8 ms·

So an NSA contractor or employee takes confidential/highly sensitive code and documents home and leaves it on their machine. They then install a pirated version

by orf 9y ago

So an NSA contractor or employee takes confidential/highly sensitive code and documents home and leaves it on their machine. They then install a pirated version of Office, after disabling their antivirus software which is telling them it is infected with a virus and preventing the installation. Seems like massive incompetence from this user rather than Kaspersky doing anything malicious, and those files where destined to be leaked somehow the moment they left the NSA. I'm sure there are some employees there who may report or leak things to the Russian government, but I don't buy the narrative that Kaspersky is some evil Russian cyber hoover. Maybe I'm naive though.

jrochkind1 9y ago
This is the best part: "...found they contained malicious code from Equation Group..." "Equation Group" is Kaspersky's label for a malware group believed to be NSA. Kaspersky's software possibly then detected as malware the very confidential code the NSA contractor/employee illegally took home, ha!
- rhizome 9y ago
  So the hubbub about Kaspersky is really CYA from the NSA?
mcny 9y ago
> those files where destined to be leaked somehow the moment they left the NSA Those files were destined to be leaked somehow the moment they were created. > Seems like massive incompetence from this user So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? It is wrong on several counts. One: this is data that we should not be hoarding in the first place. We should be helping vendors fix their stuff so the cachet of information automatically loses its value to people who want to get it. Two: Even if we are an axis of evil and don't want to do the right thing, punishing this individual seems like the thing the higher ups at an oppressive regime would do to prevent the wrath of the dictator on themselves for failing to prevent what is really a system failure. [Gitlab postmortem] https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/ https://about.gitlab.com/2017/02/10/postmortem-of-database-o... Edit while I have your attention I would like your support in ending the CFAA https://cfaa.eff.org/ https://cfaa.eff.org/
- chimeracoder 9y ago
  > So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? Are you equating an accident that resulted in deleted data with someone intentionally taking confidential materials and putting them on an insecure, personal computer?
  - williamscales 9y ago
    The Gitlab production data deletion event occurred unintentionally because the system was not designed to make it impossible. Looking at the Kaspersky situation the same way, the leaking of classified documents to Russia occurred because the system was not designed to make it impossible (i.e. by never creating these materials in the first place). GP isn't equating the facts of the events but instead drawing a contrast between the way we treat them.
    - threeseed 9y ago
      Drawing that comparison is asinine though. We treat nude photos differently than photos of a dog. We treat credit card/user information differently than app logs. That's why we have concepts such as HIPAA and PCI.
      - mcny 9y ago
        The point is punishing a person (often near at the bottom of the totem pole) does not fix the systemic problem. In fact, it creates noise which distracts us from fixing the problem. The first step toward fixing a problem is acknowledging there is a problem and identifying the problem. I am very saddened by my inability to communicate this in a better way but punishing this person will not solve any problem except someone somewhere can check a box saying they did their job.
- threeseed 9y ago
  Yes not all data is the same and gets treated differently. Truly shocking revelation I know.
qaq 9y ago
You are being naive. You can not operate a business the size of Kaspersky in Russia without being a part of the the inner circle.
- gralx 9y ago
  What's the cutoff size, how was it determined, and by whom?
- nasredin 9y ago
  If you want to do bussiness in Russia you will have to deal with organized crime and or the government which is very often the same people.
  - snowpanda 9y ago
    Ok so I know very little about Russia, where would one go to verify that claim? I'm not disputing it at all, just trying to inform myself. One of the reasons I ask, is related to Telegram. I'm aware of the crypto argument. But it seems (from the outside, so could be a complete cover of course) that Pavel Durov is somewhat taking a stand against their government[1][2][3]. Is that simply because he has enough money to do so? Or is it just a show to give people the idea he's taking a stand? [1] https://www.reuters.com/article/us-russia-telegram-security/telegram-app-agrees-to-register-in-russia-but-not-to-share-private-data-idUSKBN19J1RK https://www.reuters.com/article/us-russia-telegram-security/... [2] https://www.neowin.net/news/russian-government-fines-telegram-for-refusing-to-give-up-user-data https://www.neowin.net/news/russian-government-fines-telegra... [3] https://www.deepdotweb.com/2017/10/30/russian-government-fines-telegram-not-providing-backdoor/ https://www.deepdotweb.com/2017/10/30/russian-government-fin...
    - qaq 9y ago
      Right after he lost control of his company (FB clone) when he refused to shut down opposition related groups on it. He openly talked about pressure from FSB etc. Telegram is not run out of Russia and Durov does not live in Russia. So if you don't mind loosing all your russian assets and living in exile you sure can speak out :)
mtgx 9y ago
Incompetence? For all we know that guy was trying to sell the data to China or Saudi Arabia. Why isn't his investigation a bigger story? I thought the NSA hated leakers?
- deleted 9y ago
  [deleted]
tryingagainbro 9y ago
>>rather than Kaspersky doing anything malicious I'm sorry but Kaspersky gets NSA files and deletes them, instead of handing them to FSB? Nope, I don't believe it. You can get away with xx murders in exchange for that And that's the most generous assumption--that Kaspersky wasn't looking for them
JumpCrisscross 9y ago
> Seems like massive incompetence from this user rather than Kaspersky doing anything malicious Why not both?
golergka 9y ago
> I don't buy the narrative that Kaspersky is some evil Russian cyber hoover I don't know about this particular story, but Kaspersky is certainly has strong ties with FSB, FSO and other official structures. I don't mean that it's their main business model — developing anti-virus software pays well enough not to be some cover story — but they're definitely _friendly_ on a deep personal level. Kaspersky himself was educated in KGB school, worked in government structures and has a lot of connections (which he used, for example, with that shady story when his son was kidnapped). Usually, in Moscow, there is a strong correlation between being a highly educated, well-paid IT professional and having a negative opinion about current Russian regime; but judging from my second-hand stories from friends and colleagues, guys at Kaspersky tend to be very patriotic and pro-government. So, while I don't think that Kaspersky lab was founded deliberately like some sort of cover. But they're the kind of people who would definitely help FSB with whatever they ask — not because of some secret court order, but happily, thinking that they are serving their country and doing a good thing.
- codedokode 9y ago
  > Usually, in Moscow, there is a strong correlation between being a highly educated, well-paid IT professional and having a negative opinion about current Russian regime Do you have sources for this? Well-paid professional might not care about politics at all or might be OK with current regime because it doesn't interfere with their life. Furthermore, some of them might be even proud for occupying Crimea. But I can agree that there is relatively high percent of anti-Putin people in Moscow.
  - golergka 9y ago
    My own experience, mostly. It doesn't include any government-owned enterprises or oil companies, of course — but in IT, the correlation is staggering. From all my peers, I hardly know a single IT professional with a salary over $60k (usually a team lead level or above) that wouldn't be in opposition to the current regime. Of course, about half of such people I knew a couple years back have already moved out of the country.
- trycatch 9y ago
viraptor 9y ago
> but I don't buy the narrative that Kaspersky is some evil Russian cyber hoover. I don't think it even needs a narrative about Kaspersky. You could expect that they're infiltrated in some way (worker, infrastructure, hosting, ...) and leak information to FSB. I'm exactly the same way Symantec could leak information to NSA. Without the evil qualifier and narrative for the reasons, both are likely to happen to some extent.
chiefalchemist 9y ago
When it comes to anything IC my rule of thumb is: we'll never know the truth. It's an "industry" that trades in misinformation, mis-misinformation and so on. In this case, _if_ you buy into the arc of the story then I would say it was it was likely another family member who tried to do the pirated software. But that would be a massive faux pas. So there's likely other nips and tucks, etc.

by orf 9y ago

jrochkind1 9y ago

This is the best part: "...found they contained malicious code from Equation Group..." "Equation Group" is Kaspersky's label for a malware group believed to be NSA. Kaspersky's software possibly then detected as malware the very confidential code the NSA contractor/employee illegally took home, ha!

rhizome 9y ago
So the hubbub about Kaspersky is really CYA from the NSA?

mcny 9y ago

> those files where destined to be leaked somehow the moment they left the NSA Those files were destined to be leaked somehow the moment they were created. > Seems like massive incompetence from this user So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? It is wrong on several counts. One: this is data that we should not be hoarding in the first place. We should be helping vendors fix their stuff so the cachet of information automatically loses its value to people who want to get it. Two: Even if we are an axis of evil and don't want to do the right thing, punishing this individual seems like the thing the higher ups at an oppressive regime would do to prevent the wrath of the dictator on themselves for failing to prevent what is really a system failure. [Gitlab postmortem] https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/ https://about.gitlab.com/2017/02/10/postmortem-of-database-o... Edit while I have your attention I would like your support in ending the CFAA https://cfaa.eff.org/ https://cfaa.eff.org/

chimeracoder 9y ago
> So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? Are you equating an accident that resulted in deleted data with someone intentionally taking confidential materials and putting them on an insecure, personal computer?
- williamscales 9y ago
  The Gitlab production data deletion event occurred unintentionally because the system was not designed to make it impossible. Looking at the Kaspersky situation the same way, the leaking of classified documents to Russia occurred because the system was not designed to make it impossible (i.e. by never creating these materials in the first place). GP isn't equating the facts of the events but instead drawing a contrast between the way we treat them.
  - threeseed 9y ago
    Drawing that comparison is asinine though. We treat nude photos differently than photos of a dog. We treat credit card/user information differently than app logs. That's why we have concepts such as HIPAA and PCI.
    - mcny 9y ago
      The point is punishing a person (often near at the bottom of the totem pole) does not fix the systemic problem. In fact, it creates noise which distracts us from fixing the problem. The first step toward fixing a problem is acknowledging there is a problem and identifying the problem. I am very saddened by my inability to communicate this in a better way but punishing this person will not solve any problem except someone somewhere can check a box saying they did their job.
threeseed 9y ago
Yes not all data is the same and gets treated differently. Truly shocking revelation I know.

qaq 9y ago

You are being naive. You can not operate a business the size of Kaspersky in Russia without being a part of the the inner circle.

gralx 9y ago
What's the cutoff size, how was it determined, and by whom?
nasredin 9y ago
If you want to do bussiness in Russia you will have to deal with organized crime and or the government which is very often the same people.
- snowpanda 9y ago
  Ok so I know very little about Russia, where would one go to verify that claim? I'm not disputing it at all, just trying to inform myself. One of the reasons I ask, is related to Telegram. I'm aware of the crypto argument. But it seems (from the outside, so could be a complete cover of course) that Pavel Durov is somewhat taking a stand against their government[1][2][3]. Is that simply because he has enough money to do so? Or is it just a show to give people the idea he's taking a stand? [1] https://www.reuters.com/article/us-russia-telegram-security/telegram-app-agrees-to-register-in-russia-but-not-to-share-private-data-idUSKBN19J1RK https://www.reuters.com/article/us-russia-telegram-security/... [2] https://www.neowin.net/news/russian-government-fines-telegram-for-refusing-to-give-up-user-data https://www.neowin.net/news/russian-government-fines-telegra... [3] https://www.deepdotweb.com/2017/10/30/russian-government-fines-telegram-not-providing-backdoor/ https://www.deepdotweb.com/2017/10/30/russian-government-fin...
  - qaq 9y ago
    Right after he lost control of his company (FB clone) when he refused to shut down opposition related groups on it. He openly talked about pressure from FSB etc. Telegram is not run out of Russia and Durov does not live in Russia. So if you don't mind loosing all your russian assets and living in exile you sure can speak out :)

mtgx 9y ago

Incompetence? For all we know that guy was trying to sell the data to China or Saudi Arabia. Why isn't his investigation a bigger story? I thought the NSA hated leakers?

deleted 9y ago
[deleted]

tryingagainbro 9y ago

>>rather than Kaspersky doing anything malicious I'm sorry but Kaspersky gets NSA files and deletes them, instead of handing them to FSB? Nope, I don't believe it. You can get away with xx murders in exchange for that And that's the most generous assumption--that Kaspersky wasn't looking for them

JumpCrisscross 9y ago

> Seems like massive incompetence from this user rather than Kaspersky doing anything malicious Why not both?

golergka 9y ago

> I don't buy the narrative that Kaspersky is some evil Russian cyber hoover I don't know about this particular story, but Kaspersky is certainly has strong ties with FSB, FSO and other official structures. I don't mean that it's their main business model — developing anti-virus software pays well enough not to be some cover story — but they're definitely _friendly_ on a deep personal level. Kaspersky himself was educated in KGB school, worked in government structures and has a lot of connections (which he used, for example, with that shady story when his son was kidnapped). Usually, in Moscow, there is a strong correlation between being a highly educated, well-paid IT professional and having a negative opinion about current Russian regime; but judging from my second-hand stories from friends and colleagues, guys at Kaspersky tend to be very patriotic and pro-government. So, while I don't think that Kaspersky lab was founded deliberately like some sort of cover. But they're the kind of people who would definitely help FSB with whatever they ask — not because of some secret court order, but happily, thinking that they are serving their country and doing a good thing.

codedokode 9y ago
> Usually, in Moscow, there is a strong correlation between being a highly educated, well-paid IT professional and having a negative opinion about current Russian regime Do you have sources for this? Well-paid professional might not care about politics at all or might be OK with current regime because it doesn't interfere with their life. Furthermore, some of them might be even proud for occupying Crimea. But I can agree that there is relatively high percent of anti-Putin people in Moscow.
- golergka 9y ago
  My own experience, mostly. It doesn't include any government-owned enterprises or oil companies, of course — but in IT, the correlation is staggering. From all my peers, I hardly know a single IT professional with a salary over $60k (usually a team lead level or above) that wouldn't be in opposition to the current regime. Of course, about half of such people I knew a couple years back have already moved out of the country.
trycatch 9y ago

viraptor 9y ago

> but I don't buy the narrative that Kaspersky is some evil Russian cyber hoover. I don't think it even needs a narrative about Kaspersky. You could expect that they're infiltrated in some way (worker, infrastructure, hosting, ...) and leak information to FSB. I'm exactly the same way Symantec could leak information to NSA. Without the evil qualifier and narrative for the reasons, both are likely to happen to some extent.

chiefalchemist 9y ago

When it comes to anything IC my rule of thumb is: we'll never know the truth. It's an "industry" that trades in misinformation, mis-misinformation and so on. In this case, _if_ you buy into the arc of the story then I would say it was it was likely another family member who tried to do the pirated software. But that would be a massive faux pas. So there's likely other nips and tucks, etc.