8 ms·

U.S. Government Can’t Get Rid of Kaspersky Labs Software

61 points by lunchbreak 8y ago

cryptoz 8y ago
> Congress didn’t give anyone money to replace these devices, Seems more like the U.S. Government doesn't want to get rid of Kaspersky. They choose not to replace compromised devices. Doesn't seem like it is a hard technical challenge at all, rather the lack of action seems more intentional. Surely we can all agree this is an issue of National Security. And if the task is to be done with no Federal assistance or financial help whatsoever, it seems clear that the government is compromised.
- juliangoldsmith 8y ago
  This seems more like a Pointy-Haired Boss-type move to me. Bosses in actual IT businesses often don't understand what's involved with a large IT project; what hope does a 79-year-old senator have of understanding what removing Kaspersky software from the entirety of the United States government's systems would take?
  - Scoundreller 8y ago
    They don’t. But starting Monday, we’ll find out.
juliangoldsmith 8y ago
I'm rather surprised the United States government would be using foreign software for information security. Really, I'm surprised that they're using outside software for it at all. As much as I'm a fan of the free market, that isn't the sort of thing I'd trust to an outside company. If only there was some sort of group in the government that handled information security... Some sort of security agency, if you will.
- cptskippy 8y ago
  I'm not sure which is worse, Kaspersky/Russia spying on everyone in the Fed or the NSA.
  - CWuestefeld 8y ago
    This makes sense for the US Government. But at the same time, it makes more sense for me - as a US citizen - to use Kaspersky. The Russian gov't doesn't care about me at all, so I have little to fear from them. But I do fear the NSA because I am subject to the whims of the US government.
    - cptskippy 8y ago
      What if your PC gets enlisted in a state sponsored attack against the US? Or is used as a proxy for an intrusion? Or... so many other possible scenarios...
      - Ngunyan 8y ago
        (And if you have an American-branded anti-virus) What if your PC gets enlisted in a state sponsored attack by the US? Or is used as a proxy for an intrusion? Or... so many other possible scenarios...
- csydas 8y ago
  It's not that surprising. Typically when you work with Governments, everything is specially done, doubly so for the US Government. Custom Federal forks of the main product (with feature parity), heavily customized SLAs, full access to the source code for review, and lots more to ensure that it meets the US Federal standards. The Anti-Kaspersky stuff is likely just chest beating. I get it at the base level, and that AV software in general grants a much deeper reach that most softwares, but most likely they're not installing the same Kaspersky that anyone else is. My current employer is a rather large non-US tech company, and we have custom branches for every product specifically made for the US Federal Government. It's all rebuilt from the ground up on US soil by US Nationals and the US Government has freedom to review the code. It's the price you pay to play with the US Government. I would find it very hard to believe that Kaspersky doesn't have something similar.
peterwwillis 8y ago
FWIW, the anti-Kaspersky train has been rolling for over three years. Since the time that Kaspersky revealed (after Symantec) global co-ordinated state sponsored malware programs such as Reign, created by the NSA and GCHQ. https://www.theregister.co.uk/2014/12/05/regin_kaspersky/ https://www.theregister.co.uk/2014/12/05/regin_kaspersky/ https://en.wikipedia.org/wiki/Regin_(malware) https://en.wikipedia.org/wiki/Regin_(malware) Or the time that Kaspersky publicly humiliated the NSA by revealing their hacking of hard drive firmware. https://www.dailykos.com/stories/2015/2/17/1364910/-Breaking-Kaspersky-Exposes-NSA-s-Worldwide-Backdoor-Hacking-of-Virtually-All-Hard-Drive-Firmware https://www.dailykos.com/stories/2015/2/17/1364910/-Breaking... https://www.scmagazineuk.com/is-nsa-worlds-most-advanced-threat-actor-revealed-by-kaspersky/article/537596/ https://www.scmagazineuk.com/is-nsa-worlds-most-advanced-thr... Since then, congressional hearings, committees, and US intel agencies' warnings of "security threats" from Kaspersky had been rolling out with regular frequency. Last year's ban was just a culmination of other efforts already underway. Kaspersky's role of tracking nation-state malware inflitrations gives them a position as a quasi-intelligence agency. US intelligence agencies hate Kaspersky because they out every program the US has going on, and because they operate out of Moscow. Literally every US intelligence agency has testified before Congress about how they specifically don't trust Kaspersky. https://www.npr.org/sections/parallels/2017/07/05/535651597/congress-casts-a-suspicious-eye-on-russias-kaspersky-lab https://www.npr.org/sections/parallels/2017/07/05/535651597/... So the US and its allies infiltrated their network and reverse engineered its software in order to find whatever dirt they could. https://www.observeit.com/blog/kaspersky-lab-nation-state-attack/ https://www.observeit.com/blog/kaspersky-lab-nation-state-at... https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/ https://theintercept.com/2015/06/22/nsa-gchq-targeted-kasper... The information they have on global intelligence operations, their location outside of an ally's control, their insistence on embarrassing nation states' covert operations and exploits, and the fact that their software isn't the most secure (https://www.forbes.com/sites/thomasbrewster/2015/09/23/google-ormandy-finds-kaspersky-0days/#2263a6b65493 https://www.forbes.com/sites/thomasbrewster/2015/09/23/googl...) has given the US government enough reason to want them out of their infrastructure. It's just politically untenable.
- linkregister 8y ago
  What makes you think the NSA employees felt humiliated? Maybe they were proud that their work was publicly recognized. Higher-ups understandably felt frustration that they needed to replace the program, but what makes you think that the employees didn't already anticipate that exploits and campaigns would get burned? Is there a difference between a vendor issuing a patch or an organization's security response team cutting off access, and a anti-malware company doing its job to research campaigns?
AdmiralAsshat 8y ago
This should be fairly alarming to all parties, not the least of which being the government. I mean, let's just hypothetically assume for a moment that Kaspersky is compromised and doing intel gathering for the Russian government. Can you think of a more perfect weapon than a compromised suite of software that is so deeply entrenched in a nation state's stack that they can't remove it, even if they wanted to?
infosecdoc 8y ago
On the contrary, as an American not involved in government work, Kaspersky is one few AV products I'd trust. American antivirus makers like Symantec, Comodo, McAfee, Microsoft (Defender), Webroot, and CheckPoint are all subject to secret warrants and infiltration by the US government. Others, like the UK's Sophos, would be subject to US influence as well. You have to think about the motivations of each country. Even if Kaspersky were spying for the Russians, they won't give a damn about your porn, tax cheating, affairs, your padding of expense reports, or whatever they find on your computer. As an American, it's MY government that I'd have to worry about.
- trhway 8y ago
  >they won't give a damn about your porn, tax cheating, affairs, your padding of expense reports, or whatever they find on your computer. just at some moment in future, when you aren't some nobody like today and have become somebody meaningful, they would make you an offer you wouldn't be able to refuse - either all this collected info is sent to USG or ... Until that they would use it mostly for some innocuous stuff like what specific message to post in your feed to make you vote that specific way. >Even if Kaspersky were spying for the Russians when people say that "if" i'm always reminding myself that it is Western world, people have different mentality here. NSA here had to do _secret_ (or at least Google had to pretend so) tap to Google's fiber where is in Russia FSB has much better VPN into Kaspersky intranet than Kaspersky employees do :)
  - linkregister 8y ago
    What's the basis of your accusation that FSB has overt access into Kaspersky's infrastructure?
    - trhway 8y ago
      It isn't accusation :) You're trying to apply Western standards in the domain of completely different standards. And even applying Western standards this is what possible to say : https://www.theguardian.com/technology/2017/oct/11/israel-hack-uncovered-russian-spies-use-kaspersky-lab-2015-report-us-software-federal-government https://www.theguardian.com/technology/2017/oct/11/israel-ha... "At the time, the Department of Homeland Security said it “is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks”" Notice that Kaspersky doesn't lie : "In an official statement about the allegations, Kaspersky Lab said: “As a private company, Kaspersky Lab does not have inappropriate ties to any government, including Russia," as the keyword here is "inappropriate" which the above mentioned law clearly takes care of. Again, all these fine icing-on-the-cake details, like the law and "inappropriate", etc. are only for the Western consumption, as they just don't really matter in the Russian reality if only by virtue of being dwarfed by the things what do matter there. In that reality it would be a really "inappropriate", a faux pas of the scale that is even hard to imagine, if Kaspersky refused to work with FSB :)
linkregister 8y ago
Kaspersky AV is an excellent product. For years it was the unrivaled market leader for non-signature-based malware detection in Windows operating systems. Its competitors are closing the gap, however. Qihoo 360 is also a good product. Among the reverse engineering / exploit development crowd, I haven't heard much complaining about Symantec's detection mechanisms. There are also bespoke anti-malware solutions marketed to the U.S. government, and they are not commercially available specifically to mitigate the risk that malware authors will test their products against anti-malware engines. These bespoke solutions are understandably far more expensive due to their smaller deployment and high quality. It's reasonable that the U.S. government has to consider the need to have the best, reasonably affordable, commercially-available solution for the majority of its systems. This is balanced by the threat that the Russian Federation's government could interdict the software being delivered to the U.S. government client. Intermediate solutions, such as the project that Huawei set up with the UK government, or the source-code sharing that Microsoft does to get Russian contracts, seem to be optimal.
GnarfGnarf 8y ago
The U.S. Government doesn't want us using Kaspersky because Kaspersky blows the whistle on the back doors the gov't has installed in various software.
arca_vorago 8y ago
ClamAV is ripe for creating a FOSS disruption in this arena. If I were in a position of governmental power I would be pushing for foss solutions instead of proprietary black boxes that can't be audited.
- tinus_hn 8y ago
  Security today is very much about blind trust, certifications and not paying too much attention to the man behind the curtain. If your security software is open source anyone can point out its weaknesses.
  - anfilt 8y ago
    Even then we still have the issue of binary blobs of firmware. Also hardware it's self may be exploitable. For a truly secure system everything would have to be audit-able. Also as soon as you run or insert anything into system you did not audit that whole system might as be treated as un-audited as well. Since what ever that was may have modified firmware or software. That also exclude any subtle bugs that people may miss.

61 points by lunchbreak 8y ago

> Congress didn’t give anyone money to replace these devices, Seems more like the U.S. Government doesn't want to get rid of Kaspersky. They choose not to replace compromised devices. Doesn't seem like it is a hard technical challenge at all, rather the lack of action seems more intentional. Surely we can all agree this is an issue of National Security. And if the task is to be done with no Federal assistance or financial help whatsoever, it seems clear that the government is compromised.

juliangoldsmith 8y ago
This seems more like a Pointy-Haired Boss-type move to me. Bosses in actual IT businesses often don't understand what's involved with a large IT project; what hope does a 79-year-old senator have of understanding what removing Kaspersky software from the entirety of the United States government's systems would take?
- Scoundreller 8y ago
  They don’t. But starting Monday, we’ll find out.

juliangoldsmith 8y ago

I'm rather surprised the United States government would be using foreign software for information security. Really, I'm surprised that they're using outside software for it at all. As much as I'm a fan of the free market, that isn't the sort of thing I'd trust to an outside company. If only there was some sort of group in the government that handled information security... Some sort of security agency, if you will.

cptskippy 8y ago
I'm not sure which is worse, Kaspersky/Russia spying on everyone in the Fed or the NSA.
- CWuestefeld 8y ago
  This makes sense for the US Government. But at the same time, it makes more sense for me - as a US citizen - to use Kaspersky. The Russian gov't doesn't care about me at all, so I have little to fear from them. But I do fear the NSA because I am subject to the whims of the US government.
  - cptskippy 8y ago
    What if your PC gets enlisted in a state sponsored attack against the US? Or is used as a proxy for an intrusion? Or... so many other possible scenarios...
    - Ngunyan 8y ago
      (And if you have an American-branded anti-virus) What if your PC gets enlisted in a state sponsored attack by the US? Or is used as a proxy for an intrusion? Or... so many other possible scenarios...
csydas 8y ago
It's not that surprising. Typically when you work with Governments, everything is specially done, doubly so for the US Government. Custom Federal forks of the main product (with feature parity), heavily customized SLAs, full access to the source code for review, and lots more to ensure that it meets the US Federal standards. The Anti-Kaspersky stuff is likely just chest beating. I get it at the base level, and that AV software in general grants a much deeper reach that most softwares, but most likely they're not installing the same Kaspersky that anyone else is. My current employer is a rather large non-US tech company, and we have custom branches for every product specifically made for the US Federal Government. It's all rebuilt from the ground up on US soil by US Nationals and the US Government has freedom to review the code. It's the price you pay to play with the US Government. I would find it very hard to believe that Kaspersky doesn't have something similar.

peterwwillis 8y ago

FWIW, the anti-Kaspersky train has been rolling for over three years. Since the time that Kaspersky revealed (after Symantec) global co-ordinated state sponsored malware programs such as Reign, created by the NSA and GCHQ. https://www.theregister.co.uk/2014/12/05/regin_kaspersky/ https://www.theregister.co.uk/2014/12/05/regin_kaspersky/ https://en.wikipedia.org/wiki/Regin_(malware) https://en.wikipedia.org/wiki/Regin_(malware) Or the time that Kaspersky publicly humiliated the NSA by revealing their hacking of hard drive firmware. https://www.dailykos.com/stories/2015/2/17/1364910/-Breaking-Kaspersky-Exposes-NSA-s-Worldwide-Backdoor-Hacking-of-Virtually-All-Hard-Drive-Firmware https://www.dailykos.com/stories/2015/2/17/1364910/-Breaking... https://www.scmagazineuk.com/is-nsa-worlds-most-advanced-threat-actor-revealed-by-kaspersky/article/537596/ https://www.scmagazineuk.com/is-nsa-worlds-most-advanced-thr... Since then, congressional hearings, committees, and US intel agencies' warnings of "security threats" from Kaspersky had been rolling out with regular frequency. Last year's ban was just a culmination of other efforts already underway. Kaspersky's role of tracking nation-state malware inflitrations gives them a position as a quasi-intelligence agency. US intelligence agencies hate Kaspersky because they out every program the US has going on, and because they operate out of Moscow. Literally every US intelligence agency has testified before Congress about how they specifically don't trust Kaspersky. https://www.npr.org/sections/parallels/2017/07/05/535651597/congress-casts-a-suspicious-eye-on-russias-kaspersky-lab https://www.npr.org/sections/parallels/2017/07/05/535651597/... So the US and its allies infiltrated their network and reverse engineered its software in order to find whatever dirt they could. https://www.observeit.com/blog/kaspersky-lab-nation-state-attack/ https://www.observeit.com/blog/kaspersky-lab-nation-state-at... https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/ https://theintercept.com/2015/06/22/nsa-gchq-targeted-kasper... The information they have on global intelligence operations, their location outside of an ally's control, their insistence on embarrassing nation states' covert operations and exploits, and the fact that their software isn't the most secure (https://www.forbes.com/sites/thomasbrewster/2015/09/23/google-ormandy-finds-kaspersky-0days/#2263a6b65493 https://www.forbes.com/sites/thomasbrewster/2015/09/23/googl...) has given the US government enough reason to want them out of their infrastructure. It's just politically untenable.

linkregister 8y ago
What makes you think the NSA employees felt humiliated? Maybe they were proud that their work was publicly recognized. Higher-ups understandably felt frustration that they needed to replace the program, but what makes you think that the employees didn't already anticipate that exploits and campaigns would get burned? Is there a difference between a vendor issuing a patch or an organization's security response team cutting off access, and a anti-malware company doing its job to research campaigns?

AdmiralAsshat 8y ago

This should be fairly alarming to all parties, not the least of which being the government. I mean, let's just hypothetically assume for a moment that Kaspersky is compromised and doing intel gathering for the Russian government. Can you think of a more perfect weapon than a compromised suite of software that is so deeply entrenched in a nation state's stack that they can't remove it, even if they wanted to?

infosecdoc 8y ago

On the contrary, as an American not involved in government work, Kaspersky is one few AV products I'd trust. American antivirus makers like Symantec, Comodo, McAfee, Microsoft (Defender), Webroot, and CheckPoint are all subject to secret warrants and infiltration by the US government. Others, like the UK's Sophos, would be subject to US influence as well. You have to think about the motivations of each country. Even if Kaspersky were spying for the Russians, they won't give a damn about your porn, tax cheating, affairs, your padding of expense reports, or whatever they find on your computer. As an American, it's MY government that I'd have to worry about.

trhway 8y ago
>they won't give a damn about your porn, tax cheating, affairs, your padding of expense reports, or whatever they find on your computer. just at some moment in future, when you aren't some nobody like today and have become somebody meaningful, they would make you an offer you wouldn't be able to refuse - either all this collected info is sent to USG or ... Until that they would use it mostly for some innocuous stuff like what specific message to post in your feed to make you vote that specific way. >Even if Kaspersky were spying for the Russians when people say that "if" i'm always reminding myself that it is Western world, people have different mentality here. NSA here had to do _secret_ (or at least Google had to pretend so) tap to Google's fiber where is in Russia FSB has much better VPN into Kaspersky intranet than Kaspersky employees do :)
- linkregister 8y ago
  What's the basis of your accusation that FSB has overt access into Kaspersky's infrastructure?
  - trhway 8y ago
    It isn't accusation :) You're trying to apply Western standards in the domain of completely different standards. And even applying Western standards this is what possible to say : https://www.theguardian.com/technology/2017/oct/11/israel-hack-uncovered-russian-spies-use-kaspersky-lab-2015-report-us-software-federal-government https://www.theguardian.com/technology/2017/oct/11/israel-ha... "At the time, the Department of Homeland Security said it “is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks”" Notice that Kaspersky doesn't lie : "In an official statement about the allegations, Kaspersky Lab said: “As a private company, Kaspersky Lab does not have inappropriate ties to any government, including Russia," as the keyword here is "inappropriate" which the above mentioned law clearly takes care of. Again, all these fine icing-on-the-cake details, like the law and "inappropriate", etc. are only for the Western consumption, as they just don't really matter in the Russian reality if only by virtue of being dwarfed by the things what do matter there. In that reality it would be a really "inappropriate", a faux pas of the scale that is even hard to imagine, if Kaspersky refused to work with FSB :)

linkregister 8y ago

Kaspersky AV is an excellent product. For years it was the unrivaled market leader for non-signature-based malware detection in Windows operating systems. Its competitors are closing the gap, however. Qihoo 360 is also a good product. Among the reverse engineering / exploit development crowd, I haven't heard much complaining about Symantec's detection mechanisms. There are also bespoke anti-malware solutions marketed to the U.S. government, and they are not commercially available specifically to mitigate the risk that malware authors will test their products against anti-malware engines. These bespoke solutions are understandably far more expensive due to their smaller deployment and high quality. It's reasonable that the U.S. government has to consider the need to have the best, reasonably affordable, commercially-available solution for the majority of its systems. This is balanced by the threat that the Russian Federation's government could interdict the software being delivered to the U.S. government client. Intermediate solutions, such as the project that Huawei set up with the UK government, or the source-code sharing that Microsoft does to get Russian contracts, seem to be optimal.

GnarfGnarf 8y ago

The U.S. Government doesn't want us using Kaspersky because Kaspersky blows the whistle on the back doors the gov't has installed in various software.

arca_vorago 8y ago

ClamAV is ripe for creating a FOSS disruption in this arena. If I were in a position of governmental power I would be pushing for foss solutions instead of proprietary black boxes that can't be audited.

tinus_hn 8y ago
Security today is very much about blind trust, certifications and not paying too much attention to the man behind the curtain. If your security software is open source anyone can point out its weaknesses.
- anfilt 8y ago
  Even then we still have the issue of binary blobs of firmware. Also hardware it's self may be exploitable. For a truly secure system everything would have to be audit-able. Also as soon as you run or insert anything into system you did not audit that whole system might as be treated as un-audited as well. Since what ever that was may have modified firmware or software. That also exclude any subtle bugs that people may miss.