Kaspersky is declared a US national security threat and is banned by the FCC
hothardware.com
hothardware.com
I am a patriot, but even I don't appreciate being lied to by my government. It would be good if the next best cyber security firm and software was half as good as Kaspersky's. But I suspect not.
Theoretically, the Constitution protects you. In reality, the intelligence community acts largely in secret, and there's very little preventing them from violating the Bill of Rights. Citizens don't even know what rights they've given up until someone like Snowden spills the beans.
But you turned this question into comparing US to perfection. Yes, you are right. US is not perfection.
But there is a big difference between 70 to 10, even both are not 100.
What Snowden revealed does not make 70 to 10. If you think that way, you don’t understand how bad an authoritarian regime is.
Could the Russian press behave toward Putin as the US press toward Trump? If so, then you can have your 10s.
Even if a company does not want to participate or is not compelled to do so, the US government has very significant capacity to break into and co-opt systems (all the way from targeted surveillance of individuals by intercepting and bugging hardware to tapping undersea cables to indiscriminately hoover up communications).
So when people say that Kaspersky might be forced to go along with Russian intelligence, the same goes for American tech companies and US intelligence. There is indeed a 4th Amendment that is supposed to protect Americans, but the last two decades have shown that the government is perfectly willing to ignore that legal restriction.
The US has the most extensive global surveillance system in the world. US intelligence services receive about as much funding as the entire Russian military. I have no doubt that Russia tries very hard to engage in extensive foreign surveillance, but its not in the same league as the US.
Illegal NSA dragnets and perjury in front of Congress notwithstanding.
* The NSA secretly obtained access to every Verizon customer's entire call log. This was blatantly illegal (the 4th Amendment forbids general warrants), and it only came to light because of Snowden's leaks.[0]
* Snowden's email provider, Lavabit, was compelled to install a backdoor that allowed the US government to read the emails of all of the provider's users. The process was supposed to be secret: the company was under a gag order. The public only found out because the founder spoke out.[1]
There are many examples like this from the US (just look up "National Security Letter," or take a look at Snowden's leaks). You're citing one example in which a company successfully refused a request, but we also know from Snowden that there was mass collection on most Americans that went on for years in secret, despite the fact that it was blatantly illegal.
The scale of surveillance conducted globally by US intelligence agencies is unparalleled. I'm sure Russia wishes it could collect information on the same scale, but it simply does not have the ability to do so.
0. https://www.theguardian.com/world/2013/jun/06/nsa-phone-reco...
1. https://www.theguardian.com/commentisfree/2014/may/20/why-di...
Of course lawyers working for these agencies will try to justify them. That's what they're paid to do. During the Bush Jr. years, lawyers for the administration also argued that torture was legal, despite the fact that it's blatantly illegal.
Nevertheless, these programs are incredibly difficult to challenge in court, because the secrecy surrounding them makes even proving standing nearly impossible.
As for the (un)constitutionality of mass collection of Americans' call records, here's what Reuters[0] says:
> In a ruling handed down on Wednesday, the U.S. Court of Appeals for the Ninth Circuit said the warrantless telephone dragnet that secretly collected millions of Americans' telephone records violated the Foreign Intelligence Surveillance Act and may well have been unconstitutional.
The court did not make any ruling on the Constitutionality of the NSA's mass surveillance program, but they wrote in their decision that it very likely was Unconstitutional.[1]
Historically speaking, this NSA program is exactly the type of search that the 4th Amendment was intended to prevent. Americans were upset about "writs of assistance" that gave colonial officials wide powers to conduct searches against classes of people. That's why the 4th Amendment requires warrants to be specific and limited in scope. Handing out warrants that allow authorities to collect call logs of millions of Americans is blatantly Unconstitutional, and is exactly the sort of thing the 4th Amendment was intended to put a stop to.
0. https://www.reuters.com/article/us-usa-nsa-spying-idUSKBN25T...
1. https://cdn.ca9.uscourts.gov/datastore/opinions/2020/09/02/1...
XKeystore is simply the database that stores data collected outside the US, and Tempora is not even a US program, so clearly neither can violate the 4th Amendment, which is why no lawsuits were brought against either program.
> Handing out warrants that allow authorities to collect call logs of millions of Americans is blatantly Unconstitutional.
Obviously not. The program was limited to collecting millions of call logs instead of all call logs after the leaks, and that was considered so obviously constitutional that nobody sued. [5]
[1] https://cdn.vox-cdn.com/thumbor/DqqNh3fnfGCY1Zmk41LsSnjgUBg=...
[2] https://www.nytimes.com/2013/06/08/technology/tech-companies...
[3] http://www.nytimes.com/interactive/2013/06/07/us/comparing-t...
[4] https://www.cnet.com/news/no-evidence-of-nsas-direct-access-...
[5] https://www.reuters.com/article/us-usa-cyber-surveillance/sp...
> Tempora is not even a US program, so clearly neither can violate the 4th Amendment
The NSA is a partner in the program (led by the British, with whom the US has a very close intelligence partnership). The program does bulk collection on undersea cables which do carry Americans' data. This is prima facie a violation of the 4th Amendment.
> which is why no lawsuits were brought against either program
The reason why lawsuits so rarely get anywhere against any of these mass surveillance programs is that in the US legal system, you have to be able to prove standing in order to challenge them. The US isn't like other systems with dedicated constitutional courts that can review laws on their own initiative. Someone has to be able to show that they themselves have been specifically harmed. Unless you can prove that the NSA specifically looked at your data and used it against you in some way, you can't challenge the NSA's surveillance. By the very nature of these programs, it's nearly impossible for anyone to prove that.
> The New York Times [2][3] and CNET [4] subsequently correctly described the program
The NY Times article you cite describes it as a program that collects information from the largest US tech companies on the basis of FISA requests. Just so you recall, FISA is a court that operates in secret, that grants virtually all requests, and that has demonstrably signed off on Unconstitutional bulk surveillance (e.g., mass collection of call logs).
And by the way, the type of behavior we're discussing here, which we know for a fact the US government has engaged in, is exactly what people in this thread are alleging the Russian government might theoretically do to Kaspersky.
> High school dropout Snowden
Yes, a "high school dropout" who was paid 200 grand a year and given access to the NSA's classified networks. What a dummy!
> The program was limited to collecting millions of call logs instead of all call logs after the leaks, and that was considered so obviously constitutional that nobody sued.
This is not how the process of challenging an Unconstitutional law works. You can't just say, "That's Unconstitutional" and then sue. You have to show that you have personally been targeted. That's why Rosa Parks had to physically sit down on the bus and wait to get thrown off. That's what gave her standing to challenge Montgomery's segregated bus system. Just knowing that a surveillance program exists and has probably illegally collected your information does not automatically give you the ability to challenge said program in court.
Bulk collection of records of millions of Americans (this is just the warrant that we know of, and there were almost certainly similar warrants covering most Americans, because by design, the program was meant to do bulk analysis of all call records) is obviously unconstitutional, but also very difficult to legally challenge.
The NSA is aware of the program but has no say in implementing it and doesn't have access to its data. Only the UK has the data and gets to choose who to share what they've learned from it to. This is clearly not a violation of the 4th Amendment, which is why nobody has sued the US government for it. If you believe it is a violation, go ahead and try to find a lawyer to take your case.
> The reason why lawsuits so rarely get anywhere...
No lawsuit was brought at all against XKeyscore or Tempora. That is the reason they didn't get anywhere. Lawsuits were brought against the phone metadata program, which succeeded, and against PRISM, which was thrown out because it didn't collect the data of the person who brought the lawsuit, unlike what Snowden and Greenwald erroneously claimed.
> Just so you recall, FISA is a court that operates in secret, that grants virtually all requests, and that has demonstrably signed off on Unconstitutional bulk surveillance
Once again, no program the court has signed off on has been ruled unconstitutional. Just so you recall, FISA is not a court but a law. FISC is the court that rules on FISA requests.
> And by the way, the type of behavior we're discussing here, which we know for a fact the US government has engaged in, is exactly what people in this thread are alleging the Russian government might theoretically do to Kaspersky.
The behavior we're alleging the Russian government could do with Kaspersky is putting malware in its software. We know the US government has done this for hardware exported overseas, which is why we are right to expect Russia to do this. We also know that Russia engages in dragnet domestic surveillance, which is something you're alleging that the US does, but there is no evidence of.
> Yes, a "high school dropout" who was paid 200 grand a year and given access to the NSA's classified networks. What a dummy!
He was a Sharepoint admin earning $122k. https://www.washingtonpost.com/blogs/erik-wemple/wp/2013/06/.... His hilarious misinterpretation of PRISM and other programs proves what a dummy he is. The fact that he dropped out of high school just explains how he came to be so stupid, and it should have been a signal for you to read the documents he leaked instead of expecting him to interpret them correctly for you.
> Bulk collection of records of millions of Americans (this is just the warrant that we know of, and there were almost certainly similar warrants covering most Americans, because by design, the program was meant to do bulk analysis of all call records) is obviously unconstitutional, but also very difficult to legally challenge.
They just have to have reason to believe their data is being collected to challenge it, as they did in Klayman v. Obama I. The conclusion was that the bulk collection of everybody's call records wasn't justified by the law, with no ruling on the constitutionality, possibly because there was precedent in Smith v. Maryland that it is constitutional (the very opposite of "obviously unconstitutional"). After that, Congress passed a law that allowed collection of millions of call records, and that was not even challenged.
I'm not, so from that point of view US companies cannot offer many guarantees to me
I think Russia is using similar tactics, does it?
You have to say "Ukrainian Special Security Operation".
>Moscow attacked neighboring Ukraine last month, following a seven-year standoff over Kiev’s failure to implement the terms of the Minsk agreements, and Russia’s eventual recognition of the Donbass republics of Donetsk and Lugansk. The German- and French-brokered protocols had been designed to regularize the status of those regions within the Ukrainian state.
>Russia has now demanded that Ukraine officially declare itself a neutral country that will never join the US-led NATO military alliance. Kiev insists the Russian offensive was completely unprovoked and has denied claims it was planning to retake the two republics by force.
It doesn't seem like they are afraid of getting disappeared for saying russia attacked ukraine.
Internal newspapers, such as Novaya Gazeta, have been shut down for saying "war" in print. Just the latest in many papers, radio channels and more that have been silenced in Russia.
> It doesn't seem like they are afraid of getting disappeared for saying russia attacked ukraine.
They didn't use the word "war".
Bullshit. The US is an imperialist, sometimes oppressive pseudo-democracy, but nothing like that mafia-run kleptocracy.
Most of the world consideres americans the "bad guys", and a lot worse than the russians. You can start with southern america and middle east. Then the balkans (where putin is doing the same as you guys did with kosovo). Even parts of africa would have a say.
Here in the balkans, people were actively rooting for trump in the last two elections, because they were afraid Hillary would start a new war here...
> Most of the world consideres americans the "bad guys", and a lot worse than the russians. You can start with southern america and middle east.
Their absurd support for tin pot dictators in South America was and is reprehensible, and the whole Iraq war was morally bankrupt and threw fuel on a fire that we’ll be trying to put out for decades. And yet, nothing the American did in the Middle East came anywhere near Aleppo or Mariupol. Or the Holodomor. Or the Prague spring.
> Then the balkans (where putin is doing the same as you guys did with kosovo).
Come on, now. You cannot possibly compare Sarajevo (with an actual genocide being carried out, surprisingly, by the side with Russian support) with the charade Putin used as a fig leaf to invade Ukraine. This is pure propaganda. The region would not be any better today had the ethnically cleansing gone all the way to the end, quite the contrary. Europe should have had grown a spine and actually done something.
> Here in the balkans, people were actively rooting for trump in the last two elections, because they were afraid Hillary would start a new war here...
Well, maybe you did, but that’s not what I heard from my greek friends. The Americans are not complicated to understand, they are going where their interests are. What the hell would they do in the Balkans? That is just stupid.
Yeah sure... and iraq had weapons of mass destruction, and iraqi soldiers killed babies, and afghanistan had to be occupied for 20 years, because a few saudis flew a few planes into a few buildings. Plus syria, libya, lebanon etc... and considering how far back you go in history, there's also blood from vietnam on americans hand. And it's funny how it's a "beloved ruler" when it's a friend of america and "nasty dictator" when it's not... so america has to replace the ones they don't like (eg iran.)
Sarajevo is not in kosovo, quite a few years were between sarajevo and the bombing of yugoslavia/serbia. Kosovo albanians wanted to separate from the main country, and the main country (yugoslavia then) wouldn't let them... then they formed armed groups that attacked the serbs, and serbs attacked the albanians... basically the same thing that was happening with the russian minority in eg. donbas and lugansk in ukraine. Then someone (USA) had some geopolicital interests in the balkans, bombed the country for 78 days, bombed hospitals, passenger trains, busses, schools, tv stations, cluster bombed a few cities, bridges, roads, highways etc, and built a nato base in kosovo.
So, why have a base in the balkans, if they don't need it?
In finance I had a client that didn't trust any vendor and asked me to reverse engineer VPN appliances (they negotiate a special clause with the vendor), which makes more sense then trusting based on country of origin.
You should have the same concerns about software from anywhere, including the US. I believe it's a couple orders of magnitude more likely I'd be harmed by Russian government malicious code than any other nation.
Russia is in crisis, striking indiscriminately, and has no reputation left to lose. So that's where my concern lies.
With wikileaks, we've seen, that americans did all of the same things, you now try to accuse russia of potentialy doing.
I'm not saying russians won't do it, but americans already did it.
Those are not the actions of the state worried about public perception, except in a "silence the dissidents" sense.
Just call the "other guys" terrorists, nazis, whatever, and americans can occupy and bomb whatever country they want (and they did that to many countries) withot any backlash. Gone are the days of the hippies and anti-war-anything... sadly.
I was kinda hoping for a "revolution" in one of the european countries (eg france) during covid, where people would "remove" the current government, and make the other governments atleast worry a bit when their people get mad... but sadly, not even that.
Yeah if the US ever goes rogue we're all doomed but then your antivirus software will be the least of your worries.
But we're talking about a government that just stole hundreds of millions of dollars in foreign planes (and other equipment) and took down satellite radio networks with cyberattacks (causing a lot of collateral damage), recently backdoor'd thousands of companies via Solarwinds, and looked the other way w/r/t ransomware groups until one of them caused a major international incident (Colonial pipeline). The threat from other nations is a lot more theoretical than it is for Russia.
I'm American. My country is the US. Yes, they're spying on me. Yes, they do naughty things. But I assume that at the end of the day, the US has my interests at heart more than China does. Or the UK, or Russia, or Turkey, or anyone else. I happen to live on the land that they'll protect even while filling their pockets.
My feedback to you would be to do the same. You don't have to trust your own government but assume your government will keep you around longer than any other government will.
I'd much prefer misdeeds that don't affect me from a government that doesn't care about me, than those of a local government who wants to keep me alive for the purposes of doing more bad things to me in the future
All these people whining about "they're both the same", they are not. "Bay of Pigs" argument does not apply, last time I checked Cuba was still standing where on the other hand Ukraine is burning and getting demolished.
It seems that those complaining really really do not understand the horror of living under an "official" or "unofficial" (i.e. government sanctioned vs. government tolerated) mafia rule: either you do what they tell you, or you cease to be, along with your spouse, children, parents, siblings, etc. There is absolutely no negotiation.
After I read that profile I decided I'd never use the software. I remember before news spread of the Russian troll farms being real, people talked about it like "who would do that?" Russia would.
I don't think it's their quote - but I remember Penn of Penn & Teller saying about magic something to the effect that the magician does the things that people think "It could be... but who would do all of that work?" This is how I feel about Russia. They will or already are doing the things you think they won't and nothing is beyond being a tool for the state.
I don't really like feeding the image of the Russian super villain, but I don't consider it overly paranoid to avoid installing software from hostile nations. Yes I used this same logic to convince my wife to uninstall tiktok.
Congratulations to both of you for uninstalling TikTok :) Facebook is next.
"We welcome the start of negotiations to resolve the current situation in Ukraine and hope that they will lead to a cessation of hostilities and a compromise. We believe that peaceful dialogue is the only possible instrument for resolving conflicts. War isn’t good for anyone."
So it is not a situation were we have actual evidence of dirtbaggery against the company, but that we are rationally paranoid that Kaspersky Lab could somehow steal our Pokemons.
I have a lot of respect for Kaspersky and hope they are still independent. But "ties to intelligence" can come in many forms: deliberate, coerced, or via infiltration. We've seen similar issues here in the US. Sometimes companies work voluntarily with the FBI and NSA, sometimes they are infiltrated or tricked by them.
I suppose that entirely depends on one's threat-model. As an American, I have greater concerns of USG oppression than I do Russian. As the Russians have their ham-fisted means of exterting influence on a company, the US has their very own nasty ways of infiltration.
If you're interested in personal freedoms free of malicious government intrusion, they both suck.
All this with Russian government/president approval rating of 70%.
The "living in germany" part doesn't contradict the same concerns that those living in russia have, as like those living in russia, the emigrated russians likely have:
- family still in russia - ties to russia (financial, business, family, etc) - desire to visit russia without having to deal with legal harassment for actions done abroad - desire to be able to assist people (family/friends) living in russia without compromising them
This does not mean that they are for or against a current government, but rather, that the proposed logic is specious as it tries to create a separation where it is not probable there is one while simultaneously extrapolating the results of a small sample size across a population that supposedly is without the influence of Russia.
The whataboutism is out in full force here.
You can still find the opposing views, quite easily.
AFAIK it's a (relatively) honest business, though sadly the target of American russophobia
Putin and friends are moronic for bullying and harassing and mugging Ukraine. But if I were him, I would definitely declare apple pie a security threat in response.
And anecdotally there were a lot of MSPs in /r/sysadmin claiming that every single one of their Kasperky customers would be hit by ransomware while few if any of their other customers were.
Except for this part, which leaves a huge question of "do they share knowledge with the russian govt."
> But the bigger unknown is whether and how Kaspersky’s acknowledged discovery and acquisition of NSA hacking tools resulted in Russian intelligence agencies discovering the NSA contractor, and targeting him for further, apparently successful, attacks.
In fact, there's a similar concern that the EU has with the US. The US's CLOUD Act forces American tech companies to comply with US legal subpoenas in foreign jurisdictions, which means that said tech companies cannot also comply with GDPR data export rules. Hence, it's illegal to include US services on EU websites[0] until and unless the US either agrees to pass GDPR into US law (so that exported EU data is still protected) or repeals the CLOUD Act (so that localized EU data is legally untouchable by the FBI or CIA).
The idea that we can treat a company as wholly separate from it's host nation is more of a legal fiction than anything else. It's not, in and of itself, russophobia. If the person running Kaspersky was trying to, say, flee Russia; and people said he couldnt't be trusted, then that would be russophobia.
[0] Note: It is still legal for EU citizens to use those US services directly. This only covers data export by EU companies to third-parties.
When you are entering a cold war with Russia, it's not Russophobia, it's common sense to not allow a potential state actor to have root access to millions of devices in your country.
Also, Kaspersky was literally a former KGB
> At the age of 16, Kaspersky entered a five-year program with The Technical Faculty of the KGB Higher School,[15] which prepared intelligence officers for the Russian military and KGB.[7][8] He graduated in 1987[15] with a degree in mathematical engineering and computer technology.[4][8] After graduating college, Kaspersky served the Soviet military intelligence service [6] as a software engineer.[2][10] He met his first wife Natalya Kaspersky at Severskoye, a KGB vacation resort, in 1987.[2]
One could say that the same is true in the US, but I believe the degree matters. Although the US government and intelligence agencies will and do try to overreach, there is a strong legal and cultural tradition of exposing, resisting, and fighting these overreaches in the US. I don't see that in Russia.
So, I would not be surprised to see the US strong-arming US companies, but they would do this with sham/flimsy legal cover. The result of non-compliance would be at worst asset seizure and/or imprisonment. Both of these can be examined and contested. I imagine that the penalty for non-compliance in the Russian system would max out at having an unfortunate accident. Gangsters all, but the level of gangsterism and possibilities for investigation/redress matter.
All that said, I'm not a US citizen (although in a Five-Eyes country), so I do worry about using US-hosted services.
To be fair, the US government has used gangster tactics to get US companies to install backdoors and allow encryption breakers.
That point would be a lot stronger if the US government hadn't demonstrated shocking callousness and disregard for international law in their efforts to catch notorious whistleblowers Snowden and Assange.
I remember when Belarus downed a plane to catch a political dissident and all western countries acted shocked, even though these countries had tried to do the exact same thing to Snowden on the US's behalf, with a presidential plane no less.
My point is that the US is willing to go pretty damn far to put some high-profile dissidents in a hole and throw away the key, and there is very little pushback both internally and internationally, which kind of undercuts the whole "the US government would hesitate to do X because whistleblowers would stop them" argument.
Another I can think of is Chelsea Manning who ended up getting a presidential commutation of sentence.
IIRC they pretended there was a bomb threat or some other nonsense.
I think the key misconception behind this argument is the idea that harmful governments is a binary flag, such that if you're subjected to one adding more makes no difference. In fact, different governments have different concerns. This means if you're subject to the US and Russia you're significantly more constrained than if you were just subject to one. As such, it makes sense to reduce exposure even if you obviously can't eliminate it.
(I also believe the US govt is much better than Russian, but I'm leaving that out because I my argument doesn't need it and I'm uninterested in that argument)
The same could be said for businesses that have offices and physical assets in the US.
I don't expect Kaspersky (the person) to play hero under these circumstances.
If you're a valuable target, it's basically choosing if you want to be spied on by the russians or the americans. (or installing linux, and hoping for the best).
Those companies often actually have people scan the hardware they receive to check for alterations. There was a whole thing about this a decade ago where a reporter (wrongly, IIRC) accused Facebook and Google of having compromised motherboards, and people from those companies were commenting here about how they are actually very careful with their supply lines and have people vet what they receive with scanning electron microscopes in some instances. (I'll try to find some of the submissions here and edit them as links on the bottom shortly).
I also have it on good authority (a good friend that worked at Google at the time) that Google found out that someone (the NSA) was tapping their inter-datacenter links and that's one of the reasons they made sure all data between datacenters was encrypted, and that was prior to the Snowden leaks.
So yes, agencies are constantly attempting to infiltrate large tech companies for their own purposes. That doesn't mean they always succeed, or that those companies just give up and accept that it happens. They all fight it quite actively.
It's also not a theory.
It's true that any any software that allows auto-updating can be used to load arbitrary code onto a system, limited only by whatever additional safeguards are in place. In the case of the OS vendor, that can't really be guarded against, but it exists farther up the stack as well. Chrome and Firefox can just as easily load nefarious code onto your computer, limited only by what the OS prevents (which is generally more on a mobile platform, thankfully) and what their own reputation can sustain if they were found doing so.
Its interesting to note that not many people remember (maybe a generational thing?) Kevin Poulsen found multiple government listening devices installed on Pac Bell networks that were listening to foreign embassy phone traffic which was highly illegal at the time.
It doesn't surprise me the extent the NSA and other three letter agencies have gone to get at information they deem valuable or important.
FTC should follow a fair and evidence based process for arriving at a decision like this.
There should be punitive measures only after it has been established that there is wrongdoing.
Kaspersky is by definition a Russian company that provides antivirus software to many influential western companies and institutions.
The risk of Kaspersky bowing to the pressure from Putin is just too great to ignore. For Kaspersky this can seem unfair, but that is one of the many consequences of Putins actions.
Don't forget who started the invasion and who is still hurting innocent Ukrainians.
This decision was certainly made by a bureaucrat who may not even know about Stuxnet. It’s simple risk mitigation. Why even take the chance Kaspersky is a malicious entity? It’s not important software.
Some of the conspiracy theories people throw out around here…
also dont forget that the Global Research & Analysis Team @ Kaspersky is not Russian
If that something is owned by your enemy in a hot war it's game over.
The minute a vendor can be leaned on by a hostile government (even they are not in the country like the founder of Telegram) and the interest is strong enough to lean on them (hot war) the trust assumption becomes problematic. How problematic? I think it doesn't get more urgent then in a hot war.
Kaspersky needs to pack up in all NATO countries. Not just because they pay taxes in RU (also this is a good enough reason for me). But also because if you share data with a non-NATO country it immediately becomes problematic too if your business partner is using their products.
The options under which they should be allowed to continue to operate is purely academic because it involves not only shifting all operations out of RU but also getting rid of any executive who moves to the new location that can be leaned on back home (e.g. family and friends etc).
There is no middle ground because the minute these steps are initiated Kaspersky has good reason to feel mistreated by the West. So even they kept their hands clean until now they might start doing what they've been accused of anyway.
Also if Positive Tech and others have been sanctions already some months ago there is no reason to give this much bigger potential threat a pass.
Clearly you were joking?
The crap is your assertion that this has anything to something other than what's happening in Ukraine.
Kaspersky is collateral damage and fallout from Russia s actions and nothing more.
Please let's cut the crap.
1. Kaspersky could have long ago left Russia
2. We can't trust Kaspersky
3. The fight is real, even if the US gov lied, incentives matter
Even if he is not a dirtbag, being in Russia means Putin has power to use Kaspersky technology in war.
I’ve been using Linux/Mac exclusively for the past 10 years and never even considered it.
Insecurity policies is correct, what you mean is protecting managers a* aka the antivirus failed on us ;)
Personally I think that it’s ridiculous that these huge orgs fail to address the actual underlying issue, excel macros. But hey, it’s easier to fight the Symptome than to deal with the root cause, especially if the latter would impact established work flows god knows how far down the line.
For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection.
This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem.
For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.
We're going to start talking past each other pretty quickly if you think this is worthy of a (software) service subscription. Torque specs belong in a manual (ideally on corporate intra-net or paper); I'm talking about when the engine is deeply unhappy, and you need more to go on than a driver reporting a yellow check light.
In the case of the latter, I'd say it absolutely deserves to be a 20 year old program (which tend to be lighter) that runs entirely offline. The last thing any garage wants to do is chase hardware requirements or search for a wifi signal either out in the yard, or in between hoists, lifts, and miscelleaneous heavy equipment / tooling - all of which tend to trash a wifi signal.
AWS even offers "Workspaces" as service for this.
Though it doesn't solve the "without the internet" problem.
Back when “I love you” virus started, we had pointed out something simple as “open for read” vs “open as in run/execute” should not have had the same interface.
All the new security enhancements we have today - don’t run as admin, alerts to request privileged access, sandboxing - all of them existed for a decade, but the software vendors never had the guts to weigh security higher than UX
Even the script kiddies fall into that trap, my old school got infected by a .pdf.js.js ...
There's a reason companies use excel.
I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).
Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).
Even if you as an exec know they are security theater you are forced to comply due to these certifications.
It's not just rogue AV software. Buggy, insecure AVs are a big problem too. They're attack surface! Especially when running parsers and interpreters for untrusted inputs in kernel space.
You repeat yourself sir
(Granted, I'm a complete layperson in computer security, so there's likely something I'm missing.)
MSE is really all I've used since binning AVG which turned into bloatware.
I feel your pain. We have a load of other crap loaded such as Umbrella that is supposed to protect us from harmful websites. It does stuff like intercept DNS lookups etc. It's such a pile of shite and doesn't work properly when I need VPN into our cloud infrastructure. When it's configured so badly it feels really anti-work. But hey ho, "security reasons".
I'm CERTAIN there are massive hidden costs in fan replacement and Laptop repairs and nothing useful discovered as a result.
All that other crap does the exact same stuff to other programs that malware does, except they do so in the name of "security."
Yet Mozilla contributes to the terrible shit that Google Safe Browsing is doing to independent and open source developers hosting their software.
Never again.
What happened to defense in depth with all of the layers you can introduce?
Surely if you run a Linux server, you might want a secure password for it, or better yet, key based authentication. Port knocking? Why not, throw it in there as another layer. Maybe deny authentication on an IP range basis? Why not. What about fail2ban or some other solution like that to disallow brute forcing? Sure. Or maybe require using a VPN to connect to it at all? Even better! Actually, even running your SSH server on a non-standard port will be enough to get rid of some attempts to brute force the password.
Sure, key based auth makes many of those moot points so i probably have the order of some of those steps wrong, but surely there's a lot of merit in combining whatever solutions you can to make the end result more secure, right? Hell, if you're running a web service of some sort or an application for yourself, adding basicauth in front of it at a web server level is enough to act as a safety net should the auth functionality of the actual application be broken, until you patch it.
So why should Windows be any different? If i'm stuck using that OS, i'd surely want to use whatever software is available to me to make the uphill battle towards something vaguely secure more doable, no?
What happened was antivirus itself became your biggest attack vector, so you were more secure without it. Plus Microsoft actually cares about security now, which wasn't the case 10+ years ago.
Enabling protected folder access and process isolation in Windows 10 is also a good idea.
Sure, any program can delete the Documents folder, but how can you prevent that from happening?
UAC still pops up whether you use an admin account or not - it just requires the admin password when you use a standard account (which is, of course, still more secure). But the real advantage is that the account you are using does not have those admin privileges in the first place.
The other big advantage is that if this account is compromised in anyway (say if you used the same password to login to Chrome and Windows on your standard account) the hackers only get the password to your non privileged account. Of course this can be mitigated as well by really good password policy but I find for the average user they often re-use passwords and separating the two accounts forces them to often re-use the one that matters least.
The tradeoff for having AV is having a giant application in admin land which increases the surface area available for an attack. Combine this with the that fact you don't get much protection because a virus can just be modified until the AV doesn't detect it and AV's just aren't worth it. This trade off made sense 20 years ago because OS's were less secure so you were increasing your surface area by relatively less than you are now.
AV software, including Defender, is not useless, it is actively harmful because it prevents people from running legitimate software without any recourse for non-experts or the original developer.
I spent about 30 minutes this weekend helping my sister-in-law debug a slow internet. My observations were that attempting to do anything resulted in about a 5-10 second pause, and general sluggish response when trying to anything online. I disabled anti-virus, etc. and it was still slow. I tried Edge and everything was super-fast.
Digging further, the issue was McAfee Safe Search (powered by Yahoo). It was singlehandedly adding 5-10 second lag on every mouse click and character typed in the browser. Disabling and blocking that resolved everything.
I think my favorite part of it is that the issue itself of blocking everything for network calls is like one of the first things I learned about Windows programming in the early 2000's.
This take is either naive in the extreme, or disingenuous.
For a security company trying to maintain a trusted reputation, neither of those two options is good.
While possibly technically accurate, it is a dodge or a flub that overlooks the fact that their autonomy can be usurped by the governments where they are based and where they operate.
To be fair, this is true of almost any company I can think of, although I wonder if a DAO could get around it.
Any of them is one NSL away from becoming a spy, wrecker or saboteur.
If your threat model includes foreign governments, don't use foreign closed source software. If your threat model includes your government, don't use domestic closed source software.
Or do, but either be ready to mitigate the harm, or be willing to live with it.
All antivirus software developers should open-source their traversal software and thus guarantee that no harm can be done. The scanning doesn't need write access and doesn't need network access.
From this I conclude that the current state of AV/Security apps is dismal. Researching alternatives is difficult, it falls directly into the cesspool that is web product recommendation in 2022. Trying to weed out the garbage articles, I find a handful of apps that are consistently rated that the top.
I discarded the recommendation of McAfee. I'm forced to use that awful thing at work, and I won't deal with the performance penalty it exacts. I wound up deciding that BitDefender was the best choice.
But setting up the new software has been an awful out-of-box experience. Configuring the tool was a serious chore. The tools (like for the firewall) were clunky and difficult to use, and once I finished on one machine there's no way to export the settings to apply to other devices. Going to their website to make suggestions, I found another post indicating that their tool is unable to restore from quarantine, files that belong in protected parts of the filesystem. The support analyst had replied "thanks for the interesting suggestion" - for something that seems like a Severity 1 bug!
I'm not trying to advocate for Kaspersky - I can see that with security being its raison d'etre, they're a bridge too far. But come on, the rest of the industry really needs to get their act together. The KIS product is really head and shoulders above other products I've seen, and we should be competing on the merits, not just "the Russians are a*holes".
* Extensive use of Chinese sites, which are quite a mess. I think the risks of visiting that part of the Internet are much greater than someone engaged in more typical usage.
* Features like firewall are useful for things other than protecting against direct hacks, and I use it to ensure privacy and occasionally even to simulate failures when testing my code. I think that Defender has such a thing, but less sophisticated?
* Probably just being more paranoid than most, having lived through an era when less protection was available, and having to un-hack family members.
ETA: also, it's good to have a different sort of protection when the majority is all homogeneous. Windows Defender is the obvious high-value target for hackers. Same kind of weakness and monoculture.
All of that functionality is available in the free version. The paid version is for managing the security of entire large networks of devices from things like ransomware and advanced persistent threats.
This is the boilerplate response to the valid complaint that Windows security is a nightmare. While in theory, other platforms (Linux, BSDs, and idk, OS/400, OS/2, etc.) technically can get infected by viruses, in practice, infection on these platforms would be a vanishingly rare oddity, even compared to the also incredibly rare cases of intrusion.
That said, every major non-Windows platform in its default install configuration is inherently more secure than a Windows system that has had all of its known default security issues addressed, even those beyond what Windows Defender provides. Windows is not simply a more attractive target for malware authors because it is a more popular platform with a larger install base, it is a more popular target because it is inherently insecure, and we know it is inherently insecure because it would be foolish for anyone to run Windows and access the WWW without first addressing its security issues.
It is possible, and likely even probable, that someone could use an unhardened, non-Windows system in its default install configuration for ordinary personal computing for years without ever experiencing the security threats that online Windows users face on a minute by minute basis.
But to be fair to Windows, it honestly often is a turnkey solution to whatever office computing needs there be, and without it, information security, as an area of study, as a profession, and as an industry, would not even exist as we know it today. The fact of the matter is that Windows' security issues (and other issues Windows exhibits unrelated to security) creates jobs, and this can not be ignored. Arguably, the jobs Windows creates are more important than the security issues it introduces. Also, to be fair, without C, C++, .NET, Python, Perl, and JavaScript, Windows would probably be 90% more secure, so it is not all Microsoft's fault and, in a sense, some of the problem is beyond their control.
Highly disputed.
>Windows is not simply a more attractive target for malware authors because it is a more popular platform with a larger install base, it is a more popular target because it is inherently insecure and we know it is inherently insecure because it would be foolish for anyone to run Windows and access the WWW without first addressing its security issues.
Do you have any specifics about any of this? It really just sounds like Slashdot talking points from the Windows XP era.
I haven’t looked into AV for macOS in ages; when last I did (~5y?), Sophos (if corporate/paid) and ClamAV (fine for home use) seemed reasonably non-interfering.
I think one of the flaws of Western culture is how much business efficiency is put on a pedestal above all other priorities.
Because of that type of mindset, the West can’t even manufacture simple cloth or paper masks during a healthcare crisis (as an example).
This sounds to me kind of like the fallacy of "if it saves even one life, it's worth it". That's of course ridiculous, because saving that life costs so much that we'll be unable to save countless other lives. In reality, the balancing of costs and benefits is much more subtle and complex.
My point is that the West often seems to consider low costs and efficiency above long-term implications.
I’m not saying the West should pull an Argentina [1], but the West also shouldn’t always be metaphorically choosing the lowest bidder.
[1] https://www.npr.org/sections/money/2017/02/17/515850029/epis...
Network Settings > uncheck Traffic processing
Network Settings > Do not scan encrypted connections
Once in a while, allow internet connection, do a quick database update then immediately block the internet connection again.
* Firewall (router or software).
What would you all suggest? Aside from McAfee, Norton and of course Kaspersky. I'm all ears. Some helpful hints though might be:
1. I don't want it giving me pop-ups constantly to remind me of a sale they are having.
2. It can't interfere with legitimate programs more than once in a blue moon.
3. It has be capable of being run with other security software at the same time without incurring an infraction against #2.
4. It has to cost less than 100$ per year, if there has to be payment at all.
I'm asking this because I need a reliable choice to use when suggesting to my potential customers out there. I have some go to's that I used to use, but with everything the way it is right now; I want some input.
Hmmm. Interesting. Thanks.
See: https://0ut3r.space/2022/03/06/windows-defender/ and recent discussion on HN: https://news.ycombinator.com/item?id=30580444
Anyways.
The point to my question was to find those few helpful anti-viruses and other programs that might help fill the spots that WD might not. Ya feel me?
Its strength is that it uses very low memory and CPU cycles due to the way it is built.
It ticks all the boxes you've given above.
Anything in particular you want to add about it that might be a good tip or so? Something that only someone who's been using it for a while will know, kind of thing.
From then until now our business has gone through a lot but ESET has never been something that bothered us too much. It just sits in the background doing its thing. I have terrible memories of Symantec / McAfee just being annoying, but Nod32 is just the thing you install, it sits there and you can forget about it.
I don't know if it's a marketing ploy rntksi. What you are describing so far sounds very much like it has been written in something like Assembly if not actually assembly. From what I know at least. (Could totally be way off)
Assembly as I know it, is used because it's not resource heavy if written properly. And an antivirus definitely needs to be written properly.
Anyways. Yeah, I am probably going to give it a look for use on my intel workstation/server. It's definitely one of the 'vulnerable' chips they released.
Oh well. So long as it does its job.
Symantec. shudders with rage
But yeah, windows defender IS usually good enough.
(Disclosure: I used to work for Sophos, I no longer do.)
It's a good mix of traditional antivirus, antimalware, and privacy tools. It's also available for Macs.
Eset seems to have more features, but they both trade blows on effectiveness according to some graphs. So I think they might be good to use with each other in tandem if they will play nice.
I guess this just makes it official.
[citation needed]
Isn't oil, gas and food trade still allowed? That is not "full sanctions".
> A bit unlikely now, but you never know. On the timeline we exist, it's a possibility!
The NSA’s own incompetence led them to run an antivirus on a computer with Equation Group spyware on it. Keep in mind that Kaspersky had been fighting Western intelligence services for years at that point. Israeli intelligence actually breached Kaspersky’s network in 2015, no doubt because Kaspersky is the only AV company that actually exposes US-created malware.
[1] https://twitter.com/ggreenwald/status/1508831524854059008
If the U.S. accusations are ever proven to be true, I will reconsider. But I'm not holding my breath, since the U.S. has time and again been proven to be guilty themselves of the very thing they accuse others of, and refuse to provide any proof of.
I can recommend reading an investigation by Russian journalists on the subject: "Inside The Fight For The Soul Of Kaspersky Lab" https://www.buzzfeednews.com/article/ilyazhegulev/russia-kas...
The original Russian title of the investigation was "Orcs who defeated the techies: How the siloviki infiltrated Kaspersky Lab — and what it led to", you can check this story in Russian here: https://meduza.io/feature/2018/01/22/orki-pobedivshie-tehnar...
That should automatically qualify it, and any other malware/proprietary software that's used by more than a handful of people, across a handful of US states as a national security threat.
Globalization was a terrible idea the way it was done and I'm glad it's coming to a close.
In the new version a super AI computer is ready to launch a massive automated cyber war. While trying to get the 16 digit “launch” code it runs thousands of simulated scenarios. As things look dire, the hero has the machine play tick-tac-toe with itself…
Just before launching the attack it learns: The only way to win is not to play.
Seriously. What the hell is the world devolving into?
Here’s what I think an alien species watching earth from distant orbit would think: The people are OK. Their so-called leaders are insane. Every single war was started by their leaders. How odd.
Other projects by the same developer:
That's the one I use to catch outbound connections.
[1] https://en.wikipedia.org/wiki/Host_Based_Security_System
There's nothing for governments to allow people to communicate freely. Telegram is one of the few platforms that allows that... and this is a good opportunity for the US government to do that.
Most likely implementing FSB backdoors.
Tribalism is a helluva drug.
(This is actually independent of you or Signal, I just find it amusing that people throw their security brand™ behind some app and it's just them picking the one they like most of the time.)
The 3-letter US agencies do not have direct access to Telegram's servers, they do have when it comes to Whatsapp (or to any other US-based company). The same goes if you're a Russian doing anti-government stuff in, well, Russia, it's better to put your fate in Whatsapp's (and Meta's) hands, presumably the US agencies won't come after you for being against the Russian government. It's a classical game of arbitration (for lack of a better word).
What makes you think so?
And even if he didn't, if you run the most popular messenger app in Russia you can't simply hide behind "citizen of some other country". KGB is known for poisoning/shooting people abroad for much less, and especially if you have family or close relatives back in your country of birth you really have little leverage to speak of.
The Russian state might not care a lot about that possible consequence and still coerce them to include malware in the next update.
> EU, US and their allies can kick Kaspersky off the market. It would be a game over for Kaspersky meaning zero installs(licenses) and zero revenue. It is not worth to do it not even in the short term. Trust would be forever lost.
Do you think Putin would shed even a single tear over Kaspersky, if what you describe was the consequence of him getting something he wanted?
Anyway it made me think: is there a way to roll your own EDR for Windows/Linux/BSD? Basically, can we do EDR without the EDR software?
Those who do not use federal telecom subsidy funds are not affected.
We should at least be skeptical given the connections the founder has.