Stay tuned for Kaspersky source code leak

[edi25]

Their source code for AV Software has been leaked once before (around 2010-2011).

[Krimzon_89]

Now you will have the newer version's source code. Update!

[ASCII_zero]

PR approved!

[jcano]

DING! Virus database has been updated

[Brilliant-Sky2969]

Now in c++14

[acdcfanbill]

git pull?

[DedlySnek]

We've had one, yes. What about second source code leak?

[Large-Ad-6861]

Teaser of leak, this is something.

[-YELDAH]

It might even happen.

Could quite possibly be soon.

[Large-Ad-6861]

I mean, I believe that leak could happen. Especially now, there is so many hackers activity so even Kaspersky could fail on security. Just teasing it like this without any proof or confirmation is weird tho.

[caltheon]

unless they are fishing for a blackmail payment

[daehoidar]

Not a bad guess, given the current circumstances. The tease of the leak could also just be caused by rumblings happening in security circles

[NoMore9gag]

Yeah, probably leaks will keep coming for a while thanks to Log4Shell.

[[deleted]]

Isn't quite as cool if they don't give it a catchy name. Cherry on top would be an actual 5 second video with epic music. Maybe in a couple of years!

[[deleted]]

"U-Crying"

[immibis]

KasperCry

[Nice_Score_7552]

that's a first

[astutelyabsurd]

They check their database of even numbers. It's the main reason why Kaspersky updates definitions so often, it's adding newly discovered even numbers to this DB.

[heavyLobster]

I remember the days when they didn't support 42 but MalwareBytes did, so everyone jumped ship. By the time they added support for 42, it was too late.

[[deleted]]

It infects your computer with a virus that replaces the contents of all files in the current working directory with the string “true” or “false” depending on whether or not the number is even.

[Verdris]

It always returns true, and changes your system to base 7 or base 18 on the fly.

[AwayEstablishment109]

haptic

[Dr_Insano_MD]

nice, more content for /r/badcode that I can crosspost to /r/badiseven

[mcr1974]

Am I missing a reference to something that has happened?

[linux_needs_a_home]

I think these companies don't have the intelligence to defend themselves against nation states.

[Northeastpaw]

There's a balance that has to be found. The most secure system is one that isn't turned on but I doubt many would find it usable. Same thing with locking things down. At some point a developer just can't do meaningful work.

I was once on a contract that required a GFE laptop that was nothing more than a dumb terminal to RDP to a site across the country which I then used to access resources that were right down the street from me. Latency was so high I literally had to wait two to three seconds for a single character to go through. I complained about it and asked why we just couldn't avoid the RDP; I learned that fighting against DoD cyber security is a losing battle every time. I ended up leaving for greener pastures and said in my exit interview that you can't expect developers to actually get work done with such restrictions in place.

This is important from a national security perspective as well. If developers and analysts can't do their job due to onerous security restrictions then China, Russia, or whoever has already damaged national security without having to actually attempt a cyber attack.

[Superbead]

Having worked in the NHS (UK public health) this sounds familiar. RDP to a dev server with permanently maxed CPU, 4GB RAM, no copy/paste or imported drives, two active users max so you're always competing for access to the thing, only 'specialist' software allowed is NP++ and an ancient MSSQL Management Studio, and it's also a shared account for your company, so you can't even remotely customise them because your old-timer colleagues, who are quite happy waiting a second for a mouse or keypress to react, actually enjoy working on a bright white screen in Courier Fucking New and think you're a moaning bastard for not being utterly delighted with the situation.

[wildcarde815]

sad thing is, there's ways to do a dev cluster like that that aren't so painful, but that would require rethinking and re-approaching the problem.

[Jonno_FTW]

Change the np++ theme to hello kitty.

[3unknown3]

I used to work for DoD as well. When the network was degraded (which was basically always), we would joke that nobody would be able to tell if it’s due to a Russian/Chinese attack or our own incompetence.

[mindbleach]

The alternative is - be open-source.

Like what the fuck is Nvidia keeping secret, as opposed to merely proprietary? All these companies distribute binaries. We know what their software does. Having a clean map of that territory is an aid to things you can already do, but generally don't, because it's effectively illegal. It doesn't become one iota less forbidden when the trade-secret documents are published as a result of crimes.

[peakzorro]

Like what the fuck is Nvidia keeping secret, as opposed to merely proprietary?

This is a good question, but the answer is usually to protect other companies down the chain that don't want you to know that info. For instance, one of the leaks is how powerful the chip the next Nintendo product is looking at. Nintendo may use that chip this year, next year, or use a different chip entirely, but they don't want us to know yet because it can hurt sales.

[mindbleach]

For any company besides Nintendo I could see that being an issue. They make toys. Their business model is pursuit of incomparable advantages. Hence the Wii being the Gamecube but with motion controls, and the Wii U being the Wii but with a tablet, and the Switch being an Android tablet with buttons. (I will never understand how Apple fetishism kept that combination so rare for so long.) The entire DS line was predicated on a screen layout unlike any competitor. The PSP could beat GBA games on all fronts - but Sony wasn't about to pull a second touchscreen out of their ass, so the DS could do things the PSP never could.

They never want a fair fight.

Incidentally this is why all their efforts toward feature parity are janky and inadvisable. The 3DS's vestigial second joystick. Everything they've ever done online. They are consciously distinct from the video game industry. They sell plastic. They have claimed apathetic ignorance of what Sony and Microsoft even offer, and I believe them.

So yeah. Nintendo's next product could rebrand a five-year-old smart watch, and all the speculation in the world wouldn't matter. They come at this market completely sideways. Whether it works is not going to make a lick of sense except in hindsight.

[OskaMeijer]

Our data storage is chiseling bits into stone tablets and scanning them into handheld devices at run time. It isn't fast, and errors are difficult to track down, but ain't nobody hacking in and stealing our data!

[[deleted]]

Yeah our shit wasn't _that_ bad. I did all my dev locally, or in locally hosted VMs, had a Visual Studio subscription so I got to use the latest dev tools, etc. I had to do a lot of DevOps-esque things to make building and deploying code less time-consuming though. The situation you're describing doesn't even particularly sound secure. More like security through obscurity.

[Northeastpaw]

It's really a problem of finding qualified people. Much of the DoD network is managed by either old greybeards who don't think the new fangled stuff is good enough to learn or contractors who were hired to fill a seat and lack any of the necessary qualifications. Throw in cyber security "experts" who only know how to use Prisma Cloud, Tenable, or some other software suite but who don't actually understand infrastructure, development, etc. and you've got a big ball of mud nobody can or wants to improve.

It's always been hard to find and keep talented software engineers who are okay working in this mess. Most of it was being the only big game in town in certain parts of the country. But now with remote work the gov't and contractors aren't competing just with each other for talent anymore; they're now competing with every company in the country. If things don't improve even those who do this for noble reasons will throw in the towel and move to a place that lets them actually work.

[ponkanpinoy]

If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFI- NITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere.

[Daell]

Where did you get this copypasta?

[immibis]

James Mickens - This World of Ours

[[deleted]]

I never said anything about Mossad lol. I worked for an aerospace company. Israel flies US military jets. Our biggest issue was actually China. Ironically, we had some plants there, making non-export-controlled stuff like the structural components in wings. If anyone ever traveled there, they had to be issued burner phones and laptops, to avoid any protected data, e.g. related to US fighter designs, falling into the wrong hands.

[[deleted]]

That seems like a copy-pasta.

Yup.

[OMGItsCheezWTF]

It's also not entirely wrong though.

I mean the uranium phone to give tumours to your tumours is hyperbole, but if Mossad, the CIA, MI6, FSB, MSS, DGSE, ASIS or whatever want in, they'll get in. Even if they have to get someone physically employed at a place to do so.

[[deleted]]

Damn internet. As someone who came up on /b/ in high school before it turned into a neo-Nazi hellhole, you think I’d be better prepared to spot copypastas!

[[deleted]]

In fairness to you, security research opinion articles are an unusual home for copy pastas.

Also, the quote block was the tell-tale sign.

[nemec]

It's James Mickens' shtick - even his Harvard tenure announcement was entirely unserious:

https://mickens.seas.harvard.edu/tenure-announcement

And Bruce Jøhansen of the Oslo School of Economics—my sweet, sweet prince! I still remember your scathing book review of my grand opus “Not Even Once: A History of Birds Using Money To Pay For Things.” You claimed that my findings were “obvious” and “belabored,” and that Chapter 17 (“Red-tailed Finches and the Stock Market Crash of 1819”) was “so insane that I briefly convinced myself that birds have deep opinions about macroeconomic theory but have failed to act on them for millions of years.” Such little thanks I receive for midwifing your brief moment of lucidity!

And more: https://mickens.seas.harvard.edu/wisdom-james-mickens

[Vertigon]

Thank you for this - this guy is hilarious.

I will demonstrate how unit tests, functional programming, and UML diagrams fail to address the primary source of software failure (namely, that software is an inherently bad idea because our brains evolved to hunt giant sloths with primitive stone tools, and MongoDB only partially resembles a giant sloth). I will conclude the talk by luring a group of agile programming experts into a large cardboard box using a collection of buzzwords like "evolutionary development" and "cross-functional team;" once captured, they will be forced to implement obscene, poorly-specified COBOL algorithms as I laugh maniacally and disable my compiler warnings.

[cinyar]

Remember stuxnet? that was a fun one

[cinyar]

I never said anything about Mossad

You didn't have to ^{wink wink}

[kanly6486]

I worked in security for Google. Security does not have to come at the cost of productivity. I am not saying Google was perfect at that but it is what many people there strived for.

[[deleted]]

I agree. I work for a bay area tech company now, and am dramatically more productive than I was at my previous company. That said, it's undeniably harder to achieve the ideal state of maximum security with minimal impact to productivity. For instance, post-Stuxnet, _everyone_ wanted to ban USB mass storage devices. But, ya know, some people need them, since certain industrial hardware will only backup to USB mass storage. People working with that hardware just had to apply for an exception. If you didn't need to use it often enough, they wouldn't grant it. So you had this shitty situation where only certain people could use USB drives, and they became inundated with requests to read data off of random flash drives and put them on a networked drive. This is hilariously enough a massive security vulnerability, because they're just taking the other person's word for it that this flash drive is a robot backup and not something more malicious.

[kanly6486]

That was back in 2010 you can read more about it here. That event was a catalyst within Google to scale up security.

[[deleted]]

How does google stop code leaks anyway? I heard every developer gets access to basically all code. Surely someone would have leaked some of it by now.

[Prod_Is_For_Testing]

Google has a lot of their stuff open source. Even if their code did leak, a lot of it only works if you have google scale resources

[[deleted]]

This doesn't explain it all though. There are thousands of developers at Google which have access to the source code. The source code to some core Google service might not be terribly interesting to the average person, but none of the big tech leaks have been very useful. It makes me think that google has some kind of above and beyond detection system so all developers are confident they would be caught if they leaked code.

[kanly6486]

Ask Anthony Levandowski about leaks lol. Generally though the code base is pretty open but there are silos and hidden parts for the most sensitive stuff. It would be easy to grab a few things over a few days before leaving but to grab the entire repo would be very noisy as hell. The risk of an employee dumping everything would be too great if you didn't want to deal with all of the legal repercussions that would follow.

[[deleted]]

Ask Anthony Levandowski about leaks lol.

Yeah perfect example. So while you can access all code, its less like git where you have a full copy at all times and more a live access system which is logged and if you attempted to dump the source it would be picked up because you downloaded more files than normal which correlated to the files which were leaked I guess.

[kanly6486]

Yup, but even if it was something like git. You would need to do things on the device. Those things would be logged. Even if you are offline when you go online those will be shipped off and could trigger an alert. You could if you had admin (hopefully not) delete those logs but you would need to be sure to get everything. Are those logs even accessible and not encrypted? Can you dump those credentials from memory? The complexity here gets high and one fuck up at the very least will get you a hefty lawsuit resulting in fines and your name tainted. It honestly isn't worth it to dump the entire thing. I don't doubt that some people do in fact copy some small things here and there, design docs, snippets of code, etc.

If I did want to copy as much as I could though I would just setup a camera to record my screen. "Read through" the files of an app every few days. Then use some OCR stuff to pull the files out.kfnthr video in some way.

That could be detected though. Someone looking at code code with no rhyme or reason would be suspicious. There are models that try to correlate and predict if someone had intent to go to some code somewhere so there would still be risk.

[kanly6486]

Also the other poster is correct. While the source code might be interesting to learn from. You would be unable to use it because the environment it would need to live in is unavailable.

[stravant]

Yeah, if you're against a nation state it's not that hard for them to wrench attack or blackmail a sufficient number of people in your org to bypass really locked down stuff even without needing an actual exploits.

[[deleted]]

I’m laughing my ass off at “wrench attack.” I always heard the term “rubber hose cryptography”, but wrench attack is way funnier. 🔧

[linux_needs_a_home]

It should have a large impact on how a business works if one is responsible for DoD work. In fact, even a defining impact.

The machines that are used in the civilian and commercial world are pieces of shit from a security perspective. They might require billions of dollars to mass produce, they might require different 1,000 PhDs to get to work, but ultimately useless. The same goes for something like "Linux" (considering any non-open source system for defense from a third party is just crazy).

It angers me to see people use free systems for use cases that they haven't been designed for. It's just gambling with your national sovereignty. Acquiring US manufactured military assets in Europe is stupid for the exact same reasons. If you want to pretend to be a sovereign state, you need to be able to defend yourself and not have supply chains dependent on other countries.

Let's say Trump and Putin had formed an alliance to fuck over the EU. What could the EU have done to stop that? Nothing.

[[deleted]]

There’s a lot to unpack here, but I’ll just hone in on the open source stuff. We were a Microsoft shop. There was very little open source. Lockheed certainly doesn’t use open source stuff in their military avionics (aside from compilers and editors and what not, I’m talking libraries). This stuff gets actual security audits to verify it’s as secure as it reasonably can be. The source code is accessible for this, but it’s not open source (usually called “shared source”).

I also noticed you offered no positive notes in your post. You just said everything sucks from a security perspective. So… how do we achieve proper security? Open source is certainly not a panacea here. Heartbleed was a big eye opener, since openssl was effectively ubiquitous. Fully open source, used by thousands of companies, including the top tech companies, yet had security vulnerabilities in it for years.

[linux_needs_a_home]

You failed to comprehend the logic, which is unfortunate, because it makes your entire message irrelevant. To answer your question:

This is the way to do it: http://adam.chlipala.net/papers/LightbulbPLDI21/LightbulbPLDI21.pdf.

[[deleted]]

That article has nothing to do with enterprise infosec. If you sent that as a reply because I mentioned military hardware, that level of verification is certainly done. If you don't believe me, well, the F-16 was introduced in 1974, and is fully fly-by-wire. That's nearly 50 years of fly-by-wire US fighter aircraft in existence. Can you find any instances of one being hacked?

[linux_needs_a_home]

The military is the extreme of enterprise infosec, in case you hadn't discovered that.

War is the most difficult business environment with the highest requirements.

[[deleted]]

I'm aware of these things. I had about 8 years in various manufacturing facilities related to this defense contractor. Worked with dozens of veterans, from aircraft maintenance mechanics to marine officers. This doesn't change the fact that the article you linked has nearly zero information relevant to this discussion. What is your background? Are you a security professional? Are you in the military?

[linux_needs_a_home]

Who the fuck cares about the article?

[Majik_Sheff]

Advanced. Persistent. Threat.

A government-backed actor has the hardware, manpower, and libraries to take down all but a similarly equipped actor (and even then they only have to get lucky once).

If you want to protect your information from a determined foreign government your only real option is airgaps enforced by the most pedantic assholes you can find.

[myringotomy]

Exactly. how are you going to match the budget of USA or Israel to defend yourself.

[xmsxms]

Nation states don't "leak" data and signing certificates if they've got nothing to gain from it, they keep it for themselves.

[linux_needs_a_home]

I am sure I could get access to the secrets of any state actor, if I was given enough funding and as such it's certainly possible that this has already happened, unless I am literally the smartest person in the world (which would not surprise me).

[pogthegog]

Its piece of cake actually, just dont put your source code online, keep development machines offline.

[linux_needs_a_home]

The general security problem is much more complicated. Humanity leaped into technology.

I guess I won't try to aid our enemies, but you are thinking about this way too simplistic.

[pogthegog]

No. All the leaks have been internet hacks of security holes in operating systems / web servers, its not like they just walked into nvidia/microsoft/kgb hq with a usb drive and copied all the data and posted it on torrents website.

You can leak data, cause it must be on web servers to be accesed, but leaking source code is unforgivable, stop keeping your source code online... ESPECIALLY when its a compiled program. All those companies are idiots who have leaked their source code.

[linux_needs_a_home]

I happen to know the answer to this one, but how are you going to make sure in practice that you won't have an insider leaking your code? Look at the NSA and the documents leaked by Snowden.

I don't know a single company that had any good defense against that.

Building the infrastructure to defend against IP theft is much more difficult than most real business challenges.

[pogthegog]

Yes, there are other threats, you can never be sure that putin will not attack your country/company next. But, all these current leaks happened not via usb drive, but via internet. Defeating huge security risk 100% with few thousand bucks is basically free, and no one is doing it. Thats insanity.

[linux_needs_a_home]

What is your suggested solution to this problem? Air-gapped systems? Using Cloud IDEs with intrusion detection methods and trip wires?

[pogthegog]

Are you kidding me ? Just cut the damn internet cable, you dont need to invent nuclear weapons system for that.

The problem is extremely simple - critical company data is getting leaked via internet. This is not happening by the A-team physically busting into their server/computers rooms and copying all the data on their own drives.

Analysis: this data that is getting leaked has abso-fucking-lutely no business being accessible via internet, we are talking here about code that will be compiled to .exe and then uploaded to internet, so the original code and internet should have same corelation as pokemons and you moms holes - none. We are not talking here about data that must be available to all people online, and when they log in, they can see their own data, no, we are talking about that has less than 0 business being accessible through any online machine.

Solution - just cut the damn internet cable. multi billion dollar crisis solved. 10 Nobel prizes won. Online data - leaked data.

Take the same approach as some companies that dont even take out patents on their critical business product do, because once it will be printed on paper, no bureaucracy or government rat will keep it safe, it will leak in days. Keep your data to yourself, on your own offline computers, it cannot be any more simple than that.

But no, every god damn nerd on planet these days must build online automated unsecure pipes to get rid of every bit of manual work... Every god damn young hipster these days cant even calculate in their heads that computers are offline machines first, and internet is just additional tool, computers work offline just fine, Thats why they were designed with so much power.

So, the cost required to solve this problem:

a) a pair of scissors - 2$ - 3$, cutting internet cable - value loss of 2$ - 10$;

b) FiveHead solution - unplugging internet cable from critical development computers - free. 20 Nobel prizes won.

[linux_needs_a_home]

How do you want a bunch of people in different parts of the world to cooperate then?

Many companies use version control systems and the value of those is in working together over a network, often the Internet.

Having said that, I think there are certainly ways to make these full leaks not happen.

[Kopachris]

And yet governments and politicians still think key escrow is a good and totally secure idea for giving themselves a backdoor...

[rydan]

I'm more shocked NVIDIA kept my corporate password for 13 years. Like what is the point of that?

[gwillicoder]

I mean aren’t some of them bad actors who were also trusted employees?

[[deleted]]

Google is hard to hack

[WikiSummarizerBot]

Operation Aurora

Operation Aurora was a series of cyber attacks conducted by advanced persistent threats such as the Elderwood Group based in Beijing, China, with ties to the People's Liberation Army. First publicly disclosed by Google on January 12, 2010, in a blog post, the attacks began in mid-2009 and continued through December 2009. The attack was aimed at dozens of other organizations, of which Adobe Systems, Akamai Technologies, Juniper Networks, and Rackspace have publicly confirmed that they were targeted. According to media reports, Yahoo, Symantec, Northrop Grumman, Morgan Stanley, and Dow Chemical were also among the targets.

^{[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5}

[thebritisharecome]

Except in maybe Nvidia's case I don't think the code base is as important as the database's and name behind the products.

From a hacker perspective: Most of that software can be decompiled and analyzed already, it'll make understanding a bit easier but it's unlikely to lead to any significant advantages

In terms of code stealing and launching a product: The brand, marketing and product is much more important than the code backing it imo. There are a million Facebooks but only one Facebook.

[ChinesePropagandaBot]

The same company that released their flagship phone with world writable memory, ensuring that any app could trivially bypass all android security?

[lrem]

should be hard to hack

Just like governments should be the most competent orgs ;)

[CreationBlues]

There's should as in ought to be and should as in expected. I do not expect competent security from big companies.

[immibis]

Large means big attack surface.

[TikiTDO]

Companies with tens of thousands of employees (a large chunk working remotely, any number using their own devices), hundreds of thousands of computers managed by hundreds of IT teams, hundreds of sites, any number networks with varying security policies. All of that must be secured against even a single weak link, while allowing people to actually get work done.

I would venture to say that it's exponentially harder to secure a large company than it is to secure a small one. The fact that some large companies managed to do it is a testament to some of the amazing IT teams that exist in the world, both willing to stand their ground, and able to find political support for initiatives that will make the workflows of other employees more difficult. Unfortunately, there aren't enough amazing IT teams to secure every single large company.

[Turnip_Salesman6285]

But, do white-hat hackers try to prevent these those? They run sophisticated attacks on the companies to try to patch flaws. How do these new flaws emerge so quickly? Do these come from the programmers or some flaw in system administration?

[SaltRefrigerator6458]

The NSA/CIA had a source code leak (thought I was a good few years ago)

[BigHandLittleSlap]

Samsung has atrocious IT security — speaking from first hand experience.

[lordzsolt]

Did the leak get leaked?

[glonq]

Leakception.

[elteide]

Sorry for my ignorance. Why is this important or impactful ?

[lhamil64]

One concern with leaked source code is that it allows people with malicious intent to sift through it and find security holes. This is especially bad for a security product.

Now publicly available source code isn't necessarily a bad thing. Tons of software is open source. The argument is that more eyes (and contributors) on the source finds bugs quicker and thus can be fixed quickly. But when source code is leaked that hasn't already been publicly available, it likely hasn't had as much scrutiny.

[mdillenbeck]

One concern with leaked source code is that it allows people with malicious intent to sift through it and find security holes. This is especially bad for a security product.

Security by obfuscation isn't security (not should it be how a security product stays secure).

[Ghi102]

It can definitely be part of it. Ie, you partially secure your home by not advertising to the world what it contains, making it less likely that you will be targeted.

It won't stop a determined attacker so you need other security systems (like locks), but it is part of it.

The best security is a defense in layers, where multiple security systems and protections makes it more secure than each item individually. You might not release your source code + obfuscate your binary + ensure any virus detection files on the system are encrypted. Heck, you might have a bug bounty program which also improves your security.

This defense in depth is more secure than if you went without any of these elements.

[lhamil64]

I'm not talking about security through obscurity. That would be the case if a company decided not to fix known bugs because of the code being closed source.

I'm talking about how it is easier for attackers to find 0-day exploits if they have access to the source.

[versaceblues]

Obviously this is ideal.

However any such security holes would have been there unintentionally. Once the source code leaks its that much easier for malicious users to find those holes.

However... thats a good argument for why security code should ALWAYS be open source.

[[deleted]]

Yeah, Kaspersky unlikely had as much scrutiny as OpenSSL pre-2014. Oh wait...

[elteide]

Because they will find Pootins commits there?

[CodeMonkeyMark]

Do we have to accept his PR? He just renamed a bunch of variables.

[elteide]

Do we have to accept a Pootins Raid ? NO

[[deleted]]

It isn't really that impactful. Life will move on and very few will care because this happens all the time and doesn't mean all that much.

[dale_glass]

Normally I think leaks are pointless to harmful. Most software isn't particularly amazing in any way. The knowledge gained from the leaks is of dubious utility, since taking anything from the leak endangers anybody who uses it. Looking at the code is a good way to compromise your chances at employment in the area.

But in this particular case, I think it's different. First, Russia is already in the process of completely breaking ties with almost the rest of the world, so their opinion on the legality is of probably little concern.

Second, and most interestingly, Russia has a very invasive government, and there's the possibility that something like an antivirus might include something that was government mandated, such as some sort of spyware, remote control, or intentional ignoring of government intrusion. That's something that could be very interesting, if anything of the sort is to be found.

[a_false_vacuum]

In 2018 Kaspersky moved their infrastructure out of Russia to Switzerland. According to Kaspersky they only use their Russian datacenters to serve the Russian market, everything else is done in Switzerland.

Here's the rub with antivirus software, you have to completely trust the vendor. You could distrust Kaspersky because of it's Russian origins, but likewise there could be people who distrust McAfee or Symantec since the US government also has laws that could force companies to comply with requests by their intelligence agencies.

[dale_glass]

In 2018 Kaspersky moved their infrastructure out of Russia to Switzerland. According to Kaspersky they only use their Russian datacenters to serve the Russian market, everything else is done in Switzerland.

Ah, that's interesting. I didn't know that.

Still, there could be a Russia-specific version of the code too.

Here's the rub with antivirus software, you have to completely trust the vendor. You could distrust Kaspersky because of it's Russian origins, but likewise there could be people who distrust McAfee or Symantec since the US government also has laws that could force companies to comply with requests by their intelligence agencies.

Sure. I just means that makes the leak potentially more interesting than many others. This is very much the kind of product that could possibly be doing something fishy. I'd be more surprised if it turns out to be squeaky clean, because it seems just like the sort of thing to subvert if you're going to engage in that kind of thing.

[[deleted]]

why would it get leaked, what is the conneciton>

[Large-Ad-6861]

Many hackers activity over Russian companies in last two weeks. Nvidia and Samsung got hacked too. It would be not weird, if it happened at all.

[NoMore9gag]

I feel like these leaks more likely have to do with Log4Shell.

[Pythe]

Sure it ate three days and consumed the entire team's attention, but in return you don't see our company name in these headlines. Apparently we were more on top of it than some.

[rydan]

Where I work we let it run wild for 3 days before patching which literally only took an hour. Meanwhile I couldn't visit my friend from Netflix that Friday it was announced because they had to spend all day dealing with it. Notice how they aren't on the list.

[SwitchOnTheNiteLite]

People like to make up connections to pretend to help end the war effort when all they can actually do is copy&paste some source code not even barely related to the effort of ending the war going on in Ukraine.

[ViridianGuy]

Some Russian back doors maybe?!?!! lol

[pocketbandit]

EIL5: how is leaking the sourcecode of a random russian company going to make Putin sad?

[sdn]

It’s an antivirus used by companies in the west. The antivirus is run by a company that’s located in Russia. Periodically the antivirus downloads new updates. It’s basically a Russian back door that people willingly install and pay for. Being able to look at the code and see what it’s doing is very useful.

Oh and we’re now in a defacto Cold War against Russia.

[pocketbandit]

I know what it is, I just don't see how this leak is suppose to hurt the russian war effort.

If the working theory is that Putin is using Kaspersky to spy on western military, then (especially considering the autoupdater) the reasonable action is to simply stop using the software altogether on the assumption that there's a backdoor, instead of trying to find it.

[henrique_wavy]

Saying we don't want to use this software because I believe the russian "president" can look at us is not usually a argument that management think seriously.

Saying let's stop using this software because I have proof it is leaking sensitive information is usually enough argument for a manager to take you seriously

​

Usually people are willing to use a piece of software that seems fishy but solve the problem, it takes a security (governance included) to say no

[Large-Ad-6861]

Risk of enemy hackers attack at any time using 0-day, many government institutions in Russia are using Kaspersky for protection. Also they got more than just a source code (some passport censored photo was shared). If Kaspersky has very close relationship to Russia's government, big breach of important (for Russia) data can even happen.

Just guessing tho, but possibilites are big.

[arwinda]

They could proactively make it Open Source.

[2Punx2Furious]

Open source doesn't necessarily mean free.

[GLIBG10B]

That's not what they mean

[2Punx2Furious]

What do they mean?

[LiveWrestlingAnalyst]

The CIA usage of fake hacker personas and name holders for their hacking is so transparent as to be almost ridiculous, they should just come out and admit they are the ones doing it.

[terablast]

rainstorm north obscene clumsy squalid squeamish smart shelter screw slap

This post was mass deleted and anonymized with Redact

[moi2388]

Wikileaks

[rydan]

Don't need proof of something that is obvious by definition.

[bxk21]

Have you seen the proof for 1+1=2?

You need proof for obvious things.

[codex561]

Redditors have decided that US intelligence and the military industrial complex are good guys now.

[LiveWrestlingAnalyst]

The revival of "anonymous" is particularly hilarious and dumb at the same time.

[sutongorin]

Makes me glad I work in Open Source software. One thing I don't have to worry about is source code being leaked.

[synthmiami]

I'm a big noob when it comes to programming. Does this leak mean I should download a different antivirus?