Slashdot Mirror
Kaspersky Lab To Open Software To Review, Says Nothing To Hide (reuters.com)
Moscow-based Kaspersky Lab will ask independent parties to review the security of its anti-virus software, which the U.S. government has said could jeopardize national security, citing concerns over Kremlin influence and hijacking by Russian spies. From a report: Kaspersky, which research firm Gartner ranks as one of the world's top cyber security vendors for consumers, said in a statement that it would submit the source code of its software and future product updates for review by a broad cross-section of computer security experts and government officials. It also vowed to have outside parties review other aspects of its business, including software development. Reviews of its software, which is used on some 400 million computers worldwide, will begin by the first quarter of next year, it said. "We've nothing to hide," Chairman and CEO Eugene Kaspersky said on Monday. "With these actions we'll be able to overcome mistrust and support our commitment to protecting people in any country on our planet." Kaspersky did not name the outside reviewers, but said they would have strong software security credentials and be able to conduct technical audits, source code reviews and vulnerability assessments.
(... except backdoor.c.)
Kaspersky is the one that identified the NSA and CIA tools right.....and Stuxnet
cant have those pesky east europoors discloing their debauchery
I'm not making any kind of statement as to whether or not Kaspersky has done anything they're accused of, but what could they possibly do to prove to you that the accusations against them are false with statements like that? Let's be realistic here and recognize that fully open sourcing the product isn't a viable option.
At least in the US, people are supposed to be innocent until proven guilty, but we always seem ready to convict companies like Kaspersky in the Court of Public Opinion based on little more than a wild accusation completely devoid of evidence. I'd like to at least see some actual evidence be presented that independent experts could test.
Kaspersky is guilty of "writing code while being Russian".
I'm sounding like a broken record posting the same kinds of comments to these Kaspersky stories. The software itself isn't the issue. What does antivirus software do? Reads files, analyzes them for various content / fingerprints, transfers any files it deems "suspicious" files back to the company for "analysis" (default setting, unless disabled by the user), and modifies and deletes files. Same with the system registry. There will be no surprises here - we already know the software has total access to read and write to anything on the system and transfer our files to 3rd parties.
The issue is the dynamic control of the software, not how the software was written. That is in the form of antivirus definitions, which are the fingerprints to identify malicious code, and the scripts used to clean (or simply delete) infected files, which are pushed to the software practically daily. THAT is the issue - who controls the behavior of the software. Let's go worst-case and assume Russia wanted to weaponize Kaspersky antivirus. All they have to do is force the company to identify a few key pieces of Windows OS as malicious files, and delete those files as the way of quarantining the malware. Suddenly millions of Windows machines stop working. How does having access to the source code prevent that?
What we need is antivirus definitions that are controlled by some neutral "open" body that we can actually put some trust in. Currently, I rely on Microsoft's antivirus software. Why? Well, they already hold the keys to my system. They can already screw me over with a bad OS update (and it is harder and harder to disable automatic updates with each new version of Windows). So at least them having the ability to also screw me over with a bad antivirus update doesn't represent an entirely new vector by yet another 3rd party.
Better known as 318230.
Build it and compare the result to the published binary?
Say, is it me or is it kinda odd that the accused has to prove his innocence? Last time that was due practice people got a cremation without prior demise.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The previous administration didn't care about facts either. Or the administration before that, or the one before that.
Quit pretending that this is unprecedented.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.