. America is increasingly becoming a particularly ugly example of a corrupt and totalitarian nightmare. One only has to look at who the 'choices' for president were, to realise that the system of government there has long since ceased to function in any moderately representative way, let alone democratic.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I was deciding between Kaspersky and Bitdefender for Mac AV. Which do you recommend?