Live data from Hacker News

Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

arstechnica.com

131–139 of 139 posts

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#131
post #39

Seems plausible, though regardless of whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not, it seems prudent for any government in the world to avoid using software that potentially uploads confidential data to foreign servers. Governments anywhere would probably be ill-advised to use anti-virus software from countries like the US or Russia, unless they can be sure that cloud analysi…

Well you can say that, but they aren't likely to stop using Office...

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#132

Earlier quoted context omitted.

It is absolutely feasible. Much of Russia's wealth is generated by a handful of large state owned businesses, predominantly the oil sector. And all these positions are staffed with individuals who have intimate contact to Putin himself. Ranging from the husband of his daughter (Kirill Shamalov) who within months after the marriage took over Sibur, one of the largest petro businesses in the country, to old KGB aides o…

For starters, do you not see the huge logical leap going from naming a couple of executives who are close with Putin, to saying that ALL people in Russia with money or power are doing nothing but following Putin's agenda? What about the minor detail that the oligarchs existed not only before Putin, but before Yeltsin, his predecessor, as well (not that they didn't grow under Yeltsin, but still)? Most documentation th…

Old news. The Russian government, for all practical purposes is the Russian mafia. Many people have written about this starting several years before Steve Blank, the SV entrepreneur, wrote about it in 2008. In 2010, the US Diplomatic Cables Leak confirmed it, going on from there with Luke Harding's book Mafia State. You can get a pretty good look by reading the wikipedia article on this.

https://en.wikipedia.org/wiki/Mafia_state

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#133
post #62
post #39

Seems plausible, though regardless of whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not, it seems prudent for any government in the world to avoid using software that potentially uploads confidential data to foreign servers. Governments anywhere would probably be ill-advised to use anti-virus software from countries like the US or Russia, unless they can be sure that cloud analysi…

>whether Kaspersky cooperates (maybe under some gag order) with Russian agencies or not no offense, it is just very entertaining(and educational) to observe how people from one culture try to apply their mental frameworks to completely different mentality. There is no "whether", "or not", "gag order" (in the sense as if explicit one was necessary) in the Russian reality in the context of private company cooperating w…

"In US law protects from and punishes for illegal cooperation"

If you believe this I have an AT&T switch closet to show you.

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#134

Earlier quoted context omitted.

> the US government allowed highly intrusive software from a non-allied country on government machines in the first place. This is the key point. Also, the US Government was recently found to have fake Kaspersky SSL certs.

> Also, the US Government was recently found to have fake Kaspersky SSL certs. This is not true. An old commit for a leaked implant included example client certificates, which were invalid and self-signed, used to disguise C2 communications as anti-virus updates to avoid scrutiny. Part of the system involved copying fields from valid certificates into self-signed (invalid ones) so the traffic would not look suspiciou…

> "... example client certificates, which were invalid and self-signed ..."

That sounds "fake" to me.

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#135
post #107

Earlier quoted context omitted.

When I engage with conspiracy communities it's usually to debunk extreme claims, so I approach most claims with skepticism, but wouldn't this: https://wikileaks.org/podesta-emails/emailid/225 Suggest that it's not fabricated?

The claim of a quid-pro-quo is fabricated (seriously: it requires collusion between like five governments and three branches of the USG, of which Clinton had control of only one -- there is zero evidence of any of that). Obviously the conspiracy nuttery exists, so yeah, it's "out there".

https://archive.is/BGDb2

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#136
post #6

So an NSA contractor or employee takes confidential/highly sensitive code and documents home and leaves it on their machine. They then install a pirated version of Office, after disabling their antivirus software which is telling them it is infected with a virus and preventing the installation. Seems like massive incompetence from this user rather than Kaspersky doing anything malicious, and those files where destine…

> I don't buy the narrative that Kaspersky is some evil Russian cyber hoover I don't know about this particular story, but Kaspersky is certainly has strong ties with FSB, FSO and other official structures. I don't mean that it's their main business model — developing anti-virus software pays well enough not to be some cover story — but they're definitely _friendly_ on a deep personal level. Kaspersky himself was edu…

> (which he used, for example, with that shady story when his son was kidnapped).

Read the first-person account by Igor Ashmanov who witnessed the whole incident. [1] Kaspersky's son was found not by FSB, he was found by the unit of Moscow police that was specifically created to deal with kidnappings, with cases like that one. If the story with the kidnapping proves anything, it proves the opposite, that he actually had NO any serious FSB connection.

[1] https://roem.ru/18-10-2017/261503/kaspersky-poprosil-dokazat... and following comments

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#137

Earlier quoted context omitted.

> I don't buy the narrative that Kaspersky is some evil Russian cyber hoover I don't know about this particular story, but Kaspersky is certainly has strong ties with FSB, FSO and other official structures. I don't mean that it's their main business model — developing anti-virus software pays well enough not to be some cover story — but they're definitely _friendly_ on a deep personal level. Kaspersky himself was edu…

> (which he used, for example, with that shady story when his son was kidnapped). Read the first-person account by Igor Ashmanov who witnessed the whole incident. [1] Kaspersky's son was found not by FSB, he was found by the unit of Moscow police that was specifically created to deal with kidnappings, with cases like that one. If the story with the kidnapping proves anything, it proves the opposite, that he actually…

> Igor Ashmanov

Yeah, a really good and unbiased source you got there.

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#138
post #37
post #3

I have to ask: Is there any concrete evidence against Kaspersky doing anything remotely concerning since this whole charade against them started in 2015 or is it still "they're Russian, so they must be doing something bad" scenario? EDIT: Fuck if I understand why people like JohnStrange, revelation and ryanlol are downvoted in their replies to this comment. They're on topic.

Watching US situation from outside it's seems there's an urgent need for some kind of a bad guy. Kaspersky is just easy target and apparently three-letter-agencies have means to steer the media to pursue this direction.

> Watching US situation from outside it's seems there's an urgent need for some kind of a bad guy.

How else would you justify all that Defense budget spending?

https://en.wikipedia.org/wiki/Bomber_gap

https://en.wikipedia.org/wiki/Missile_gap

Re: Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

#139

Earlier quoted context omitted.

The Gitlab production data deletion event occurred unintentionally because the system was not designed to make it impossible. Looking at the Kaspersky situation the same way, the leaking of classified documents to Russia occurred because the system was not designed to make it impossible (i.e. by never creating these materials in the first place). GP isn't equating the facts of the events but instead drawing a contras…

Drawing that comparison is asinine though. We treat nude photos differently than photos of a dog. We treat credit card/user information differently than app logs. That's why we have concepts such as HIPAA and PCI.

The point is punishing a person (often near at the bottom of the totem pole) does not fix the systemic problem. In fact, it creates noise which distracts us from fixing the problem. The first step toward fixing a problem is acknowledging there is a problem and identifying the problem.

I am very saddened by my inability to communicate this in a better way but punishing this person will not solve any problem except someone somewhere can check a box saying they did their job.

Post reply on HN