9 ms·

Antivirus Companies Shouldn’t Have Hidden What They Knew About Regin

123 points by aburan28 12y ago

wmt 12y ago
It's easy to say it should be publicised, but I'm not sure how someone can do that if the infected organisation specifically asks the antivirus company not to publicly discuss the malware, like what appears to have been the case with F-Secure. (https://mobile.twitter.com/mikko/status/536959936476221440 https://mobile.twitter.com/mikko/status/536959936476221440) Sure, they could just go ahead and disclose it against the customers express wishes, but how many would hire their services in the future if there's no expectation of customer confidentiality? Edit: There likely is an NDA in place even before externals are allowed in, so breaching it might invite some additional problems than just image issues.
- higherpurpose 12y ago
  But that doesn't seem to have been the case with Kaspersky. So what's their excuse? Other than being pro-surveillance that is: https://twitter.com/csoghoian/status/505376361268400128 https://twitter.com/csoghoian/status/505376361268400128
  - wmt 12y ago
    That is a good point, some companies had very different motivations for not discussing it, e.g. Ronald Prins from Fox IT had this to say to Mashable: For Prins, the reason is completely different. "We didn't want to interfere with NSA/GCHQ operations," he told Mashable, explaining that everyone seemed to be waiting for someone else to disclose details of Regin first, not wanting to impede legitimate operations related to "global security." http://mashable.com/2014/11/25/regin-spy-malware-nsa-gchq/ http://mashable.com/2014/11/25/regin-spy-malware-nsa-gchq/
- gordaco 12y ago
  To add something: I think that it makes a lot of sense for an infected organisation to ask for confidentiality about something like this; any public communication in the opposite sense would be an immediate signal for the attackers to release a new version of the malware. Although, depending on what the malware does, the attackers may realize immediately that it has been protected against. EDIT: also, it's not like antivirus companies publicise everything they do. From what I've seen (admittedly not much, so maybe I'm wrong) most releases are simply summarised as "added protection against 100 new threats".
  - jamez1 12y ago
    Are you suggesting that it shouldn't be added to the signature list? Forget the news - that will be the tip off more than anything for the virus makers. When they 'release a new version', that behaviour can be spotted by the AV companies, and that new version can then be added to the signature list as well.
- lvs 12y ago
  It would be possible to discuss the find publicly without disclosing the source. I'm pretty sure that's how all national security journalism functions today.
  - freehunter 12y ago
    Even that may be against the contract. I've worked with companies where their NDA said their security troubles can't be disclosed even if the information was completely sanitized. Even saying "One company in the US was impacted by Malware X" would be inviting the lawyers. But I don't know this particular contract, so that may not be in play.
wfunction 12y ago
I didn't see a compelling argument for why they should be publicized in the article.
- wmt 12y ago
  Unfortunately Schneier first guesses that in reality nobody came out because they didn't have the full picture, instead of the reasons the companies actually gave, and then he goes on about how the reason he is guessing to be the real reason is not a good reason.
  - fulafel 12y ago
    Lack of full picture is a consequence of the AV companies' given reason of customer confidentiality. Unless they had closed circle of sharing the info and analysis with each other, in which case keeping it all quiet is even more more damning... Psychologists will tell you that you shouldn't put too much faith in what people tell you about their reasons. Both because people are bad at introspection and/or try to put a spin on things, and because for most things a single reason doesn't even exist. (See also "Why did you buy product X", a question subject to much study).
- higherpurpose 12y ago
  You mean other than the obvious "trust" benefit? If "anti-virus" companies don't want to protect you against "certain" viruses for political reasons, why bother trusting them and buying their product?
  - wfunction 12y ago
    What would your alternative be? Not buying their products?
    - josteink 12y ago
      Yes. If the security product you're buying isn't providing you with security, what are you paying for?
thornjm 12y ago
Cleaning up a modern malware infection is quite a big task. You can't immediately wipe it off a single computer because you will be playing whack-a-mole forever. You have to carefully monitor and learn everything you can about the malicious actor, and discover all the infections. Then produce a plan to remove it and prevent further infection. This is all implemented at a single instant. However, it doesn't end there, you then have to monitor very carefully to see if it comes back. If this can all be done in secret it is much easier, especially if the malicious actor doesn't know you know they are there. If you immediately reported everything you knew it would greatly assist the malicious actor - keeping it secret is part of trying to stay ahead in the game. Even after the first incident keeping it secret helps with future incidents.
- noinsight 12y ago
  > Cleaning up a modern malware infection is quite a big task. And the only way to clean up a compromised computer is a full reinstall. You can't possibly know what has happened on the compromised computer during the compromise. This is what the desktop support jockeys and most companies get wrong - obviously it's probably because of the cost associated with a full reinstall, but it doesn't make it any less valid. If it costs too much, companies should then focus on preventing machines getting compromised in the first place. Think about it, if I ask you to hand over your laptop for say, an hour, during which I have completely free reign over it, can you tell me everything I've done during that hour and all the backdoors installed, if any? And to nitpick, obviously these days not even a full reinstall might do it when there's BIOS viruses and even hard drive firmwares can be compromised etc. of course.
  - new299 12y ago
    Unless you reinstall all your systems simultaneously and close whatever vector was used in the attack at the same time, reinstalling might not help. As long as the attacker has at least one route into the organization at anyone time, the possibility of reinfection exists. So I guess it's wise to take a coordinated approach.
  - colordrops 12y ago
deleted 12y ago
[deleted]
zecg 12y ago
"My guess is that none of the companies wanted to go public with an incomplete picture." -- or, see Assange's censorship pyramid: http://wikileaks.org/Transcript-Meeting-Assange-Schmidt#279 http://wikileaks.org/Transcript-Meeting-Assange-Schmidt#279
jmnicolas 12y ago
I don't care if they publicize it or not, what I care is that they protect me against the malware. I'm very disappointed by Kaspersky : I chose them specifically because they were Russians, I though they would not be susceptible to NSA pressures.
- Illniyar 12y ago
  From the article it appears that they did protect against it. At least, that's what I understand from "all the companies had added signatures for Regin to their detection database".
toothbrush 12y ago
Non-ironic question: do many people on HN use anti-virus of some form or another? Generally i'd probably trust people's judgement here as far as that goes. I naively use Linux with no externally accessible services running and no active anti-virus -- am i an idiot, should i clean-install everything ASAP? Or do yous reckon this is reasonable? edit: clarification
- grimman 12y ago
  I do, but a very basic kind; ie. Microsoft Security Essentials. That doesn't change my distrust of binaries though, and if I must run things I don't trust, I frequently do it in a VM. But the gist of it is that if I can alleviate some of the risk that comes from running Windows, with no discernible cost (ie. no noticeable system slowdown), I will do so (obviously in addition to "common sense" security measures). It'd be foolish not to.
  - toothbrush 12y ago
    Yeah, if i had to use Windows i would consider it essential to use some form of active anti-virus, but then again, i don't think that would alleviate my (unfounded?) general unease and feeling of still not being that "safe". But i'm trying to get a reality check here :)
    - freehunter 12y ago
      Windows 8 and Windows 10 come with AV built-in. It's generally "good enough" for home users. It will flag suspicious downloads before they download and before they run, and then scan them as they're running. With those two OSes, I never use an AV. I'd prefer user education over a stricter AV. On the other hand, my work laptop is Red Hat 6 and Linux, Mac, or Windows, we're required to run Symantec by corporate policy. Then again I work for a security company, so...
  - 01Michael10 12y ago
    Microsoft Security Essentials/Windows Defender is one of the few antivirus software that fails AV-TEST certification. http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ How old is your PC that modern antivirus software noticeably slows it down?
justfane 12y ago
I think the issue is... Windows is the biggest problem because most of the 'malware' kids come from hacking communities... Most communities use VB.net, C# when i coded in both of these languages things seemed easy; and there is really only FUD packagers on Windows; to make the executable undetectable. It's easy to code a RAT program or anything in vb.net or c#
- doctorKrieger 12y ago
  and all those methods are easily detected by avs.
deleted 12y ago
[deleted]
phkn1 12y ago
Here we see the other side of the "responsible disclosure" coin -- if the ethical white-hat security researcher is required to withhold publication of a critical vulnerability for a set amount of time, is there a corresponding deadline for timely publication as well? And if that deadline is not met by meaningful attempts at remediation or disclosure, is the researcher not compelled to publish the findings independently? Obviously these companies failed miserably to meet any reasonable person's timeline of disclosure. One question is whether the extra time researching this malware reasonably would have produced additional worthwhile intelligence about its function and targets. If so, then the delay was "worthwhile". Another question is whether it's not better to simply release an incomplete picture to the security community (perhaps selectively) and let the larger hive mind go to work on finding and corroborating additional clues. It seems like the firms chose the former; many HN readers would advocate the latter. So finally, the question remains whether such a forced disclosure would be perceived as an irresponsible "leak" based only upon the disagreement in methodology and interpretation of "responsible"? Would its withholding be considered likewise irresponsible? Can a single firm, a collection of firms, or the security research community at large meaningfully stay ahead of a dedicated state-funded attacker? (Probably, Probably, Probably not). If a nation-state is producing malware, it logically will also be monitoring the channels of disclosure for evidence of its release and detection in the wild. But that's no reason to limit the resources being dedicated to protecting the public; it's egotism at best and collusion at worst.

123 points by aburan28 12y ago

wmt 12y ago

It's easy to say it should be publicised, but I'm not sure how someone can do that if the infected organisation specifically asks the antivirus company not to publicly discuss the malware, like what appears to have been the case with F-Secure. (https://mobile.twitter.com/mikko/status/536959936476221440 https://mobile.twitter.com/mikko/status/536959936476221440) Sure, they could just go ahead and disclose it against the customers express wishes, but how many would hire their services in the future if there's no expectation of customer confidentiality? Edit: There likely is an NDA in place even before externals are allowed in, so breaching it might invite some additional problems than just image issues.

higherpurpose 12y ago
But that doesn't seem to have been the case with Kaspersky. So what's their excuse? Other than being pro-surveillance that is: https://twitter.com/csoghoian/status/505376361268400128 https://twitter.com/csoghoian/status/505376361268400128
- wmt 12y ago
  That is a good point, some companies had very different motivations for not discussing it, e.g. Ronald Prins from Fox IT had this to say to Mashable: For Prins, the reason is completely different. "We didn't want to interfere with NSA/GCHQ operations," he told Mashable, explaining that everyone seemed to be waiting for someone else to disclose details of Regin first, not wanting to impede legitimate operations related to "global security." http://mashable.com/2014/11/25/regin-spy-malware-nsa-gchq/ http://mashable.com/2014/11/25/regin-spy-malware-nsa-gchq/
gordaco 12y ago
To add something: I think that it makes a lot of sense for an infected organisation to ask for confidentiality about something like this; any public communication in the opposite sense would be an immediate signal for the attackers to release a new version of the malware. Although, depending on what the malware does, the attackers may realize immediately that it has been protected against. EDIT: also, it's not like antivirus companies publicise everything they do. From what I've seen (admittedly not much, so maybe I'm wrong) most releases are simply summarised as "added protection against 100 new threats".
- jamez1 12y ago
  Are you suggesting that it shouldn't be added to the signature list? Forget the news - that will be the tip off more than anything for the virus makers. When they 'release a new version', that behaviour can be spotted by the AV companies, and that new version can then be added to the signature list as well.
lvs 12y ago
It would be possible to discuss the find publicly without disclosing the source. I'm pretty sure that's how all national security journalism functions today.
- freehunter 12y ago
  Even that may be against the contract. I've worked with companies where their NDA said their security troubles can't be disclosed even if the information was completely sanitized. Even saying "One company in the US was impacted by Malware X" would be inviting the lawyers. But I don't know this particular contract, so that may not be in play.

wfunction 12y ago

I didn't see a compelling argument for why they should be publicized in the article.

wmt 12y ago
Unfortunately Schneier first guesses that in reality nobody came out because they didn't have the full picture, instead of the reasons the companies actually gave, and then he goes on about how the reason he is guessing to be the real reason is not a good reason.
- fulafel 12y ago
  Lack of full picture is a consequence of the AV companies' given reason of customer confidentiality. Unless they had closed circle of sharing the info and analysis with each other, in which case keeping it all quiet is even more more damning... Psychologists will tell you that you shouldn't put too much faith in what people tell you about their reasons. Both because people are bad at introspection and/or try to put a spin on things, and because for most things a single reason doesn't even exist. (See also "Why did you buy product X", a question subject to much study).
higherpurpose 12y ago
You mean other than the obvious "trust" benefit? If "anti-virus" companies don't want to protect you against "certain" viruses for political reasons, why bother trusting them and buying their product?
- wfunction 12y ago
  What would your alternative be? Not buying their products?
  - josteink 12y ago
    Yes. If the security product you're buying isn't providing you with security, what are you paying for?

thornjm 12y ago

Cleaning up a modern malware infection is quite a big task. You can't immediately wipe it off a single computer because you will be playing whack-a-mole forever. You have to carefully monitor and learn everything you can about the malicious actor, and discover all the infections. Then produce a plan to remove it and prevent further infection. This is all implemented at a single instant. However, it doesn't end there, you then have to monitor very carefully to see if it comes back. If this can all be done in secret it is much easier, especially if the malicious actor doesn't know you know they are there. If you immediately reported everything you knew it would greatly assist the malicious actor - keeping it secret is part of trying to stay ahead in the game. Even after the first incident keeping it secret helps with future incidents.

noinsight 12y ago
> Cleaning up a modern malware infection is quite a big task. And the only way to clean up a compromised computer is a full reinstall. You can't possibly know what has happened on the compromised computer during the compromise. This is what the desktop support jockeys and most companies get wrong - obviously it's probably because of the cost associated with a full reinstall, but it doesn't make it any less valid. If it costs too much, companies should then focus on preventing machines getting compromised in the first place. Think about it, if I ask you to hand over your laptop for say, an hour, during which I have completely free reign over it, can you tell me everything I've done during that hour and all the backdoors installed, if any? And to nitpick, obviously these days not even a full reinstall might do it when there's BIOS viruses and even hard drive firmwares can be compromised etc. of course.
- new299 12y ago
  Unless you reinstall all your systems simultaneously and close whatever vector was used in the attack at the same time, reinstalling might not help. As long as the attacker has at least one route into the organization at anyone time, the possibility of reinfection exists. So I guess it's wise to take a coordinated approach.
- colordrops 12y ago

deleted 12y ago

[deleted]

zecg 12y ago

"My guess is that none of the companies wanted to go public with an incomplete picture." -- or, see Assange's censorship pyramid: http://wikileaks.org/Transcript-Meeting-Assange-Schmidt#279 http://wikileaks.org/Transcript-Meeting-Assange-Schmidt#279

jmnicolas 12y ago

I don't care if they publicize it or not, what I care is that they protect me against the malware. I'm very disappointed by Kaspersky : I chose them specifically because they were Russians, I though they would not be susceptible to NSA pressures.

Illniyar 12y ago
From the article it appears that they did protect against it. At least, that's what I understand from "all the companies had added signatures for Regin to their detection database".

toothbrush 12y ago

Non-ironic question: do many people on HN use anti-virus of some form or another? Generally i'd probably trust people's judgement here as far as that goes. I naively use Linux with no externally accessible services running and no active anti-virus -- am i an idiot, should i clean-install everything ASAP? Or do yous reckon this is reasonable? edit: clarification

grimman 12y ago
I do, but a very basic kind; ie. Microsoft Security Essentials. That doesn't change my distrust of binaries though, and if I must run things I don't trust, I frequently do it in a VM. But the gist of it is that if I can alleviate some of the risk that comes from running Windows, with no discernible cost (ie. no noticeable system slowdown), I will do so (obviously in addition to "common sense" security measures). It'd be foolish not to.
- toothbrush 12y ago
  Yeah, if i had to use Windows i would consider it essential to use some form of active anti-virus, but then again, i don't think that would alleviate my (unfounded?) general unease and feeling of still not being that "safe". But i'm trying to get a reality check here :)
  - freehunter 12y ago
    Windows 8 and Windows 10 come with AV built-in. It's generally "good enough" for home users. It will flag suspicious downloads before they download and before they run, and then scan them as they're running. With those two OSes, I never use an AV. I'd prefer user education over a stricter AV. On the other hand, my work laptop is Red Hat 6 and Linux, Mac, or Windows, we're required to run Symantec by corporate policy. Then again I work for a security company, so...
- 01Michael10 12y ago
  Microsoft Security Essentials/Windows Defender is one of the few antivirus software that fails AV-TEST certification. http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-7/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ http://www.av-test.org/en/antivirus/home-windows/windows-8/ How old is your PC that modern antivirus software noticeably slows it down?

justfane 12y ago

I think the issue is... Windows is the biggest problem because most of the 'malware' kids come from hacking communities... Most communities use VB.net, C# when i coded in both of these languages things seemed easy; and there is really only FUD packagers on Windows; to make the executable undetectable. It's easy to code a RAT program or anything in vb.net or c#

doctorKrieger 12y ago
and all those methods are easily detected by avs.

deleted 12y ago

[deleted]

phkn1 12y ago

Here we see the other side of the "responsible disclosure" coin -- if the ethical white-hat security researcher is required to withhold publication of a critical vulnerability for a set amount of time, is there a corresponding deadline for timely publication as well? And if that deadline is not met by meaningful attempts at remediation or disclosure, is the researcher not compelled to publish the findings independently? Obviously these companies failed miserably to meet any reasonable person's timeline of disclosure. One question is whether the extra time researching this malware reasonably would have produced additional worthwhile intelligence about its function and targets. If so, then the delay was "worthwhile". Another question is whether it's not better to simply release an incomplete picture to the security community (perhaps selectively) and let the larger hive mind go to work on finding and corroborating additional clues. It seems like the firms chose the former; many HN readers would advocate the latter. So finally, the question remains whether such a forced disclosure would be perceived as an irresponsible "leak" based only upon the disagreement in methodology and interpretation of "responsible"? Would its withholding be considered likewise irresponsible? Can a single firm, a collection of firms, or the security research community at large meaningfully stay ahead of a dedicated state-funded attacker? (Probably, Probably, Probably not). If a nation-state is producing malware, it logically will also be monitoring the channels of disclosure for evidence of its release and detection in the wild. But that's no reason to limit the resources being dedicated to protecting the public; it's egotism at best and collusion at worst.