Kaspersky releases a malware scanner for Linux systems | Hacker News Reader

Kaspersky releases a malware scanner for Linux systems

kaspersky.com

28 pointscraigmart29 comments

I like the audacity to suggest "downloading" a random closed-sourced 166MB .run script that will scan my system and send data to KGB

But can I interest you in an OS that will send your data to NSA instead?

With Kaspersky you have the guarantee it won’t be sent to NSA since it is Russian.

I like to mix and match my providers so everyone can have a good peek.

Actually you can't guarantee even that given the profitable black market for user data in Russia (it's easy to sell and buy leaked or stolen data there)

Since we are talking about Linux.

I assume you have a link to the source code where this is happening.

Not everything in Linux have a source code available for users. And you may want to use i.e. Chrome, or some games, or some drivers by i.e. NVidia. And that without counting BIOS or whatever deep down computers use, most of what you could use as social network/mail solution, and not found yet trojans like what happened with xz in some basic tool.

Having the source is a good start, but having a "lawful" powerful active player that actively want to intrude should be part of the equation. It was a formidable threat a decade ago, nothing was done about that, and now is even more advanced than what was then.

Are we still talking about the OS?

https://en.wikipedia.org/wiki/Binary_blob

I always thought Kaspersky is one of the better AntiVirus programs. But as an end user on Linux, do you really need one?

If I miss a Russian program, then it is the ABBYY FineReader Engine CLI for Linux

Unfortunately, it was always very expensive.

Why the downvote?

Dilemma: Whom would you trust - malware or Kaspersky?

Malware, at least that has a track record of not fucking with my day, which cannot be said about AV programs like Kaspersky.

I would rather chose malware, because Kaspersky is malware and more for the worse.

It's good to have more antivirus options on Linux, but why should we trust Kaspersky? They've been implicated in hacking for the Russian government

Source for the second statement?

Asking for the source usually gets you marked as part of the big russian botnet™

tread carefully, stalker

I made a big claim, it's perfectly reasonable to ask me for a citation.

They might be referring to this.

According to InformNapalm, "managers of the Kaspersky Lab neural network development team created the on-board AI system for the Russian Albatross drones."

https://www.twz.com/news-features/ukraine-situation-report-f...

Here's a Wikipedia page about it: https://en.m.wikipedia.org/wiki/Kaspersky_bans_and_allegatio...

#1 Kaspersky #2 Impossible to schedule #3 Cant update, must re-download

Am I missing something or is this a pile of dark patterns to drive you to a paid product?

What are the ways in which viruses and other types of malware can infect a Linux system?

TFA lists many examples.

Downloading binaries from should-not-be-trusted sources, and executing/installing them is one way. There is some irony on having to do exactly that with this scanner. But, anyway, you may not have everything you want in your distribution, so you may have to resort to that in some cases.

There are more subtler ways to download binaries and scripts from elsewhere, depending on what you use, like Steam games, python/js/perl/etc repositories , browser extensions, adding new distribution repositories, and so on. Everything should be safe enough and should be checked, but as the xz problem showed, that is not a fail-proof guarantee.

Also ML models, which are often distributed not as data (weights), but data wrapped in Python scripts that get to run arbitrary code and download stuff from the Internet.

Manually downloaded scripts from websites, which are then run as root. The website will tell you that thats how it works, and to "trust me bro".

The target audience is the same "computer expert" who runs anything he downloads onto his Windows 7 PC as admin, because that solves a lot of issues usually™.

If you have a public HTTP server somewhere, you can check its access logs. You'll find a lot requests which try to exploit remote code execution vulnerabilities of some CMS or router firmware.

https://news.ycombinator.com/item?id=40561915

Is the executable updated before each run, and not merely the data (definitions/patterns) used? Because running as root, being closed source, and updating the virus definitions daily wouldn't be surprising.

Reply on news.ycombinator.com