4 ms·
> the US government allowed highly intrusive software from a non-allied country on government machines in the first place. This is the key point. Also, the US
by grandalf 9y ago
> the US government allowed highly intrusive software from a non-allied country on government machines in the first place.
This is the key point. Also, the US Government was recently found to have fake Kaspersky SSL certs.
- willstrafach 9y ago> Also, the US Government was recently found to have fake Kaspersky SSL certs. This is not true. An old commit for a leaked implant included example client certificates, which were invalid and self-signed, used to disguise C2 communications as anti-virus updates to avoid scrutiny. Part of the system involved copying fields from valid certificates into self-signed (invalid ones) so the traffic would not look suspicious. If they actually had fake/spoofed SSL certificates valid for Kaspersky’s domain, that would be entirely different.
- jlgaddis 9y ago> "... example client certificates, which were invalid and self-signed ..." That sounds "fake" to me.