3 ms·
>Let's try a little exercise here. Stipulate that it's malice, and then generate the narrative in which malice makes sense. Sure. Kaspersky creates security so
by sigmar 10y ago
>Let's try a little exercise here. Stipulate that it's malice, and then generate the narrative in which malice makes sense.
Sure. Kaspersky creates security software. The FSB benefits from vulnerabilities in antivirus software. Kaspersky knows this and puts company resources into particular areas. ie how to spot the next stuxnet, rather than fix bugs like this.
The FSB does not need to write the source code (for Kaspersky Anti-virus) to benefit from vulnerabilities. In fact NSA, GCHQ, and FSB all benefit from subversion of https.
- tptacek 10y agoYou can't stop at that point in my comment. You have to read the whole thing first. I'm not asking "does it ever make sense to backdoor Kaspersky AV". Clearly it does.
- sigmar 10y agoI did. You created a ridiculous narrative, that seems to amount to a strawman. No one ever said that FSB wrote the antivirus program.
- tptacek 10y agoMy narrative has in fact nothing whatsoever to do with the FSB. That's why I said "whatever entity".
- sigmar 10y ago"your evil backdoor only impacts machines running your software already. " seems to assume that "whatever entity" can freely put in whatever code they want. I agree that cert collisions is a strange way to backdoor, but to dismiss any questions as to possible malice as "conspiracy theories" seems to ignore many recent events (such as Juniper Networks)
- tptacek 10y agoOnce again, you're responding to an argument I did not make. I'm not saying this bug doesn't make sense because nobody would want to backdoor Kaspersky AV. Clearly they would. I'm saying it doesn't make sense because it doesn't make sense as a backdoor. It provides the attacker with far less access than they already have, and does so in a way that leaves tracks all over the Internet even when the "backdoor" isn't "in use".
- lawnchair_larry 10y agoKnow what else you said doesn't make sense as a backdoor, times a million? And this makes way more sense than that one did. Not that I'm convinced that it is one. But if it is, it's a pretty good one IMO.