German Government Agency warns about using Kaspersky

https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2022/220315_Kaspersky-Warnung.html

by Fake4d • 4 years ago

186 142 4 years ago

bsi.bund.de

montzark2• 4 years ago

Little bit worried about Jetbrains products as well. I think they have development centers in Russia? Not worried about company, but rather some disgruntled employee, for example put this USB stick to your computer or otherwise we will prosecute you or your close one for participating in protests or some fabricated accusation.

dannyw• 4 years ago

Insider attacks should be part of every threat model.

ognarb• 4 years ago

Look at https://blog.jetbrains.com/blog/2022/03/11/jetbrains-stateme..., they are actively moving all their employees out of Russia.

EugeneOZ4• 4 years ago

Sorry, but there is no such information. Some employees have moved out of Russia - JB help to them is not mentioned. I hope I just misunderstood it and JB do help their employees to move out of Russia.

pacificmint• 4 years ago

Jetbrains is Czech. They have suspended their sales and R&D activities in Russia and Belarus two weeks ago[1].

Hacker News discussion from when it was announced[2].

[1] https://blog.jetbrains.com/blog/2022/03/11/jetbrains-stateme... [2] https://news.ycombinator.com/item?id=30639572

montzark2• 4 years ago

Thanks! My bad.

lmm• 4 years ago

Jetbrains is Czech.

Their headquarters is Czech, but many of their developers are or at least were based in Russia.

They have suspended their sales and R&D activities in Russia and Belarus two weeks ago

"R&D activities" is a funny phrase. Does that mean they've stopped all development in Russia (i.e. there are no longer Russian employees working in Russia with commit access) or not?

TheAdamist• 4 years ago

Jetbrains was already banned at the department of defense and many other companies in the wake of previous hacks where they were suspected as the entry point.

efdee2• 4 years ago

Can you expand on this, perhaps with a link to documentation about this?

thweoruoi234• 4 years ago

You realize everyone from Intel to Samsung have R&D centers in Moscow right ?

Wavelets• 4 years ago

I’m worried about JetBrains too. From what I can tell, only a small portion of their team (including the founders) are located outside Russia. That’s a lot of people left inside Russia to be pressured, manipulated, and abused into compliance.

MauranKilom• 4 years ago

This is interesting news, but submitted content must be in English on HN.

Edit: Take it from dang, not me: https://news.ycombinator.com/item?id=27571809

celticninja• 4 years ago

Is there a rule that says that?

Etheryte• 4 years ago

Language isn't mentioned anywhere in the submission guidelines [0].

[0] https://news.ycombinator.com/newsguidelines.html

sva_• 4 years ago

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

EugeneOZ4• 4 years ago

Not sure why this comment is downvoted - my post was removed because of this, it is a real limitation (not so smart one).

saalweachter• 4 years ago

I feel like browser translation widgets have gotten good enough that if half of HN is reading the article as a translation, they'll still be worlds ahead of the half of HN who doesn't read the article before commenting.

samwillis2• 4 years ago

Google translate: https://www-bsi-bund-de.translate.goog/DE/Service-Navi/Press...

(For the none German speakers)

bilekas• 4 years ago

(For the none German speakers)

I'm sure there's a few for sure!

/s Thanks for the Translation

ogogmad• 4 years ago

The DeepL translation (deepl.com) seems to be a bit better:

# BSI warns against the use of Kaspersky antivirus products

The Federal Office for Information Security (BSI) warns against the use of antivirus software from the Russian manufacturer Kaspersky in accordance with §7 of the BSI Act. The BSI recommends replacing applications from Kaspersky's portfolio of antivirus software with alternative products.

Antivirus software, including the associated real-time cloud services, has extensive system permissions and must maintain a permanent, encrypted and unauditable connection to the manufacturer's servers for system-related reasons (at least for updates). Therefore, trust in a manufacturer's reliability and self-protection, as well as its authentic ability to act, is critical to the secure use of such systems. If there are doubts about the manufacturer's reliability, antivirus software poses a particular risk to an IT infrastructure that is to be protected.

The actions of military and/or intelligence forces in Russia, as well as the threats made by the Russian side against the EU, NATO and the Federal Republic of Germany in the course of the current armed conflict, are associated with a considerable risk of a successful IT attack. A Russian IT manufacturer may itself carry out offensive operations, be forced to attack target systems against its will, or itself be spied upon as a victim of a cyber operation without its knowledge, or be misused as a tool for attacks against its own customers.

All users of antivirus software can be affected by such operations. Companies and public authorities with special security interests and operators of critical infrastructures are particularly at risk. They have the option of seeking advice from the BSI or the relevant constitutional protection authorities.

Companies and other organizations should carefully plan and implement the replacement of essential components of their IT security infrastructure. If IT security products and, in particular, antivirus software were to be switched off without preparation, they might be left defenseless against attacks from the Internet. Switching to other products involves temporary losses in convenience, functionality and security. The BSI recommends that an individual evaluation and consideration of the current situation be carried out and, if necessary, that BSI-certified IT security service providers be consulted.

Press contact: Federal Office for Information Security Press Office Tel.: 0228-999582-5777 E-mail: presse@bsi.bund.de Website: www.bsi.bund.de

Twitter: @BSI_Federation #GermanyDigitallySecureBSI

InCityDreams• 4 years ago

Deepl is an amazing translation service. So much so, that i have seen sdveral peolle blindly writing into it...exposing all sorts of pii, both theirs and other persons. I often wonder what happens to it.

And, tbh, being more circumspect, i haven't been bothered enough to try and find out.

samwillis2• 4 years ago

This is interesting news but I think it's more about sanctions/politial pressure than an actual threat to general businesses and people.

Once a zero day or backdoor has been used its burnt forever, nation state intelligent services need to be incredibly careful about when and where they use them. If one was to be placed in a Kaspersky product and used, that's Kaspersky burnt as a business forever, and with it the ability to use it as a vector for high value targets. They are not going to use a backdoor in a Kaspersky product for a general attack on people and business, at least not at this point. Realistically any high value target in the west isn't using Kaspersky anyway.

tuukkah• 4 years ago

more about sanctions/politial pressure than an actual threat

I think this would be one of their hybrid warfare steps (well) before actually going nuclear.

lozenge• 4 years ago

You seem to be assuming a lot of things, like that Kaspersky couldn't deploy certain updates to targeted customers? That malware will leave behind trails of how it got on the computer? That plausible deniability is impossible?

What happens when a definition update "reduces false positives" but actually lets in a Russian cyberweapon that is delivered independently?

c0l0• 4 years ago

I will go on the record here and one-up them, warning against the use of any antivirus product. SO many vulns and gaping, smoking holes in that kind of software over the years, it's not even funny. Faux-security is what most vendors are peddling.

https://twitter.com/GossiTheDog/status/1427935182200492039 is one of my favourite bugs from recent years. I acknowledge this bug is not specific to an antivirus product (but of course, Fortigate offers that as an optional component for traffic inspection - and I keep wondering what that sub-component's code quality is like 8-)), but anyone who tries WILL find examples for grave problems aplenty.

kevingadd2• 4 years ago

It's definitely reasonable at this point to just skip using AV. It won't protect users from bad security habits and it tends to make your system performance worse even if it doesn't have vulnerabilities.

I have Windows Defender enabled on my machines since it comes with the OS (and work policy requires it), but I definitely had to exclude most of my work folders to be able to get work done.

It would be nice to have software that specifically blocks ransomware by trying to detect it heuristically, but that would probably not be very effective and the right solution is just to have backups.

Helmut10001• 4 years ago

First I skipped using Antivirus altogether, but now I opted for intermediate solution using Microsoft's native Antivirus Defender. At least this is fairly guaranteed to be compatible with Windows itself. Regarding firewall: I don't trust Windows anymore - using an external HW firewall on my router (opnsense).

dspillett3• 4 years ago

to have backups

With the usual additional notes: unless you include an off-site, an off-line (or at least soft-offline) backup, and your backups get tested regularly enough, you don't have a backup system, you have aspirations & hopes!

----

For your valuable information anyway. For most individuals the core “it would really inconvenience my life if I lost it” data is surprisingly small¹, and the next layer (“losing it would really annoy me”) is only a few tens of Gb². For personal use everything else in the grand scheme of things can be reacquired or won't be massively missed, things are a bit different for businesses of course.

[1] password store, financial details & other officialdom, code & docs for personal projects that might come to something else [2] meaningful digital photos & such

charcircuit• 4 years ago

Malware writers make sure their malware is undetected by most antivirus software. Antivirus will not save you.

vladvasiliu2• 4 years ago

A new [0] feature in Windows is "protected folders", which denies access to specific folders (user-configurable) by default to applications, and the user needs to actively allow them access. The downside is that it's all or nothing, meaning that a given app either has access to none of those folders or to all of them.

You can do something similar with SELinux and AppArmor, and I think recent versions of macOS also have something similar.

---

[0] new to me, I'm only an occasional Windows user, for gaming, so it may have been there for a long time

londons_explore• 4 years ago

specifically blocks ransomware

If microsoft made the "shadow copy"/"previous versions"/"system restore" functionality a core part of the kernel that even someone with admin rights can't mess with (which it almost is already), then that could be used to roll the system back to 5 mins before ransomware infection easily.

qwertox2• 4 years ago

Most insurances expect you to have an AV installed.

polymatter• 4 years ago

Does Windows Defeneder not count?

sofixa2• 4 years ago

Sometimes even on Linux servers, where the best an AV can do is take CPU and IO so that there's less for the malware.

salmo2• 4 years ago

It’s also part of Windows hardening standards that are then pulled into compliance frameworks.

My company installs at least 3 antimalware/security management products that cripple, I mean, protect endpoint systems. 2 vendors. None of them are integrated with each other. So files and executables are all scanned 3x. Git runs abysmally slow because of all the processes involved and tiny files.

One of the reasons I run the paperwork gauntlet to run a Mac. Windows is crippled, Linux is banned on endpoints, so Mac it is. I have to run 1 AV, but it doesn’t do a lot. And I love apple kicking everyone out of the kernel over time (except VirtualBox, that’s annoying).

Luckily it’s mostly an application-level concern on Linux. Scanning files and such on file-servers, mail gateways, etc. ultimately protecting windows systems w/ normal user processes not all up in my kernel, and on limited systems. It actually kinda makes sense.

Now, commercial IDS/IPS, I don’t even want to know how those are architected. I haven’t touched an OSS one (Snort) in years.

If I won the lottery, it would be kind of fun to just sit and find horrific exploits in these things.

st_goliath• 4 years ago

Yes, basically this. On the one hand, being able to parse every protocol and file format under the sun in search for malware means high complexity and a lot of attack surface. On the other hand, being able to read every file, intercept all network traffic, or peek into any processes memory means pretty much highest system privilege level. Big attack surface and high privilege level are a bad combination.

And regarding the point that the BSI is trying to make here: A high privilege process with an auto-update channel back home (as modern software tends to have), is basically an extremely powerful backdoor. That's definitely not something you want to have installed across loads of systems across your countries industry and critical infrastructure.

It's funny that they apparently only realize this now. The same reasoning in the article can be used pretty much regardless of the AVs country of origin.

phendrenad24• 4 years ago

That's bad advice. It's a trade-off. Installing antivirus opens some security holes and closes others. It also adds heuristic analysis. It seems to me that the security world has come to the consensus that AV is better than no AV.

fsflover• 4 years ago

the security world has come to the consensus

Any links? If you really care about security of your OS, consider security through compartmentalization approach, which actually works. See also: https://qubes-os.org.

fphhotchips• 4 years ago

My favourite part of this tweet is the down-thread reply from the author:

"In fairness MSFT are really good in terms of web facing things, particularly security things." [1]

This, of course, aged like milk the very next month. [2]

[1] https://twitter.com/GossiTheDog/status/1427966653938143233

[2] https://www.paloaltonetworks.com/blog/2021/09/azurescape/

tablespoon• 4 years ago

My favourite part of this tweet is the down-thread reply from the author:
"In fairness MSFT are really good in terms of web facing things, particularly security things." [1]
This, of course, aged like milk the very next month. [2]

Being "good at software security" (in modern terms) doesn't imply not having any vulnerabilities ever, or even serious vulnerabilities.

t43562• 4 years ago

It's curious to look on at this situation from Linux. Perhaps I shouldn't be too comfortable but it's really a different world. I suppose that one should take care which distribution one uses as that is also an effective entry point for software from the outside but at least a bit more obvious and open than some AV company.

swiftcoder• 4 years ago

As a 25 year Mac user, I concur.

I'm just glad that Microsoft eventually decided to bring antivirus in-house, and I don't ever again have to mess with 3rd-party security products for my Windows box

Avamander• 4 years ago

Though some say that Windows Defender is one of the easiest AV's to bypass.

I wonder though if Microsoft Defender ATP and Virtualization-Based Security makes it more difficult.

jeroenhd3• 4 years ago

I'm anxious to see what the Steam Deck, one of the first popular, user accessible Linux computers, will do to the Linux landscape.

For ages now, Linux has been relatively virus free because let's be honest, Linux is either used by just a few nerds (who are often just a tad harder to trick than the tech illiterate) or by servers, for which entirely different classes of malware exists.

With effectively no antivirus protection, either because of a lack of options or because the outdated mantra that "you don't need it" because of some peculiarities that Apple used for years to deny the existence of macOS malware, Linux users are bound to run into viruses sooner rather than later. Hackers that are after Steam accounts will definitely try their hardest to infect Linux desktop users.

My best hope is that the way Linux distributions are woefully incompatible with each other will protect the hardcore Linux users somewhat from the viruses that will inevitably be spread across the "common" Linux environment. I'm sure we'll see Flatpak/Snap viruses down the line, but for a short while, we'll hopefully still have time to see where the Linux landscape is headed.

ajsnigrutin2• 4 years ago

The biggest benefit to being "virus free" (even though it's not), is the package management. On windows, most software installs, updates, etc., rely on you executing a random .exe file, downloaded from some random page online, while on linux, you trust the team of maintainers (who usually know what they're doing) to keep repositories relatively safe.

The same idea came for apple and google, and their software stores, but google mostly fucked it up by allowing a "flashlight app" to access your contacts and gps location, and apple fucked up by not allowing you to sideload a program at all, even when you know what you're doing and trust the software.

ho_schi8• 4 years ago

I've the users act right and use the package management and Steam, they will be fine. If the users decided to "save money" with warez, cracks and black market software they will suffer. And Antivirus software is available for Linux but only competent administrators use it, were needed.

vladvasiliu2• 4 years ago

The potential issue I see on Linux is the spread of third party distribution channels, like npm / pip / etc, which also tend to undergo much less scrutiny than official packages.

Sure, if someone gets root on my Linux PC, they could do a lot of damage. But my most important things are parked in my home folder, which any old script running as my user can access without any problem. No need for privilege escalation or other fancy things.

AppArmor and SELinux can probably mitigate this, but I don't think they see particular widespread use in "default deny" mode.

phendrenad24• 4 years ago

Linux is very secure by default, if you stick to open-source software and install it from the distro package managers. What I worry about is when Linux becomes more popular, and commercial software is ported over, and people start pirating it. The door is wide open when people start typing their root passwords into keygens. I expect the Linux world will have a revelation where they discover the power of AV.

ho_schi8• 4 years ago

I warn about using any kind of snake oil.

Often sold under the marking terms "antivirus" or "personal firewall" or "cloud cyber security". Known side effects of this treatment are high CPU load, high RAM consumption, drain of battery power. Sometimes they also consume your money or looking at your data. So far I would consider other counter measures, like applying user rights, proper package management and re-consider your decision using this random stuff from the internet? If you're forced to use Windows the one with the least known side effects is Microsoft Security Essentials but even this has several drawbacks. If you're already using Linux or some kind of BSD you probably applied already these measures accordingly.

PS: This doesn't mean you shouldn't make sane use of software looking expectantly for malware. If your are a server admin and hosting a mail server which faces random stuff from the internet it makes sense to filter out bad stuff. And it won't spin up the fan of your laptop or drain its battery.

hutzlibu3• 4 years ago

"If you're forced to use Windows the one with the least known side effects is Microsoft Security Essentials but even this has several drawbacks."

But permanently disabling it is very, very hard.

midasuni• 4 years ago

But permanently disabling it is very, very hard.

I installed linux in a new machine just last week

vbezhenar• 4 years ago

Intellij Idea recommends to exclude directories related to project and IDE from MSE. I think that's a reasonable compromise between performance and security.

nisa2• 4 years ago

Actually it's not. Just add an exclusiun for C:/ - it still hogs some memory but the i/o drawbacks are gone. There is probably also a way to let it scan Downloads only but I didn't found it yet. In this configuration it still scans USB drives.

gandalfian• 4 years ago

Though actually I installed kapersky free edition on an older comouter because it was fairly light and well behaved. Has a good reputation for catching things too. But yes I should really think about removing it now and I'm sure we all have sympathy for the trusting victims who paid to upgrade their bundled mccafee/Norton/sympatec and were worse off for paying extra....

jeroenhd3• 4 years ago

Anti virus can be very helpful in corporate environments if set up right and managed by knowledgeable people. Those people are expensive, but they're life savers when John from marketing clicks the "enable editing" button in a spreadsheet he just received from a spoofed email address.

The problem with corporate security is that security vendors often try to shovel as much crap onto your network as possible, rather than set you up with the security system you need. It's not hard to set up a company wide system that shows all green checkmarks and has tons of tray icons running to assure upper management that everyone's computer is now secure, especially with duplicate features and multiple daemons that a talkative sales rep might try to slip in for that sweet commission money. You also need someone competent to look through logs, keep checks on what's going on, and not get fired or demoted if they don't report anything new (because if you're lucky, there's nothing new to report).

For smaller businesses, the best you can do is hope for the best, really. Keep your consumer AV running and try to stick to common security advice, because there's no way you'll be able to get much use out of common business AV products if you don't have someone in your company who knows how to use those tools.

For consumers, Windows defender is often a decent balance. It's pretty good at detecting viruses, doesn't get in your face all the time, and although there's definitely a performance impact, it's low enough that office work shouldn't be affected by it too much. As a dev, I hate how much it gets in the way of many applications (especially those accessing many small files, like compilers), but I realise that this isn't exactly the most common workload for AV.

progx• 4 years ago

No problem in a company, where spreadsheet not have root access to everything.

ho_schi8• 4 years ago

Will be difficult. Most people are trained in a way that . "Antivirus" means "Ass covering successfully applied. I'm no longer responsible!".

The "antivirus" was sold as solution to the MBA people for thirty years and computer magazines told the consumers the same wrong story. I've seen arguments like "ISO27001 requires us to install an antivirus on that application servers". Suddenly you see "undefined behavior" on the same application server. Guess how get's blamed? Not the responsible people.

When we see weird issues on customers systems "Please turn off antivirus" is in a high number of times the solution, suddenly defined behavior. The problem with antivirus software is that it is the actual implementation of undefined behavior.

I'm not a network admin! John from marketing should be in an isolated VLAN or something like that? Only access to an departed internal file server? Because it will fail. Maybe there is JavaScript in the next spreadsheet and Microsoft Security Essentials is happy "JavaScript? Let me see. I want put my nose inside!": https://docs.microsoft.com/en-us/security-updates/SecurityAd...

Failure will happen in general computing and the systems need to be resilient about that. The other approach is what we see in mission critical systems? Multiple parallel instances if possible, no unchecked updates, no random software, only input through defined interfaces.

boopmaster• 4 years ago

Working on a large corporation, I liken our AV deployments and endpoint security as the invisible hand of productivity destruction. I’m not saying these products don’t block malware, I’m not disagreeing with you at all.

It should be stated that, with a high degree of confidence, deploying these measures against your internal employees personal systems and cloud deployments WILL invariably lead to the destruction of employee output and system performance, when things inevitably do go wrong and whole operating systems are hosed if not obliterated.

Back up your data folks +Your environments +Your passwords.

It can take weeks to get back up to full speed when your system dies to AV or anything else.

elesiuta2• 4 years ago

I agree with the snake oil sentiment, and wanting a tool to monitor connections on a per application basis but being dissatisfied with everything I found, I wrote my own (https://elesiuta.github.io/picosnitch/).

Only then did I discover that creating any sort of tool that is running on the same machine it is supposed to protect, if malware is also on said machine, is basically a fool's errand.

I tried to overcome as many of the pitfalls as I reasonably could, but reached a point now where the best approach is to just document any remaining limitations and some of the other counter measures you can use.

protoman3000• 4 years ago

What about Telegram?

hutzlibu3• 4 years ago

The client is open source, so should be quite safe and the company is not based in russia. But I think some servers are?

In either case, it is not a medium for secure communication anyway.

I use it more as a open forum software.

tonyedgecombe• 4 years ago

In either case, it is not a medium for secure communication anyway.

The problem is it is running on your machine.

nonrandomstring2• 4 years ago

I'm reading this as I am giving a class on Stuxnet this morning.

We're doing worms and multi-stage malware. But inevitably the conversation turns to national boundaries, cyberwar, collateral damage (to individuals, hospitals, power plants, companies..). My students want to understand the relations between companies like Microsoft and the NSA, what happened to Siemens from the economic fallout, why the Iranians would be running Windows? Who paid to clean up the tens of millions of infected machines out there? I keep getting questions that begin "Bit surely....?"

We've been through an unprecedented period of human history in which the internet brought us together. That time is over.

The fact that a Russian company could trade freely in the world such that American companies, only within a decade of the Cold War, would use Kaspersky (which I believe is an a good product) is absolutely remarkable.

It's what Richard Buckland called "A miracle of interoperability" that allowed a movie made in Hollywood to be recorded on a DVD manufactured in China to run on a player assembled in India, according to standards designed in Nederlands and Japan, playing in a home in Australia.

That level of trust and cooperation has to run both ways. It's at least as remarkable as Russians, Chinese and Iranians running Microsoft Windows. The internet delivered on much of its promise to unite the world. But what I've seen in the past 5-10 years is so much effort by everyone to _undo_ that trust. Greed and surveillance capitalism has played as much a part as gobernment intelligence over-reach and economic warmongering. All parties have abused trust and now we are withdrawing into silos again.

From a business perspective, maybe we'll need to reckon with a future more centred around domestic sales and use. Perhaps the "splinternet" is just the beginning of a global divergence at the protocol level.

How can we (proponents of a true INTER-net) avoid this?

ganzuul• 4 years ago

Decentralization from meshnets up. The user agent needs to handle the entire electronic presence, establish the identity of it's user, and keep watch on its friends like a herd.

anon_123g987• 4 years ago

[...] "A miracle of interoperability" that allowed a movie made in Hollywood to be recorded on a DVD manufactured in China to run on a player assembled in India, according to standards designed in Nederlands and Japan, playing in a home in Australia.

Well, it can be played in Australia only if its DVD region code is 4, and it cannot be played in any other countries you mentioned, which are all in different regions (USA: 1; China: 6; India: 5; the Netherlands and Japan: 2). So there's that. "A miracle of interoperability."

https://en.wikipedia.org/wiki/DVD_region_code

nonrandomstring2• 4 years ago

There are people who make things. And people who break things. Each have their time. We are living in an age where the latter have the upper-hand. But it will pass and we will build new monuments on their bones.

severino• 4 years ago

So they basically say Russia can spy on you if using Kaspersky (but the German government, or its "allies", can't). Then, I guess that using Kaspersky is a wise decision unless you happen to live in Russia or Ukraine. Dowloading ;-)

waihtis3• 4 years ago

It’s been interesting to note how Kaspersky has been responding to the scrutiny. It’s almost always the same - ”we have been audited a huge amount of times and no-one has ever found anything!”

It’s suspicious because as someone who is a vendor of risk management, they’re leaving out the gaping hole fact which is that software is updateable and oftentimes AV will do so automatically. Potent risk is pretty huge.

Same applies also to the Huawei discourse.

nisa2• 4 years ago

But this applies to any software that has auto-updates. Can we be sure that Microsoft/Google/Apple don't sign backdoor updates for the NSA for specific targets? As far as I know these national security orders are non-public and we don't even know if it's happening.

But Russia used Ukraine in the past as "playground" for cyber attacks: Some mandated tax software auto-update was hackend and delivered a ransomware trojan without any chance to pay i.e. pure data destruction.

waihtis3• 4 years ago

No, it doesn't. Because not all software companies can be a) under influence of a foreign government potentially hostile towards yours and b) software has varying degrees of replacement difficulty.

Example - building an entire smart city network on top of Huawei network gear. It would be very difficult to rip it out and replace on a whim if China suddenly decided to side with Russia in a war against the West, which is literally a possibility floating in the air right now. End state - you have a hostile actor who has access & control of your critical infrastructure. ¯\_(ツ)_/¯

sofixa2• 4 years ago

Same applies also to the Huawei discourse.

How? Huawei routers and switches don't auto-update.

alexklark2• 4 years ago

Their whole range of management software do.

oldgradstudent• 4 years ago

Assume, just for the sake of argument, that Kaspersky has no back doors and no connections to state organs.

What would you, as Kaspersky CEO, would say?

lizardactivist4• 4 years ago

How else should they respond? And almost all software today is updateable, and many do so automatically per default. What is your argument here exactly?

waihtis3• 4 years ago

The point here is - don't build critical functionality via companies that are under the thumb of foreign superpowers.

"But what about USA??" I don't expect Europe as it is now to be in hostile terms with USA. But the principle would of course apply if that started being true.

aszantu• 4 years ago

clamwin is actually light weight and nicely unintrusive

schleck83• 4 years ago

And has notoriously bad signatures afaik.

nivenkos• 4 years ago

Why are they even using Windows?

The US is not an ally either.

phendrenad24• 4 years ago

Germany is one of the oldest NATO countries. Of course the US did supposedly intercept the Chancellor's phonecalls or emails or something, but it seems like not much ill-will was generated as a result.

lizardactivist4• 4 years ago

Not supposedly, definitely. And I think the fact that they actually did something like this is very concerning and shows two things: they are very deep inside EU computer and network systems, and that they do not truly consider the EU as an ally.

hnbad• 4 years ago

it seems like not much ill-will was generated as a result

That's because any ill-will at a government level would have been futile and disproportionate. There was public outrage at the wiretapping but largely the general assumption seems to have been that the US intelligence operates freely in Germany. That US intelligence services engage in surveillance against even close allies was an open secret and most likely widely known among German intelligence agencies and possibly the government too.

Historically, Germany post-WW2 existed at the whim of the US, France and UK. The governments of the occupation forces in the territory of West Germany had special legal rights based on contracts pre-dating and superceding the German constitution. Officially most of those special provisions expired but there's nothing in the original contracts requiring any successor contracts to be publicly acknowledged so depending on how much you like tinfoil hats, it's entirely possible that the US still holds a legal wildcard in German law.

And even if the US had no special legal exemptions, what would that ill-will translate to? Germans opposed the invasions of Afghanistan and Iraq but the German government continued to operate as usual, to the point of participating in "peacekeeping" during the military occupation following the regime changes.

Sanctioning the US would be economic suicide. Despite the outrage about human rights abuses, Germany still isn't sanctioning China. Russia got away with various abuses and even political assassinations without actual consequences because Russian gas was an important import. And the US not only dominates large parts of the German economy but also its culture.

throwaway4good2• 4 years ago

Seeing that the west just killed off payments in the Moscow metro, stopped security patches for Cisco networking equipment etc. etc. There is a bit of projection going on: We fear that Russia might do to us, what we just did to them.

But what is the end result of this? Any "potential enemy of the west" will have to do their own tech, and we will only use our own stuff. Sounds like a bad trade for us; instead of selling all this stuff we have already made for a nice buck, we now insists that everyone makes their own.

EugeneOZ4• 4 years ago

It would be a legit thought if Kaspersky (company and the owner) wouldn't have direct connections to FSB.

throwaway4good2• 4 years ago

In the same manner, you can easily connect any of the big US tech companies to the US intelligence services or military.

losvedir• 4 years ago

There's a lot of anti-antivirus sentiment in these comments, and while I, too, hate AV and have grown up with it being nothing but snake oil, I wonder if that's still correct in the current era of "zero trust".

I think we've learned that corporate firewalls and VPNs don't really work all that well. In other words, if you can't rely on a safe boundary to the outside world, how do you ensure individual corporate machines are not compromised? What about newer software like Crowdstrike?

What do the big tech companies like Google, Microsoft, Meta, etc do on their employees computers? Do none of them use antivirus?

jeltz• 4 years ago

I feel traditional antivirus software is the very opposite of zero trust. It runs at a very high level of permissions and intercepts almost everything.

viraptor4• 4 years ago

https://www.microsoft.com/security/blog/2018/10/26/windows-d... There are of course still some occasional issues, but the scanning is pretty restricted these days.

einarfd• 4 years ago

With the fast moving legal landscape in Russia this seems like a smart move. Given the new laws getting added in Russia now, a law coercing Kaspersky to help the Russian government attacking its customers that Kremlin sees as enemies. Do not seem that far fetched.

alexklark2• 4 years ago

Kaspersky is indeed FSB controlled, lot of proofs of that in last 10 years, but of course they will not just upload all your data or brick PC in revenge for sanctions (well may be they will if told nuclear war has been started). They will behave according to the agreement, and just let FSB peek a bit for data they legitimately getting. Same as Microsoft / Google / Apple / Amazon etc. relationship with multiple US spying agencies.

Terry_Roll• 4 years ago

The illusion of cybersecurity is finally being questioned.

AV scanning emails has been a phishing scam for decades which benefits the criminals.

Because so many people have worked on so many parts of a computer beit the hardware or software, who do you trust when you dont trust random strangers in the street and people like to gossip and spread rumours? Is this a classic case of cognitive dissonance or just shows giving money for something makes someone/something instantly trustworthy when their own survival comes before yours?

_the_inflator• 4 years ago

This ban on Kaspersky in software is similar to the US ban on Chinese Huawei for 5G.

What I am really waiting for is a ban on cloud services like Github. Since Russia is now basically even more rogue than Iran, I bet something like this here is in the making: https://techcrunch.com/2019/07/29/github-ban-sanctioned-coun... And it's reversal till this day: https://github.blog/2021-01-05-advancing-developer-freedom-g...

Cybercrime is still a thing in Russia.

lizardactivist4• 4 years ago

The same warning obviously applies to all the American AV vendors, given what we have learned in the last years. And this is not idle speculation and baseless accusations, it's right from the inside part of the NSA and CIA leaks.

So what is one to do? Where is the free open-source AV the world needs, which has the same number of highly skilled full-time developers and researchers as Kaspersky does?

There really needs to be a global AV effort and software, funded by governments, but open and transparent, and based in a country which does not sit in the shadows of over-reaching spying agencies. But what will it take for this to happen?

Maxburn• 4 years ago

We supply servers running some proprietary control software and a school district put Kaspersky on it after receiving it. We mentioned to them we can't be involved with that product anywhere because of our companies involvement with DFARS, and frankly we are surprised they were able to get away with using it being a government organization. Still there though, guess they just don't care.

GrumpyNl• 4 years ago

What do you guys recommend? Windows defender or?

lizardactivist4• 4 years ago

I always recommend Kaspersky, as it's one of the best AV suites out there, and because there is still no proof whatsoever that the Russian government is "inside" KAV.

slenk• 4 years ago

What makes it the best over other options? Windows Defender turned on plus a firewall protects like...everything.

schleck83• 4 years ago

Bitdefender is the most recommended other option. Sophos and F Secure are good too, so is Emsisoft and G Data. Depends on who you want to share your data with and how much you are willing to spend. Emsisoft is the least bloated option, they don't include all the password and vpn nonsense.

loufe• 4 years ago

I am not an IT professional but a bit confused by how many completely negative views there are here on AV use. I have a NOD32 license and at least twice per month a url is blocked while browsing in an unobtrusive way by the software, which makes sense as may have contained malicious JS or something. Maybe it would've been caught by ublock afterwards, or may have been caught by MS defender as well, but I like the assurance provided. You can argue that I'm browsing in an unsafe manner but I doubt many of you restrict your browsing to strictly "safe" chunks of the internet.

lpcvoid• 4 years ago

The point is that the AV does not do much here. The security model should be proper sandboxing within the browser, along with block lists that get used by ublock origin if you wish. A third party program running alongside your browser, inspecting the URLs you visit (possibly then via TLS certificate MITM?), is just a weird way to think about security in my opinion. Not even talking about the potential new attack surface that may be introduced in some way.

DavideNL• 4 years ago

What anti-virus (if any) does one recommend their 60 year old parents on a Macbook...?

fomine3• 4 years ago

Aside from avoiding Kaspersky on important division in western world is practical, I wish Kaspersky survive. They are great about detection and analysis and not based on western world.

German Government Agency warns about using Kaspersky

Related Stories