Kaspersky Antivirus 2009 source code leaked

by etix • 15 years ago

138 76 15 years ago

More info here:

http://news.softpedia.com/news/Former-Kaspersky-Employee-Res...

It seems it's probably a beta version of AV 2009... Still embarrassing/potentially harmful to the company though - especially following the hacking of their website a few months ago (http://www.computerworlduk.com/news/security/3244882/kaspers...)

dchest3• 15 years ago

...the source code remains the intellectual property of Kaspersky Lab and downloading, distributing or using it without consent is illegal.

Is it true that downloading it is illegal?

ancymon• 15 years ago

Probably it depends on what country you're in...

johkra• 15 years ago

Yes, downloading is akin to making a copy without consent of the copyright owner. (Edit: At least according to the Berne Convention, which most countries have signed.)

Edit2: I think dchest is right and illegality of the act of downloading does probably not follow from the Berne Convention, sorry. Distribution (offering for download) certainly is and I think at least according to German law the resulting copy has to be destroyed. Mind you, I'm no lawyer and might be mistaken.

jacquesm12• 15 years ago

Not where I live.

They would wish it to be so, but that's a different matter. It won't scare off anybody though, that's for sure.

Distributing it is illegal where I live, but downloading it is not.

pvilchez• 15 years ago

I read it as 'downloading without consent', 'distributing without consent' or 'using it without consent'.

entity• 15 years ago

Is it legal to steal from thief? They've stolen GPL code

paraschopra• 15 years ago

Some one in the antivirus industry please clarify something for me. Which is more important/critical for an AV company: the software or regular virus definition updates. My guess is that the virus signature database is where they create maximum value?

johnnygood• 15 years ago

The signature database is where they'll get more money from. However, this is still bad for them. It gives people the chance to look through the code for vulnerabilities and it allows competitors to look at any techniques they're using. But the worst part is that they're a computer security company that couldn't keep their source code secure. Clearly, accidents happen even when one has the best policies and such in place. Sometimes it's merely chance as opposed to an indicator of something in a statistically valid way. However, it's still embarrassing. I don't find that there's a lot of testing of the efficacy of anti-virus software out there and so purchases are partially made on faith (would love to know if I'm wrong here since I'd be interested in the results). Anyway, as a purchase made partially on instinct, this makes purchasers feel less happy in their gut (so to speak).

weaksauce• 15 years ago

There is some testing being done on them but it's really only the known viruses that are tested against. It's the viruses that are unknown that are what you want to worry about.

sucuri2• 15 years ago

I have been in the AV industry for a while and I would say both.

AV companies have a lot of behaviour analysis/decoding/parsing done inside their code that is as important as their "static" signature set.

In fact, I would say that having access to the code and how they analyze the files/memory/etc is more valuable to a competitor (and the "bad guys") than the static signature set.

tptacek2• 15 years ago

In what sense have you ever been in the AV industry? I'm not sure whether this account belongs to David or Dre, but neither of you have an AV company on your LinkedIn profiles.

I admire you for building a business on cleaning up hacked Wordpress installs (seriously), but that's not the same game that Kaspersky is playing.

shimi• 15 years ago

Both are very important.

From an industry point of view its always the DB size that matters. When MS bought Giant it was due their DB size, it was huge and useless e.g there were installers that generated random guid for active x controls, registering those guids as a signature was pointless but they still went with it, when it was time to sell the MS guys fell for it. I worked for a company that was sold eventually and it was the same story when the founders decided that its time to sell it was all about the number of signatures.

Kasperskey are known to have a brilliant engine, this leak is a huge blow for them

On a different note: I wonder how this happened in the first place, the security companies that I worked for were pretty strict on code access, I couldn't checkout any code I wish, only a few people could pull the entire code repository.

_b8r0• 15 years ago

I'm not in the AV industry, but as someone involved in malware cleanups I can tell you that having access to the source code makes it slightly easier to go through the code base in order to identify ways of getting around the AV.

It's also possible to do some source code analysis to identify vulnerabilities in the product that might not be otherwise fairly easily exposed.

The virus signature database is pretty much worthless for all but the lowest hanging of fruit. There are plenty of tricks botmasters use to get around signatures, and AV firms are moving (or have moved) to more behavioural characteristics to detect malicious code. It guess it all depends whether that's in the updates or in the code base.

scorchin2• 15 years ago

I realise that this is a pretty dubious request, but a part of me would much prefer to see a link to either GitHub or BitBucket than a torrent of a zip file.

lrm242• 15 years ago

Why? Cloning a repository doesn't improve the morality of downloading and viewing this code. In the same way that it is wrong to receive a stolen radio, you shouldn't touch this code with a 10 foot pole no matter how it's packaged.

scorchin2• 15 years ago

As I said above, I realise it's a dubious request. I know it doesn't improve the morality either.

It's more for the sake of viewing the code. I associate those 2 brands with viewing/sharing code.

leon_• 15 years ago

Sorry man, but that's just a huge pile of dumb bullshit. If the information is out there it's, as a thinking human, your duty to learn about it and improve your knowledge.

Information want to be free per definition. If some company fails to guard their precious secrets - well, game over for them.

Self censorship won't help anybody.

CJefferson• 15 years ago

I can't imagine GitHub or BitBucket would keep such a repository, once they knew it was there.

getsat• 15 years ago

The zipped torrent is actually larger than the torrent file itself. I have no idea why he did this.

nimrody• 15 years ago

While the leaked code may ease the work of malware writers, keep in mind that whoever writes malware regularly tests against all popular antivirus software.

No point in releasing something only to get caught right away.

borski• 15 years ago

This is true, but if a test doesn't work with KAV, arguably it is now much easier to figure out why and find a workaround.

bigmac• 15 years ago

Indeed - Virus Total can be useful for this task: http://www.virustotal.com/

rw2-• 15 years ago

The torrent has lots of Chinese leechers.

levesque• 15 years ago

Interesting fact. I wonder what they are up to!

skinnymuch• 15 years ago

Purely academic intentions I presume.

olalonde• 15 years ago

Also lots of Transmission/libTorrent clients.

CWuestefeld• 15 years ago

I'm reading your comment to imply that Chinese are more interested in researching their production of malware.

But really, we'd need to know what proportion of leechers there are for other pirated software torrents before we could even think about drawing conclusions.

dfox• 15 years ago

One thing that amazes me at most of commercial codebases I have seen (leaked or not) is the sheer size of them. How can one spend 1GB of source code on something like anti-virus program?

davidu• 15 years ago

It's not limited to commercial code... Lots of codebases for complex applications are substantially large. Often the translation files filled with strings alone will be 50% of it.

cookiecaper2• 15 years ago

Well, the Linux kernel source code is around 71MB compressed, I'd guess maybe 200MB uncompressed. That's quite a difference in source code size, and I think that the same is true with most OSS projects. The WINE project for instance is also < 100MB for the full (huge and extensive, including translation) source.

I think that commercial codebases just end up with a lot of cruft and nobody ever feels like cleaning them up (plus, there is incentive for keeping things a bit clunky as it buys slack-off time and/or extra hourly pay). As above, I also think they use other commercial/crappy components like third-party widgets that had the same treatment, so it all snowballs into a huge/unwieldy thing.

chollida1• 15 years ago

For the large code bases I've seen, the size is often taken up by Third party code.

If we depend on a third party library we'll down load the source and build it for all supported targets( x86 and x64) (debug and release) (windows and linux). This can really increase the size of your code base quickly.

barrkel• 15 years ago

Static and dynamic libraries for third-party code and imports from external repositories.

Code that's been around for a long time, with a team of developers working on it for a decade or more, tends to be big. The way it is with commercial software, you more or less have to keep adding features to compete; and it's dangerous to refactor much to eliminate code because of the risk of breaking backwards compatibility, so that introduces another form of duplication.

1GB of source, just source, is pretty big, though. Just the source from RAD Studio (the product I work on) is nearly 10 million lines, about 350 million characters - though that doesn't include the C++ compiler, C RTL, debugger kernel, and a bunch of other things.

jacquesm12• 15 years ago

Once again the human element proves to be the hardest to secure.

Three years in jail is a pretty solid sentence, but still, every company with employees handing sensitive data like this is potentially at risk. All it takes is one bad leave and your corporate crown jewels could be on the street.

qquirrell• 15 years ago

Very interesting. This should be obvious, but I'd just like to remind everyone that given the source, nature, and intended audience of this file, it is fairly likely that it contains novel malware to catch people from other AV companies, and that you should not open, compile, or run anything from it without the full set of malware-safety precautions. Use only a virtual machine with no network connectivity.

Kaspersky Antivirus 2009 source code leaked

Related Stories