5 ms·

They probably didn't hack anything, they just have people who receive these AV samples as malware researchers. Any intelligence agency worth their money should.

They probably didn't hack anything, they just have people who receive these AV samples as malware researchers. Any intelligence agency worth their money should. And yes, this is the gist of what's behind all the Kaspersky hysteria. The NSA trying to obscure another extremely embarrassing leak. Every AV software uploads new detections for analysis. It just so happened that this fool used Kaspersky. It's abundantly clear that behind all the make believe is a mostly incompetent agency that can't keep it's secrets any better than Equifax.

DiabloD3 9y ago
Basically. I've seen what now looks like state sponsored bullshit blogs posing as tin foil hatters being posted to HN saying Kaspersky is part of the Russian intelligence apparatus, and that's why the US government pressured stores to remove Kaspersky AV from store shelves, etc etc etc. Most likely, they did their job, and they did it correctly. The NSA can't really defeat competent AV researchers who aren't even looking at the NSA in the first place.
- neuronexmachina 9y ago
  The DHS is "tin foil hatters"? https://www.dhs.gov/news/2017/09/13/dhs-statement-issuance-binding-operational-directive-17-01 https://www.dhs.gov/news/2017/09/13/dhs-statement-issuance-b... > The Department is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks. The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates U.S. national security.
  - KGIII 9y ago
    > The DHS is "tin foil hatters"? Yes? To be fair, that is kind of their job. I don't suppose their precept says that they should be paranoid and believing in conspiracy theories - in those exact words. But, that seems to be how it is manifest.
- openasocket 9y ago
  Kaspersky is pretty well known to have a close relationship with the Russian government, though. Hell, Kaspersky himself used to work for Soviet military intelligence. There's several articles cited here: https://en.wikipedia.org/wiki/Kaspersky_Lab#Allegations_of_ties_to_the_Russian_government https://en.wikipedia.org/wiki/Kaspersky_Lab#Allegations_of_t... I'm not saying Kaspersky is a part of the Russian intelligence apparatus, but I wouldn't trust them to report on Fancy Bear campaigns, nor would I trust their AV software if I were a particularly juicy target.
  - Bendingo 9y ago
    > Kaspersky himself used to work for Soviet military intelligence This is straight up not true. He studied at an institute that was administered by the KGB.
  - lawnchair_larry 9y ago
    They are not known for any such thing, and Eugene did not work for military intelligence. He has addressed this many times.
- tptacek 9y ago
  Whatever the "bullshit blogs" might be (I haven't noticed these stories, but maybe you can provide links?), they're in good company now, because that's more or less the story the NYT, WSJ, and WaPo have developed.
  - Natsu 9y ago
    There's not a lot of attribution going on here, though. Take the WaPo story, they just tell us what's possible and leave us to draw conclusions ourselves - “That’s the crux of the matter,” said one industry official who received the briefing. “Whether Kaspersky is working directly for the Russian government or not doesn’t matter; their Internet service providers are subject to monitoring. So virtually anything shared with Kaspersky could become the property of the Russian government.” Late last month, the National Intelligence Council completed a classified report that it shared with NATO allies concluding that the FSB had “probable access” to Kaspersky customer databases and source code. That access, it concluded, could help enable cyberattacks against U.S. government, commercial and industrial control networks.
jnbiche 9y ago
Read the original New York Times story, it gives a lot more technical details on the hack than this one[0]. Assuming the Israeli and NYT accounts are to be believed, this was a very deliberate hack. Israel watched in real-time as Kaspersky sent out searches for NSA codename programs on all computers with Kaspersky AV installed (this was related to the whole Duqu 2.0 intrusion into Kaspersky's network that Kaspersky blogged about 2 years ago). And the NSA tools were some of the files reeled in from those searches. That said, it's still extremely embarrassing. Why is someone from TAO taking this kind of work home? 0. https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...
- StanislavPetrov 9y ago
  >Assuming the Israeli and NYT accounts are to be believed, An assumption nobody who knows anything about history will make.
  - sien 9y ago
    This shouldn't be modded down. Security services are completely unreliable and release these things for their own benefit. The question with this is why are the Israelis pushing this now? The NYT has a poor record on this stuff as does pretty much everyone. WMD.
- dotancohen 9y ago
  > Israel watched in real-time as Kaspersky sent out searches for NSA codename programs on all computers with Kaspersky AV installed That happened _after_ Kaspersky identified the "NSA codename programs" as malware. That is exactly what an anti-malware application should do: look for instances of known malware.
- revelation 9y ago
  It's the NYT for crying out sake! Unless you believe they have the knowledge on staff to do any sort of original reporting on this, this story is exactly what a "government official speaking on the condition of anonymity" has whispered to them. It's the fricking party line. It's right there in the article: The current and former government officials who described the episode spoke about it on condition of anonymity because of classification rules. There are two options here, obviously. Someone revealed actual classified information, in which case apparently multiple government workers committed a felony to tell the NYT about a story that is entirely flattering for the employer they just betrayed. Or, and given the incidence of "government officials .. spoke on the condition of anonymity" in NYT stories the far more likely option, the press office of the NSA called the NYT, whispered some dangerous words about "off the record" and then delivered the official press release that for some reason they just didn't get to put on NSA website just yet. This is the NYT writing a government press release into a bad thriller guided not by independently verified facts (how could you) but sheer ideology to fill in the gaps.

DiabloD3 9y ago

Basically. I've seen what now looks like state sponsored bullshit blogs posing as tin foil hatters being posted to HN saying Kaspersky is part of the Russian intelligence apparatus, and that's why the US government pressured stores to remove Kaspersky AV from store shelves, etc etc etc. Most likely, they did their job, and they did it correctly. The NSA can't really defeat competent AV researchers who aren't even looking at the NSA in the first place.

neuronexmachina 9y ago
The DHS is "tin foil hatters"? https://www.dhs.gov/news/2017/09/13/dhs-statement-issuance-binding-operational-directive-17-01 https://www.dhs.gov/news/2017/09/13/dhs-statement-issuance-b... > The Department is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks. The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates U.S. national security.
- KGIII 9y ago
  > The DHS is "tin foil hatters"? Yes? To be fair, that is kind of their job. I don't suppose their precept says that they should be paranoid and believing in conspiracy theories - in those exact words. But, that seems to be how it is manifest.
openasocket 9y ago
Kaspersky is pretty well known to have a close relationship with the Russian government, though. Hell, Kaspersky himself used to work for Soviet military intelligence. There's several articles cited here: https://en.wikipedia.org/wiki/Kaspersky_Lab#Allegations_of_ties_to_the_Russian_government https://en.wikipedia.org/wiki/Kaspersky_Lab#Allegations_of_t... I'm not saying Kaspersky is a part of the Russian intelligence apparatus, but I wouldn't trust them to report on Fancy Bear campaigns, nor would I trust their AV software if I were a particularly juicy target.
- Bendingo 9y ago
  > Kaspersky himself used to work for Soviet military intelligence This is straight up not true. He studied at an institute that was administered by the KGB.
- lawnchair_larry 9y ago
  They are not known for any such thing, and Eugene did not work for military intelligence. He has addressed this many times.
tptacek 9y ago
Whatever the "bullshit blogs" might be (I haven't noticed these stories, but maybe you can provide links?), they're in good company now, because that's more or less the story the NYT, WSJ, and WaPo have developed.
- Natsu 9y ago
  There's not a lot of attribution going on here, though. Take the WaPo story, they just tell us what's possible and leave us to draw conclusions ourselves - “That’s the crux of the matter,” said one industry official who received the briefing. “Whether Kaspersky is working directly for the Russian government or not doesn’t matter; their Internet service providers are subject to monitoring. So virtually anything shared with Kaspersky could become the property of the Russian government.” Late last month, the National Intelligence Council completed a classified report that it shared with NATO allies concluding that the FSB had “probable access” to Kaspersky customer databases and source code. That access, it concluded, could help enable cyberattacks against U.S. government, commercial and industrial control networks.

jnbiche 9y ago

Read the original New York Times story, it gives a lot more technical details on the hack than this one[0]. Assuming the Israeli and NYT accounts are to be believed, this was a very deliberate hack. Israel watched in real-time as Kaspersky sent out searches for NSA codename programs on all computers with Kaspersky AV installed (this was related to the whole Duqu 2.0 intrusion into Kaspersky's network that Kaspersky blogged about 2 years ago). And the NSA tools were some of the files reeled in from those searches. That said, it's still extremely embarrassing. Why is someone from TAO taking this kind of work home? 0. https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...

StanislavPetrov 9y ago
>Assuming the Israeli and NYT accounts are to be believed, An assumption nobody who knows anything about history will make.
- sien 9y ago
  This shouldn't be modded down. Security services are completely unreliable and release these things for their own benefit. The question with this is why are the Israelis pushing this now? The NYT has a poor record on this stuff as does pretty much everyone. WMD.
dotancohen 9y ago
> Israel watched in real-time as Kaspersky sent out searches for NSA codename programs on all computers with Kaspersky AV installed That happened _after_ Kaspersky identified the "NSA codename programs" as malware. That is exactly what an anti-malware application should do: look for instances of known malware.
revelation 9y ago
It's the NYT for crying out sake! Unless you believe they have the knowledge on staff to do any sort of original reporting on this, this story is exactly what a "government official speaking on the condition of anonymity" has whispered to them. It's the fricking party line. It's right there in the article: The current and former government officials who described the episode spoke about it on condition of anonymity because of classification rules. There are two options here, obviously. Someone revealed actual classified information, in which case apparently multiple government workers committed a felony to tell the NYT about a story that is entirely flattering for the employer they just betrayed. Or, and given the incidence of "government officials .. spoke on the condition of anonymity" in NYT stories the far more likely option, the press office of the NSA called the NYT, whispered some dangerous words about "off the record" and then delivered the official press release that for some reason they just didn't get to put on NSA website just yet. This is the NYT writing a government press release into a bad thriller guided not by independently verified facts (how could you) but sheer ideology to fill in the gaps.