42 ms·

Senior manager at Kaspersky arrested in Moscow

97 points by r721 10y ago

Krevv 10y ago
I use Kaspersky, and am starting to regret it. The worst part is the newest version has some great features (built in VPN is pretty easy to use), but I simply dont trust the software anymore. I've heard that simply uninstalling it still leaves some processes running, so i guess i will make the move when i buy a new laptop...
- romanovcode 10y ago
  I don't understand why people even bother with additional anti-virus for Windows nowadays. Windows defender is updated very frequently and is running in the background at all times. Also, unless you are using some shady software e.g. cracks etc.. it is not that easy to catch a computer virus nowadays.
  - Outpox 10y ago
    Yep, as long as you stick with an adblocker in your browser and avoid downloading shady things it's pretty safe.
    - jdhendrickson 10y ago
      I would add the use of noscript or a similar white listing javascript blocker would probably be of use as well.
      - dahauns 10y ago
        uMatrix is very nice, a whitelisting everything blocker with a really intuitive interface.
      - smsm42 10y ago
        I don't see how non-professional can browse the net with JS blocker on. Most of the sites nowdays just won't work and average user won't have any way to figure out why.
      - ndesaulniers 10y ago
        https://www.reddit.com/r/razer/comments/5orvy5/late_2016_rbs_qhd_linux_damage_report/ https://www.reddit.com/r/razer/comments/5orvy5/late_2016_rbs...
  - TeMPOraL 10y ago
    > I don't understand why people even bother with additional anti-virus for Windows nowadays. Old habits die hard. Especially among non-tech-savvy people, who in the past were told so many times that antivirus is essential because Windows is easy to infect, that it's hard now to explain to them that the built-in Windows Defender is good enough.
    - CamelCaseName 10y ago
      Absolutely. I just had the pleasure of being lectured on how Macs don't get viruses yesterday.
    - AntivirusExpert 10y ago
      Good enough for you, perhaps. You can't teach people to be sensible and 100% vigilant, and when it comes to AV software I think that independent lab test scores tell the story about MS Defender: https://bestantivirus.reviews/tools/test-results-calculator?purposeId=1&groupId=1&startDate=2015-1-1&endDate=2017-1-1&companyId=16 https://bestantivirus.reviews/tools/test-results-calculator?...
  - rubber_duck 10y ago
    >Windows defender is updated very frequently and is running in the background at all times. And will often suck your IO and bring your computer to a crawl during say big builds, extracts, installations, etc. I just keep it disabled.
    - deleted 10y ago
      [deleted]
    - RugnirViking 10y ago
      Pray, tell: how have you managed to keep it disabled? It always seems to re-enable for me
      - rubber_duck 10y ago
        Constantly disabling it when I notice it unfortunately :(
  - ionised 10y ago
    Windows Defender has been shown time and time again in comparatives to be not much better than nothing. Its only plus point was it's low resource requirement.
    - romanovcode 10y ago
      Heh, those comparatives more often than not are sponsored by AV companies. That's why every comparative will show different Nr. 1 AV software.
      - ionised 10y ago
        As far as I know, these guys are totally independent; https://www.av-comparatives.org/about-us/ https://www.av-comparatives.org/about-us/ I may be wrong, but I can't find any info as to their sponsors other than universities and volunteer researchers. And I'm not sure how that addresses what I said about Defender being borderline useless, because they come up short across most tests from what I remember. Unless it has drastically improved in the last year.
        cvwright 10y ago
        I think AV Comparatives are independent -- at least they were when I last had to read up on all this several years ago. At the time (2010ish), they even had a few reports where they showed that pretty much all the AV products were quite bad. Either they failed to detect a large portion of real malware, and/or they were a huge drain on the system's resources.
        krylon 10y ago
        > Either they failed to detect a large portion of real malware, and/or they were a huge drain on the system's resources. Those aren't mutually exclusive... ;-) Some things never change, I guess. As a Windows admin who uses Unix-ish systems exclusively at home, I am a little clueless sometimes. When using AV software on our computers, I can at least point to that and say I did what I could (be reasonably expected to do), but whenever I read what people who really know about IT security have to say about the AV industry, I get the feeling it's all just a bunch of charlatans and snake oil peddlers. But the latter is a little difficult to explain to my boss without sounding like a tinfoil-hat-wearing lunatic.
  - rwmj 10y ago
    In my experience it's because of slavishly following PCI-DSS standards (and probably other similar things). For example section 5.1 says: 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). Presumably unless the software was explicitly "deployed" (rather than being bundled with Windows), they don't feel like they are complying.
    - decwakeboarder 10y ago
      IANAL, but I'd assume that Windows Defender is "deployed" to the system at the time of "deploying" the OS.
    - dogma1138 10y ago
      Windows defender is sufficient for PCI-DSS compliance.
  - rando444 10y ago
    You don't have to be using shady software.. All you have to do is browse the internet. As long as code execution vulnerabilities in web browsers and common plugins (adobe, etc.) exist.. and they still do, 'drive-by downloading' will continue to spread malware, adware, and ransomware.
    - veeti 10y ago
      Antivirus itself is a huge attack surface for remote code execution. For example, see Kaspersky's atrocious track record so far: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=kaspersky&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
    - cpncrunch 10y ago
      You should disable flash by default these days. I haven't come across a site in months that requires it.
  - elahd 10y ago
    Windows Defender misses a lot of malware and drive by toolbar installs. I bought licenses of ESET Smart Security for everyone in my immediate family about 3 years ago. They were on Windows Defender before. The number of calls about "my internet isn't working" has dropped to 0 since I rolled out ESET.
    - mixedCase 10y ago
      Given that everyone lives on a browser and the most outside of that they usually need is a browser, a dedicated media player and a PDF reader, I installed them Linux and cut tech support down to a single call so far: A 5 year old install that needed an upgrade to support a 3G modem. No license management needed.
  - smsm42 10y ago
    It's pretty easy: a. Troyans aka "Letter from IRS" promising to jail you unless you open it. Yes, a lot of people still fall for that. b. Browser vulns if you didn't update your browser and visit some weird sites. c. Plugin vulns such as flash/java - a lot of content, esp. video, still requires flash. Though I think most cybercrime moved on from old-fashioned viruses to botnets and ransomware (not strictly correct since I'm mixing delivery and monetization here but I hope you get what I mean), since you can make much more money with it. And given the frequency I read about those in the media, they are not rare at all.
- r721 10y ago
  FAQ mentions "Kaspersky Lab Product Remover" which allegedly removes everything in case of uninstalling problems: http://support.kaspersky.com/answers#installerrors http://support.kaspersky.com/answers#installerrors Ctrl-F "Delete the files of the earlier installed product versions" UPD Ah, it has an own page: https://support.kaspersky.com/common/service.aspx?el=1464 https://support.kaspersky.com/common/service.aspx?el=1464
  - crummy 10y ago
    From my tech support days it seemed like every antivirus or firewall software I encountered had its own unique uninstallation software that you had to download separately if you wanted to completely wipe it off your machine. I don't understand why their standard uninstalls don't do this in the first place.
    - smsm42 10y ago
      Standard installers are usually written using some sort of toolkit which usually has limited APIs. It could be that the antivirus does things that these APIs can not revert (just guessing).
- garganzol 10y ago
  The same goes for me. From one side, Kaspersky is a reputable and established AV company, from another side it has too tight ties with FSB. Sorry, no trust anymore.
deleted 10y ago
[deleted]
dinodino 10y ago
Good luck trying to meddle in the elections in the Netherlands! They vote with pencil and paper http://wijvertrouwenstemcomputersniet.nl/English http://wijvertrouwenstemcomputersniet.nl/English.
- quantumhobbit 10y ago
  Doesn't matter if they can influence voters with enough "fake news" and document dumps from selectively hacked politicians. Social engineering is always the weakest link.
- hueving 10y ago
  The meddling in the elections in the US the Russians are being accused of has nothing to do with the actual election systems. It's related to impacting the public perception of a candidate by releasing dirt on one at opportune times.
  - lisivka 10y ago
    And goal is to break trust between US government and US people.
    - autotypo 10y ago
      This should be a zero trust relationship by design. Instead we are forced to trust the untrustworthy. Blaming convenient phantoms is sidestepping the problem.
      - criddell 10y ago
        Well, there shouldn't be trust by default, but the government should be able to earn our trust on a department-by-department basis. For example, I have quite a bit of trust in the CDC. I have less trust in the EPA. Trust is hard to earn but easy to lose.
      - smsm42 10y ago
        It can't be zero trust relationship - if you pay taxes and elect representatives, you trust they will not just do whatever they like with it and ignore you but do at least something useful to you. Of course, I would agree that people in general place way too much trust in government right now and that's why it was allowed to grow to current metastatic sizes and become so dangerous. But it does not mean it can function with zero trust - some trust is necessary, just not too much of it.
dr_hooo 10y ago
"U.S. and EU officials also have accused..." "...It wasn't immediately clear if the arrests are somehow linked to these allegations." Then why bring this up?
- Strom 10y ago
  Maybe because it's a popular topic and many readers may assume it's linked. Of course it's also possible the author just wants to dramatize this event.
saycheese 10y ago
This article covers the topic better: http://www.forbes.com/sites/thomasbrewster/2017/01/25/russia-kaspersky-treason-arrest/ http://www.forbes.com/sites/thomasbrewster/2017/01/25/russia... And here a translation of the Russia newspaper that first covered the arrest: https://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=http://www.kommersant.ru/doc/3200840 https://translate.googleusercontent.com/translate_c?depth=1&...
- r721 10y ago
  It contains two autoplaying videos though (I firstly submitted that article, but then changed my mind).
- msimpson 10y ago
  It also contains ad blocker detection which gates the article until you disable it.
  - mixedCase 10y ago
    Works for me with the Anti-Adblock killer list and the Adblock Warning Removal list that are available in uBlock Origin's dashboard.
    - msimpson 10y ago
      > "Anti-Adblock killer list" > "Adblock Warning Removal list" Ugh, no. I will not be participating in an arms race against advertisements. Either a site yields to my use of an ad blocker or they lose my traffic entirely. End of story.
      - mixedCase 10y ago
        > Ugh, no. I will not be participating in an arms race against advertisements. Nobody's forcing you to submit patches just for enabling them. But browse as you like, it's your computer; that's one of the main arguments in favor of ad blocking anyway.
pragma_ 10y ago
Right now an Uplink Corporation hacker somewhere is sending an email to his employer to get paid for this arrest.
- davman 10y ago
  I understood that reference.
  - pragma_ 10y ago
    Nothing to do with the article but its too awesome not share. Check this Uplink mod if you havent already: http://www.moddb.com/mods/uplink-os http://www.moddb.com/mods/uplink-os

97 points by r721 10y ago

Krevv 10y ago

I use Kaspersky, and am starting to regret it. The worst part is the newest version has some great features (built in VPN is pretty easy to use), but I simply dont trust the software anymore. I've heard that simply uninstalling it still leaves some processes running, so i guess i will make the move when i buy a new laptop...

romanovcode 10y ago
I don't understand why people even bother with additional anti-virus for Windows nowadays. Windows defender is updated very frequently and is running in the background at all times. Also, unless you are using some shady software e.g. cracks etc.. it is not that easy to catch a computer virus nowadays.
- Outpox 10y ago
  Yep, as long as you stick with an adblocker in your browser and avoid downloading shady things it's pretty safe.
  - jdhendrickson 10y ago
    I would add the use of noscript or a similar white listing javascript blocker would probably be of use as well.
    - dahauns 10y ago
      uMatrix is very nice, a whitelisting everything blocker with a really intuitive interface.
    - smsm42 10y ago
      I don't see how non-professional can browse the net with JS blocker on. Most of the sites nowdays just won't work and average user won't have any way to figure out why.
    - ndesaulniers 10y ago
      https://www.reddit.com/r/razer/comments/5orvy5/late_2016_rbs_qhd_linux_damage_report/ https://www.reddit.com/r/razer/comments/5orvy5/late_2016_rbs...
- TeMPOraL 10y ago
  > I don't understand why people even bother with additional anti-virus for Windows nowadays. Old habits die hard. Especially among non-tech-savvy people, who in the past were told so many times that antivirus is essential because Windows is easy to infect, that it's hard now to explain to them that the built-in Windows Defender is good enough.
  - CamelCaseName 10y ago
    Absolutely. I just had the pleasure of being lectured on how Macs don't get viruses yesterday.
  - AntivirusExpert 10y ago
    Good enough for you, perhaps. You can't teach people to be sensible and 100% vigilant, and when it comes to AV software I think that independent lab test scores tell the story about MS Defender: https://bestantivirus.reviews/tools/test-results-calculator?purposeId=1&groupId=1&startDate=2015-1-1&endDate=2017-1-1&companyId=16 https://bestantivirus.reviews/tools/test-results-calculator?...
- rubber_duck 10y ago
  >Windows defender is updated very frequently and is running in the background at all times. And will often suck your IO and bring your computer to a crawl during say big builds, extracts, installations, etc. I just keep it disabled.
  - deleted 10y ago
    [deleted]
  - RugnirViking 10y ago
    Pray, tell: how have you managed to keep it disabled? It always seems to re-enable for me
    - rubber_duck 10y ago
      Constantly disabling it when I notice it unfortunately :(
- ionised 10y ago
  Windows Defender has been shown time and time again in comparatives to be not much better than nothing. Its only plus point was it's low resource requirement.
  - romanovcode 10y ago
    Heh, those comparatives more often than not are sponsored by AV companies. That's why every comparative will show different Nr. 1 AV software.
    - ionised 10y ago
      As far as I know, these guys are totally independent; https://www.av-comparatives.org/about-us/ https://www.av-comparatives.org/about-us/ I may be wrong, but I can't find any info as to their sponsors other than universities and volunteer researchers. And I'm not sure how that addresses what I said about Defender being borderline useless, because they come up short across most tests from what I remember. Unless it has drastically improved in the last year.
      - cvwright 10y ago
        I think AV Comparatives are independent -- at least they were when I last had to read up on all this several years ago. At the time (2010ish), they even had a few reports where they showed that pretty much all the AV products were quite bad. Either they failed to detect a large portion of real malware, and/or they were a huge drain on the system's resources.
        krylon 10y ago
        > Either they failed to detect a large portion of real malware, and/or they were a huge drain on the system's resources. Those aren't mutually exclusive... ;-) Some things never change, I guess. As a Windows admin who uses Unix-ish systems exclusively at home, I am a little clueless sometimes. When using AV software on our computers, I can at least point to that and say I did what I could (be reasonably expected to do), but whenever I read what people who really know about IT security have to say about the AV industry, I get the feeling it's all just a bunch of charlatans and snake oil peddlers. But the latter is a little difficult to explain to my boss without sounding like a tinfoil-hat-wearing lunatic.
- rwmj 10y ago
  In my experience it's because of slavishly following PCI-DSS standards (and probably other similar things). For example section 5.1 says: 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). Presumably unless the software was explicitly "deployed" (rather than being bundled with Windows), they don't feel like they are complying.
  - decwakeboarder 10y ago
    IANAL, but I'd assume that Windows Defender is "deployed" to the system at the time of "deploying" the OS.
  - dogma1138 10y ago
    Windows defender is sufficient for PCI-DSS compliance.
- rando444 10y ago
  You don't have to be using shady software.. All you have to do is browse the internet. As long as code execution vulnerabilities in web browsers and common plugins (adobe, etc.) exist.. and they still do, 'drive-by downloading' will continue to spread malware, adware, and ransomware.
  - veeti 10y ago
    Antivirus itself is a huge attack surface for remote code execution. For example, see Kaspersky's atrocious track record so far: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=kaspersky&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
  - cpncrunch 10y ago
    You should disable flash by default these days. I haven't come across a site in months that requires it.
- elahd 10y ago
  Windows Defender misses a lot of malware and drive by toolbar installs. I bought licenses of ESET Smart Security for everyone in my immediate family about 3 years ago. They were on Windows Defender before. The number of calls about "my internet isn't working" has dropped to 0 since I rolled out ESET.
  - mixedCase 10y ago
    Given that everyone lives on a browser and the most outside of that they usually need is a browser, a dedicated media player and a PDF reader, I installed them Linux and cut tech support down to a single call so far: A 5 year old install that needed an upgrade to support a 3G modem. No license management needed.
- smsm42 10y ago
  It's pretty easy: a. Troyans aka "Letter from IRS" promising to jail you unless you open it. Yes, a lot of people still fall for that. b. Browser vulns if you didn't update your browser and visit some weird sites. c. Plugin vulns such as flash/java - a lot of content, esp. video, still requires flash. Though I think most cybercrime moved on from old-fashioned viruses to botnets and ransomware (not strictly correct since I'm mixing delivery and monetization here but I hope you get what I mean), since you can make much more money with it. And given the frequency I read about those in the media, they are not rare at all.
r721 10y ago
FAQ mentions "Kaspersky Lab Product Remover" which allegedly removes everything in case of uninstalling problems: http://support.kaspersky.com/answers#installerrors http://support.kaspersky.com/answers#installerrors Ctrl-F "Delete the files of the earlier installed product versions" UPD Ah, it has an own page: https://support.kaspersky.com/common/service.aspx?el=1464 https://support.kaspersky.com/common/service.aspx?el=1464
- crummy 10y ago
  From my tech support days it seemed like every antivirus or firewall software I encountered had its own unique uninstallation software that you had to download separately if you wanted to completely wipe it off your machine. I don't understand why their standard uninstalls don't do this in the first place.
  - smsm42 10y ago
    Standard installers are usually written using some sort of toolkit which usually has limited APIs. It could be that the antivirus does things that these APIs can not revert (just guessing).
garganzol 10y ago
The same goes for me. From one side, Kaspersky is a reputable and established AV company, from another side it has too tight ties with FSB. Sorry, no trust anymore.

deleted 10y ago

[deleted]

dinodino 10y ago

Good luck trying to meddle in the elections in the Netherlands! They vote with pencil and paper http://wijvertrouwenstemcomputersniet.nl/English http://wijvertrouwenstemcomputersniet.nl/English.

quantumhobbit 10y ago
Doesn't matter if they can influence voters with enough "fake news" and document dumps from selectively hacked politicians. Social engineering is always the weakest link.
hueving 10y ago
The meddling in the elections in the US the Russians are being accused of has nothing to do with the actual election systems. It's related to impacting the public perception of a candidate by releasing dirt on one at opportune times.
- lisivka 10y ago
  And goal is to break trust between US government and US people.
  - autotypo 10y ago
    This should be a zero trust relationship by design. Instead we are forced to trust the untrustworthy. Blaming convenient phantoms is sidestepping the problem.
    - criddell 10y ago
      Well, there shouldn't be trust by default, but the government should be able to earn our trust on a department-by-department basis. For example, I have quite a bit of trust in the CDC. I have less trust in the EPA. Trust is hard to earn but easy to lose.
    - smsm42 10y ago
      It can't be zero trust relationship - if you pay taxes and elect representatives, you trust they will not just do whatever they like with it and ignore you but do at least something useful to you. Of course, I would agree that people in general place way too much trust in government right now and that's why it was allowed to grow to current metastatic sizes and become so dangerous. But it does not mean it can function with zero trust - some trust is necessary, just not too much of it.

dr_hooo 10y ago

"U.S. and EU officials also have accused..." "...It wasn't immediately clear if the arrests are somehow linked to these allegations." Then why bring this up?

Strom 10y ago
Maybe because it's a popular topic and many readers may assume it's linked. Of course it's also possible the author just wants to dramatize this event.

saycheese 10y ago

This article covers the topic better: http://www.forbes.com/sites/thomasbrewster/2017/01/25/russia-kaspersky-treason-arrest/ http://www.forbes.com/sites/thomasbrewster/2017/01/25/russia... And here a translation of the Russia newspaper that first covered the arrest: https://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=http://www.kommersant.ru/doc/3200840 https://translate.googleusercontent.com/translate_c?depth=1&...

r721 10y ago
It contains two autoplaying videos though (I firstly submitted that article, but then changed my mind).
msimpson 10y ago
It also contains ad blocker detection which gates the article until you disable it.
- mixedCase 10y ago
  Works for me with the Anti-Adblock killer list and the Adblock Warning Removal list that are available in uBlock Origin's dashboard.
  - msimpson 10y ago
    > "Anti-Adblock killer list" > "Adblock Warning Removal list" Ugh, no. I will not be participating in an arms race against advertisements. Either a site yields to my use of an ad blocker or they lose my traffic entirely. End of story.
    - mixedCase 10y ago
      > Ugh, no. I will not be participating in an arms race against advertisements. Nobody's forcing you to submit patches just for enabling them. But browse as you like, it's your computer; that's one of the main arguments in favor of ad blocking anyway.

pragma_ 10y ago

Right now an Uplink Corporation hacker somewhere is sending an email to his employer to get paid for this arrest.

davman 10y ago
I understood that reference.
- pragma_ 10y ago
  Nothing to do with the article but its too awesome not share. Check this Uplink mod if you havent already: http://www.moddb.com/mods/uplink-os http://www.moddb.com/mods/uplink-os