Slashdot Mirror
Kaspersky Lab To Open Software To Review, Says Nothing To Hide (reuters.com)
Moscow-based Kaspersky Lab will ask independent parties to review the security of its anti-virus software, which the U.S. government has said could jeopardize national security, citing concerns over Kremlin influence and hijacking by Russian spies. From a report: Kaspersky, which research firm Gartner ranks as one of the world's top cyber security vendors for consumers, said in a statement that it would submit the source code of its software and future product updates for review by a broad cross-section of computer security experts and government officials. It also vowed to have outside parties review other aspects of its business, including software development. Reviews of its software, which is used on some 400 million computers worldwide, will begin by the first quarter of next year, it said. "We've nothing to hide," Chairman and CEO Eugene Kaspersky said on Monday. "With these actions we'll be able to overcome mistrust and support our commitment to protecting people in any country on our planet." Kaspersky did not name the outside reviewers, but said they would have strong software security credentials and be able to conduct technical audits, source code reviews and vulnerability assessments.
If they do that, then that's absolutely great and reason alone to switch to Kaspersky. Everybody should welcome this.
Closed-source Antivirus and other security products (encryption, voting machines, credit card processing, etc.) tend to be fairly insecure for lack of external auditing. Companies go at great length to claim how careful they are etc., but the sad truth is that without any external auditing they will allow all kinds of blunders, fix vulnerabilities late and secretly, etc. This has been proven again and again.
It's definitely a step in the right direction. To say more about it, we'll need to see the printed results of the audits and who conducted them.
From my understanding the software "worked as advertised" and pulled back Word DOC and other files for additional investigation. Allegedly those files ended up in the Russian governments hands via that pull back.
So what's an analysis of the source code going to show? That Kapersky sends back Word DOC files? Well... DERP.
The CEO of Kapersky has already defended his software's actions that pulled back code that looked like it was malicious and that they make no apologies for being aggressive in tracking cyber-crime.
More importantly will this release of the source code include their data tables for the signatures and key phrases they detect?
Kaspersky is guilty of "writing code while being Russian".