13 ms·
DHS Issues BOD Banning Kaspersky from Federal Government
- FatAmericanDev 9y agoThe fact that they allowed it in the first place is mind boggling, the people that run Kaspersky love Russia.
- neilsimp1 9y agoTe people that run Kaspersky are Russia, as I understand it.
- rotrux 9y agoThey're based in Russia which obviously says a lot without needing to go into more specifics. They still do good work though, they're one of the most respected disclosure-publishers in the world. I do wonder "why now?" though RE: banning them...Could be either posturing or some sort of recent intelligence (also I mean "recent" in the bureaucratic sense, so like...idk < 1 year?)
- hprotagonist 9y agowhen a really big horse leaves the barn, you have to close the barn door very firmly after it, i guess.
- tryingagainbro 9y agothe people that run Kaspersky love Russia. Love it or leave it, literally. Unless you like a Siberian prison. FSB walks in, point to a dozen laws you've broken and then ask, how are going to do this. And you've almost certainly broken the laws (it's nearly impossible to operate otherwise in such countries), and even if you didn't a judge will say you did.
- marcoperaza 9y agoTech sovereignty is going to be one of the most important international issues of the next few decades. The US has mostly lucked out so far, being the home of the overwhelming majority of major tech firms. But China has very purposefully taken steps to secure and guarantee their technological sovereignty, and there is movement in Europe to do the same.
- cinquemb 9y agoI wonder where the technological sovereignty of the individual exists in the midst of this…
- duncan_bayne 9y agoRight alongside all the other aspects of individual sovereignty that society has chosen to abrogate.
- wil421 9y agoChina is blatantly ripping off the West in tech and non tech. Their rising middle class and population make it simple to copy and internally consume. Russia can do something similar because purposely segregate themselves.
- myth_drannon 9y agoIs there some sort clandestine effort by Russian intel agencies to force US government to install McAfee Antivirus and subsequently cripple the productivity of said government agencies?
- arkitaip 9y agoMaybe it's the Gerasimov Doctrine in action [0], i.e. Chaos All The Things!!! [0] http://www.politico.com/magazine/story/2017/09/05/gerasimov-doctrine-russia-foreign-policy-215538 http://www.politico.com/magazine/story/2017/09/05/gerasimov-...
- deleted 9y ago[deleted]
- zmoreira 9y agoThere is no Gerasimov Doctrine.
- sailfast 9y agoEnd of (federal fiscal) year is an OK time for this as there may actually (fingers crossed) be money available to shift away from these products that can be applied toward licenses. What a happy, happy windfall for all the Symantec / McAfee sales reps with Federal accounts. If you're at a bar with one, they're buying :)
- BoiledCabbage 9y agoNone of the following is confirmed, but I keep seeing articles online hinting around this, or implying this. Essentially it sounds like is known in classified circles that Kaspersky works closely with and supports Russian Intelligence (FSB). It seems while the US knew about this it had a spy within Kaspersky and was their source for finding out what they were up to. The accused spy was arrested by the FSB recently so likely the US no longer is willing to take on the risk of allowing Kaspersky to run on us govt machines. Marco Rubio appeared to hint at some classified info about known govt risks of dealing with Kaspersky. Additionally the second link mentions Kaspersky is moving into protecting critical infrastructure, which seems notable giving the sudden frequency of mentions of the weakness of US infrastructure to network attack. The problem with classified security stuff is you never find out the full story. Only bits and pieces around the edges of it. It's almost never in their best interest to reveal the depths of what they know because it exposes their methods and awareness. https://www.cbsnews.com/news/russia-treason-fsb-spies-kaspersky-labs-us-intelligence-denies-cia-hacking/ https://www.cbsnews.com/news/russia-treason-fsb-spies-kasper... Earlier article on then working with the FSB. https://www.bloomberg.com/news/articles/2017-07-11/kaspersky-lab-has-been-working-with-russian-intelligence https://www.bloomberg.com/news/articles/2017-07-11/kaspersky...
- amigoingtodie 9y agoThere was also this article a few days ago about an intentional CIA backdoor in Microsoft products that Kaspersky was plugging: https://theunhivedmind.com/news/2017/09/12/us-explodes-after-russian-company-closes-cia-backdoor-embedded-in-all-microsoft-software/ https://theunhivedmind.com/news/2017/09/12/us-explodes-after...
- mehrdadn 9y agoNever heard of that site. Any reputable site reporting in this that we can trust?
- xenophonf 9y agoThis has analysis of the kernel bug: https://breakingmalware.com/documentation/windows-pssetloadimagenotifyroutine-callbacks-good-bad-unclear-part-1/ https://breakingmalware.com/documentation/windows-pssetloadi... And this details the workaround: https://breakingmalware.com/documentation/windows-pssetloadimagenotifyroutine-callbacks-good-bad-unclear-part-2/ https://breakingmalware.com/documentation/windows-pssetloadi... What I'd like to know (and lack the ability to figure out for myself) is whether other antivirus products implement the same kind of workaround as Windows Defender, i.e., calling FltGetFileNameInformationUnsafe etc.
- Stranger43 9y agoThe US declaring that it think that an government should think hard about what foreign products to let into it's core infrastructure is going to have consequences the intended ones. That is probably great news if your an European, or especially Asian software vendor trying to compete with any US based company for local government contracts, as the US have now legitimized any concern about foreign governments(including the US) forcing back doors into commercial products. It might not be all that good if your an Californian start up trying to make money on the European and Asian market as what was a hard sell, now got harder. Though it's not a new trend as were heading towards a situation where IT procurement is getting incredibly political and where the legal department is increasingly vetoing solutions that otherwise would have gotten selected due to jurisdiction issue in relationship to stored data.
- syphon7 9y agoIt's different. EU is in NATO with US (most of EU). Buying from an ally vs a non ally (or enemy depending, Ukraine for instance) is a very big difference.
- zmoreira 9y agoNot really. Ally vs non-ally is not the criteria for spying. Important vs unimportant is.
- marcoperaza 9y agoThe US hasn't really legitimized anything new. If you are a major power with barely competent government, you have been concerned about technological sovereignty for decades now.
- Tepix 9y agoIt's similar with European companies not using US-based cloud products or cloud providers.
- tptacek 9y agoThis is very bad for Kaspersky. Put aside how much revenue the entire GSA market represents for a security company (it'll be a double-digit percentage for a typical company). The bigger problem is that in the wake of this, every systemically important financial firm will also eject Kaspersky. In addition to being another significant chunk of revenue, major financial firms set the buying direction for IT security for the whole industry. If you're wondering what the backstory is here, well, join the club. Dave Aitel sums it up: US Senators John McCain and Marco Rubio claim the US IC has presented them some kind of smoking gun evidence that some kind of line was crossed. They're not planning to share more information. Anybody who tells you they know more about what's going on is probably just spreading gossip.
- ComodoHacker 9y agoThere's no need to have smoking gun. If confrontation between countries go too far, this is a potential attack vector. It can be used even without any cooperation from Kaspersky, is necessary. And, if used wisely, even without attribution (this requires cooperation though). This risk is enough to justify this move.
- tptacek 9y agoIf that's true now, it was true 4 years ago too. The McCain/Rubio claims are what's new.
- joering2 9y agoSo its even more important for public to see the evidence. Otherwise it feels like private vendetta most likely because Kaspersky is Russian (you know, our current Administration doesn't like Russians much) who actually build his empire on fighting Russian Government-funded cyberspying (claims Wikipedia). I'm sure if Kaspersky sells tons of software on US soil, and most likely pay taxes on US soil, then they will sue and have a solid case against the US Government on discriminatory basis; unless of course said smoking gun will be made public. Otherwise it feels guilty until proven innocent (if given chance). Welcome to Russia, err. I mean: America. Edit: if this falls thru, we have a very dangerous precedence; until now, politicians were taking money and lobbying for/against certain rules to help certain businesses to gain competitive edge. Now we have 2 Senators who happen to have "smoking gun" from "anonymous sources" (I presume) that could pretty much shut the whole company down. Whether Russian or American, irrelevant.
- jk2323 9y agoMakes sense. I understand their concerns. Would also makes sense to ban Microsoft at least in the EU for anything government or military related and only used a custom tailored Linux. EULinuxs instead of Red Linux :-)
- syphon7 9y agoNot the same. Most EU countries are allied with the US. Most of them hold negative or downright hostile views towards Russia.
- jk2323 9y ago1. This can change easily and actually has changed already with Trump not renewing the NATO wow. 2. Why take any risk that you can avoid?
- syphon7 9y agoSure, these are still valid concerns, but they are different when framed from an alliance/adversary point of view.
- pera 9y agoI am unsure what exactly makes a country an "ally" of America (aside of diplomatic relations), but the US IC do have history of industrial espionage against the EU and other trading partners: https://theintercept.com/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://theintercept.com/2014/09/05/us-governments-plans-use...
- syphon7 9y agoIf they're in NATO then they're an ally. Also, interesting you posted a Glenn Greenwald article - he has been accused by some people in the U.S. of dismissing things Russia has done recently in these fronts.
- chx 9y ago
- AngeloAnolin 9y agoQuote: "The BOD calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems in the next 30 days, to develop detailed plans to remove and discontinue present and future use of the products in the next 60 days, and at 90 days from the date of this directive" That number of days could be critical. If they have intel telling them that Kaspersky can be used as a vector to exploit their systems by Russia, then this could be used outright to further exploit their systems and possibly (?) plant more ways to attack, even after Kaspersky has been removed. I am assuming that DHS will already have in place another security company to handle other potential scenarios and ensure the security of their system while the transition process is happening.
- csydas 9y agoIt could just be an excuse to award a contract to a variety of local security firms to perform a "Post-Kaspersky Security Audit" at great expense in the interest of National Security, but that's just baseless cynical speculation. It's a weird move, and I would like to imagine that there is some solid reasoning behind the endeavor besides posturing and playing up to hot-button issues. But it really does just seem like the sort of issue that either ends up in bureaucratic limbo (e.g., Kaspersky remains installed for months while agencies look to find a replacement that meets their criteria) or that leaves the computers unprotected while the search continues.
- trhway 9y agoBad FSB! No more free access to USG computers for you!
- diminish 9y ago>> The Department is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks. In 2017 in tech we're progressing towards a fragmented future where governments don't trust each other and big tech companies hold strong intelligence power in people's lives.
- todd8 9y agoIs Nginx next? I suppose that it's open source nature mitigates the risks of an important software infrastructure piece being developed in a country that might not always be friendly to us.
- shallot_router 9y agoNginx isn't a security company and doesn't make client-side software, so probably not. (Of course, theoretically nginx could be backdoored to give valuable information to intelligence agencies, but it's harder due to the fact it's open source, and even if it was closed source the escalation in response to banning nginx could start a new Cold War. Imagine the US and Russia mutually banning use of any of the other side's software and actually trying to implement it.)
- dewyatt 9y agoIt's entirely possible. I know of a certain open-source application that was banned from an entire component of DHS, specifically because the developer is Russian.
- Overtonwindow 9y agoI am deeply suspicious of the criticism heaped on Kaspersky, and I suspect it might be part of a smoke and mirrors attempt to distract us from actual threats. The US IC community is deeply ingrained in the antivirus and computer security industries. NSA employees go to work for these companies, and vice versa. Foreign governments have just as much to fear from Norton and McAfee, as we do from Kaspersky.
- 3JPLW 9y agoHow does that conclusion follow your premise? Premise: US AV companies are deeply connected to the US intelligence communities. Conclusion: Deep suspicion of criticism that a Russian AV company may be connected with Russian intelligence communities?
- rmrfrmrf 9y agoRight. As a US citizen, I guess I would pick the US spying on me if I had to choose between the US and a foreign government.
- 21 9y agoIf the US wants to spy on you, it doesn't matter what software you pick. See how NSA spied on internal Google networks, even if Google was already in PRISM.
- interstitial 9y agoI doubt the hive mind of HN will notice this comment, but if you read the Glenn Greenwald book, No Place to Hide, it shows this is actually a tactic of the CIA to get you to use compromised security. Plausible: Kapersky is actually blocking the CIA efforts, so they need you to use a compromised version of security from some else.
- crb002 9y agoIf Kapersky provides source to NSA then there should be no issue.
- lawnchair_larry 9y agoThey do. Their source is available for examination by any government.
- 0xbear 9y agoComing up next: Russian government bans US software on government machines. Microsoft delivers large bags of money to McCain (unless he kicks the bucket by then) and Rubio. Senators recant.
- solotronics 9y agothe natural progression is state sponsored software and hardware at every level. China has been working on this for some time the US is foolish to ignore this.