Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German Government Agency warns about using Kaspersky

bsi.bund.de

Post reply on HN
Print view View original

111–120 of 147 posts

Re: German Government Agency warns about using Kaspersky

#111

Post by formerly_proven »

Ensorceled wrote: post #99
jacquesm wrote: post #65

Earlier quoted context omitted.

"With the usual additional notes: unless you include an off-site, an off-line (or at least soft-offline) backup, and your backups get tested regularly enough, you don't have a backup system, you have aspirations & hopes!" This should be posted in every place where people are involved with IT operations.

It gets posted on HN EVERY SINGLE TIME. Usually the words "have backups" triggers multiple lectures on offsite backups and testing and multiple factors and ...

Don't forget to not roll your own crypto!!!

Re: German Government Agency warns about using Kaspersky

#112

Post by tored »

vladvasiliu wrote: post #79
kevingadd wrote: post #25

Earlier quoted context omitted.

It's definitely reasonable at this point to just skip using AV. It won't protect users from bad security habits and it tends to make your system performance worse even if it doesn't have vulnerabilities. I have Windows Defender enabled on my machines since it comes with the OS (and work policy requires it), but I definitely had to exclude most of my work folders to be able to get work done. It would be nice to have s…

A new [0] feature in Windows is "protected folders", which denies access to specific folders (user-configurable) by default to applications, and the user needs to actively allow them access. The downside is that it's all or nothing, meaning that a given app either has access to none of those folders or to all of them. You can do something similar with SELinux and AppArmor, and I think recent versions of macOS also ha…

Protected folders has existed for a while, in practical terms is almost useless, because you can’t create groups of protected folders for different type of applications, thus protecting too many folders will have consequence of you need to allow almost every application you regularly use.

Therefore protected folders works best if either a) you only use a very limited set of approved applications, which of course is rarely the case if you are skilled enough to know what protected folders are, or b) you only protect one folder with text documents that you only read in notepad, but if you have that case it is better to put them in a encrypted storage.

Re: German Government Agency warns about using Kaspersky

#113

Post by viraptor »

jeltz wrote: post #108
losvedir wrote: post #55

There's a lot of anti-antivirus sentiment in these comments, and while I, too, hate AV and have grown up with it being nothing but snake oil, I wonder if that's still correct in the current era of "zero trust". I think we've learned that corporate firewalls and VPNs don't really work all that well. In other words, if you can't rely on a safe boundary to the outside world, how do you ensure individual corporate machin…

I feel traditional antivirus software is the very opposite of zero trust. It runs at a very high level of permissions and intercepts almost everything.

https://www.microsoft.com/security/blog/2018/10/26/windows-d... There are of course still some occasional issues, but the scanning is pretty restricted these days.

Re: German Government Agency warns about using Kaspersky

#114

Post by tored »

viraptor wrote: post #91
charcircuit wrote: post #41

Earlier quoted context omitted.

Malware writers make sure their malware is undetected by most antivirus software. Antivirus will not save you.

This is the case only for the first few hours. Sure, the new releases are checked against the current AV engines. But there's no magic that will prevent them from being detected in a week. And unless you're being actively targeted or extremely unlucky, that means AV will catch most things for you.

Agree, but doesn’t that mean that heuristic based AV is useless, only creates annoyance by flagging legit software , when a list of known malware would be good enough if response time to add to that list is high enough.

Re: German Government Agency warns about using Kaspersky

#116

Post by waihtis »

lizardactivist wrote: post #94
waihtis wrote: post #38

It’s been interesting to note how Kaspersky has been responding to the scrutiny. It’s almost always the same - ”we have been audited a huge amount of times and no-one has ever found anything!” It’s suspicious because as someone who is a vendor of risk management, they’re leaving out the gaping hole fact which is that software is updateable and oftentimes AV will do so automatically. Potent risk is pretty huge. Same a…

How else should they respond? And almost all software today is updateable, and many do so automatically per default. What is your argument here exactly?

The point here is - don't build critical functionality via companies that are under the thumb of foreign superpowers.

"But what about USA??" I don't expect Europe as it is now to be in hostile terms with USA. But the principle would of course apply if that started being true.

Re: German Government Agency warns about using Kaspersky

#117

Post by waihtis »

nisa wrote: post #58
waihtis wrote: post #38

It’s been interesting to note how Kaspersky has been responding to the scrutiny. It’s almost always the same - ”we have been audited a huge amount of times and no-one has ever found anything!” It’s suspicious because as someone who is a vendor of risk management, they’re leaving out the gaping hole fact which is that software is updateable and oftentimes AV will do so automatically. Potent risk is pretty huge. Same a…

But this applies to any software that has auto-updates. Can we be sure that Microsoft/Google/Apple don't sign backdoor updates for the NSA for specific targets? As far as I know these national security orders are non-public and we don't even know if it's happening. But Russia used Ukraine in the past as "playground" for cyber attacks: Some mandated tax software auto-update was hackend and delivered a ransomware troja…

No, it doesn't. Because not all software companies can be a) under influence of a foreign government potentially hostile towards yours and b) software has varying degrees of replacement difficulty.

Example - building an entire smart city network on top of Huawei network gear. It would be very difficult to rip it out and replace on a whim if China suddenly decided to side with Russia in a war against the West, which is literally a possibility floating in the air right now. End state - you have a hostile actor who has access & control of your critical infrastructure. ¯\_(ツ)_/¯

Re: German Government Agency warns about using Kaspersky

#118

Post by tored »

vbezhenar wrote: post #46
hutzlibu wrote: post #24

Earlier quoted context omitted.

"If you're forced to use Windows the one with the least known side effects is Microsoft Security Essentials but even this has several drawbacks." But permanently disabling it is very, very hard.

Intellij Idea recommends to exclude directories related to project and IDE from MSE. I think that's a reasonable compromise between performance and security.

At the same those folders are probably the biggest backdoor into your system if you are a software developer, software developers are smart enough to not download crap from the internet, but they will gladly run npm install with full user privileges.

Re: German Government Agency warns about using Kaspersky

#119

Post by qwertox »

sofixa wrote: post #68
qwertox wrote: post #50

Earlier quoted context omitted.

Most insurances expect you to have an AV installed.

Sometimes even on Linux servers, where the best an AV can do is take CPU and IO so that there's less for the malware.

Regarding Linux servers:

EP 10: MISADVENTURES OF A NATION STATE ACTOR

https://darknetdiaries.com/transcript/10/

NSA: So we’ve figured out here is the internet-facing box. The web server that they’re using was not patched, wasn’t updated, so I was able to actually use the known exploit to gain the right access to that machine. [MUSIC] Once I did that, I put an implant down on that machine because it was pretty safe. It was actually a Linux server and the nice thing about Linux is no antivirus, right? I’m not super concerned. Especially because it’s a web server, I don’t worry about a user seeing the screen and using it and see something weird going on. But anyway, so I get down on that box, sit there for a little bit. Everything looks pretty good. There’s not much to see; it’s a web server and it’s got a website on it, got a database back end to it. Not a whole lot going on.

Re: German Government Agency warns about using Kaspersky

#120

Post by viraptor »

tored wrote: post #114
viraptor wrote: post #91

Earlier quoted context omitted.

This is the case only for the first few hours. Sure, the new releases are checked against the current AV engines. But there's no magic that will prevent them from being detected in a week. And unless you're being actively targeted or extremely unlucky, that means AV will catch most things for you.

Agree, but doesn’t that mean that heuristic based AV is useless, only creates annoyance by flagging legit software , when a list of known malware would be good enough if response time to add to that list is high enough.

Heuristics are often good. The very basic one "has a significant number of users ever seen this file before" is both annoying for development and probably the best possible first line of defence for larger companies.
Post reply on HN