6 ms·

>Kaspersky promptly identified the malware they were working on as malware and uploaded it? If the news story is to be believed, Kaspersky was scanning for cla

>Kaspersky promptly identified the malware they were working on as malware and uploaded it? If the news story is to be believed, Kaspersky was scanning for classified data using US intelligence codewords as a selector. >I'm sort of surprised Kaspersky had servers vulnerable to Israel I'm not, everyone's servers are vulnerable. Intelligence agencies can buy exploits. If they want in, they get in. >but I'm really surprised it was acceptable for NSA TAO employees to do work on their personal machines. I don't believe it is allowed. That said controlling access to data is hard, lots of people probably do work at home with classified stuff when they are told they shouldn't.

radicaldreamer 9y ago
They also have huge catalogs of 0-days and unreleased exploits, probably, in addition to human intelligence sources within major AV, infrastructure tech companies.
comex 9y ago
> If the news story is to be believed, Kaspersky was scanning for classified data using US intelligence codewords as a selector. Assuming you mean the linked article, it doesn’t say that. It says that Kaspersky uses “silent signatures”, which are supposed to be indicators of malware, but could hypothetically be adapted to search for classified data instead. But it doesn’t allege Kaspersky was actually doing that. (edit2: But the NYT report [2] does seem to allege that! This reporting is such a mess…) Apparently, silent signatures are a technique to test new signatures where instead of blocking files with the signature, the AV reports the finding back to a server, allowing the vendor to identify false positives before fully deploying the signature. The question is what exactly Kaspersky is/was reporting to their server. I googled ‘silent signature’ and found a patent [1], issued to Kaspersky, which describes sending only hashes of the executable with the signature. But this article seems to suggest that they were sending the executable in full - at least if the leak of NSA tools occurred via that mechanism. (The article doesn’t say it did, but it sounds like a plausible route for a customer’s executable to find its way to Kaspersky’s network.) If this is the case, it sounds extremely troubling from a privacy perspective even without any intelligence services getting involved. edit: Actually, I think the body of the patent does disclose sending the whole file to a server, which isn’t mentioned in the summary. The text is a little vague, though. > If no threat is detected in step 720, statistics regarding the executable file and the frequency of launches of the executable file are collected in step 740. Then, in step 750, the file is downloaded and sent for a further analysis in step 760. After the analysis, either a white list or black list can be updated with a signature of this executable file. [1] https://www.google.com/patents/US20110126286 https://www.google.com/patents/US20110126286 [2] https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...
- jnbiche 9y ago
  > Assuming you mean the linked article, it doesn’t say that It's from the original NY Times article, which is linked to from the WP article.
- lysp 9y ago
  > But this article seems to suggest that they were sending the executable in full It doesn't necessarily need to be an executable. Imagine this filter: - File type: .docx - Silent Signature: "TOP SECRET//COMINT//NOFORN" That means all word documents with: - the "top secret" classification - in the "Special Intelligence(ComInt)" area - marked as "No Foreign Nationals" will automatically be sent back to servers for review.
  - geofft 9y ago
    Why the heck is a file that says "TOP SECRET//COMINT//NOFORN" on anyone's personal laptop? Isn't that, like, not just a firing offense but also a criminal offense? Again, in my industry I'm not allowed to take code home with me; I have to remote into work and edit it on my work desktop. And the worst-case scenario of code leaking is basically that a competitor makes money that we would otherwise have made. Can't people who literally have (in their belief, at least) the fate of the free world in their hands be at least this careful?
- dotancohen 9y ago
  > ...detected in step 720, statistics regarding ... collected in step 740. Then, in step 750, ... All line numbers are module zero for ten? Is the code written in BASIC with the anticipation of line additions? I miss my C64!
- lawnchair_larry 9y ago
  Pretty much all AV products do this, for "suspicious" files too. Doesn't even need a signature to get collected. This includes non-executables such as docs or pdfs, since those are common 0day vectors.

radicaldreamer 9y ago

They also have huge catalogs of 0-days and unreleased exploits, probably, in addition to human intelligence sources within major AV, infrastructure tech companies.

comex 9y ago

> If the news story is to be believed, Kaspersky was scanning for classified data using US intelligence codewords as a selector. Assuming you mean the linked article, it doesn’t say that. It says that Kaspersky uses “silent signatures”, which are supposed to be indicators of malware, but could hypothetically be adapted to search for classified data instead. But it doesn’t allege Kaspersky was actually doing that. (edit2: But the NYT report [2] does seem to allege that! This reporting is such a mess…) Apparently, silent signatures are a technique to test new signatures where instead of blocking files with the signature, the AV reports the finding back to a server, allowing the vendor to identify false positives before fully deploying the signature. The question is what exactly Kaspersky is/was reporting to their server. I googled ‘silent signature’ and found a patent [1], issued to Kaspersky, which describes sending only hashes of the executable with the signature. But this article seems to suggest that they were sending the executable in full - at least if the leak of NSA tools occurred via that mechanism. (The article doesn’t say it did, but it sounds like a plausible route for a customer’s executable to find its way to Kaspersky’s network.) If this is the case, it sounds extremely troubling from a privacy perspective even without any intelligence services getting involved. edit: Actually, I think the body of the patent does disclose sending the whole file to a server, which isn’t mentioned in the summary. The text is a little vague, though. > If no threat is detected in step 720, statistics regarding the executable file and the frequency of launches of the executable file are collected in step 740. Then, in step 750, the file is downloaded and sent for a further analysis in step 760. After the analysis, either a white list or black list can be updated with a signature of this executable file. [1] https://www.google.com/patents/US20110126286 https://www.google.com/patents/US20110126286 [2] https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...

jnbiche 9y ago
> Assuming you mean the linked article, it doesn’t say that It's from the original NY Times article, which is linked to from the WP article.
lysp 9y ago
> But this article seems to suggest that they were sending the executable in full It doesn't necessarily need to be an executable. Imagine this filter: - File type: .docx - Silent Signature: "TOP SECRET//COMINT//NOFORN" That means all word documents with: - the "top secret" classification - in the "Special Intelligence(ComInt)" area - marked as "No Foreign Nationals" will automatically be sent back to servers for review.
- geofft 9y ago
  Why the heck is a file that says "TOP SECRET//COMINT//NOFORN" on anyone's personal laptop? Isn't that, like, not just a firing offense but also a criminal offense? Again, in my industry I'm not allowed to take code home with me; I have to remote into work and edit it on my work desktop. And the worst-case scenario of code leaking is basically that a competitor makes money that we would otherwise have made. Can't people who literally have (in their belief, at least) the fate of the free world in their hands be at least this careful?
dotancohen 9y ago
> ...detected in step 720, statistics regarding ... collected in step 740. Then, in step 750, ... All line numbers are module zero for ten? Is the code written in BASIC with the anticipation of line additions? I miss my C64!
lawnchair_larry 9y ago
Pretty much all AV products do this, for "suspicious" files too. Doesn't even need a signature to get collected. This includes non-executables such as docs or pdfs, since those are common 0day vectors.