Israel Hacked Kaspersky, Then Tipped NSA Its Tools Had Been Breached

Post by giancarlostoro » Thu, Oct 12, 2017, 11:00 AM UTC

aswanson wrote: post #217

inetknght wrote: post #205

Earlier quoted context omitted.

I'll cut you some slack because you stated you're not a malware developer. But even if you're a normal developer, you should know that telling software to do something does not mean that the software will do that something. When the software in question is subject to being controlled by adversaries, all guarantees go out of the window.

Yeah. I facepalmed at that assumption as well. It's as naive as a parent telling an 18 year old not to have friends over while they go on vacation for 2 weeks and thinking its all good from there.

Post by frabbit » Thu, Oct 12, 2017, 1:45 PM UTC

lqdc13 wrote: post #137

dunpeal wrote: post #121

Earlier quoted context omitted.

How else can you explain their obsessive occupation with The Equation Group, which they themselves claim to be a (US) state actor, targeting other (US-unfriendly) state actors? https://en.wikipedia.org/wiki/Equation_Group An ordinary anti-virus company would never get involved in state-vs-state cyber warfare, let alone pour tons of money into researching it. How does that support their business model? Do you think it…

Are you saying state sponsored malware should not be looked into? It seems like American companies tend to find Russian state-sponsored malware and Russian ones keep finding US/US allies-sponsored malware.

Post by tptacek » Thu, Oct 12, 2017, 8:39 PM UTC

seabird wrote: post #292

tptacek wrote: post #249

Earlier quoted context omitted.

Your comment doesn't really say anything. Obviously, most AV software relays files back to the AV vendor's servers. But that's not what this graf implies. The graf suggests that Russian hackers are sending selectors down to the installed base of AV software to retrieve specific files, and that, once they obtained files that way, they passed the files on to Russian intelligence.

You seem to miss the part where I say >If the collection wasn't incidental, what mechanism could the FSB exploit to non-naively identify tools that it didn't already have, and flag them for retrieval? Emphasis on "non-naively." Antivirus seems like a highly ineffective tool for espionage of the sort being claimed in the article. You either have to blindly fish for something or already have a fingerprint of what you'r…

Post by dboreham » Fri, Oct 13, 2017, 7:34 PM UTC

thrill wrote: post #52

dboreham wrote: post #4

Earlier quoted context omitted.

Perhaps he was doing the bidding of his employers in order to test a theory that Kaspersky was an attack vector? I mean, this is exactly how you tell if your data has been breached or your source code leaked -- you put fake but unique records in your database then watch the dark webs for folks selling dumps containing those values; and plausible but bogus code containing unique constants then check competitors' binar…

Real data works too.