Kaspersky in the gov's bad books.

[The Duke]

This seems like it’s been coming for a few months, to me it seems a witch hunt against KL. The gov is writing to companies telling them KL COULD be exploited by Russia so they should not trust it. Barklys Bank has withdrawn their free app it was giving away to all thier Bank customers.

The theorist in me says its probably to secure for GCHQ to crack, so it has to go. Only insecure software allowed.

 

http://www.appy-geek.com/Web/ArticleWeb.aspx?regionid=4&articleid=125204834&source=clipper%2B

 

[JayCeeDee]

Just got an email today from Barclays – they’re basically saying they’re not going to put their support behind it from this point on, but if you’re using it keep it going.

 

See extract from the email below:-

 

Dear …… ,
We wanted to let you know about some information relating to Kaspersky anti-virus software following the information that’s been shared in the news today. We felt it was important to share with you the decisions we’ve made, as well as some key facts.
What you need to know
The UK Government has been advised by the National Cyber Security Centre to remove any Russian products from all highly sensitive systems classified as secret or above.
We’ve made the precautionary decision to no longer offer Kaspersky software to new users, however there’s nothing to suggest that customers need to stop using Kaspersky.
What should you do next?
At this stage there is no action for you to take. It’s important that you continue to protect yourself with anti-virus software. If you have any concerns, you could consider alternative anti-virus suppliers.
We’ll continue to take every practical measure to ensure that your personal and financial details remain as safe and secure as possible. One of those measures is Barclays Online and Mobile Banking Guarantee. For more details on this, visit our website and search Mobile Banking Guarantee.
We’re here to help
We always like to hear from our customers. Should you have any questions, please call us and we’ll be glad to help.
Yours sincerely,
Your Barclays Team

 

a considered reaction without fuss or hyperbole in all.

 

Unless there’s contradictory advice I’ll keep using it.
 

 

[The Duke]

If I thought the need of an 3rd party AV was needed, i wouldn’t be put off at this point.

It stinks of anti Russian propaganda. You’d think the government had an agenda or something…..

Now if they also said, windows could be an issue as USA could take advantage, ios and android too, id be more on side. That’s never going to happen, but what about Iran, that is a hot bed of software production, why are they not highlighting Iranian software. Also some of the more ‘less known’ (to the west) android phones. I can garrentee all smartphones not even the fringe devices are a security risk,far greater than KLs.

I don’t see the problem bed for a 3rd party av, not used on for best part of ten years (probably), and haven’t had any meltdowns. One of the biggest pc cons ever sold. Creating the problem, then unveil the solution. That was MrMcafees greatest con. That and getting away with murder. Allegedly.

[Bob Williams]

Trump-inspired anti-Russian propaganda, communicated to Westminster, aided and abetted by a UK bank which listens to rumour and reacts with the kind of hysteria that ignores its own part in actions that resulted in the financial crisis of 2008. Too much Cold War-style ranting and raving.

I have used Kas for years and will not use any other IS or AV programme. The CEO has stated publicly that he will move the company out of Russia entirely, if this affair affects profitability, or if anyone can prove that the Russian government uses Kas to ‘spy’ on any nation, organisation or individual. I could understand high-end tech businesses and government departments being cautious, even though they are wrong to do so. But Kaspersky ‘spying’ on ordinary users through their Security programme? Give me a break, what would they learn? That most people live boring lives?

Mad Vlad will be laughing like a drunken Cossack, he loves to think he is intimidating the West, with no effort on his own part. Kaspersky collects and collates malware information that many other AV companies use in their own systems. Kas is a hugely successful company with offices and workers all over the world. This reporting is a steaming pile of horse faeces.

When the Thought Police arrive at your door, think -
I'm out.

[Ed P]

As Steve says – this stinks of anti-Russian propaganda. If the Government were really concerned about security they would be banning all Androids/Apples etc with chips made in China. As we have seen from the malware Intel concealed in their microcode it is very worrying just exactly what a SoC contains.

I’ll stick with Kas, they are now more likely to start allowing the detection of NSA/GCHQ inspired malware.

[Dave Rice]

Networks classified as secret and above are air gapped anyway. Their hard drives are removed after each use and stored in a safe.

Getting new AV signatures on is a manual affair, no automatic updates from the internet here.

Getting data into / out of a secret network is a highly regulated process. Imagine a USB (or any other) port as a door. It’s the equivalent of triple dead locked with a CCTV camera pointed at it 24/7.

People running these networks aren’t just left to their own devices, there’s plenty of guidance and rules / auditing coming from the MoD all the time. Why the Govt chose to publicly announce this decision smacks of propaganda.

[Richard]

Dave, maybe all you said covers all that needs to be said. However, the NSA bloke in the USA was very possibly a victim of the sloppy recruitment policies and inadequate management capabilities  of the NSA. He then used a personal laptop with data he should not have had at home. After that monumental screw up ‘K’ found the data on his personal laptop and the world, plus dog, plus flees on the dog knew almost all there was to know about the matter.

As for that lovely previously failed KGB operative Emperor Putin (or Tzar Putin?), anyone who cares to read of his actions should have a rather better understanding of the way that he is currently working. Restricting his own citizens and everyone else in Russia via a range of laws and decrees. He is clearly priming himself to rival Stalin in the milk of human kindness stakes.

I loosely subscribe to the theory that Kaspersky is of little interest to the KGB while they are dealing with ordinary oiks like us. Putin is however very interested in finding any route to weaken, or damage the will or ability of others to stand against his desires. If his lot can find anyway to gain access to systems, that is the prize. It can be done in two ways, to subvert enough people to stand for him, and gain a critical toe hold entry to non military and normally non tactical or strategic systems. Two benefits accrue, mess about with traffic management, or power distribution for example and ordinary oiks become very anti authority. Secondly those aspects that Dave wrote about being protected suddenly become less important. As a bonus, any armed forces lose funding in favour of beefing up our digital defences. This is already the case. The only problem with the action on current digital defences  is such defences may well be no more than a Maginot Line, already bypassed and thus close to unimportant.

It is regrettable that many in Europe have already mortgaged themselves to Russia, Germany needs their gas as do many other locations handing the Tzar a valuable control lever. Greece openly courted the Russians when things got sticky when the EU, especially Germany, made their ill judged mistakes over the Greek finances.

If anyone is deluded enough to think that their personal computer habits are of any interest to any security body then good luck. There are only two cases of interest, those up to their necks in anti state activities – (and sadly not all of them are spotted in time) and those in some official position who could be blackmailed or otherwise damaged by possession of quasi damaging information.

Sadly the quality of too many NSA personal appears to be far too low to be of much use to anyone, vetting and recruitment appear to be hopeless and subsequent management deplorable. While GCHQ are being run off their ‘backsides’ in an impossibly target rich, but hopelessly resource strapped environment.

Action against Kaspersky serves two minor objectives, it possibly limits cash flow to an increasingly hostile power, but more importantly and possibly the real reason, might spur some lazy sods to think about what they are really doing about data security.

I still think Barclays were simply tilting at windmills.

The moody, unstable, thin skinned toddler in the Whitehouse is probably doing more to recruit terrorists to the causes of disharmony in its many forms and hate than any previous fool. As such it is hard to decide which is more dangerous to the world Putin or Trump. I declare it a dead heat.

[Ed P]

I thought we had lost everything when Inmos was sold down the river but apparently a few bits of wafer fab shops survive. There is even one in Newport! I just hope it doesn’t get killed by Brexit, and loss of regional funding as the future security of the country could depend on places such as these.

[The Duke]

@edps. Was your post here done by mistake. As I just read it in another thread where it made sense. If so I’ll delete it, this one, and your reply to this ?

[Ed P]

“. If the Government were really concerned about security they would be banning all Androids/Apples etc with chips made in China. As we have seen from the malware Intel concealed in their microcode it is very worrying just exactly what a SoC contains.”

No the post was meant to be there as a follow-on from the comment alluding to the security risks associated with Chinese manufactured chips. SoCs as you probably know can be programmed to act like any other chip, and the Inmos  ‘Transputer’ chip was in effect the very first SoC. If it is another thread please delete it there!

[Ed P]

[edit] just found the other reference – that one fits too! I must have had a case of dittography! I should probably have rephrased the Kaspersky comment.

[Dave Rice]

I don’t trust anything American as far as Govt sponsored spying goes. We don’t really have an massively popular software written here in the UK, but I’m sure there’s plenty of taps in the ISP infrastructure.

I just assume anything on my PC is accessible to someone somewhere if they’re Govt sponsored. I aim to keep the criminals out, not helped when they start using Govt written exploits.

[Ed P]

Dave Rice wrote:

I don’t trust anything American as far as Govt sponsored spying goes. We don’t really have an massively popular software written here in the UK, but I’m sure there’s plenty of taps in the ISP infrastructure. I just assume anything on my PC is accessible to someone somewhere if they’re Govt sponsored. I aim to keep the criminals out, not helped when they start using Govt written exploits.

+1 – Unfortunately those who work for Government Agencies frequently have different views about the systems put in place for mass surveillance. Some, are whistle-blowers such as Snowdon and do it out of a genuine belief that their Agency is acting illegally, while others find ways of subverting the internal security checks of the Government link.

The bottom line is that Government inspired operating system/CPU flaws become known to the criminal fraternity and feed things like botnets or ransomware. Unfortunately NSA and GCHQ seem to me to be the original source of most of this malware (Stuxnet being potentially the worst of the lot). I now view Kaspersky as being less likely to kow-tow in keeping such security flaws secret and more likely to flag this malware.

While I agree we cannot keep Governments from spying on us, we should not facilitate criminals using these self-same tools.

[The Duke]

I’d take Russian spyware over any uk/eu/us all day. Not that I have anything to hide. I’d rather the one with no jurisdiction to  monitor over me. Not that they would have an exciting job.

“comrade where is Steve today, Same place, hospital with a stop off a KFC”.

[Richard]

I could see a vanishingly tiny, (sub atomic particle size?) reason for either GCHQ and/or NSA still knowing me though about the only possible reason that comes to mind is a shortage of real targets. Somehow I doubt that applies.

The idea that Russia might be daft enough to take a personal level interest is in a different league of silliness. While I would be happy to decry their covert actions to discredit such things as vaccinations for MMR, ‘flu, or their working to stir up concerns about fracking etc. I doubt that marks me as a prime personal target for them. Should they take an interest then I would suspect they have seriously lost the plot. Their efforts directed at targets that offer the Tzar a more direct payback, either identifying soft targets that would annoy the population at large, or at the more personal level targets for fund raising money scams. In this regard they do of course face competition from those lovely(?) nut job employees of fat boy kim in N. Korea.

A tendency to avoid the internet for financial activities, allied to a healthy, (overbearing?) dose of cynicism about mails should stand me in good stead. In this regard a far greater concern for many should be the potential impact of PSD2 on their financial risk profile and attack surface.

[The Duke]

I was only Jk Richard, I don’t think the Russians are spying on me, or any state. What would the point be.

Though if I had to bet on who who would be targeting uk civilians, I wouldn’t be putting my chips on Russia or America. As what would their reasons be? I can’t think of one. I can think of a few why a government would want to snoop on thier own thoughts.

One thing I don’t know, where do we stand legally with uk agencies snooping on uk citizens? I know it’s a no no in the USA. It’s rumoured that the uk spy on US citizens that are of interest  to the US, and vice versa. That why it’s kept “legal”. Well by rumoured, it was in the Snowden papers iirc?

[Richard]

Resources are a major issue for all agencies these days, they cannot even chase down all the priority leads, so searching for new haystacks to poke into looks far fetched to me.

However, luck and coincidence can be valuable, you hear of a ‘person of interest’ and they contact others. What do you do and how do you advise whose with a possible interest in  knowing?

At the personal level the PSD2 malarkey gives me the runs as I see that as a direct financial risk and threat surface.

[Ed P]

I do not care who snoops if they have a judicial warrant to do so. It is snooping without such a warrant that worries me as the public is exposed to nosey snoopers from both the police and local authorities. The Government should at a minimum raise the proposed bar for serious crime to greater than their laughable 6 month tariff (i.e. any of these can snoop if they SUSPECT that you may refuse to pay your TV licence).

I do not personally worry about such snooping but were I poor, a film/pop star or footballer than there would be a high likelihood of intrusive snooping much of which would be illegal.

[Bob Williams]

The Investigatory Powers Act in this country, is far more dangerous to the privacy and security of UK citizens, than any foreign government. If UK Ministers are going to be trusted with all their own citizens’ details and ID, we know what those people, and some “Security Officials” do with electronic records. All any foreign spy has to do, is catch a bus, train or taxi in which these idiots travel regularly. Sooner or later a USB key, laptop or brief case will fall into their possession.

When the Thought Police arrive at your door, think -
I'm out.

[Author]

Posts