14 ms·

Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

166 points by gvb 9y ago

deleted 9y ago
[deleted]
r3bl 9y ago
I have to ask: Is there any concrete evidence against Kaspersky doing anything remotely concerning since this whole charade against them started in 2015 or is it still "they're Russian, so they must be doing something bad" scenario? EDIT: Fuck if I understand why people like JohnStrange, revelation and ryanlol are downvoted in their replies to this comment. They're on topic.
- X86BSD 9y ago
  It’s a witch hunt slash scapegoat. Just as is Russian “collusion” with trump. Absolutely zero evidence at all only unnamed sources and speculation. All the money wasted on this politics garbage sigh.
  - cisanti 9y ago
    The witch hunt has gone so crazy that even the author of faceapp than removes make up was somehow tied to "Russian troll farms". It's sickening.
    - cisanti 9y ago
      Why are you downvoting me, people? What is that I said was wrong?!
      - krapp 9y ago
        I didn't downvote you, but you're responding in agreement to an obvious troll and spreading propaganda about a vast left-wing "witch hunt" which only serves to dilute and further degrade what little intellectual value this thread might have possessed.
    - jonknee 9y ago
      What's your source for this? I remember they got a lot of flack for introducing race changing filters (AKA digital blackface). Thinking that was a good idea is pretty sickening.
  - orf 9y ago
    > Just as is Russian “collusion” with trump. Absolutely zero evidence Well... not quite.
    - ryanlol 9y ago
      Can you link to any evidence suggesting foul play on Kasperskys part? edit: This question was far more reasonable before the parent comment was edited.
      - forapurpose 9y ago
        [deleted]
        ryanlol 9y ago
        Really only describes standard AV co practices.
      - orf 9y ago
        I was responding to the comment regarding collision between the Trump campaign and Russia
      - ctrl-j 9y ago
        I mean... it was all over the news? https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...
        ryanlol 9y ago
        You could write a very similar article about any AV company. I've personally been automatically scanning data shared by various¹ AV companies for sensitive documents. I only store files not detected as malware by any scanners, and filter out large usually boring files (i.e. videos, audio). I also make an effort to filter out publicly available documents by googling them. So far I've gathered over 20TB of data. So far I've found: Entire customer database of a Swedish bank Thousands of git repositories Hundreds of passport scans Tens of gigabytes of sensitive medical documents Tens of gigabytes of internal government documents Payroll data for hundreds of thousands of people Entire email inboxes, both government and corporate. Hundreds of website dbs in various formats This is just off the top of my head, I could keep going for a while. I've got a searchable archive of tens of millions of clean pdfs, word docs, excel spreadsheets, powerpoints and so on. All pulled from users computers by their AV software. ¹ Not including Kaspersky, but including many US firms.
  - ctrl-j 9y ago
    > Just as is Russian “collusion” with trump. Absolutely zero evidence at all only unnamed sources and speculation. Just out of curiosity, what makes you think there is zero evidence? How would we know what evidence Mueller's team has uncovered? How do you reconcile all of the interactions between the trump campaign and the various Russian entities involved?
    - X86BSD 9y ago
      None of which were illegal. There has been zero evidence uncovered or produced by anyone in 10 months. This is nothing but a witch hunt to demonize some idiot the left hates. It’s transparent and disappointing. While the left gets away with Benghazi and uranium one. There is no justice only the decision of those in power.
      - maskedinvader 9y ago
        There is no justice only the decision of those in power. -do you really want that power to be in the tiny hands of an orange clown ? #justcurious
        thatguy0900 9y ago
        As much as you may dislike him, please don't use this kind of discourse on HN.
        maskedinvader 9y ago
        just to clarify ? the question itself has merit ? no ? the description of the commander in chief however may not have shown respect, for which I accept your comment and take the downvotes on the chin.
      - orf 9y ago
        > away with Benghazi Wasn't Benghazi investigated to death by the right for an absurdly long time? Why do you think nothing was found? I'm not sure if your willfully trolling or actually believe the misinformation you are spreading, and I'm not sure which is worse.
  - ihaveahadron 9y ago
    This is hacker news where we are smart which includes proper grammar. Why did you write out the word "slash", don't you know it's sybolized with a / sign. Learn to philosophalize better.
  - sctb 9y ago
    We've asked you many times to follow the guidelines. Please re-read them and start posting civilly and substantively or we'll ban the account. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- matt4077 9y ago
  It's a security company run mostly by ex-KGB and dependent on the good will of an administration willing to very publicly murder their opponents[0], and not bound by anything resembling rule of law. So yes, it is possible, maybe even likely, that Kasperky is doing nothing shady and has only the best intentions. It's also somewhat irresponsible to entrust them with any data of value. Those two things are not mutually exclusive.
  - 55555 9y ago
    Perhaps I'm confused, but did you mean to add a footnote/citation ([0])?
    - matt4077 9y ago
      Yeah. Just google for Polonium. They murdered someone, and made sure the victim, and the whole world, knew exactly who was behind it.
      - FeepingCreature 9y ago
        Usually if you leave a footnote[0], you have to actually include the note in the footer of your comment. [0] https://en.wikipedia.org/wiki/Note_(typography) https://en.wikipedia.org/wiki/Note_(typography) Like so.
        nasredin 9y ago
        Probably misspelled, from memory: Litvienko (Polonium) Politovskaya (Journalist) Nemtsov (Politician) And no, you do not need to leave a note (IMHO) since the fact that Russian government murders its critics is common knowledge.
    - syockit 9y ago
      [0] is just a short form for [citation needed]
- revelation 9y ago
  The best part of all of this is how there is all this media coverage on a fricking antivirus, but nobody seems all too concerned with the NSA losing more secrets. It's like incident #100, maybe Kaspersky is the KGB, good on them since they are clearly more competent than the NSA. Maybe we can poach them?
  - philipov 9y ago
    Stands to reason that the media coverage is a smoke screen to eat up attention on the issue. Easier to give people a boogeyman so they don't have as much energy to spend on noticing the really important problems. And our media outlets will happily run with anything that produces those sweet clicks.
    - revelation 9y ago
      Our media outlets will happily run anything the government tells them. Here is the line from that infamous NYT article: "The current and former government officials who described the episode spoke about it on condition of anonymity because of classification rules." And now you know why Snowden wouldn't touch the NYT with 10 foot pole. This isn't "current and former government officials" committing a felony and treason to leak information to the NYT, no, they are just telling that reporter the NSA press report with a hushed voice.
- deleted 9y ago
  [deleted]
- JohnStrange 9y ago
  I suspect there is a secret background story, like every so often when intelligence agencies are involved. Maybe Kaspersky didn't cooperate with the NSA as much as they'd wished for, or Russian intelligence interfered to prevent this. It looks to me like somebody is holding a very special grudge against this company. I'm merely speculating, of course. Personally, I never take ordinary public announcements or claims from intelligence agencies at face value, since they have plenty of reasons to lie and disinform. That doesn't entail that their secret reports are bogus, of course, and senate hearings are also reliable. I've followed the senate hearings close enough to be reasonably certain that the US intelligence community is right about the accusations concerning Russian meddling in politics in the US and the EU. But that's a different case, people were testifying under oath in front of senate committees and senators from both parties who went to meetings behind closed doors were also convinced of the (classified) evidence. As for Kaspersky, the information is unreliable and my personal guess is that whatever happened wasn't their fault. If someone has malware on his machine, it's the job of the antivirus software to detect and analyze it. If at all, the story has increased my overall trust in the technical quality of Kaspersky software. Another speculation that I find overall credible is that since Snowden's revelations there is some concerted effort to further discredit the NSA in order to weaken their ability to operate. If that's so, then this campaign seems to be quite successful.
- odiroot 9y ago
  Watching US situation from outside it's seems there's an urgent need for some kind of a bad guy. Kaspersky is just easy target and apparently three-letter-agencies have means to steer the media to pursue this direction.
  - whoopdedo 9y ago
    Remember last year when Kaspersky accused[1] Microsoft of anti-trust for disabling their antivirus? And Microsoft admitted it was done in the name of compatibility.[2] Something about that seemed fishy to me because none of the other AV venders were complaining. Was Microsoft told to intentionally sabotage Kaspersky? [1] https://www.computerworld.com/article/3141470/security/kaspersky-founder-calls-out-microsoft-for-av-shenanigans.html https://www.computerworld.com/article/3141470/security/kaspe... [2] https://www.theverge.com/2017/6/20/15836208/microsoft-kaspersky-eu-anti-virus-complaint-response https://www.theverge.com/2017/6/20/15836208/microsoft-kasper...
    - londons_explore 9y ago
      That sounds like a legit software incompatibility to me. Kaspersky was probably using some private API they shouldn't have been using, and when Microsoft changed the API or changed the way it worked, they had to disable Kaspersky or computers would no longer boot up. When companies do that, they nearly always reach out to the affected vendors with advance warning so the vendor can do a rushed fix, but repeat offenders, or issues detected very late in the game before release can end up with no notice.
  - gspetr 9y ago
    > Watching US situation from outside it's seems there's an urgent need for some kind of a bad guy. How else would you justify all that Defense budget spending? https://en.wikipedia.org/wiki/Bomber_gap https://en.wikipedia.org/wiki/Bomber_gap https://en.wikipedia.org/wiki/Missile_gap https://en.wikipedia.org/wiki/Missile_gap
- roywiggins 9y ago
  The simplest argument to make is that, regardless of whether the top people at Kaspersky are gleefully collaborating with the Russian government, they probably are required to give the Russian security service a backdoor to their networks as a condition of existing. Given what we know about the feds installing black boxes in ISPs' networks here in the US- a country nominally committed to the rule of law- it seems somewhat naive to think that the Russian government doesn't have access to Kaspersky servers. Does that make Kaspersky uniquely evil? Probably not. Do the feds have an agreement with Microsoft to take a peek at anything they turn up from a foreign intelligence service? I don't know. It wouldn't be too surprising.
- daxorid 9y ago
  > Fuck if I understand why people like JohnStrange, revelation and ryanlol are downvoted The Hacker News community largely gets its non-hacker news from CNN, the NYT, HuffPo, etc. As mainstream US media parrots whatever the FVEY IC tells them to, it's not surprising that most HN voters end up uncritically believing the Russia-Is-Evil narrative from the same IC that conducted MKULTRA and sold us a war predicated on the lie that Saddam was loaded up with WMDs. Downvoting any and all dissent from CIA psyops is the natural consequence of this. Because, patriotism, or something.
  - willstrafach 9y ago
    You really don't believe there is a possibility that some others have assessed all available facts and simply disagree with the conclusion that you've evidently come to?
matt4077 9y ago
Kasperky's story here seems completely believable. Yet the US government's warnings also seem reasonable even given just the facts everyone agrees on. I guess the larger lesson may be how Russia's failure to establish rule of law makes it impossible to run a business that depends on trust. The US should take note: if they succeed in breaking Apple et al's attempts to protect their users, pretty soon the only countries you'll want to buy software from are Norway and Canada.
- sschueller 9y ago
  With secret warrants and other questionable laws trust is also becoming an issue for US companies.
- grandalf 9y ago
  > Yet the US government's warnings also seem reasonable even given just the facts everyone agrees on. But somehow these warnings only became necessary in the past year or so, when the US has had ongoing conflict with Russia over the past 20 years?
- indubitable 9y ago
  It's interesting to analyze your comment for a minute. Consider that PRISM was revealed in 2013. It is a far reaching surveillance program carried out by the NSA with the assistance of numerous major tech players, including Apple. [1] It's unveiling was certainly an embarassment both for the companies involved as well as the NSA. And here we are in 2017, just 4 years later, with you stating that users can "trust" companies, including Apple by name, to implicitly protect their data from government overreach. Essentially, that the government is publicly running a campaign to openly access user data does not in any way change the fact that they already have covert access to that data in private. Why are they doing this? One can only speculate, but I'd imagine one reason is that unlawfully obtained information and evidence is not admissible in court leading to all sorts of fun things like parallel construction. [2] [1] - https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... [2] - https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
orf 9y ago
So an NSA contractor or employee takes confidential/highly sensitive code and documents home and leaves it on their machine. They then install a pirated version of Office, after disabling their antivirus software which is telling them it is infected with a virus and preventing the installation. Seems like massive incompetence from this user rather than Kaspersky doing anything malicious, and those files where destined to be leaked somehow the moment they left the NSA. I'm sure there are some employees there who may report or leak things to the Russian government, but I don't buy the narrative that Kaspersky is some evil Russian cyber hoover. Maybe I'm naive though.
- jrochkind1 9y ago
  This is the best part: "...found they contained malicious code from Equation Group..." "Equation Group" is Kaspersky's label for a malware group believed to be NSA. Kaspersky's software possibly then detected as malware the very confidential code the NSA contractor/employee illegally took home, ha!
  - rhizome 9y ago
    So the hubbub about Kaspersky is really CYA from the NSA?
- mcny 9y ago
  > those files where destined to be leaked somehow the moment they left the NSA Those files were destined to be leaked somehow the moment they were created. > Seems like massive incompetence from this user So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? It is wrong on several counts. One: this is data that we should not be hoarding in the first place. We should be helping vendors fix their stuff so the cachet of information automatically loses its value to people who want to get it. Two: Even if we are an axis of evil and don't want to do the right thing, punishing this individual seems like the thing the higher ups at an oppressive regime would do to prevent the wrath of the dictator on themselves for failing to prevent what is really a system failure. [Gitlab postmortem] https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/ https://about.gitlab.com/2017/02/10/postmortem-of-database-o... Edit while I have your attention I would like your support in ending the CFAA https://cfaa.eff.org/ https://cfaa.eff.org/
ihaveahadron 9y ago
It's very descriptive. They say a 45mb file was stolen. Nice of them to do that instead of painting it like some ancient civilization from some far galactic empire came down and spread pixie dust around nsa headquarters and that's how they hacked us.
forapurpose 9y ago
The article contains a useful recap of the evidence so far regarding this particular Kapersky issue, but the news is Kerpersky's denial. I don't take the latter to mean too much either way; when you get into the world of intelligence, plausible denials are the norm, and corporations practice it pretty commonly too. Of course the U.S. government had to remove Kapersky from its computers. Russian intelligence has been very aggressive; the U.S. can't assume they'd pass on the opportunity to utilize an opportunity this good: Antivirus is widespread and highly invasive - a confidentiality (and even integrity) violation utility, with access to all data and code on the system, that the user helpfully installs for you, and it comes with built-in remote updates and communication that the user fully approves of.
- JohnStrange 9y ago
  What I find hilarious about this whole story is that the US government allowed highly intrusive software from a non-allied country on government machines in the first place. It seems fairly reasonable to restrict software on machines that potentially hold confidential information (incl. e.g. patient data, payrolls) to software that is produced in the same country or by companies of close allies, or at least by companies who agree to some auditing. Yet allowing anything seems fairly common practice, even more so outside the US. I wonder how many government employees of countries other than the US have Gmail accounts and put all their documents on Google docs, etc. Not to mention online backups which tend to be more expensive for servers located outside the US...
  - csydas 9y ago
    I don't know what the particular condition with Kaspersky and the US government was, but I work for a non-US based software company that has multiple special contracts with the US Federal Government; we have a special build of the software which was remade piece by piece on US soil, meets some Federal encryption guidelines, and our support is very strict on who can do what with any Federal Government account. I'm not sure if this is common place or not, but I was under the impression that if you were from outside the US and wanted to land Federal contracts, you had to be ready to bend over a bit for the US Federal Government. No other government gets the same treatment currently.
rando444 9y ago
Before this article was published I don't think it was alleged that Kaspersky ever did anything. All the public knew is that allegedly Israel hacked Kaspersky and noticed the Russian government using Kaspersky's tools to try and dig out secret documents. I mean who knows, maybe the Russian government had a backdoor that they were abusing, maybe they hacked Kaspersky themselves, or maybe they were just given access. I would have given Kaspersky plausible deniability before this article.. now I just don't believe them. At face value their explanation sounds reasonable. However, the original claim is that the Israelis were watching in real-time as agents searched computers around the world for secret codenames [0]... which is a world away from the explanation given in the submitted article. [0] https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...
- r721 9y ago
  Also this part from WSJ article remains: "For many months, U.S. intelligence agencies studied the software and even set up controlled experiments to see if they could trigger Kaspersky’s software into believing it had found classified materials on a computer being monitored by U.S. spies, these people said. Those experiments persuaded officials that Kaspersky was being used to detect classified information." https://www.wsj.com/articles/russian-hackers-scanned-networks-world-wide-for-secret-u-s-data-1507743874 https://www.wsj.com/articles/russian-hackers-scanned-network...
  - londons_explore 9y ago
    As a spy agency, this is how you put the middle finger up to a a remote spy agency. You report their malware to an antivirus database. It's basically saying 'ha ha, we caught you, and now the whole world can look at what you were up to'. Presumably, the NSA will have automated monitoring tools scanning every bit of AV software and AV databases looking for any of their own tools there, so they know right away when someone has publically outed them. I wouldn't be surprised if these weren't even hooked up to automated self-removal logic so that NSA malware could remove itself in seconds worldwide if an AV database were updated to detect it.
- 9y ago
Asdfbla 9y ago
Seems plausible, though regardless of whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not, it seems prudent for any government in the world to avoid using software that potentially uploads confidential data to foreign servers. Governments anywhere would probably be ill-advised to use anti-virus software from countries like the US or Russia, unless they can be sure that cloud analysis is either disabled or done in local datacenters. I guess on the bright side at least the anti-virus market has a variety of firms based in many different countries, so you can choose your poison based on how trustworthy you find the respective governments. Doesn't help you when they themselves get hacked though. As for the story itself, I kinda dislike the reliance on access journalism and "unnamed" sources in many of the reports. Yes, there surely are many legitimate reasons why sources have to remain anonymous, no doubt about that. But in a case that's so highly political it kinda leaves a bad taste if the story is so dependent on unnamed government sources.
- trhway 9y ago
  >whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not no offense, it is just very entertaining(and educational) to observe how people from one culture try to apply their mental frameworks to completely different mentality. There is no "whether", "or not", "gag order" (in the sense as if explicit one was necessary) in the Russian reality in the context of private company cooperating with FSB. Hell, there is no even much of "cooperating". An FSB guy just says what he wants to get, and he gets it pronto. And in cases like Kaspersky it is even more straightforward as Kaspersky and the others there are FSB guys. I mean it is like a joke among Russians here: "Did you hear? The NSA thinks about stopping to use Kaspersky on their computers!" "Wow! How did they discovered (the ploy)? Was it the parachute?" (the parachute is a reference to a very well known joke about a USSR spy in Nazi Germany from very popular TV movie - the spy was so good and invincible that only the deployed parachute he was dragging behind him in the open daylight on the streets of Berlin was the only possible clue for the Nazis) Again, it is different reality. In US law protects from and punishes for illegal cooperation, whereis in Russia the system protects for cooperation and punishes for refusal to do so.
  - 9y ago
peterwwillis 9y ago
Two things this article just ZOOMS over but are critical: 1. If Israelis were "burrowed deep" in Kaspersky's network, sure, Russian hackers may have been, too - but so could have anyone else. Also the Israelis are not exactly fans of the Russians, and are our primary (sole?) Middle East ally, so there is bias and uncertainty there. 2. From the article: "The allegations, all attributed to unnamed officials with no supporting documentation, helped explain why the US Department of Homeland Security in September took the unprecedented step of directing all US agencies to stop using Kaspersky products and services" So we're not even mentioning how in May the Senate was already taking Kaspersky to task, and there were rumors of them getting the boot even in 2016? The allegations don't explain shit, they are just another facet of a year long political battle between the American legislative branch and intelligence services against Kaspersky. It is plausible that the U.S. government made these files go through Kaspersky just so they could have leverage over them for a deal they wanted (like spying on their own country), or that a stupid contractor put them on their laptop along with Kaspersky AV, and the NSA got caught with it's pants down, they're using the Israelis to try to cover the embarrassment. This is not out of the ordinary behavior for an intelligence service. Look at it this way: flip the roles. Would Russia try a play on their contracts with a U.S. company to further their goals?
jradd 9y ago
As far as I can tell, the only reason US gov banned kaspersky because of some emails and work performed for the FSB led by Igor Chekunov, Kaspersky Lab’s chief legal officer and a former member of the KGB. Is there any good reason for us gov to mistrust this company or will they need to leak secrets to us before that will happen?
walshemj 9y ago
Ok so you out and out admit an offence under the espionage act - you've just fucked every employee out side of Russia over. Receiving the goods in this case is just as much an ofence as stealing.
- willstrafach 9y ago
  Can you explain this any further? I am also inclined to believe Kaspersky is in the wrong here, especially given the publicizing of personal data from a customer's computer for PR purposes, but I am having trouble understanding how the Espionage Act applies?
  - walshemj 9y ago
    "As it is currently written, the Espionage Act of 1917 makes it a crime to hurt the United States or benefit a foreign country by collecting or communicating information that would harm the national defense. It is also a crime to enter an installation or obtain a document connected to the national defense in order to hurt the United States or benefit a foreign country. Knowingly receiving classified information that has been obtained illegally, as well as passing it on, also runs afoul of the Espionage Act." https://www.rcfp.org/browse-media-law-resources/news-media-law/wikileaks-and-espionage-act-1917 https://www.rcfp.org/browse-media-law-resources/news-media-l...
    - willstrafach 9y ago
      Interesting. That language gives me the idea that such prosecution could be very tricky, given the many instances of purported-classified information being relayed to press (In fact this would presumably apply to the information relating to Israel accessing Kaspersky systems and allegedly watching Russians exfil interesting data).
    - Anderkent 9y ago
      How is accidentally downloading a document and then deleting it immediately 'knowingly receiving classified information'?
lawnchair_larry 9y ago
Original source article: https://securelist.com/investigation-report-for-the-september-2014-equation-malware-detection-incident-in-the-us/83210/ https://securelist.com/investigation-report-for-the-septembe...

166 points by gvb 9y ago

deleted 9y ago

[deleted]

r3bl 9y ago

I have to ask: Is there any concrete evidence against Kaspersky doing anything remotely concerning since this whole charade against them started in 2015 or is it still "they're Russian, so they must be doing something bad" scenario? EDIT: Fuck if I understand why people like JohnStrange, revelation and ryanlol are downvoted in their replies to this comment. They're on topic.

X86BSD 9y ago
It’s a witch hunt slash scapegoat. Just as is Russian “collusion” with trump. Absolutely zero evidence at all only unnamed sources and speculation. All the money wasted on this politics garbage sigh.
- cisanti 9y ago
  The witch hunt has gone so crazy that even the author of faceapp than removes make up was somehow tied to "Russian troll farms". It's sickening.
  - cisanti 9y ago
    Why are you downvoting me, people? What is that I said was wrong?!
    - krapp 9y ago
      I didn't downvote you, but you're responding in agreement to an obvious troll and spreading propaganda about a vast left-wing "witch hunt" which only serves to dilute and further degrade what little intellectual value this thread might have possessed.
  - jonknee 9y ago
    What's your source for this? I remember they got a lot of flack for introducing race changing filters (AKA digital blackface). Thinking that was a good idea is pretty sickening.
- orf 9y ago
  > Just as is Russian “collusion” with trump. Absolutely zero evidence Well... not quite.
  - ryanlol 9y ago
    Can you link to any evidence suggesting foul play on Kasperskys part? edit: This question was far more reasonable before the parent comment was edited.
    - forapurpose 9y ago
      [deleted]
      - ryanlol 9y ago
        Really only describes standard AV co practices.
    - orf 9y ago
      I was responding to the comment regarding collision between the Trump campaign and Russia
    - ctrl-j 9y ago
      I mean... it was all over the news? https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...
      - ryanlol 9y ago
        You could write a very similar article about any AV company. I've personally been automatically scanning data shared by various¹ AV companies for sensitive documents. I only store files not detected as malware by any scanners, and filter out large usually boring files (i.e. videos, audio). I also make an effort to filter out publicly available documents by googling them. So far I've gathered over 20TB of data. So far I've found: Entire customer database of a Swedish bank Thousands of git repositories Hundreds of passport scans Tens of gigabytes of sensitive medical documents Tens of gigabytes of internal government documents Payroll data for hundreds of thousands of people Entire email inboxes, both government and corporate. Hundreds of website dbs in various formats This is just off the top of my head, I could keep going for a while. I've got a searchable archive of tens of millions of clean pdfs, word docs, excel spreadsheets, powerpoints and so on. All pulled from users computers by their AV software. ¹ Not including Kaspersky, but including many US firms.
- ctrl-j 9y ago
  > Just as is Russian “collusion” with trump. Absolutely zero evidence at all only unnamed sources and speculation. Just out of curiosity, what makes you think there is zero evidence? How would we know what evidence Mueller's team has uncovered? How do you reconcile all of the interactions between the trump campaign and the various Russian entities involved?
  - X86BSD 9y ago
    None of which were illegal. There has been zero evidence uncovered or produced by anyone in 10 months. This is nothing but a witch hunt to demonize some idiot the left hates. It’s transparent and disappointing. While the left gets away with Benghazi and uranium one. There is no justice only the decision of those in power.
    - maskedinvader 9y ago
      There is no justice only the decision of those in power. -do you really want that power to be in the tiny hands of an orange clown ? #justcurious
      - thatguy0900 9y ago
        As much as you may dislike him, please don't use this kind of discourse on HN.
        maskedinvader 9y ago
        just to clarify ? the question itself has merit ? no ? the description of the commander in chief however may not have shown respect, for which I accept your comment and take the downvotes on the chin.
    - orf 9y ago
      > away with Benghazi Wasn't Benghazi investigated to death by the right for an absurdly long time? Why do you think nothing was found? I'm not sure if your willfully trolling or actually believe the misinformation you are spreading, and I'm not sure which is worse.
- ihaveahadron 9y ago
  This is hacker news where we are smart which includes proper grammar. Why did you write out the word "slash", don't you know it's sybolized with a / sign. Learn to philosophalize better.
- sctb 9y ago
  We've asked you many times to follow the guidelines. Please re-read them and start posting civilly and substantively or we'll ban the account. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
matt4077 9y ago
It's a security company run mostly by ex-KGB and dependent on the good will of an administration willing to very publicly murder their opponents[0], and not bound by anything resembling rule of law. So yes, it is possible, maybe even likely, that Kasperky is doing nothing shady and has only the best intentions. It's also somewhat irresponsible to entrust them with any data of value. Those two things are not mutually exclusive.
- 55555 9y ago
  Perhaps I'm confused, but did you mean to add a footnote/citation ([0])?
  - matt4077 9y ago
    Yeah. Just google for Polonium. They murdered someone, and made sure the victim, and the whole world, knew exactly who was behind it.
    - FeepingCreature 9y ago
      Usually if you leave a footnote[0], you have to actually include the note in the footer of your comment. [0] https://en.wikipedia.org/wiki/Note_(typography) https://en.wikipedia.org/wiki/Note_(typography) Like so.
      - nasredin 9y ago
        Probably misspelled, from memory: Litvienko (Polonium) Politovskaya (Journalist) Nemtsov (Politician) And no, you do not need to leave a note (IMHO) since the fact that Russian government murders its critics is common knowledge.
  - syockit 9y ago
    [0] is just a short form for [citation needed]
revelation 9y ago
The best part of all of this is how there is all this media coverage on a fricking antivirus, but nobody seems all too concerned with the NSA losing more secrets. It's like incident #100, maybe Kaspersky is the KGB, good on them since they are clearly more competent than the NSA. Maybe we can poach them?
- philipov 9y ago
  Stands to reason that the media coverage is a smoke screen to eat up attention on the issue. Easier to give people a boogeyman so they don't have as much energy to spend on noticing the really important problems. And our media outlets will happily run with anything that produces those sweet clicks.
  - revelation 9y ago
    Our media outlets will happily run anything the government tells them. Here is the line from that infamous NYT article: "The current and former government officials who described the episode spoke about it on condition of anonymity because of classification rules." And now you know why Snowden wouldn't touch the NYT with 10 foot pole. This isn't "current and former government officials" committing a felony and treason to leak information to the NYT, no, they are just telling that reporter the NSA press report with a hushed voice.
deleted 9y ago
[deleted]
JohnStrange 9y ago
I suspect there is a secret background story, like every so often when intelligence agencies are involved. Maybe Kaspersky didn't cooperate with the NSA as much as they'd wished for, or Russian intelligence interfered to prevent this. It looks to me like somebody is holding a very special grudge against this company. I'm merely speculating, of course. Personally, I never take ordinary public announcements or claims from intelligence agencies at face value, since they have plenty of reasons to lie and disinform. That doesn't entail that their secret reports are bogus, of course, and senate hearings are also reliable. I've followed the senate hearings close enough to be reasonably certain that the US intelligence community is right about the accusations concerning Russian meddling in politics in the US and the EU. But that's a different case, people were testifying under oath in front of senate committees and senators from both parties who went to meetings behind closed doors were also convinced of the (classified) evidence. As for Kaspersky, the information is unreliable and my personal guess is that whatever happened wasn't their fault. If someone has malware on his machine, it's the job of the antivirus software to detect and analyze it. If at all, the story has increased my overall trust in the technical quality of Kaspersky software. Another speculation that I find overall credible is that since Snowden's revelations there is some concerted effort to further discredit the NSA in order to weaken their ability to operate. If that's so, then this campaign seems to be quite successful.
odiroot 9y ago
Watching US situation from outside it's seems there's an urgent need for some kind of a bad guy. Kaspersky is just easy target and apparently three-letter-agencies have means to steer the media to pursue this direction.
- whoopdedo 9y ago
  Remember last year when Kaspersky accused[1] Microsoft of anti-trust for disabling their antivirus? And Microsoft admitted it was done in the name of compatibility.[2] Something about that seemed fishy to me because none of the other AV venders were complaining. Was Microsoft told to intentionally sabotage Kaspersky? [1] https://www.computerworld.com/article/3141470/security/kaspersky-founder-calls-out-microsoft-for-av-shenanigans.html https://www.computerworld.com/article/3141470/security/kaspe... [2] https://www.theverge.com/2017/6/20/15836208/microsoft-kaspersky-eu-anti-virus-complaint-response https://www.theverge.com/2017/6/20/15836208/microsoft-kasper...
  - londons_explore 9y ago
    That sounds like a legit software incompatibility to me. Kaspersky was probably using some private API they shouldn't have been using, and when Microsoft changed the API or changed the way it worked, they had to disable Kaspersky or computers would no longer boot up. When companies do that, they nearly always reach out to the affected vendors with advance warning so the vendor can do a rushed fix, but repeat offenders, or issues detected very late in the game before release can end up with no notice.
- gspetr 9y ago
  > Watching US situation from outside it's seems there's an urgent need for some kind of a bad guy. How else would you justify all that Defense budget spending? https://en.wikipedia.org/wiki/Bomber_gap https://en.wikipedia.org/wiki/Bomber_gap https://en.wikipedia.org/wiki/Missile_gap https://en.wikipedia.org/wiki/Missile_gap
roywiggins 9y ago
The simplest argument to make is that, regardless of whether the top people at Kaspersky are gleefully collaborating with the Russian government, they probably are required to give the Russian security service a backdoor to their networks as a condition of existing. Given what we know about the feds installing black boxes in ISPs' networks here in the US- a country nominally committed to the rule of law- it seems somewhat naive to think that the Russian government doesn't have access to Kaspersky servers. Does that make Kaspersky uniquely evil? Probably not. Do the feds have an agreement with Microsoft to take a peek at anything they turn up from a foreign intelligence service? I don't know. It wouldn't be too surprising.
daxorid 9y ago
> Fuck if I understand why people like JohnStrange, revelation and ryanlol are downvoted The Hacker News community largely gets its non-hacker news from CNN, the NYT, HuffPo, etc. As mainstream US media parrots whatever the FVEY IC tells them to, it's not surprising that most HN voters end up uncritically believing the Russia-Is-Evil narrative from the same IC that conducted MKULTRA and sold us a war predicated on the lie that Saddam was loaded up with WMDs. Downvoting any and all dissent from CIA psyops is the natural consequence of this. Because, patriotism, or something.
- willstrafach 9y ago
  You really don't believe there is a possibility that some others have assessed all available facts and simply disagree with the conclusion that you've evidently come to?

matt4077 9y ago

Kasperky's story here seems completely believable. Yet the US government's warnings also seem reasonable even given just the facts everyone agrees on. I guess the larger lesson may be how Russia's failure to establish rule of law makes it impossible to run a business that depends on trust. The US should take note: if they succeed in breaking Apple et al's attempts to protect their users, pretty soon the only countries you'll want to buy software from are Norway and Canada.

sschueller 9y ago
With secret warrants and other questionable laws trust is also becoming an issue for US companies.
grandalf 9y ago
> Yet the US government's warnings also seem reasonable even given just the facts everyone agrees on. But somehow these warnings only became necessary in the past year or so, when the US has had ongoing conflict with Russia over the past 20 years?
indubitable 9y ago
It's interesting to analyze your comment for a minute. Consider that PRISM was revealed in 2013. It is a far reaching surveillance program carried out by the NSA with the assistance of numerous major tech players, including Apple. [1] It's unveiling was certainly an embarassment both for the companies involved as well as the NSA. And here we are in 2017, just 4 years later, with you stating that users can "trust" companies, including Apple by name, to implicitly protect their data from government overreach. Essentially, that the government is publicly running a campaign to openly access user data does not in any way change the fact that they already have covert access to that data in private. Why are they doing this? One can only speculate, but I'd imagine one reason is that unlawfully obtained information and evidence is not admissible in court leading to all sorts of fun things like parallel construction. [2] [1] - https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... [2] - https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction

orf 9y ago

So an NSA contractor or employee takes confidential/highly sensitive code and documents home and leaves it on their machine. They then install a pirated version of Office, after disabling their antivirus software which is telling them it is infected with a virus and preventing the installation. Seems like massive incompetence from this user rather than Kaspersky doing anything malicious, and those files where destined to be leaked somehow the moment they left the NSA. I'm sure there are some employees there who may report or leak things to the Russian government, but I don't buy the narrative that Kaspersky is some evil Russian cyber hoover. Maybe I'm naive though.

jrochkind1 9y ago
This is the best part: "...found they contained malicious code from Equation Group..." "Equation Group" is Kaspersky's label for a malware group believed to be NSA. Kaspersky's software possibly then detected as malware the very confidential code the NSA contractor/employee illegally took home, ha!
- rhizome 9y ago
  So the hubbub about Kaspersky is really CYA from the NSA?
mcny 9y ago
> those files where destined to be leaked somehow the moment they left the NSA Those files were destined to be leaked somehow the moment they were created. > Seems like massive incompetence from this user So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? It is wrong on several counts. One: this is data that we should not be hoarding in the first place. We should be helping vendors fix their stuff so the cachet of information automatically loses its value to people who want to get it. Two: Even if we are an axis of evil and don't want to do the right thing, punishing this individual seems like the thing the higher ups at an oppressive regime would do to prevent the wrath of the dictator on themselves for failing to prevent what is really a system failure. [Gitlab postmortem] https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/ https://about.gitlab.com/2017/02/10/postmortem-of-database-o... Edit while I have your attention I would like your support in ending the CFAA https://cfaa.eff.org/ https://cfaa.eff.org/

ihaveahadron 9y ago

It's very descriptive. They say a 45mb file was stolen. Nice of them to do that instead of painting it like some ancient civilization from some far galactic empire came down and spread pixie dust around nsa headquarters and that's how they hacked us.

forapurpose 9y ago

The article contains a useful recap of the evidence so far regarding this particular Kapersky issue, but the news is Kerpersky's denial. I don't take the latter to mean too much either way; when you get into the world of intelligence, plausible denials are the norm, and corporations practice it pretty commonly too. Of course the U.S. government had to remove Kapersky from its computers. Russian intelligence has been very aggressive; the U.S. can't assume they'd pass on the opportunity to utilize an opportunity this good: Antivirus is widespread and highly invasive - a confidentiality (and even integrity) violation utility, with access to all data and code on the system, that the user helpfully installs for you, and it comes with built-in remote updates and communication that the user fully approves of.

JohnStrange 9y ago
What I find hilarious about this whole story is that the US government allowed highly intrusive software from a non-allied country on government machines in the first place. It seems fairly reasonable to restrict software on machines that potentially hold confidential information (incl. e.g. patient data, payrolls) to software that is produced in the same country or by companies of close allies, or at least by companies who agree to some auditing. Yet allowing anything seems fairly common practice, even more so outside the US. I wonder how many government employees of countries other than the US have Gmail accounts and put all their documents on Google docs, etc. Not to mention online backups which tend to be more expensive for servers located outside the US...
- csydas 9y ago
  I don't know what the particular condition with Kaspersky and the US government was, but I work for a non-US based software company that has multiple special contracts with the US Federal Government; we have a special build of the software which was remade piece by piece on US soil, meets some Federal encryption guidelines, and our support is very strict on who can do what with any Federal Government account. I'm not sure if this is common place or not, but I was under the impression that if you were from outside the US and wanted to land Federal contracts, you had to be ready to bend over a bit for the US Federal Government. No other government gets the same treatment currently.

rando444 9y ago

Before this article was published I don't think it was alleged that Kaspersky ever did anything. All the public knew is that allegedly Israel hacked Kaspersky and noticed the Russian government using Kaspersky's tools to try and dig out secret documents. I mean who knows, maybe the Russian government had a backdoor that they were abusing, maybe they hacked Kaspersky themselves, or maybe they were just given access. I would have given Kaspersky plausible deniability before this article.. now I just don't believe them. At face value their explanation sounds reasonable. However, the original claim is that the Israelis were watching in real-time as agents searched computers around the world for secret codenames [0]... which is a world away from the explanation given in the submitted article. [0] https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-...

r721 9y ago
Also this part from WSJ article remains: "For many months, U.S. intelligence agencies studied the software and even set up controlled experiments to see if they could trigger Kaspersky’s software into believing it had found classified materials on a computer being monitored by U.S. spies, these people said. Those experiments persuaded officials that Kaspersky was being used to detect classified information." https://www.wsj.com/articles/russian-hackers-scanned-networks-world-wide-for-secret-u-s-data-1507743874 https://www.wsj.com/articles/russian-hackers-scanned-network...
- londons_explore 9y ago
  As a spy agency, this is how you put the middle finger up to a a remote spy agency. You report their malware to an antivirus database. It's basically saying 'ha ha, we caught you, and now the whole world can look at what you were up to'. Presumably, the NSA will have automated monitoring tools scanning every bit of AV software and AV databases looking for any of their own tools there, so they know right away when someone has publically outed them. I wouldn't be surprised if these weren't even hooked up to automated self-removal logic so that NSA malware could remove itself in seconds worldwide if an AV database were updated to detect it.
9y ago

Asdfbla 9y ago

Seems plausible, though regardless of whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not, it seems prudent for any government in the world to avoid using software that potentially uploads confidential data to foreign servers. Governments anywhere would probably be ill-advised to use anti-virus software from countries like the US or Russia, unless they can be sure that cloud analysis is either disabled or done in local datacenters. I guess on the bright side at least the anti-virus market has a variety of firms based in many different countries, so you can choose your poison based on how trustworthy you find the respective governments. Doesn't help you when they themselves get hacked though. As for the story itself, I kinda dislike the reliance on access journalism and "unnamed" sources in many of the reports. Yes, there surely are many legitimate reasons why sources have to remain anonymous, no doubt about that. But in a case that's so highly political it kinda leaves a bad taste if the story is so dependent on unnamed government sources.

trhway 9y ago
>whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not no offense, it is just very entertaining(and educational) to observe how people from one culture try to apply their mental frameworks to completely different mentality. There is no "whether", "or not", "gag order" (in the sense as if explicit one was necessary) in the Russian reality in the context of private company cooperating with FSB. Hell, there is no even much of "cooperating". An FSB guy just says what he wants to get, and he gets it pronto. And in cases like Kaspersky it is even more straightforward as Kaspersky and the others there are FSB guys. I mean it is like a joke among Russians here: "Did you hear? The NSA thinks about stopping to use Kaspersky on their computers!" "Wow! How did they discovered (the ploy)? Was it the parachute?" (the parachute is a reference to a very well known joke about a USSR spy in Nazi Germany from very popular TV movie - the spy was so good and invincible that only the deployed parachute he was dragging behind him in the open daylight on the streets of Berlin was the only possible clue for the Nazis) Again, it is different reality. In US law protects from and punishes for illegal cooperation, whereis in Russia the system protects for cooperation and punishes for refusal to do so.
- 9y ago

peterwwillis 9y ago

Two things this article just ZOOMS over but are critical: 1. If Israelis were "burrowed deep" in Kaspersky's network, sure, Russian hackers may have been, too - but so could have anyone else. Also the Israelis are not exactly fans of the Russians, and are our primary (sole?) Middle East ally, so there is bias and uncertainty there. 2. From the article: "The allegations, all attributed to unnamed officials with no supporting documentation, helped explain why the US Department of Homeland Security in September took the unprecedented step of directing all US agencies to stop using Kaspersky products and services" So we're not even mentioning how in May the Senate was already taking Kaspersky to task, and there were rumors of them getting the boot even in 2016? The allegations don't explain shit, they are just another facet of a year long political battle between the American legislative branch and intelligence services against Kaspersky. It is plausible that the U.S. government made these files go through Kaspersky just so they could have leverage over them for a deal they wanted (like spying on their own country), or that a stupid contractor put them on their laptop along with Kaspersky AV, and the NSA got caught with it's pants down, they're using the Israelis to try to cover the embarrassment. This is not out of the ordinary behavior for an intelligence service. Look at it this way: flip the roles. Would Russia try a play on their contracts with a U.S. company to further their goals?

jradd 9y ago

As far as I can tell, the only reason US gov banned kaspersky because of some emails and work performed for the FSB led by Igor Chekunov, Kaspersky Lab’s chief legal officer and a former member of the KGB. Is there any good reason for us gov to mistrust this company or will they need to leak secrets to us before that will happen?

walshemj 9y ago

Ok so you out and out admit an offence under the espionage act - you've just fucked every employee out side of Russia over. Receiving the goods in this case is just as much an ofence as stealing.

willstrafach 9y ago
Can you explain this any further? I am also inclined to believe Kaspersky is in the wrong here, especially given the publicizing of personal data from a customer's computer for PR purposes, but I am having trouble understanding how the Espionage Act applies?
- walshemj 9y ago
  "As it is currently written, the Espionage Act of 1917 makes it a crime to hurt the United States or benefit a foreign country by collecting or communicating information that would harm the national defense. It is also a crime to enter an installation or obtain a document connected to the national defense in order to hurt the United States or benefit a foreign country. Knowingly receiving classified information that has been obtained illegally, as well as passing it on, also runs afoul of the Espionage Act." https://www.rcfp.org/browse-media-law-resources/news-media-law/wikileaks-and-espionage-act-1917 https://www.rcfp.org/browse-media-law-resources/news-media-l...
  - willstrafach 9y ago
    Interesting. That language gives me the idea that such prosecution could be very tricky, given the many instances of purported-classified information being relayed to press (In fact this would presumably apply to the information relating to Israel accessing Kaspersky systems and allegedly watching Russians exfil interesting data).
  - Anderkent 9y ago
    How is accidentally downloading a document and then deleting it immediately 'knowingly receiving classified information'?

lawnchair_larry 9y ago

Original source article: https://securelist.com/investigation-report-for-the-september-2014-equation-malware-detection-incident-in-the-us/83210/ https://securelist.com/investigation-report-for-the-septembe...