Slashdot Mirror
US Government Can't Get Controversial Kaspersky Lab Software Off Its Networks (thedailybeast.com)
The law says American agencies must eliminate the use of Kaspersky Lab software by October. But U.S. officials say that's impossible as the security suite is embedded too deep in our infrastructure, The Daily Beast reported Wednesday. From a report: Multiple divisions of the U.S. government are confronting the reality that code written by the Moscow-based security company is embedded deep within American infrastructure, in routers, firewalls, and other hardware -- and nobody is certain how to get rid of it. "It's messy, and it's going to take way longer than a year," said one U.S. official. "Congress didn't give anyone money to replace these devices, and the budget had no wiggle-room to begin with."
At issue is a provision of the National Defense Authorization Act (NDAA) enacted last December that requires the government to fully purge itself of "any hardware, software, or services developed or provided, in whole or in part," by Kaspersky Lab. The law was a dramatic expansion of an earlier DHS directive that only outlawed "Kaspersky-branded" products. Both measures came after months of saber rattling by the U.S., which has grown increasingly anxious about Kaspersky's presence in federal networks in the wake of Russia's 2016 election interference campaign.
At issue is a provision of the National Defense Authorization Act (NDAA) enacted last December that requires the government to fully purge itself of "any hardware, software, or services developed or provided, in whole or in part," by Kaspersky Lab. The law was a dramatic expansion of an earlier DHS directive that only outlawed "Kaspersky-branded" products. Both measures came after months of saber rattling by the U.S., which has grown increasingly anxious about Kaspersky's presence in federal networks in the wake of Russia's 2016 election interference campaign.
With the rapid advancements in AI, it doesn't seem that this problem should be too hard to resolve.
We must read the story of Helen of Troy, and the Trojan horse. Most bolshy applicable.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
If you can't trust Russians, how many of them are working for M$?
How many are working for other proprietary applications free or commercial for Windows?
as the security suite is embedded too deep in our infrastructure
So, it's an advanced persistent anti-virus?
~20 years of NSA infiltrating network components, who would have expect the other side to do the same...
There still has not been any proof or even shady evidence offered that Russia changed a single ballot or tampered with a single voting machine, or had agents at a single polling place to interfere with the election process..
Exercising the right of free speech in order to influence the way people think is called "politics," not "interfering with an election."
Foreign interests have "interfered" with our elections since the birth of the nation. It's nothing new. Get over yourselves.
wipe the drives of EVERYTHING!!!
install Linux, problem solved, tell all the users they need to brush up on their computer skills and quit surfing porn for 6 months, that should give them time to learn their way around the basics of using Linux for a desktop workstation operating system, libreoffice or openoffice whatever the user chooses,
Politics is Treachery, Religion is Brainwashing
The question to ask, as both a taxpayer and an IT guy is this: What's the "penalty" for failing to make the October deadline?
Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
this includes Windows.
We can't uninstall a program.
Sadly the morons who put it there in the first place are getting their fat cat pensions. Why they were using this in the first place is beyond me. You would have to have been pretty dull to not have known its true purpose considering who founded it. But it people make all kinds of stupid decisions to save a buck here or there, Lenovo equipment, cough.
U.S. officials say that's impossible as the security suite is embedded too deep in our infrastructure,
So is Microsoft Windows, Microsoft Office, etc.
Wondering if they'll replace it with TrendMicro, because that would be so much more secure....
wipe the drives of EVERYTHING!!!
install Linux, problem solved,
Unless of course there's a rootkit in firmware somewhere, and wiping does nothing to solve the problem. APT cases are many.
The government is lucky this Kaspersky scare is bullshit, then. If this had been an actual emergency (e.g. the software were doing something bad, whether by design or due to some random bug that you can't fix because it's proprietary), sounds like everything would be totally fucked.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
If you can't get your Anti-Virus software off of your equipment, is it really anti-virus, or has it just become another virus?
Brawndo: It's what plants crave!
bullshit. Do a week of training with one of their competitors, uninstall the old stuff, install the new stuff, call it a day. None of this is difficult. These are software programs designed to take care of security for end users.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
>> Congress didn't give anyone money to replace these devices, and the budget had no wiggle-room to begin with
In the real world, I'd go to Kaspersky's biggest competitors and say, "if you replace these guys on a one-to-one basis (at no charge this year), we'll give you their support contracts in future years."
A government agency with no slack in their budget? Inability to remove third party software because it's embedded too deeply? This has all the look and feel of another tax payer shakedown.
I don't believe in karma, I just call it like I see it.
No, Cut The Hardline!
"We thought it was just the White House computers crawling with stuff helpful to Putin but it's worse than we thought!"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Getting that proposal approved, authoring the RFP, doing even a basic appraisal of responding vendors all costs money that is not in the budget.
From the summary: "Congress didn't give anyone money to replace these devices, and the budget had no wiggle-room to begin with."
I hope the U.S. will eventually have a healthy government.
The parent comment: "~20 years of NSA infiltrating network components, who would have expected the other side to do the same...?" (Slightly edited.)
"National Security is the chief cause of national insecurity." - Celine's First Law.
Life in the U.S. is rapidly degrading.
Government officers are forbidden from making promises like that, Congress will void the contract and put them in jail.
LoL, it's called "uninstall".
:)
Of course, if you're still afraid they left some kind of spyware, then just Nuke & Pave.
Tossing the hardware because you can't figure out how to use an uninstall something is only a solution for a rich moron that's a complete computer illiterate.
Sure a bunch of the higher ups more or less fit that category, but it's not like they're the ones that'll be doing any of it in the first place.
For that matter, even if they buy new hardware, it'll still have to be configured and have the appropriate software installed on it, so it's no more work for IT than doing a nuke & pave. Besides, it'll take more time and a lot more money to get that unneeded replacement hardware.
However, if they do go full moron and buy new hardware, please send the old ones to me.
it's a bloody national security issue. Get the money for new hardware out of the Defense budget. There's no shortage of money there.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
... compared to removing Avast.
It little behooves the best of us to comment on the rest of us.
Americans don't deserve any security.
The US government using Russian-made software to secure their machines is like the time that they let Russian workers build the Moscow embassy. It ended up being so bug-ridden that they had to rebuild parts of the new building in order to have a secure zone.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Can't they just e-mail it all to Hillary Clinton? She knows how to deal with... this kind of thing. Or, have Michael Cohen pay it to go away... damn it all, I've been watching too much news lately, haven't I. Oh, wait! Send it to Leilani Estates in Hawaii... Yep. Too much news.
Don't think there are backdoors in Asian chips and boards?
Don't think there are other vulnerabilities put into software outsourced to India, China or Eastern Europe?
If so, you're an idiot, or just possibly a naive, uninformed, incompetent military/security timeserver more concerned with saving money and getting a good review than with actual national security.
Or maybe you're just stupid enough to trust our silicon valley overlords who do the actual outsourcing. I'm sure they give a shit about national security over profit.
Just a thought.
Please do not read this sig. Thank you.
Then Congress does not get to make the claim they care about National Security.
would be really funny if these people just carried out the order and got rid of the software and devices... shut everything down... they ought to do it... just to see what happens...!!!
When software is tested the testing should include the ease of a full uninstall, plus some regression testing to be sure the uninstall didn't have side effects. I stopped buying Logitech products about 15 years ago when one uninstall had side effects that took me 8 hours to fix.