3 ms·

That paragraph reeks of either journalistic license or a journalist who doesn't seem to understand what antivirus does. Every antivirus program aggressively sc

That paragraph reeks of either journalistic license or a journalist who doesn't seem to understand what antivirus does. Every antivirus program aggressively scans for malicious programs and sends them back to the security firm for inspection and creation of fingerprints. If the collection wasn't incidental, what mechanism could the FSB exploit to non-naively identify tools that it didn't already have, and flag them for retrieval?

tptacek 9y ago
Your comment doesn't really say anything. Obviously, most AV software relays files back to the AV vendor's servers. But that's not what this graf implies. The graf suggests that Russian hackers are sending selectors down to the installed base of AV software to retrieve specific files, and that, once they obtained files that way, they passed the files on to Russian intelligence.
- seabird 9y ago
  You seem to miss the part where I say >If the collection wasn't incidental, what mechanism could the FSB exploit to non-naively identify tools that it didn't already have, and flag them for retrieval? Emphasis on "non-naively." Antivirus seems like a highly ineffective tool for espionage of the sort being claimed in the article. You either have to blindly fish for something or already have a fingerprint of what you're looking for.
  - tptacek 9y ago
    Obviously, they have fingerprints of what they're looking for.
    - seabird 9y ago
      To have a hash of a file, you need the file (or a large portion of the file), especially in the context of antivirus, which searches for very specific files and needs to have a very low false positive and false negative rate. Consequently, they would already have to have the tool (or a large portion of the tool) to find it and retrieve it. A little non-productive, don't you think? Saying that they "obviously have fingerprints of what they're looking for" is an active attempt to make the events fit a narrative.

tptacek 9y ago

Your comment doesn't really say anything. Obviously, most AV software relays files back to the AV vendor's servers. But that's not what this graf implies. The graf suggests that Russian hackers are sending selectors down to the installed base of AV software to retrieve specific files, and that, once they obtained files that way, they passed the files on to Russian intelligence.

seabird 9y ago
You seem to miss the part where I say >If the collection wasn't incidental, what mechanism could the FSB exploit to non-naively identify tools that it didn't already have, and flag them for retrieval? Emphasis on "non-naively." Antivirus seems like a highly ineffective tool for espionage of the sort being claimed in the article. You either have to blindly fish for something or already have a fingerprint of what you're looking for.
- tptacek 9y ago
  Obviously, they have fingerprints of what they're looking for.
  - seabird 9y ago
    To have a hash of a file, you need the file (or a large portion of the file), especially in the context of antivirus, which searches for very specific files and needs to have a very low false positive and false negative rate. Consequently, they would already have to have the tool (or a large portion of the tool) to find it and retrieve it. A little non-productive, don't you think? Saying that they "obviously have fingerprints of what they're looking for" is an active attempt to make the events fit a narrative.