Ask Slashdot: Should Users Uninstall Kaspersky's Antivirus Software? (slashdot.org)

First, here's the opinion of two former NSA cybersecurity analysts (via Consumer Reports): "It's a big deal," says Blake Darche, a former NSA cybersecurity analyst and the founder of the cybersecurity firm Area 1. "For any consumers or small businesses that are concerned about privacy or have sensitive information, I wouldn't recommend running Kaspersky." By its very nature antivirus software is an appealing tool for hackers who want to access remote computers, security experts say. Such software is designed to scan a computer comprehensively as it searches for malware, then send regular reports back to a company server. "One of the things people don't realize, by installing that tool you give [the software manufacturer] the right to pull any information that might be interesting," says Chris O'Rourke, another former NSA cybersecurity expert who is the CEO of cybersecurity firm Soteria.
But for that reason, Bloomberg View columnist Leonid Bershidsky suggests any anti-virus software will be targetted by nation-state actors, and argues that for most users, "non-state criminal threats are worse. That's why Interpol this week signed a new information-sharing agreement with Kaspersky despite all the revelations in the U.S. media: The international police cooperation organization deals mainly with non-state actors, including profit-seeking hackers, rather than with the warring intelligence services."

And long-time Slashdot reader freddieb is a loyal Kaspersky user who is wondering what to do, calling the software "very effective and non-intrusive." And in addition, "Numerous recent hacks have gotten my data (Equifax, and others) so I expect I have nothing else to fear except ransomware."

Share your own informed opinions in the comments. Should users uninstall Kaspersky's antivirus software?

Comments

ANY antivirus

[Anonymous Coward]

Uninstall any such snakeoil crap.

Re: ANY antivirus

[Steelheart]

F-Secure used to be a huge resource hog, run tens of different processes for the UI, background scanning, updates and such. It used to bog down most machines considerably. Granted, we have more processor power to spare than ever before, so has this changed?

Re:ANY antivirus

[plopez]

That assumes you can. If your apps are hosted remotely (aka "The Cloud") do YOU know what they are using? What about their subcontractors and sub-subcontractors? What about your bank? Let's keep going and ask about your health care provider. And so on. Do you know?

Re:ANY antivirus

[Dutch Gun]

They're less "snake oil" than "yesterday's solution."

At this point, for Windows users, I'd simply recommend using the built-in AV and some common-sense precautions. No, it's never rated quite as highly as 3rd party AVs in the number of viruses they catch, but it's completely unobtrusive, lightweight, and has very few compatibility issues. And for any MAJOR attacks, it's typically updated fairly promptly.

These days, the security vulnerabilities they may introduce by hooking deep inside your system are no longer worth any minor benefits they may provide.

In short, I'd recommend uninstalling Kaspersky or any other AV, not because of "Russian Hackers", but for more pragmatic reasons.

Re:ANY antivirus

[Flytrap]

From what I understand ANY anti-virus or anti-malware tool is susceptible to being targeted by powerful nation-state actors for use is accessing user's computers... not just those from the US or Russia. That means that F-Secure, or any other such tool from any other country could still be hacked by the China, Iran, North Korea, Russia, the US or any other nation-state with an active cyber intelligence programme and used to violate the user's privacy and confidentiality.

I do not know what the real answer is... but I believe that the recent cyber intrusions are going to strengthen the advocacy for sandboxed application models and strict or explicit permissioned based access to computer hardware, software, network and data resources that have become prevalent on modern mobile platforms. Powerful nation-state actors will still try to hack and find vulnerabilities in the underlying operating system host or hypervisor layer, but at least it would give security practitioners a single concerted layer to focus their intrusion detection efforts on.

Protecting the cloud and the various systems, protocols, etc that make up the disparate components of cloud based systems is a whole other kettle of fish, which i think is beyond the scope of the question posed by the original poster.

Re:ANY antivirus

[Anonymous Coward]

I do not know what the real answer is... but I believe that the recent cyber intrusions are going to strengthen the advocacy for sandboxed application models and strict or explicit permissioned based access to computer hardware, software, network and data resources that have become prevalent on modern mobile platforms. Powerful nation-

In other words, the answer is 'real security'. Like they have on any OS that isn't windows. So no need for security add-ons like 'antivirus'.

state actors will still try to hack and find vulnerabilities in the underlying operating system host or hypervisor layer,

Sure, but when security is part of the design, these actors will need to find an actual fault to exploit. And faults can be patched without further ado - as nobody sane relies on faults. But you can't patch a unsafe design like windows, because lots of sw is written to its broken spec.

Re: ANY antivirus

[Steelheart]

I'm sorry, but Windows being insecure by design is a myth.

Re:ANY antivirus

[DarkOx]

The only real answer is fully MAC (Mandatory Access Control) model that is very fined grained. The result of that unfortunately is a computer system nobody really wants to use.

The more immediate reality with A/V software is that its probably something that requires the highest level of trust. This is software that literally hooks into the I/O layers on your system and is allowed to bypass essentially every other kind of access control check. At the same time its hard to put a lot of instrumentation around it because so much of what it does isn't thru the usual OS channels. So you can't know if its misbehaving or doing things it ought not to easily. External network hardware should be able to tell you if its phoning home but that might even be complicated. We are talking about software that after all could stash whatever it wants to send some unused place on the disk and wait three weeks until your not at home but connected to the wifi in some airport and phone home at that time.

Frankly after this and a few past issues, I am not sure any third party A/V solution is advisable. In the Windows world Microsoft should probably just stop even allowing third party kernel modules they have not fully audited. Which would basically kill the A/V industry.

Re:ANY antivirus

[geekmux]

They're less "snake oil" than "yesterday's solution."

At this point, for Windows users, I'd simply recommend using the built-in AV and some common-sense precautions...

I'm not sure what is the larger risk here; assuming that removing software is going to properly cover your ass in the event of an outbreak, or actually believing that the user community is fluent in "common-sense precautions".

Remember there are times when software is solely used to prevent you from getting fired, particularly when the CxO doesn't see A/V as mere "snake oil".

Re:ANY antivirus

[jellomizer]

For the most part today we don't really deal with individual software but for good or bad we deal with mostly a service Infrastructure.
So if you have an Apple Infrastructure, you may have an iPhone, a Mac and use airdrop to share files and use the iCloud.
If you use the Google Infrastructure, you will have an Android Phone, a PC, using Google Drive
If you are using a Microsoft infrastructure, You are more or less out of the phone, but you have Windows 10, Office 365 and OneDrive

While you can mix these services around, but you are normally better off sticking to the brand you like as it offers better support and extra cool features.

3rd party tools on your infrastructure in general will detract from your experience and your ability to get things, done... (You may not be able to get away from this, due to cost concerns, or just needing a tool that isn't available) However these tools installed are nearly always at risk of being not supported, or breaking something else.

I am not saying this is good thing, being locked to a vendor for bulk of your use cases is overall bad, however this is the world that we currently live in. And you are better off using the Windows AV for windows because in general it is better built and it isn't trying to hack the system to do what it needs to do.

Re:ANY antivirus

[Type44Q]

It just depends who you're dumb enough to believe.

Re:ANY antivirus

[Anne Thwacks]

If your apps are hosted remotely you are stuffed.

FTFY

Re: ANY antivirus

[orlanz]

Although I agree with you in priciple, that's just the way the world is. I don't consider it neither good nor bad... like gravity. Perception is just as, if not more, important than reality.

If reality says an investment has a 10% APY, but perception is less than that, you won't get the startup funding to engage that endeavor. Thus fulfilling the perception.

I am being US centric here: The most effective insurance I have seen thus far is either FDIC or home insurance. Health insurance is horrible. The labor costs are high, the equipment costs are high, there is a lot of labor involved, and the overall system is extremely inefficient. Yet the prices are almost arbitrary. It is very difficult to assess if the insurance fees are worth the inflated pricing. Plus, effective insurance is meant for the one off disaster costs. They are meant to off load the risk of a high bill. That the average fees will more than cover the low probability it happens. Not for milestones you hit in life.

Re:ANY antivirus

[Curunir_wolf]

This. My organization has policies all up and down the chain that mandates A/V software be installed and enabled on EVERY endpoint, servers, laptops, workstations, Linux and Mac, etc. Everywhere.

Re: ANY antivirus

[amicusNYCL]

Well yeah, but you see if the AV is using all of the CPU resources, that's just less cycles for the virus to have to execute.

Re:ANY antivirus

[Aighearach]

Sure, sure, but only for very small values of "we."

Re:ANY antivirus

[plopez]

my point exactly.

No

[EkriirkE]

This is all just propaganda.

Re:No

[sittingnut]

this is indeed pure propaganda by nsa.

kaspersky software detected(as it should) nsa's new malware in a negligent incompetent private contractor's private computer, alerted hq, russian gov may have heard about it, kaspersky is punished for doing its job. btw american made software did not detect such malware.

if, after knowing the facts(as opposed to nsa propaganda), you find kaspersky is a threat, uninstall it.

Re:No

[mwvdlee]

Go peddle your trolling nonsense on infowars.

Re:No

[Anonymous Coward]

The whole mass hysteria about Russia comes from the vast list of things Russian agencies has done in recent years to divide competitors to their interests

FTFY. The email thing was overplayed vastly in the US media (while Trump's staff doing the exact same thing wasn't, curiously), but it doesn't change the fact that the Kremlin-backed candidate won in that election and it is likely that he hadn't without Russian involvement. Moreover, Russian meddling in US politics is part of a much wider programme, including the destabilisation of Georgia and Ukraine and the financial backing of populist movements in various European countries and contributions towards the desinformation campaign in favour of Brexit.

Re:No

[tinkerton]

Propaganda ok, but I'd be surprised if the NSA had gotten involved in the propaganda business.

Now, there is some value in the claim that Kaspersky data is shared with spying agencies. Data is uploaded to their servers and these servers are a target. After all the Israelis have succeeded in getting in, in a reckless attempt to provide Kaspersky and others with the most advanced evolution of Stuxnet/Duqu. They claim the Russians also succeeded in getting access and it's not impossible. It's probably a lie, especially when upgraded to 'yeah and the Russians don't even have to try hard' , but it shows people want to get in there.

Re:No

[skam240]

There is a mountain of evidence that an adversarial nation to our own (Russia) attempted to sway our election in favor of the current winner. How you can just blow that off is beyond me. Russia is not our friend, not by a long shot.

Re:No

[Anonymous Coward]

Propaganda ok, but I'd be surprised if the NSA had gotten involved in the propaganda business.

I'm guessing you've never heard of a little concept called counterintelligence.

Also known as propaganda business.

And yes, the NSA would likely engage in this, particularly if their own tools (NSA spyware) and mission were threatened.

Re:No

[EvilSS]

This is all just propaganda.

Thank you for your insightful response and continued support comrade.

Re:No

[cascadingstylesheet]

and it is likely that he hadn't without Russian involvement.

That's the hand waving part.

I get why you want to believe that. It's a lot easier than facing up to your policies being deeply unpopular for half the country. And your candidate being just as awful.

Her email thing was vastly under blown. The Secretary of State, discussing classified matters on email through a private email server in her bathroom? Little people are in prison for less.

The point is, we didn't need Russian "meddling" (what, do they employ the Scooby gang? "And I would have got away with it too, if it weren't for you meddling Russian kids!")

Re:No

[jeff4747]

I get why you want to believe that. It's a lot easier than facing up to your policies being deeply unpopular for half the country. And your candidate being just as awful.

The election was won by tens of thousands of votes in a couple states. Such as the 11,000 vote margin in Michigan and the 68,000 vote margin in Pennsylvania.

With a margin that small, every single thing that nudged some voters was required to win the election. That includes email, the utterly incompetent Clinton campaign, and Russia. Take any one away and those margins flip.

Re:No

[Plus1Entropy]

Damage to national security due to a leak doesn't magically expire if there was a fucking election wrapped around that stupidity.

Funny, because that is pretty much exactly what the OP of this thread was saying:

She lost the election, can we stop this idiotic red scare?

Re:No

[jedidiah]

> Thank you for your insightful response and continued support comrade.

This is an ironic response consider who is and is not a communist these days.

Re:No

[jedidiah]

> How you can just blow that off

My echo chamber consists of more than just screeching Hollywood liberals.

I also have a genuine understanding of history rather than the pathetic "Cliff Notes" version peddled by the media.

The American electorate has been split three ways since long before the Soviets were a convenient bogeyman.

Re:No

[jeff4747]

Sorry to break it to you but a big chunk of the rust belt didn't NEED any sort of "nudge" to hate Hillary

Try actually reading this phrase this time:

the utterly incompetent Clinton campaign

If you'd take a moment to stroll out of your echo chamber, you'd realize that the vast majority did not like either candidate.

Again, the margin in MI was 11,000 votes. That's easily flipped if Clinton had run a competent campaign. Or had Clinton not been so stupid about emails. Or if Russia wasn't running a large social media campaign. Or if the Obama administration had a better response to Flint. Or if the Obama administration had put bankers in jail in 2009. Or if the economy was 1% better. Or if the Obama, W, Clinton or Bush administrations had any idea what to do with the Rust Belt in their free trade idolatry.

Margins that small mean if you take away one small effect, the margin goes away. That is true no matter which candidate you supported.

Re:No

[amicusNYCL]

Let me guess: a communist is anyone to the left of you.

Re:No

[amicusNYCL]

The whole mass hysteria about Russia comes from the FUD campaign launched by Clinton to distract people from the fact that she was sending top secret emails in plain text using her own Exchange server instead of using the state department secure infrastructure.

Is that the official party line to use when the Mueller investigation starts sending out indictments?

Russia is a third world country

*Pet peeving intensifies*
Austria, Finland, Sweden, Switzerland, and Ireland are third-world countries. I'm pretty sure that even though the Soviet Union is gone, Russia would still be considered a second-world country.

Re:No

[Curunir_wolf]

She could have, you know, maybe visited the state? Maybe just once? Like, maybe do some campaigning there?

Hillary was running a popularity contest, and she won.

Unfortunately for her, that's not what wins a Presidential contest. You have to win the most states, not the most votes on the coasts...

Re:No

[jeff4747]

She could have, you know, maybe visited the state? Maybe just once? Like, maybe do some campaigning there?

Personally, the malpractice came from not reacting to her primary loss in MI. Clinton's campaign was expecting a large win. Instead, they got crushed.

You'd think after that in the primary, they'd be a bit leery of trusting their data model in the general election. But not the Clinton campaign. They once again expected a large win....and then lost.

Re:No

[david_thornley]

The Secretary of State, discussing classified matters on email through a private email server in her bathroom? Little people are in prison for less.

I haven't seen evidence that she was discussing classified matters, as opposed to getting some classified documents on her server.

Moreover, as far as I've been able to tell, no little people are in prison for doing what she did. Unless you're claiming she was deliberately and intentionally putting classified material on her server, she falls into the category of people who are not criminally prosecuted.

Re:No

[lucm]

Go peddle your trolling nonsense on infowars.

Did you hear more about the content of the DNC emails that were leaked, or about *theories* that Russia had hackers trying to meddle in the election?

And yet, only one of those two things happened for sure. But go on, embrace the conspiracy theory narrative instead of looking at facts. At least now we know that when the liberals lose, they don't just lose the election, they also lose their moral compass and common sense.

Re:No

[lucm]

With a margin that small, every single thing that nudged some voters was required to win the election. That includes email, the utterly incompetent Clinton campaign, and Russia. Take any one away and those margins flip.

There was the email server, but also the DNC emails that were leaked - and those contained damaging content for Clinton, but of course they brought in (again) the mysterious Russian hackers (of which there is still, as of today, zero actual evidence), and the mainstream media jumped on it since it was easier than explaining things such as those "How can we help?" emails they sent to Clintons campaign.

Anyone who supports Clinton at this point and who still peddle that Russian hacker bullshit should stop calling themselves liberals, and call themselves Clintonians instead, as those are two different things.

Re:No

[lucm]

Anyone who modded down the above is a fucking hypocrite and probably knows it.

Re:No

[lucm]

The whole mass hysteria about Russia comes from the FUD campaign launched by Clinton to distract people from the fact that she was sending top secret emails in plain text using her own Exchange server instead of using the state department secure infrastructure.

Is that the official party line to use when the Mueller investigation starts sending out indictments?

I don't know what you mean, but the bit about using her own Exchange server and sending messages in plain text is public record; the date at which they switched to TLS and moved the server to an actual data center is even known.

There's lots of nasty shit about Clinton that is a matter of public record (such as when her brothers had to pay back the bribes they received to buy presidential pardons from her husband) but mysteriously those facts never seem to cross the thick layer of propaganda behind which you people hide your conscience.

Re:No

[skam240]

It's super great you made a reference to the soviets! That, however. is entirely irrelevant to the conversation. Good try at an attempt to convolute the discussion though!

Furthermore, I don't need an echo chamber to show me that Russia acts contrary to American interests. The country's of Georgia and Ukraine try to go pro West and get invaded and parts of their sovereign nations seized? Former Eastern Block Nations face constant internet attacks traced to Russia? Constant influences favoring Russia's favored candidate in regards to our recent presidential elections are traced back to Russia? Russia favors Iran and Iranian allies thus allowing for Iranian nuclear armament? The list can go on from here.

Please, inform on how Russia is our friend and not a geopolitical adversary because I don't see fuck-all for evidence for them being our friend and you have provided zero evidence for such aside from "Duh... liberals are bad!"

It actually horrifies me that so many Americans are willing to label a country so blatantly contrary to our own interest as a friend just because their favored leader, who is immersed in Russian controversy, tells them to.

Re:No

[amicusNYCL]

None of what you just said has any bearing on the Russian state security services and their involvement in the United States or Europe. I don't know who the "you people" you think you're talking to are, but I knew before the primaries even started that I would never vote for Clinton. Shit, she's the second most-disliked candidate in the history of presidential polling, a lot of people don't like her and refuse to vote for her and I'm one of them. And, again, this has absolutely nothing to do with the Russian state security services. If you think that Putin isn't playing a long game that involves the rise of dictators or authoritarian leaders friendly to Russia anywhere he can help that happen, and the eventual collapse of the EU and NATO, then you're not paying attention. This has nothing to do with Hillary Clinton. The fact that Putin was campaigning against Clinton is only a footnote in the bigger picture.

Re: No

[amicusNYCL]

Well, then why don't you research the history of that term and provide some insight?

Re:No

[skam240]

That's pure hypotheticals. I was a Bernie supporter first and foremost but he is far to the left of traditional American politics. Of course Trump is far from traditional American politics as well but there was certainly no guarantee that Bernie would have won the election given how nontraditional he was.

To be honest I think you're just voicing support for a Russian troll. They're very active on here, just look at the two replies put up on a recent post by me.
My Post: https://slashdot.org/comments....
Russian: https://slashdot.org/comments....
https://slashdot.org/comments....

There is no way those are both done by original authors. I find all divisive AC comments suspect nowadays, especially when they line up with my own ideology.

Re:No

[lucm]

I think you're just voicing support for a Russian troll. They're very active on here

The whole "Russian masterminds posting divisive comments" is just a remix of "Russian masterminds hacking elections". There's no Russian conspiracy, there's a mainstream media conspiracy that uses Russia as a scarecrow to distract people.

Ask yourself: what *exactly* do Russians have to gain from all this? They already had Clinton in their pockets with their massive contributions to the Clinton Foundation, and they knew Trump wouldn't be their sworn enemy based on his comments during the campaign. This was basically a no-lose election for them.

So what's the agenda? Leading America to civil war via Facebook statuses? Creating social chaos using inflammatory tweets? For what purpose *exactly*? Confuse everyone so they can increase their stronghold on Syria or Ukraine without opposition? Distract Americans so they can sabotage missile bases and invade Alaska?

Seriously, it's time to move on with this shit. The Democrats and mainstream medias have been caught in bed together and have used the whole Russia thing as a red herring, there's nothing else going on. Just more evidence of the moral corruption of the DNC, New York Times and CNN.

Re:No

[skam240]

"They already had Clinton in their pockets with their massive contributions to the Clinton Foundation, and they knew Trump wouldn't be their sworn enemy based on his comments during the campaign. This was basically a no-lose election for them."

Well when you start with a false premise you can prove anything! Clinton is a proven hawk when it comes to international affairs and you have no proof in regard to your claims that Hillary was "in their pockets", just pure speculation. In fact it is well known that Hillary was very much in favor of far more US intervention in Syria, a firm Russian ally ( http://www.cnn.com/2017/04/06/... , http://time.com/4730416/syria-... , And Trumps take: http://time.com/4730416/syria-... is to bad mouth her position). Clinton also made it very clear in 2016 that Russia was not our friend ( http://time.com/4730416/syria-... ) where as Donald consistently stated the contrary.

Re:No

[lucm]

Bah.

Let’s put the Uranium One scandal in perspective: The cool half-million bucks the Putin regime funneled to Bill Clinton was five times the amount it spent on those Facebook ads — the ones the media-Democrat complex ludicrously suggests swung the 2016 presidential election to Donald Trump.

http://www.nationalreview.com/...

Spin that any way you want, everyone knows by now that she's a corrupt pawn on the global russian chessboard.

Re:No

[skam240]

You mean the Uranium scandal that only Obama had the power to stop and was approved but almost dozen other people / agencies and that Clinton at best could have only sent the matter for Presidential approval?
http://www.factcheck.org/2015/...

A very inconvenient quote for you from the article
"The fact is, Clinton was one of nine voting members on the foreign investments committee, which also includes the secretaries of the Treasury, Defense, Homeland Security, Commerce and Energy, the attorney general, and representatives from two White House offices — the United States Trade Representative and the Office of Science and Technology Policy. (Separately, the Nuclear Regulatory Commission needed to approve (and did approve) the transfer of two uranium recovery licenses as part of the sale.)"

Once again, you are running with pure speculation.

I also love your "I'm the center of the world" comment about "everyone" knowing she is in Russia's pocket. If you believe it, it must be a universal truth! Funny then that over 50 percent of voting Americans voted for her.

Re:No

[lucm]

I also love your "I'm the center of the world" comment about "everyone" knowing she is in Russia's pocket. If you believe it, it must be a universal truth! Funny then that over 50 percent of voting Americans voted for her.

At the time those people voted, the biased media was doing all it could to hide this scandal so it's not surprising. But now they basically wrote her off so they're no longer shielding her with such ferocity, allowing everyone to finally see the ugly monster that lurks behind that mask of liberal values.

Re:No

[skam240]

Maybe the "biased media" did their homework and realized that she was just one of 10 people or entire organizations who approved it and had no kind of veto power so that it was therefore not really a scandal at all. I went over this above.

Of course it should be removed

[vityok]

Of course Kaspersky should be removed from your system.

Or if you want to keep it, then don't complain when your files get reviewed by an invasive dictatorship. Of course, in 90% of cases they might not give a two shits about you, but if they do, then Kaspersky is one of their possible tools.

Also, there is absolutely no doubt that Kaspersky and similar Russian-made products should be removed from government networks or any computers handling sensitive information.

Re:Of course it should be removed

[sittingnut]

says establishment tool nsa's slaves,
willing to sacrifice money and blood(usually other americans' ) in wars, propagated by willfully false nsa and ilk, that further the interests of "allies" and exploiters willing to loot other country resources for their private profit,
willing to applaud torture camps and and mass human rights violations, against american laws and constitution,
willing to allow unaccountable mass surveillance by nsa, that dictators in russia can only dream about .
etc etc.
-
kaspersky software detected( as it should) nsa new malware in negligent incompetent private contractor's private computer , alerted hq, russian gov may have heard about it, kaspersky is punhsied for doing its job. btw american made software did not detect such malware.

if, after knowing the facts(as opposed to nsa propaganda), you find kaspersky is a threat, uninstall it.

Re:Of course it should be removed

[helga the viking]

Absolute FUD.

Kaspersky BENCHMARKS the shit out of Norton, McCrapee and most others reliably over longer periods of time.

Show us the code, the detail and the proof it has a backdoor or exploit. An open availability of technical explanations proving there is an exploit makes it credible. We've got them for just about everything else so this one stands at odds as an outlier which should ring alarm bells that its political and not founded.

There are two layers of logic to this:

• You take the risk Kaspersky installs malware via some backdoor because Kremlin (no proof yet still waiting). Considers your desktop machine a valid target. Under this situation assuming everyone has a ticking time bomb installed on their computer for the Kremin to manipulate is not unprecedented. Welcome to the last 20+ years of insecure by design Adobe flash products.
• You ARE ACTUALLY running something that is of state,corporate 'secret' level, controls a national grid, controls some real world system that could kill people, controls governmental sensitive emails. Then why is it running anything other than a hardened lunix BSD OS anyway?!?

Re:Of course it should be removed

[butzwonker]

People forget that Kaspersky's engine is used by many other security products, too.

The reasonable stance is that if you have important trade secrets on your machines, you should choose your antivirus carefully - it's best to use one from your own country, including the engine. The same for journalists, dissidents, etc. Don't security products from the country you're criticizing.

Any other people aka "ordinary citizens" should just choose the antivirus that performs best and suits them best. Kaspersky is top notch. If you're worried about viruses and maybe a bit about NSA mass surveillance, Kaspersky is one of the best choices. If you're primarily worried about Romanian mass surveillance, on the other hand, then you should avoid Bitdefender. And so on.

It's kind of a no-brainer. On a side note, any machine, no matter how well-patched and which operating system it is running, will be broken and accessed in a targeted attack by any state actor. There are no secure PCs.

Re:Of course it should be removed

[Billly Gates]

Absolute FUD.

Kaspersky BENCHMARKS the shit out of Norton, McCrapee and most others reliably over longer periods of time.

Show us the code, the detail and the proof it has a backdoor or exploit. An open availability of technical explanations proving there is an exploit makes it credible. We've got them for just about everything else so this one stands at odds as an outlier which should ring alarm bells that its political and not founded.

There are two layers of logic to this:

• You take the risk Kaspersky installs malware via some backdoor because Kremlin (no proof yet still waiting). Considers your desktop machine a valid target. Under this situation assuming everyone has a ticking time bomb installed on their computer for the Kremin to manipulate is not unprecedented. Welcome to the last 20+ years of insecure by design Adobe flash products.
• You ARE ACTUALLY running something that is of state,corporate 'secret' level, controls a national grid, controls some real world system that could kill people, controls governmental sensitive emails. Then why is it running anything other than a hardened lunix BSD OS anyway?!?

Here is the citation of proof of Kremlin involvement

Re:Of course it should be removed

[Anonymous Coward]

"I've got my hand in the oven, should I remove it? It is a really great oven!"

Re:Of course it should be removed

[AmiMoJo]

You shouldn't need anti-virus software at all.

Limiting what applications can do and blocking malicious behaviour is the job of the operating system. If you need a second application with kernel level privileges just to replicate the functionality of the actual kernel, you have a deeper problem.

Re:Of course it should be removed

[StormReaver]

Or if you want to keep it, then don't complain when your files get reviewed by an invasive dictatorship.

And also don't complain when a non-U.S. country reviews your files.

Re:Of course it should be removed

[StormReaver]

The reasonable stance is that if you have important trade secrets on your machines, you should choose your antivirus carefully....

The reasonable stance is that if you have important trade secrets on your machines, you shouldn't store them on anything accessible by Windows.

Re:Of course it should be removed

[DarkOx]

There may not be any backdoor code or exploit. The software sends malware samples home, it tells you that much.

What the NSA created really was malware and the product correctly identified that, and sent the sample.

Now here is where it gets problematic. Any company of any size in Russia has its government minders. They are probably just sharing their data with Russian intelligence, because no doing so means they end up drinking sugar laced with heavy radioactive isotopes in their morning tea.

Re:Of course it should be removed

[Anonymous Coward]

Here is the citation of proof of Kremlin involvement

Interestingly, another article linked in the link above mention this:
The N.S.A. bans its analysts from using Kaspersky antivirus at the agency, in large part because the agency has exploited antivirus software for its own foreign hacking operations and knows the same technique is used by its adversaries.

So which one? I would assume it's American made. Come to think of it, the russian antivirus is running on top american operating system which, just like any antivirus, definitely has access to any files inside the computer

Re:Of course it should be removed

[DCFusor]

You mean NSA has cracked it too? "don't complain when your files get reviewed by an invasive dictatorship" That's here, and not just since Trump either. I kind of chuckled at the story that the Israelis had cracked it and told us they found the Russians there already. As if the Russians (gov) couldn't just watch the data going in and out on the fiber without leaving a trace at Kaspersky itself (as NSA does), and as if only the Israelis had any good crackers...

Re:Of course it should be removed

[Anonymous Coward]

Makes me wonder if the F-35 design/engineering teams weren't hit with a Russian virus, or if we aren't just becoming a nation of klutzes.

Anyway, it was the DNC's emails and actions that fucked up the election more than anything. But, as always, elephants are quite invisible.

Re:Of course it should be removed

[Mr. Slippery]

Or if you want to keep it, then don't complain when your files get reviewed by an invasive dictatorship.

So...make sure your files are never transmitted over a network controlled by the US or its allies, then?

Re:Of course it should be removed

[gweihir]

Excellent example for how propaganda victims fall for it: There is zero actual evidence, yet you are convinced that "of course" all the accusations are true and that "of course" US products are better.

Re:Of course it should be removed

[thegarbz]

Let me paraphrase:

You shouldn't need anti-virus software at all.

Limiting what users can do and blocking malicious behaviour like installing software and the ability to send network traffic is the job of the operating system. If you need a second application with kernel level privileges just to replicate the functionality of the actual kernel, you have a deeper problem.

Now user hostile system aside, there's a reason why anti-virus relies on matching the type of software, actual software lists, or attempting to determine what looks like malware rather than closing off the options for malware to exist: a) users will happily permit malware to install without a thought, b) most malware looks identical to any other application on the system in terms of how it interacts with the OS.

So something as tunable and fungible as software that monitors and attempts to block other software does NOT now, nor should it ever run in the kernel.

Every single OS in the world has your "deeper problem" the only difference between them is ultimately the attack surface (mono-culture helps) and the effort people are willing to put into the attack.

Re:Of course it should be removed

[gweihir]

Here is the citation of proof of Kremlin involvement

Your "proof" says "reportedly" right there in the headline. This is called "hearsay", not "proof". Or in other words, the proof value of that statement is zero.

Re:Of course it should be removed

[gweihir]

Actually, AV companies share malware samples all around. It is standard practice.

Re:Of course it should be removed

[speedplane]

Here is the citation of proof of Kremlin involvement

Your "proof" says "reportedly" right there in the headline. This is called "hearsay", not "proof". Or in other words, the proof value of that statement is zero.

It's not proof, but it is evidence, pretty strong evidence at that. Given such evidence, you'd be pretty negligent to think that Kaspersky is untouched by Russian intelligence.

Re:Of course it should be removed

[gweihir]

It is actually nothing of the sort. It is just an indicator that this smear-campaign is reasonably well organized. And who said I think Kaspersky is innocent? I am merely pointing out that the current accusations do not come with any evidence that would deserve that name at all. However, this campaign is obviously targeted at people like you that cannot distinguish fact and fantasy and mistake unsupported accusations for "evidence". Because of people like you, it is done this way, because people like you will be convinced even when the accuser have absolutely nothing. The fantasy just needs to be served in the right way. This one is.

Re:Of course it should be removed

[speedplane]

It is actually nothing of the sort. It is just an indicator that this smear-campaign is reasonably well organized.

And what's your evidence of a well organized smear campaign?

No, your denial of reality is propaganda.

[Anonymous Coward]

Your bullshit denial of reality in the face of mounting evidence only convinces fools and traitors.

Re: No, your denial of reality is propaganda.

[Anonymous Coward]

Mounting evidence of what ? Claims by shady spooks without any hard evidence ?

Re:No, your denial of reality is propaganda.

[Anonymous Coward]

the russians are more trustworthy than the u.s. government. besides, if the russians get *my* identity, my credit score can only go *up*.

Re: No, your denial of reality is propaganda.

[Anonymous Coward]

What an absurd suggestion. You have surely taken leave of your senses to even entertain such a notion. Only in the diseased and perverted fantasies of a deranged maniac could such trolls exist.
[Will that do?]

Re: No, your denial of reality is propaganda.

[umghhh]

I disagree about that "we don't need to know". As for the rest - the verdict is still out there. Bring evidence and we will see. The fact is however that most of the systems that we operate send shit somewhere. Try to prevent some of the stuff we have to use (for whatever reasons) doing that and see how well that works.

Re: No, your denial of reality is propaganda.

[Anonymous Coward]

The problem with it is the fact that it calls home to Russia with data about the system(s) it runs on. Kasperski's own web page says this.

Relations between the west and Russia have soured a bit, and people like Obama and Clinton and other war mongers have been pushing for a conflict with Russia. It's not a big stretch of imagination that a Russian General would utilize kasperski's AV software to deploy a Stuxnet type code on U.S. systems if a military conflict came about.

We can't take that chance.

Re: No, your denial of reality is propaganda.

[Anonymous Coward]

I'm sorry but when it comes to real national security, you can't out source it. The Kaspersky stuff may be entirely propaganda/fiction and much of the information I've seen admittedly appeals directly to fear mongering with little-to-no evidence.

With that said, strategically thinking, you need more "skin in the game" when it comes to defense. If you want the best security and defense, motivation needs to be driven by underlying self-preservation and mutual benefit/interest in defending something, not just a contract. You wouldn't want to depend on another country to produce our fighter jets, tanks, etc. I suppose there's something to be said about benefits of diversifying your suppliers in case one or more should turn against you. It's a bit trckier when it comes to systems of interconnected software versus physical infrastructure though.

Re:No, your denial of reality is propaganda.

[gweihir]

What evidence? I have yet to see any. At this time, this are all unproven accusations, with zero actual evidence and some really hard-to-believe claims. For example, that an NSA member would take NSA attack software and put it on his private computer that is connected to the Internet and runs AV is not credible at all. Seriously, doing so is a federal crime and the people with access to this stuff _now_ that. They also know how AV works and that their private computers may be compromised if connected to the Internet.

Don't get me wrong, if there were solid evidence, then that would be pretty interesting, but there is not. All there is is propaganda claims that turn out to be based on hot air once you dig a little deeper and some of them do not even make sense at all.

Re: No, your denial of reality is propaganda.

[gweihir]

Indeed. You have just explained why you must not run _any_ AV on critical systems and why you must not run Windows or MacOS either.

Re: No, your denial of reality is propaganda.

[gweihir]

You take the same chance with US AV. If they can hack Kaspersky (who are really good), then they can hack the other AV vendors as well. And no, Kaspersky will not have cooperated. They are not suicidal.

People thinking that Kaspersky being based in Russia is a special risk are kidding themselves.

Re: No, your denial of reality is propaganda.

[BlueStrat]

The problem with it is the fact that it calls home to Russia with data about the system(s) it runs on. Kasperski's own web page says this.

Relations between the west and Russia have soured a bit, and people like Obama and Clinton and other war mongers have been pushing for a conflict with Russia. It's not a big stretch of imagination that a Russian General would utilize kasperski's AV software to deploy a Stuxnet type code on U.S. systems if a military conflict came about.

We can't take that chance

Russians have no particular interest in me, pose no threat to me personally, and cannot throw me in prison. My own government, on the other hand, incarcerates a huge percentage of the population and poses a significant and local threat to my life & freedom and have also been shown to use illegal/unconstitutional methods and practices to achieve their goals. They are actually *more* criminal than those stealing CC details.

I have far more to fear from the US government than from the Russians.

Strat

Re: No, your denial of reality is propaganda.

[Killall -9 Bash]

Israeli crypto nerds broke into Kaspersky's network. They found that Russian crypto nerds had already done so, and were using Kaspersky's resources to collect intelligence on NSA spyware Kaspersky was finding.

Moral of this story for me: The only AV vendor I trust to not be fucking me with backdoors and malware got hacked not only but the ruskies, but by the jews. I guess it's hard to run a secure network with Intel IME on every fucking motherboard.

TL;DR-- NSA is butthurt that their toys keep getting stolen.

Re: No, your denial of reality is propaganda.

[Anonymous Coward]

This is probably true. Possibly also the control of Russian company is more difficult than of one which one can force to cooperate with a court order.

Why? What job do you think SVR/FSB do?

[vityok]

Of course russian intelligence services are using Kaspersky for their own purpose.

Why install any?

[RhettLivingston]

Are antivirus programs really worth the impact on your machine? They use a surprising amount of resources and many experts have voiced opinions that the threats are outrunning their capabilities.

If you want to visit a site that might contain malware, just start a VM or boot a CD-based OS that doesn't use your drives.

When was the last time your antivirus actually prevented an infection? If it did, it definitely told you because they do everything possible to keep your fear level up.

Re:Why install any?

[mwvdlee]

If you want to visit a site that might contain malware, just start a VM or boot a CD-based OS that doesn't use your drives.

You do realize that includes literally every single website, right? Including this one.

Re: Why install any?

[scumdamn]

Block ads, update regularly, don't download shit if you don't know what it does. I have never had an antivirus program on my personal computer and I've never had problems.

Re:Why install any?

[AmiMoJo]

I started doing that after the Snowden leaks showed that GCHQ was actively attacking users of this site.

Re: Why install any?

[mwvdlee]

I have never had an antivirus program on my personal computer and I've never had problems.

How do you know? Were you expecting popups and silly effects? Were you expecting the virus to inform you of it's wrongdoings in some way?

Re: Why install any?

[jedidiah]

> If you worked in an organization which relied on email, you'd very quickly see the point of a good antivirus.

You mean one filled with idiots that click on the stuff that you obviously shouldn't click on?

Although the real problem isn't the dufus but the tool that even allows that to happen.

I remember when the idea of an "email virus" was laughed at. It's a shame that Microsoft changed that. It's baked in the idea of "running random untrusted shit". Almost makes it impossible to get away from.

Re:Why install any?

[barbariccow]

You do realize that includes literally every single website, right? Including this one.

I did get a pop-under ON THIS SITE a few days ago (running on Linux) where a voice told me my windows system was scanned and a serious flaw was found, and I had to update flash in order to secure myself. I closed all browser windows, but the voice kept going for a few seconds. I chalked that up to buffering though.

Re: Why install any?

[barbariccow]

If I'm not mistaken, in comes in powder form. You add it to milk. You can eat it, and in fact you must explicitly modify/create a derivative of the original (probably a violation of some DMCA provision) to drink it.

Re:Why install any?

[RhettLivingston]

Most malware is of no consequence. I run ad blockers, https everywhere, noscript, and other tools that seem to control it with no problem without the need for an antivirus. I do run malware scans occasionally but have never found anything.

I have on occasion turned off the extensions (while running in a VM) and cannot understand how people use the current web without them. Virtually every site is pretty much broken under the weight of the ads. On many pages, it is very hard to find the main content. Even when you do, it is just a strip of text that is very annoying for someone whose subconscious normally scans surrounding text for context in understanding the area actually being read.

Still, if I have a need to visit a site that I know contains extensive malware or, on occasion, to intentionally download software that I am near certain is malware infested, I usually use a VM that runs from a CD-image and has no virtual hard drive or (if I need to run it on Windows) has a virtual hard drive with change history so that I can revert the hard drive afterwards.

So, the main vulnerability I have would be a zero-day on a mainstream site. That is a vulnerability that will get through most AV products anyway.

As for email that others have mentioned, I do use it extensively. However, I have not seen a spam message in my box in years, don't use a local client, and don't click on attachments. That seems to be pretty safe.

Yes

[DrXym]

And any other AV software. While it's doubtful Kaspersky or any other firm would bother spying on "low value" targets and the software behaves as intended it's still intrusive, destabilizing and slows down the system. And if Russia wanted to be malicious, e.g. shutdown computers in the runup to something, I'm sure the software's AV update mechanism would give them the means to do so.

Of course if I were in Russia I would have my doubts about running US software for the same reason. As a rule of thumb, don't trust code produced by your main adversary.

Re:Yes

[helga the viking]

Its not unprecedented in the IT world to have an entity push something through an 'update'/'backdoor' that stops a computer from working. Replace the word russian government with microsoft windows update There's your precedent.

Re:Yes

[Zocalo]

Yes, you could say exactly the same thing about the equivalent tools make by companies based in the US/EU/China/wherever, depending on where you happen to live. Everyone spies on everyone, so we might as well assume that governments subvert popular software/hardware/services as well, right? So, assuming that you are a low value target to state actors, then the question becomes more about which of the following scenarios you prefer:

1. A tool that has been backdoored by some third party country that likely doesn't give a crap about your low value data and petty misdemeanors, even if they do decide to take a peek.
2. A tool that has been backdoored by your own government, and may well decide to share that information with other government organisations, and possibly even "friendly" companies/organisations like the **AAs, assuming that they decide to have a peek.

Personally, I think the former option is the safer one given the all pervasive surveillance states many countries seem to be turning into, signature updates to brick PCs in the unlikely event of a sufficiently large scale shooting war breaking out aside. All bets are off if you're not a low value target, of course, but if you are in that position then you'd probably want to be looking at a more in-depth security model that doesn't allow potential compromises such as the one allegedly impacting Kaspersky AV to be a complete deal breaker.

Re:Yes

[tero]

> Of course if I were in Russia I would have my doubts about running US software for the same reason

I think that applies to the rest of the world outside US and not just Russia. American government has been the nr 1 information collector for a long time.

Actually it's been shown that American agencies even spy on US citizens. So you're not safe from government oppression even on US soil.

Basically: If any government intrusion is part of your personal threat model... you need to proceed very very carefully. If it's not - well Kaspersky's AV is just as good (or bad) as anyone elses.

Re:Yes

[Zocalo]

Even more specifically, there have been any number of incidents of AV vendors pushing bad updates too. Now, who's to say that at least *some* of those bad updates were not done deliberately to cause disruption to one or more of their recipients? It would be trivial for a vendor in the pocket of a state actor to work out when Target #4796617's next AV update is due and start pushing out a bad patch just before that scheduled update then pull the update once they know they've got a hit.

Re:Yes

[Billly Gates]

Not saying I agree with what you are saying but I would rather drink a poison of an American corporation (I am American) than the Russian government/hackers anyday. ... actually to give me a +mod 5 Linux would be the best way but even Ubuntu was caught doing telemetry. Yes, I am using Chrome too typing this but no other good modern browser exists so what choice do I have?

But in the real world I want a usable desktop and be able to edit my resume and work on spreadsheets that look the same on my bosses Windows based PC. That means Windows like many users.

Man things are depressing these days.

Re:Yes

[Billly Gates]

Even more specifically, there have been any number of incidents of AV vendors pushing bad updates too. Now, who's to say that at least *some* of those bad updates were not done deliberately to cause disruption to one or more of their recipients? It would be trivial for a vendor in the pocket of a state actor to work out when Target #4796617's next AV update is due and start pushing out a bad patch just before that scheduled update then pull the update once they know they've got a hit.

Yeah, but the insidious problem with Kaspersky is the Russian government is so corrupted with the Russian Mafia who are tied to the criminal ramsonware and malware that you can't trust them especially! Even if you use an American one that the US has the private keys for you can be assured there is no Mafia or criminal gangs associated with them as well.

Re:Yes

[Opportunist]

Israelis caught them being used to spy upon it's users which is why it is banned by the US government. In addition it replaces SSL certificates with their own doing MITM attacks and sniffing de-encrpyting your data.

Care to show us how to scan the content of encrypted traffic for malware without? Me and the makers of a few proxies and firewalls would like to know (hint: They all do exactly that).

Re:Yes

[hcs_$reboot]

AV slow down systems for a reason. Do you have evidence a regular windows 10 user can rely on "defender" to protect their computer, having no other AV?

Re:Yes

[guacamole]

Why should we always trust what Israel's intelligence says without offering a tiny bit of evidence? And hasn't Israel itself hacked into other's computers and planted nasty time-bombs there? (stuxnet)

Re:Yes

[jedidiah]

The EU? Are you fucking joking? They go ape shit any time we decide that they should pay for their own defence budget. The whole lot of them put together couldn't deal with Russia. They've been "on the dole" for far too long.

Re:Yes

[Opportunist]

Correct, but I still miss any kind of indication that someone controls both endpoints.

Re:Yes

[Tony Isaac]

Disabling antivirus might work for computer-savvy people like yourself. But consider the many employees and individual users who have no clue about safe links! Trust me, if an unknown person sends an email to all your employees promising something free for clicking a link, some people WILL click it. I know because my company conducts regular security audits which include just this kind of simulated attack. At least one person in every department clicks the suspicious link, every time.

Re:Yes

[drinkypoo]

You are assuming that the us and Russia are not sharing information. This is an unsafe assumption. Some foreign government that doesn't give two shits about me might trade my data (along with that of many of my fellow citizens) for data on their own citizens, collected by my government. Paranoid? Bollocks. There is and always has been information trading, why not this information?

Nyet

[azrael29a]

Nyet.
Obligatory russian hackers joke.

Depends on the threat.

[king neckbeard]

All AV software should be treated as if compromised by it's country of origin. So, whether or not you should uninstall Kaspersky is who you are worried about.

If the biggest threat to you is ordinary criminal malware? No.
If the biggest threat to you is Russian intelligence? Yes.
If the biggest threat to you is US intelligence? No.

Re:Depends on the threat.

[Bert64]

Not just AV software, *any* software...
The russians only use kaspersky as a backdoor because very little russian software is widespread outside of russia.

Yes

[Billly Gates]

Israelis caught them being used to spy upon it's users which is why it is banned by the US government. In addition it replaces SSL certificates with their own doing MITM attacks and sniffing de-encrpyting your data.

I noticed Google Chrome even hides certificates now in the address bar after AV software was caught doing this! Coincidence?

Not only would I uninstall it. I would re-image too if you have to use Windows. You can't trust whatever backdoors or spyware Kaspersky could have changed in the Windows Registry or done to your system.

Yes. And ...

[Qbertino]

... you shouldn't use any operating system or computer work environment that needs to rely on anti-virus software to relyably function.

Glad I could help.

Re:Yes. And ...

[thegarbz]

... you shouldn't use any operating system or computer work environment that needs to rely on anti-virus software to relyably function.

Glad I could help.

So we shouldn't use anything period? You weren't much of a help.

If you can, then you don't need to, but...

[shanen]

Think about it for a minute.

Would truly malicious software actually allow itself to be uninstalled? If the Kaspersky people are competent at what they do, and if they are doing it for Putin, then you are in a world of hurt. The question of "Should you uninstall?" is relatively trivial compared to the big questions of "Are you able to uninstall the software?" and "How can you be sure you really got rid of it?"

The makers of the best anti-virus software (which might be Kaspersky for all I know) would know about every backdoor into your system and every way to hide bad code. If that company was evil or suborned for evil purposes, that same knowledge would make it impossible to remove their software unless they REALLY wanted to let you remove it.

All things considered, especially things like how good Putin is at manipulating people, at this point I'd have very little trust in any computer that ever ran any software that originated in Russia. Or even software that was exposed to Russians who have family members still living in Russia.

Technology remains morally neutral. Putin and his kleptocrats? Not so much.

Before commenting, I searched this discussion for prior statements of this obvious reality. Didn't find any, but maybe I just hadn't thought of the right keywords yet. So I'll try another search now...

Re:If you can, then you don't need to, but...

[edx93]

While I do sympathize with what your comments, I fundamentally disagree.

Would truly malicious software actually allow itself to be uninstalled? If the Kaspersky people are competent at what they do, and if they are doing it for Putin, then you are in a world of hurt. The question of "Should you uninstall?" is relatively trivial compared to the big questions of "Are you able to uninstall the software?" and "How can you be sure you really got rid of it?"

You're right, If they really worked for Russia, I'm sure uninstalling it would be as futile as resisting an alien invasion. But:

"It's a big deal," says Blake Darche, a former NSA cybersecurity analyst and the founder of the cybersecurity firm Area 1. "For any consumers or small businesses that are concerned about privacy or have sensitive information, I wouldn't recommend running Kaspersky."

Really? The NSA is concerned about our privacy now? Honestly, this stinks as political propaganda (on our part). Furthermore, I had a chat with an acquaintance / friend in computer security a couple of days ago where we literally talked about just that (he worked for Kaspersky). In short, he had great things to say about the people at Kaspersky (incredibly smart and talented people) and agreed with my statements above. Also, he's 100% American, born and raised.

It could very well be that the upper echelon of KL is in cohoots with Putin, but like I said, this whole thing stinks of political propaganda. Either way, the best thing is to use an OS that doesn't rely on antivirus (Linux / Mac OS FTW :-)

Re:If you can, then you don't need to, but...

[Anonymous Coward]

I love a good conspiracy theory. This isn't one of them.

Would truly malicious software actually allow itself to be uninstalled?

Yes. No software can be 100% effective at evading detection because said software must be running, and if it's running then it has some impact on the system, and that means it's detectable. If anything, malicious software pretending to be good should allow itself to be uninstalled: if it's discovered that the "legitimate" software left active remnants on the system* then that calls into question whether it is, in fact, legitimate and suddenly there's an uproar. That's bad news for the maker and leads to a chanting chorus of "Uninstall!"

"But Kaspersky is smart. They're antivirus, after all, so they know the nooks and crannies."

That's true, but the majority of people who actively uninstall antivirus are doing so to install something else [citation needed]. Which means a different antivirus program will start inspecting the nooks and crannies... All it takes is the right signature or heuristic to discover the deception and it's game over.

* Not counting dumb things like configuration files or registry entries, which unfortunately nearly every program leaves behind to some degree.

All things considered, especially things like how good Putin is at manipulating people, at this point I'd have very little trust in any computer that ever ran any software that originated in Russia. Or even software that was exposed to Russians who have family members still living in Russia.

Question: how much do you know about Putin and Russia that wasn't told to you by western governments and media? I'm not saying he's a saint but propaganda goes both ways.

Honestly, when Kaspersky first hit the news a few weeks back, I thought it sounded exactly like propaganda: it's inflammatory, it reinforces the Cold War mentalities of western/American is being good and Russia is being bad, it's nearly impossible for anyone to refute, and most importantly it's believable. Everybody wants to think that the government is spying on them, and now conveniently attention is moving from the NSA to the Kremlin.

Did the Russian government hijack Kaspersky for their purposes? Maybe. I believe the news that says they worked to undermine the elections, however taking over a major software company is quite a step. But there's no way for me or the people around me to know for sure so all we can do is listen to what others are saying.

Re:If you can, then you don't need to, but...

[Anonymous Coward]

Think about it for a minute.

Would truly malicious software actually allow itself to be uninstalled? If the Kaspersky people are competent at what they do, and if they are doing it for Putin, then you are in a world of hurt. The question of "Should you uninstall?" is relatively trivial compared to the big questions of "Are you able to uninstall the software?" and "How can you be sure you really got rid of it?"

The fucking irony of asking these questions when uninstalling the very security mechanism that is designed to prevent malicious software from being installed.

You want to run your Windows environments without anti-virus/malware protection? OK. Good luck. Chances are Putin is a hell of a lot less interested in your computer than a virus is.

Re:If you can, then you don't need to, but...

[shanen]

I think it's a typical Slashdot response of unjustified hostility and disagreement. When in doubt, scream and shout. It's the Slashdot way.

I didn't say anything about American antivirus software being any more reliable or trustworthy or uninstallable than the Russian stuff. I suppose the amusing paradox here is that whoever is best at detecting malware becomes the least trustworthy precisely because they would also be the best at evading detection of their malware by other antivirus software.

However, I do have to say that I do not agree with you about either of your examples of OSes that don't rely on antivirus software. They need it just as much, even if they can't rely on it. (I use at least 4 OSes these days, but probably around 8 if you count by versions.)

The most dangerous delusion is that you or your computers are safe. Unfortunately, I don't have any real solutions to offer. The problems are really difficult and in any contest between amateurs and experts, I'm going to bet on the experts and I know that I'm no expert when it comes to computer security (and even though friends and acquaintances seem to think I know a bit about the field). Or as the old joke puts it: âoeThe race is not always to the swift nor the battle to the strong, but thatâ(TM)s the way to bet.â (Attributed to Damon Runyon)

Hmm... Is it even worth the effort to see humor in this active topic? The "funny" shortage on Slashdot is reaching crisis levels...

Re:If you can, then you don't need to, but...

[jeff4747]

The problems are really difficult and in any contest between amateurs and experts

This slightly mischaracterizes the situation.

It's a contest between one person (expert or not), and tens of thousands of experts.

Since we don't live in a movie, I wouldn't put my money on the one person.

Re:If you can, then you don't need to, but...

[Anne Thwacks]

Since we don't live in a movie where is the evidence for that assertion?

Me? I am relying on Batman!

(and avoiding closed source software).

Re:If you can, then you don't need to, but...

[Anne Thwacks]

IMO you should physically destroy anything that Windows conceivably could have been installed on.

FTFY

Re:If you can, then you don't need to, but...

[Bert64]

Well typically by "uninstall" you are relying on a script provided by the software to do what it claims, there's no overriding package manager keeping track of what was installed and cleanly removing all trace.

Re:If you can, then you don't need to, but...

[drinkypoo]

It depends. If the software's source cannot be denied, then yes they will let you uninstall it so that it's not obvious what they are up to. Compare windows 10

It's Simple

[skam240]

It's simple, Russia has gone out of its way to make itself an adversarial state to the US (of which I am a member). The Russian government has also been very heavy handed in dealing with its own private sector often dictating how they conduct business and very much muddling the lines between free enterprise and government controlled. This all equals, don't trust "security" provided by the Russians.

Now one can go on with "Americans spy on everything" and yeah, I don't like that. But as a US citizen I like Russians spying on me even less that Americans.

Re:It's Simple

[Anonymous Coward]

But as a US citizen I like Russians spying on me even less that Americans.

Why? Assuming you're not a very high profile international target (then things change), what do you have to fear from Russia?
Putin himself could know everything about your whole life and it wouldn't change a thing, as they have no way to affect your life. However, your own nation having all this info on you can quite certainly be used against you, with or without you realizing.

I think you have your priorities wrong.

Re:It's Simple

[skam240]

What a convenient conspiracy theory. Fact is in the last Ukrainian election pro Western candidates won handily. I have seen no evidence for your claims meanwhile there is plenty of evidence for Russia being in Georgia and Ukraine.

Re:It's Simple

[skam240]

Anyone curious about Russian influence in our forums should visit these two responses to my post.

https://slashdot.org/comments....
https://slashdot.org/comments....

Sure, Russia is our friend alright!

It depends

[terbeaux]

Do you want the Kremlin to have your data or just the NSA? The idea that the NSA regularly collects data from US citizens is well documented. The idea is tenuous that Kaspersky is colluding with the Russian government to export data from USA targets to Russian intelligence. Endpoint security relies on central services understanding what is going on in the world. This can be referred to as operation intelligence. Kaspersky sense data back into "unsecured channels" and may include data that DHS considers sensitive. I would personally want the best antivirus or malware software that identifies the most vulnerabilities and I don't give a damn which nation illegally collects my data. If they want to exert power over who collects it then they should be open about how they collect it.

Re:It depends

[Baron_Yam]

It's far less likely that an average citizen of the USA will find the KGB using data against them than their own government. As long as the Russians don't have an interest in you for intelligence gathering, you're going to be ignored and the data will go in a big Russian bit bucket.

Now, anything the NSA gathers on you? That's held to use against you. You're in their backyard and as long as computer processing power keeps increasing, they will keep increasing their data collection and mining operations so they know as much about you as possible, which - whether they ever use that data or not - has a 'chilling effect' on you as a citizen.

Unfortunately, if you're running Windows... you've already lost because Microsoft collects most of what can be collected AND has the keys to your OS for anything more that might be wanted, and the NSA can get whatever they want out of Microsoft whenever they want.

An ultimately pointless effort?

[The Cynical Critic]

I'm not sure dumping a particular vendor because of their country they operate out of is all that useful when there's already been at least one major breach trough the antivirus software by tricking it into downloading malicious updates from the attacker's own servers. The perpetrator of this particular hack was North Korea, but we know that there's at least half a dozen other countries, on both sides of the old iron curtain (which seems to be going up again), so you're never going to be fully safe from breaches using your choice of antivirus software.

Sure, you can use a vendor like F-Secure that operates from a country where the laws don't even allow for this kind of thing, either by request by the government of the country or by the request of a foreign government, but all that really does is increase the skill and effort barrier to pull off a breach using anti-virus software.

No (At least not because they are Russian)

[houghi]

The thing we know is that the NSA and Israel do not have access to the code. We know that Russia tried to get into Kasperski and that means they do not work with them.
We know that the NSA warns against them.

To me all this tells me they are the safest bet for security of any of the anti-virus companies.

My guess is that the NSA has back doors in the rest and if they have them, the rest has as well. So even IF the Russians have hacked them, they are still more secure than any other AV program who must be assumed to have been hacked by everybody;

Re:No (At least not because they are Russian)

[Zocalo]

That's the big question though, isn't it - who had access to the code? Even if we assume (and I see no reason not to) that the Israeli's are telling the truth about the FSB using Kaspersky AV to commit espionage rather than just supporting some US FUD, we actually still have no idea whether they were using code that was deliberately placed there by Kaspersky at the behest/insistance of the FSB, or a coding error that the FSB exploited in the same manner that the NSA has demonstrably exploited numerous tools. Note also the careful wording of the public versions of the Israeli announcement - they are making absolutely no assertions about whether or not Kaspersky Labs was aware of the flaw, just that the FSB was exploiting the software.

We should absolutely assume that the FSB has a similar programme of finding and exploting zero-day exploits to the NSA, so what really matters now is how Kaspersky Labs responds. Addressing the issue of the flawed code is easy enough, especially if they Israelis have treated it as a bug and shared the details with them, but the real trick (regardless of whether they are in the pocket of the FSB or not) is going to be to convince people they really didn't have any knowledge of this and it really was a zero day discovered by the FSB. That's going to be tough, but perhaps not impossible - don't forget that they have a pretty good track record of exposing various hacking groups, including some that are almost certainly Russian government sponsored, and was instrumental in pinning Stuxnet on the US and Israelis so there's history there as well..

Re:No (At least not because they are Russian)

[jeff4747]

We know that Russia tried to get into Kasperski and that means they do not work with them

You sure about that? I'm pretty sure the Ksaperski employees who are not in Russian prison would be quite willing to cooperate to avoid what happened to their colleagues.

Re:No (At least not because they are Russian)

[houghi]

Ok. Here in more details if it is worse case:
Everybody has access to everything.
Best worst case
The NSA has no access to Kaspersky, but has to the rest.
The FSN has access to everything.
The worst best case
Nobody has access, except the FSB who have access to only Kaspersky
The best case
Nobody has access to anything.

Only in case 3 does it make sense not to use Kaspersky and that is the 2nd least likely. So the Russians will have access anyway. The question now is: do you give the NSA access as well or not?

Re:Yes, of course uninstall it. Don't be a traitor

[Opportunist]

Russia has been found to be using Kaspersky to spy on Americans, as part of their ongoing cyberwarfare campaign against the United States.

Really? Could you link the article?

Damn, be out of town a few days and all hell breaks loose!

Wait, the NSA wants me to?

[Opportunist]

If some reputable source would say it, I would certainly start rethinking my privacy strategy. But considering who's "recommending" this, I have to second guess whether the reason is that it keeps them from spying on me...

If I had told you 40 years ago that you can't trust one of your TLAs when they warn about Russians...

Bitdefender?

[mattr]

How about buying Bitdefender instead? Was just about to decide on Kaspersky but...

Anybody like it?

Should users uninstall their AV software?

[Artem S. Tashkinov]

This is the question that needs to be asked.

Here's a list of the features that every AV has:

• It doesn't fully protect you.
• It slows down your OS.
• It interferes with your OS functions.
• It makes you trust unknown software with dubious functions.
• It potentially makes your PC less secure, because AV needs kernel level drivers.
• It may potentially be used to gather any information/spy on you without your knowledge.
• Most AVs are dumb as fuck which means they cannot intelligently tell bad software from good software. Their heuristics is either a joke or a joke which makes your PC slow as hell.

Either your OS has means of protecting your data from apps, or apps from each other, or you cannot use this OS to run any new/unknown software.

Windows can be made more or less 100% secure if you use SandBoxie.

Re:Should users uninstall their AV software?

[zifn4b]

It potentially makes your PC less secure, because AV needs kernel level drivers.

Explain based on your thorough knowledge of Antivirus software, Virus design and user mode and kernel mode software development experience, how it is possible to do this without a kernel mode driver? I await your thoughtful response. If you don't have one, STFU because you're an idiot

Re:Should users uninstall their AV software?

[Artem S. Tashkinov]

I've already said that an OS which requires an AV in order to guard apps/data is not the OS you should be running in the first place.

Also, I am indeed a raving idiot because I don't have an AV installed and for my 25+ years of computer usage I've never been infected or lost my credentials (aside from companies leaking them, e.g. Adobe). That couldn't be attributed to sheer luck, right? Windows is inherently insecure and an AV gives you a false sense of security as indicated by literally tens of millions of examples when people have got infected while having a fully updated AV installed and running.

Re:Should users uninstall their AV software?

[zifn4b]

I've already said that an OS which requires an AV in order to guard apps/data is not the OS you should be running in the first place.

Also, I am indeed a raving idiot because I don't have an AV installed and for my 25+ years of computer usage I've never been infected or lost my credentials (aside from companies leaking them, e.g. Adobe). That couldn't be attributed to sheer luck, right? Windows is inherently insecure and an AV gives you a false sense of security as indicated by literally tens of millions of examples when people have got infected while having a fully updated AV installed and running.

I asked you a direct question: How does one offer an antivirus solution that does not involve a kernel mode driver? And you failed to respond. Thanks for playing!

Re: Should users uninstall their AV software?

[black3d]

Except he wasn't arguing that you should run an AV that doesn't require kernel mode drivers. He said you shouldn't be running AV at all. You asked him to provide a solution for something he never suggested.

Re: Should users uninstall their AV software?

[zifn4b]

Except he wasn't arguing that you should run an AV that doesn't require kernel mode drivers. He said you shouldn't be running AV at all. You asked him to provide a solution for something he never suggested.

He made the claim "It potentially makes your PC less secure, because AV needs kernel level drivers." I prompted him for a basis for this claim and none was provided. Now if we want to discuss a different claim: like Antivirus software is more bad than it is good. We have to provide a basis for the claim usually in the form of evidence and/or subject matter expertise. When a person makes a claim like "It potentially makes your PC less secure, because AV needs kernel level drivers" yet doesn't appear to have the expertise or education to actually substantiate the claim or even explain the claim, the person's claim becomes suspect based on the evidence provided.

I would ask OP to be more clear about what their claim is and what the actual evidence is for the claim. If one can't do that then they should not have made the claim. I am highly educated on the subject matter and I see no reason to provide the technical information to someone who appears to have made a baseless claim and in a pseudo-intellectualist manner because it's likely that person won't be able to understand it anyway.

Finally in summation: If a person doesn't know what they're talking about, they should not be giving advice to others on serious topics like this. Do you really want grandma ending up with ransomware on her computer? Neither do I.

Re: Should users uninstall their AV software?

[Artem S. Tashkinov]

I perfectly understood what I said, and you keep arguing about something absolutely irrelevant.

I don't fucking care that AVs require kernel level drivers - that was not the point of my statement. The point was that by doing so they make the underlying OS a lot less secure because they make the attack surface a lot wider. A perfectly built OS does not require an AV. Check iOS, Android (to a lesser extent) and UWP (on Windows) - neither of them require an AV to stay secure.

Now fuck off, please, a wanna-be-security-researcher. You've written pretty much three completely inane paragraphs. I don't even understand why I decided to reply to your comments. A complete waste of time.

You should...

[zifn4b]

Research your options and choose what you feel is best for what you personally need. I would not consult Slashdot for advice.

Uninstall Krapersky

[MoarSauce123]

Krapersky shovels tons of data from your system to servers in Canada and Russia without any explanation as to why this is necessary. That traffic is easy to spot and can be blocked, but it is a clear signal that you are better off with no AV than with Krapersky. And without Krapersky system no longer need half an hour to boot up and your browsers start working right again.

go one step further

[FudRucker]

remove MS_Windows & install Debian GNU/Linux https://www.debian.org/

Users

[SCVonSteroids]

Should just be careful what they download and what links they click on.

Re:Users

[Baron_Yam]

>Should just be careful what they download and what links they click on.

Yeah, you wouldn't want to accidentally drink polonium tea after posting an insult to Putin on social media...

As an individual, NO

[JamesKauffman]

I've had Kaspersky Internet Security for a couple of years now. It's my understanding that Russian law is similar to Chinese law about software--to sell in those countries, you must provide the government with your source code. I have no doubt the Russian spy agencies found an exploitable vulnerability in that source code and have been using it. I'm no more worried about that than the NSA's covert knowledge of vulnerabilities in Windows. And I place little credence in anything that Israeli intelligence says. KIS works very well on my system and doesn't slow it down. I accept the privacy risk, because information privacy is pretty much non-existent in these times, except perhaps for Tor. I don't keep work materials on my home system for exactly that reason. I'm going to support Kaspersky by keeping it on my system at least until my license expires. I'd hate to see a quality company have to shut down for lack of sales from an incident that wasn't their fault.

No

[AHuxley]

Help find the next
Stuxnet
Flame
Equation Group
Duqu
https://en.wikipedia.org/wiki/...
A more secure and safe internet is great news for all users.

Re:Why only kasperskys?

[AHuxley]

Equation Group would have worked if not for?
https://en.wikipedia.org/wiki/...

Should users use Linux...

[fbobraga]

... and don't use an antivirus software?

No, because it makes no difference whatsoever.

[black3d]

Since the OS it's running on top of is already deeply rooted by the NSA, what difference does it make if another spy agency has a zero day for one particular program I'm running on there? Hell, I'm sure both the KGB and NSA have zero-days for half the software I run on my PC. It takes a good half-hour of regedits, scripts and service disabling just to turn off telemetry in Windows 10, and that's just the stuff you're meant to know about.

If I was working on documents that I really needed to keep secret from a state-sponsored attacker, I'd need to air-gap that shit. Whether I was running Windows, Linux, or XBMC.

As it is, while Kaspersky won't keep state-sponsored attackers out (and neither will any other AV, or Windows Defender), it does a darn good job of keeping non-state-sponsored attackers out. And if a malicious attacker gets access to the same kind of tools a state-sponsored attacker does, it makes no difference whether I'm using Kaspersky or something else.

Unless someone can show me that Kaspersky puts me MORE at risk from non-state-sponsored attackers than a competing AV (or no AV at all), then swapping one out for another makes no difference. And no, "a hacker could get a-hold of KGB's zero days" is not an argument against Kaspersky, since a hacker could also get a-hold of NSAs zero days which don't target Kaspersky.. you know, like the whole dump of NSA zero-days that was dumped.

Re: No, because it makes no difference whatsoever.

[black3d]

Naw, the analogue would be that Kaspersky is your accounting software, and the attacker is the accountant. You don't stop doing accounting just because one accountant has a way to screw with your books. The point is, all accountants have a way to screw with your books, no matter what accounting system you're using. Swap out you accounting package, and another (or the same) accountant are able to screw with that as well. If you want to keep your accounts safe, lock them all in a vault that accountants can't access.

NoScript is the best AV

[guacamole]

In the last 10 years or so I have used a Windows PC with anti-virus software to visit an incredible number of web sites of extremely shoddy origin and appearance and I used various p2p software to download all sorts of content on almost weekly basis. As a result, the AV software caught positives may be two or three times in that whole time, and every time this was "there is a dangerous ClickMe.EXE in your torrent folder! do not touch!" (well, what sort of idiot would click that anyways?). Why haven't I run into more alleged viruses? I guess it's because most of the time I used Firefox with NoScript extension. NoScript is sort of a pain to use, because you first need to teach it to allow scripts from all web sites that legitimately need to run scripts, like a forum, eCommerce, or say your bank.

Simpler solution

[yelvington]

Uninstall Windows.

Kasperksy should go open-source

[guacamole]

If Kaspersky wants to continue selling its software in the west, I think the only way they can convince everyone that they're NOT providing a backdoor in their software to FSB is by going open source. That is, they should make their AV engine open source, and but the virus definition data could be provided as a paid subscription.

It depends

[JohnFen]

Antivirus programs cause all kinds of trouble. I suggest, for people who are able and willing to stay alert and investigate warning signs, not using any antivirus program at all. Use a tripwire system instead.

If, however, you're the sort who ignores warnings and red flags, then use an antivirus program. Should you use a different one over Kaspersky? I don't think it matters that much.

I have no antivirus

[mevanchik1695]

and never been seriously infected. I also run as administrator, I maybe in it, but I'm calling user issue

No

[Anonymous Coward]

Kaspersky isn't the problem here. Israel hacked Kaspersky.
"Among the targets Kaspersky uncovered were hotels and conference venues used for closed-door meetings by members of the United Nations Security Council to negotiate the terms of the Iran nuclear deal — negotiations from which Israel was excluded. Several targets were in the United States, which suggested that the operation was Israel’s alone, not a joint American-Israeli operation like Stuxnet."

How can you trust Israel's assessment of Kaspersky when Israel is doing the shady shit. The particular Kaspersky anti-virus installed on that government contractor's home computer was hacked by the russian government and used to scan for documents. There's no evidence Kaspersky helped and there's zero need for their help. The russian hackers would lose kaspersky's market penetration if it came out that they helped. Any anti virus could have been hacked and used. The government contractor used kaspersky because it's the best and he knows it. That's the only story here.

https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html?_r=0

Well.....

[MerlTurkin]

DUH! What do YOU think?!

All antivirus SW shall be dumped for WinDefender

[williamyf]

After all, microsoft already has full control of the OS layer, no intermediaries required.

If Microsoft wants to spy on you, they will spy on you, no matter what antivirus you use. So, if you stick to Windows defender, there is one less vector for others to spy on you (because, once you start using windows as your OS, you cede control to Microsoft to potentialy spy on you).

Windows Defender (or Microsoft security essentials, if that's how you roll) are free (as in beer), have decent detection capabilities, does not suck resources like crazy, is updated by the same means of your OS, and is acepted by certifiying agencies in regulated industries (like PCI for credit cards).

Of course, in an ideal world we would all use linux and ClamAV, but this is not an ideal world, some people like their linux, I use a mac, some people like linux but are forced, for one reason or another, to use windows...

So, if you want or need windows, stick with Windows Defender...

Why would Russian government want my stuff?

[iamacat]

The threat I have rational reasons to worry about is domestic and foreign cybercrime. I don't know why NSA would want my data either, but they probably don't need a very strong reason. Kaspersky would be same for defense from the crooks and a little better for defense from NSA, so it's a keeper. Also it would be naive to expect to be able to defend oneself from a major spy agency without training that can probably only be given by another spy agency.

Re:Why would Russian government want my stuff?

[tinkerton]

I don't know why NSA would want my data either, but they probably don't need a very strong reason

They need it 'just in case'. But the NSA only bulk-captures traffic. they're not going to put advanced malware on a large set of computers. Each time you put malware on a computer you increase the chance of being found out so you have to use it sparingly. Being found out on one system increases the chances of being found out everywhere. Now imagine what the Israelis did: sneak in Duqu inside Kaspersky. That's totally reckless. They ruined the package for everyone. That also explains why they're eager to come up with claims they found something while getting back at Kaspersky. What, like two years later?

I'm still wondering what they heck they...

[mark-t]

.... are claiming is evidence to substantiate the notion that it the software is dangerous.

AV should have never existed in the first place

[HBI]

Microsoft failing to secure its operating systems is a painful story that has taken over 25 years to unwind, exacerbated by that internet thing.

Your biggest threat is a social attack on your credentials, which your AV does nothing for. Your next biggest threat is a zero day, which is not something your AV will stop. The next threat on the list is user error, mostly running things you shouldn't on your computer. The purpose of AV is orthogonal to this problem, and the signature-based stuff mostly won't help.

Since AV doesn't stop the most significant threats, it hardly has a purpose. Back in the DOS days, I could make a good argument for it, but today? Nah. You might as well assume compromise, use a password manager and change them frequently.

Change "likely" to "definitely"

[HBI]

What is this American bias against believing that our own government is in the propaganda business the same way every other country is engaged in the propaganda business? Our government lies freely to serve its own aims and always has - and believe me on this, I work for it!

Probably the same way nearly all Americans think the US is based on classically liberal principles like those old Saturday morning civics cartoons rather than being a corporatist fascist state, as it has been at least since the 1930s. Cognitive dissonance is a powerful thing.

Best Buy Complicit

[Ulfilas2000]

About a year ago I bought a new laptop from BestBuy which included a 'Free' Antivirus Software CD which of course I ignored. Was contacted for the next several months asking why "I had not yet installed the free license of xxx antivirus software."

Real Story

[barbariccow]

The Real Story: Kapersky antivirus is able to flag NSA spyware/malware and does not forcibly contain the whitelist of NSA software like American antivirus software.

No Change

[andywest]

Kaspersky is still an excellent anti-virus software, and since I am nobody in the eyes of the nation-states, I will continue to use it. If it goes away, I will not switch to another anti-virus software: I will switch to DeepFreeze and revert to an original state of my computer whenever it is infected.

Interpol

[jacks0n]

China and Russia are running interpol now thanks to Trump's incompetence/treason. Shocker that Interpol now thinks using compromised AV is cool.

Most users should use AV made in the free world

[Etcetera]

No pun intended.

ClamAV is wonderful, but won't be able to keep up with everything you need. For free. It's worth it for everyone who isn't a security ninja themselves to find a reasonable middleground between OCD paranoia on their own, and taking prudent measures to protect themselves. That means commercial security software from a reputable company.

I can't speak for what Russian end-users should use, because I don't know whether *FOR THEM* the greater threat is internal or external to their country. In the days of the USSR, it would be obvious -- the Party is more of a threat to you than external actors. Now? Not for me to say.

For an American citizen, and as a sysadmin, I'm far more worried about economic espionage and data lifting from untargeting third parties (bitcoin extortion that happens to hit me) and spear phishing attacks against companies I work for, potentially from foreign intrigue, than I am about the domestic NSA spying on me via Symantec or another domestic product.

Americans have options, and for someone in a similar position I'd encourage them to weigh the positives and negatives similarly.

Egress filtering?

[h4ck7h3p14n37]

I'm posting this late and no one will probably see it, but I'm wondering how many of you are doing egress filtering on your networks?

I have noticed that a lot of places use a default policy of passing all traffic out, but that's not very wise. I assume it's done for the sake of convenience to avoid support calls from people who can't write firewall rules. I would highly recommend not allowing any traffic out unless it's absolutely necessary and has been filtered. A lot of places pass HTTP/HTTPS traffic directly to the Internet so you can get software updates, but you should probably be using proxies that only allow whitelisted sites to be contacted. Better yet is to deploy new servers instead of patching live ones and give them no outside access.

If someone does manage to get shell access on your host, then your egress filtering should prevent them from opening a remote shell using something like nc. Yeah, they can still trash the internal network, but it's going to be a major PITA without an interactive shell.

What other governments say

[manu0601]

The only sources we have so far about Kaspersky spying are US government officials. Even the Israeli part of the story is reported by them.

An interesting point is that other countries did not rush to ban Kaspersky. It is difficult to believe Kaspersky turned its antivirus into a spyware that only the US government is able to spot.

Re:The Eternal Dilemma

[JohnFen]

If people were actually serious about their privacy, along with uninstalling Kaspersky they'd also stop using anything made/run by Google and Microsoft, stop using all social networks, and would have the most basic of flip phones you could find.

I disagree.

People who are actually serious about privacy understand the exposure involved with every interaction with other humans and systems and make an informed choice about when, where, and how much data about themselves they are willing to reveal in exchange for services they want or need.

Locking yourself in a cave somewhere for fear of losing your privacy isn't taking the issue seriously. At best, it's attempting to avoid the issue. At worst, it's straight-up paranoia.