Russian antivirus firm faked malware to harm rivals, say ex-employees • Hacker News Board

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#91

Post by rebootthesystem » Fri, Aug 14, 2015, 11:50 PM UTC

dragonwriter wrote: post #87

rebootthesystem wrote: post #86

Not being pedantic. I realize English isn't everyone's first language. And then there's auto-completion on devices like iPad's that can result in embarrassing errors. It's "principle", not "principal". They are very different. I see this a lot, used in the other direction, on job postings "Principle Engineer" as opposed to "Principal Engineer".

> Not being pedantic. I realize English isn't everyone's first language. And then there's auto-completion on devices like iPad's that can result in embarrassing errors. Embarrassing errors like using "'s" to form a plural, instead of the correct "s"?

Yup.

Done on internationally to see how quickly my helpful comment would find someone looking for a way to take me down. I figured it was easier to just offer-up three errors and get it over with.

Yes, there are two more you missed.

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#92

Post by kazinator » Fri, Aug 14, 2015, 11:53 PM UTC

yabun wrote: post #84

kazinator wrote: post #77

This seems like fair game, and it benefits the consumer by keeping the anti-virus people on their toes. Kaspersky has demonstrated a weakness: that the firms copy each other's data and blindly trust each other as well as the initial submissions. They have a submission process for infected files which can be demonstrably abused to inject false positives. Also this: > Then, when competitors ran this doctored file throu…

A lot of new malware is self-modifying. In situations where this is the case checksums lose most if not all of their value. Heuristics in such situations are really the only viable option.

No, I mean to know what is clean.

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#93

Post by dang » Sat, Aug 15, 2015, 12:09 AM UTC

rebootthesystem wrote: post #86

Not being pedantic. I realize English isn't everyone's first language. And then there's auto-completion on devices like iPad's that can result in embarrassing errors. It's "principle", not "principal". They are very different. I see this a lot, used in the other direction, on job postings "Principle Engineer" as opposed to "Principal Engineer".

This subthread detached from https://news.ycombinator.com/item?id=10061894 and marked off topic.

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#94

Post by cpncrunch » Sat, Aug 15, 2015, 1:06 AM UTC

throwawayaway wrote: post #89

cpncrunch wrote: post #49

Earlier quoted context omitted.

I don't see how an interview with Bush about his book has anything to do with propoganda.

"pure propaganda/fluff pieces" if you don't see how this matches either description fair dues to you.

The Bush story is fluff, but the grandparent comment was talking about "fluff AND propaganda", which obviously doesn't apply to the Bush article. (I assume it didn't mean "fluff OR propaganda" because obviously that wouldn't apply to the Kaspersky article).

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#95

Post by yabun » Sat, Aug 15, 2015, 4:56 AM UTC

kazinator wrote: post #92

yabun wrote: post #84

Earlier quoted context omitted.

A lot of new malware is self-modifying. In situations where this is the case checksums lose most if not all of their value. Heuristics in such situations are really the only viable option.

No, I mean to know what is clean.

OK, but that's a very large data set that to track - does AV software actually do that?

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#96

Post by x5n1 » Sat, Aug 15, 2015, 6:09 AM UTC

evook wrote: post #90

x5n1 wrote: post #50

Earlier quoted context omitted.

The article is about how Reuters biases public perception in favor of Palestinians and it's written by Henry I. Silverman who may or may not have an agenda of his own. That's the thing, everyone has an agenda. Just because someone is calling someone out on something that does not mean that they themselves are not motivated by their own agenda.

Meh, it was an "example given". How much do you want? Another famous one would be MH17 and Fedotov. Also you should read the definition of agenda, you clearly misused it. ("the things that must be done"[1]). The word you were looking for was motive. That Reuters isn't a reliable source of information isn't a matter of motive or "agenda", it is common sense within educated circles. [1] https://en.wikipedia.org/wiki/Ag…

"Political agenda, the set of goals of an ideological group. In this context it is often used in a negative sense..."

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#97

Post by varjag » Sat, Aug 15, 2015, 9:26 AM UTC

enlightenedfool wrote: post #83

thescrewdriver wrote: post #30

Why does the article title lead with the nationality of the company?

It helps build a negative sentiment against those nations. That's one of the techniques in a propaganda.

In this case it's the opposite: enforcing a negative reputation of a company based on deservedly poor reputation of its host country.

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#98

Post by ogurechny » Sat, Aug 15, 2015, 9:35 AM UTC

There's a link to Kaspersky's forum post from 2012 floating on the net: http://www.anti-malware.ru/forum/index.php?showtopic=24588&p...

(Web Archive shows this topic — initially about Avast breaking Windows by blocking tcpip.sys but turned into flame about “shitty free antiviruses”, their lack of analytics team, and pirated software quite soon — existed in 2012.)

He explains it had been done a couple of years back to demonstrate the problem to Computer Bild journalists. A number of executable files with “funny” code that could not do any actual harm were made and 50% of them were added to Kaspersky's detection list under distinctive names. Then they all were shared on VirusTotal (and thus with other vendors). Surprisingly enough, only those “viruses” that triggered Kaspersky Antivirus on VirusTotal started spreading through others' databases, often with the same name. Still, there was no article written on that for some reason. These results were later presented to analytics and investors visiting Kaspersky's conference (Security Analyst Summit 2012).

So what's left is to ask Computer Bild if they participated in something like that test and/or someone who was on that conference.

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#99

Post by throwawayaway » Sat, Aug 15, 2015, 9:59 AM UTC

cpncrunch wrote: post #94

throwawayaway wrote: post #89

Earlier quoted context omitted.

"pure propaganda/fluff pieces" if you don't see how this matches either description fair dues to you.

The Bush story is fluff, but the grandparent comment was talking about "fluff AND propaganda", which obviously doesn't apply to the Bush article. (I assume it didn't mean "fluff OR propaganda" because obviously that wouldn't apply to the Kaspersky article).

> Asked by Winfrey whether he regretted the decision to invade Iraq based on unfounded intelligence that leader Saddam Hussein had weapons of mass destruction, Bush admitted feeling "terrible" and "sickened" about being wrong the weapons, but blamed Hussein.

I consider this to be propaganda. First time I've seen reuters accidentally a word too. Down further in my estimation!

Re: Russian antivirus firm faked malware to harm rivals, say ex-employees

#100

Post by mike_hearn » Sat, Aug 15, 2015, 1:16 PM UTC

mc32 wrote: post #26

igravious wrote: post #25

Earlier quoted context omitted.

Not a bit coincidental that said firm seems to be the only antivirus firm in recent memory (unless I'm mistaken) that seems to be able or willing to uncover government-level shenanigans. No, not a bit coincidental at all. edit: And of course this http://www.wired.com/2015/06/kaspersky-finds-new-nation-stat... from two months ago. First, security breach; now, an attack on their reputation?

It's also not coincidental at all that Kaspersky steers clear of exposing any shenanigans by Moskow. I mean, Eug himself claims Russia produces not only the best programmers but also the best exploit writers.... But surprisingly no exposés on them. Hmmm.

Or maybe Russia just doesn't spend as much on this stuff as western governments do.

There have been exposes by western AV firms too, but not as many and not as good. If there was obviously Russian govt malware out there, it'd surface sooner or later. We've seen American, Chinese, British, French, Israeli ...... seems odd that there's no Russian yet. But then I get the impression that Russian spying is overblown anyway. They seem to mostly focus inwards these days, or focus only on the former Soviet satellite states. USA has a much more aggressive global agenda.