4 ms·

I don't use their products and the place I used to work was a little surprised when I pointed out his multiple connections to the current regime. I also though

I don't use their products and the place I used to work was a little surprised when I pointed out his multiple connections to the current regime. I also thought it was odd he always seemed to have no problem catching US nation state malware, but all of those Russian state cyber weapons other companies keep finding seem to allude him and his team. Coincidence?

happyscrappy 11y ago
Maybe he doesn't like polonium.
drzaiusapelord 11y ago
I was reading about how Estonia and Ukraine were victims to all these client side hacks from the Russian government which Kaspersky magically couldn't detect. I think its pretty obvious they're in cahoots. I imagine these governments are no longer running Kaspersky. Brian Krebs also writes about popular malware that first does a check to see if its being run on a computer in Russia. If so, it stops running. There's a lot of government sponsored malware coming from Russia. There's a public private partnership to put profitable malware on non-Russian computers and Russian officials turn a blind eye due to corruption, bribes, etc. Its all fairly ugly.
- dogma1138 11y ago
  Every security vendor is aligned with it's "host" nation, that is how business works. Not to mention that it's one of the only few sources for these types of enterprises to recruit from in the first place. Most of the security software coming out of Israel like Checkpoint goes even beyond that and it's actual code that was written in the IDF and was released for commercial use. The NSA also has a technology transfer program that enables commercialization of many technologies which were invented or developed by the NSA, they also release quite a abit of their TTP software as open source.
  - drzaiusapelord 11y ago
    I think you're certainly overstating the case here. We don't see US derived malware being ignored by the USG. In fact, almost all high profile hacker arrests stem from US investigations. US researchers are the ones who take out Russian and Chinese botnet C&C servers. We see almost no action on the nation states that profit from malware, namely Russia and China. On a cyber weapons level, who knows, but citing things like TTP which releases to FOSS or Israel's defense industry as a sign of corruption is asinine and not remotely comparable to what is the status quo in Russia. Cyber weapons will always be here and, when used correctly, can't be detected by signature based AV because they have no idea what to look for and the exploits they use are typically zero days. Stuxnet used, I believe, 3 or 4 different zero day attacks. Nor did you bother to read the Kaspersky articles where the proof is laid out in a pretty obvious way. I think its foolish to knee-jerk to "Oh Russia does this, so must everyone else." Certainly there are degrees of corruption, and Russia is on the extreme end of this scale. Brian Krebs and Tavis Ormandy aren't on some NSA payroll to make Russia look bad. Russians do that for free. Lets stop playing the "every government is the same" card. Its been historically untrue. >Every security vendor is aligned with it's "host" nation Also, I really doubt the guys writing rules for Snort, ClamAV, or mod_security or OSSEC are aligned with anyone. Your view is incredibly cynical and very much an example of the disingenious tactic of "whataboutism" Russians use to defend their wrongdoings. Those rules are public, pray tell, which ones are NSA backdoors? I suggest you come up with some proof if you're making such accusations. The articles I linked to about Kasperky are significant and well-researched. edit: I cant reply below so I'll type it here. Clinton-era crypto limitations are a non-issue. Clinton lost the crypto wars after the Clipper chip was never passed or funded and after Phil Zimmerman wrote PGP and helped end crypto restrictions. I'm talking about things happening right now. 20+ years ago whining is not helping nor relevant. Use whatever crypto you like.
    - dogma1138 11y ago
      Ok, every commercial security vendor of significance better? RSA and other security vendors had to introduce work reducers for the NSA in the 90's because that's what was mandated to them to be able to export their software. Being aligned with national interests doesn't mean introducing backdoors it means cooperating with them, considering the breath of knowledge that a national organization has and their resources it's a mutual beneficial relationship in most cases. It's not conspiracies it's the simple fact it's like universities doing research for national defense that's a given fact, but you don't expect saint petersburg polytechnic to perform research for DARAP just like you don't expect caltech doing research for the Russians. Nowhere did i hinted that it's a sign of corruption or that i even see this as negative thing as i don't on both count. This is the simple reality of how businesses and academia work for national interests and I'm not sure what surprising about this.
linkregister 11y ago
> but all of those Russian state cyber weapons other companies keep finding seem to elude him and his team Kaspersky blog has written up analyses of malware campaigns from many different countries. Here are some Russian-origin APT campaigns. 1. https://blog.kaspersky.com/turla-apt-exploiting-satellites/9771/ https://blog.kaspersky.com/turla-apt-exploiting-satellites/9... 2. https://securelist.com/blog/research/69731/the-cozyduke-apt/ https://securelist.com/blog/research/69731/the-cozyduke-apt/ 3. http://www.kaspersky.com/about/news/virus/2014/crouching-yeti-an-ongoing-spying-campaign-with-2800-highly-valuable-targets-worldwide http://www.kaspersky.com/about/news/virus/2014/crouching-yet...

happyscrappy 11y ago

Maybe he doesn't like polonium.

drzaiusapelord 11y ago

I was reading about how Estonia and Ukraine were victims to all these client side hacks from the Russian government which Kaspersky magically couldn't detect. I think its pretty obvious they're in cahoots. I imagine these governments are no longer running Kaspersky. Brian Krebs also writes about popular malware that first does a check to see if its being run on a computer in Russia. If so, it stops running. There's a lot of government sponsored malware coming from Russia. There's a public private partnership to put profitable malware on non-Russian computers and Russian officials turn a blind eye due to corruption, bribes, etc. Its all fairly ugly.

dogma1138 11y ago
Every security vendor is aligned with it's "host" nation, that is how business works. Not to mention that it's one of the only few sources for these types of enterprises to recruit from in the first place. Most of the security software coming out of Israel like Checkpoint goes even beyond that and it's actual code that was written in the IDF and was released for commercial use. The NSA also has a technology transfer program that enables commercialization of many technologies which were invented or developed by the NSA, they also release quite a abit of their TTP software as open source.
- drzaiusapelord 11y ago
  I think you're certainly overstating the case here. We don't see US derived malware being ignored by the USG. In fact, almost all high profile hacker arrests stem from US investigations. US researchers are the ones who take out Russian and Chinese botnet C&C servers. We see almost no action on the nation states that profit from malware, namely Russia and China. On a cyber weapons level, who knows, but citing things like TTP which releases to FOSS or Israel's defense industry as a sign of corruption is asinine and not remotely comparable to what is the status quo in Russia. Cyber weapons will always be here and, when used correctly, can't be detected by signature based AV because they have no idea what to look for and the exploits they use are typically zero days. Stuxnet used, I believe, 3 or 4 different zero day attacks. Nor did you bother to read the Kaspersky articles where the proof is laid out in a pretty obvious way. I think its foolish to knee-jerk to "Oh Russia does this, so must everyone else." Certainly there are degrees of corruption, and Russia is on the extreme end of this scale. Brian Krebs and Tavis Ormandy aren't on some NSA payroll to make Russia look bad. Russians do that for free. Lets stop playing the "every government is the same" card. Its been historically untrue. >Every security vendor is aligned with it's "host" nation Also, I really doubt the guys writing rules for Snort, ClamAV, or mod_security or OSSEC are aligned with anyone. Your view is incredibly cynical and very much an example of the disingenious tactic of "whataboutism" Russians use to defend their wrongdoings. Those rules are public, pray tell, which ones are NSA backdoors? I suggest you come up with some proof if you're making such accusations. The articles I linked to about Kasperky are significant and well-researched. edit: I cant reply below so I'll type it here. Clinton-era crypto limitations are a non-issue. Clinton lost the crypto wars after the Clipper chip was never passed or funded and after Phil Zimmerman wrote PGP and helped end crypto restrictions. I'm talking about things happening right now. 20+ years ago whining is not helping nor relevant. Use whatever crypto you like.
  - dogma1138 11y ago
    Ok, every commercial security vendor of significance better? RSA and other security vendors had to introduce work reducers for the NSA in the 90's because that's what was mandated to them to be able to export their software. Being aligned with national interests doesn't mean introducing backdoors it means cooperating with them, considering the breath of knowledge that a national organization has and their resources it's a mutual beneficial relationship in most cases. It's not conspiracies it's the simple fact it's like universities doing research for national defense that's a given fact, but you don't expect saint petersburg polytechnic to perform research for DARAP just like you don't expect caltech doing research for the Russians. Nowhere did i hinted that it's a sign of corruption or that i even see this as negative thing as i don't on both count. This is the simple reality of how businesses and academia work for national interests and I'm not sure what surprising about this.

linkregister 11y ago

> but all of those Russian state cyber weapons other companies keep finding seem to elude him and his team Kaspersky blog has written up analyses of malware campaigns from many different countries. Here are some Russian-origin APT campaigns. 1. https://blog.kaspersky.com/turla-apt-exploiting-satellites/9771/ https://blog.kaspersky.com/turla-apt-exploiting-satellites/9... 2. https://securelist.com/blog/research/69731/the-cozyduke-apt/ https://securelist.com/blog/research/69731/the-cozyduke-apt/ 3. http://www.kaspersky.com/about/news/virus/2014/crouching-yeti-an-ongoing-spying-campaign-with-2800-highly-valuable-targets-worldwide http://www.kaspersky.com/about/news/virus/2014/crouching-yet...