Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky AV injected unique ID allowing sites to track users in incognito mode

heise.de

Post reply on HN
Print view View original

91–100 of 164 posts

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#91

Post by andai »

mcny wrote: post #68
noselasd wrote: post #40

Earlier quoted context omitted.

If you have an IT department, they will insist on AV software just to cover their ass. Noone there wants to be the one explaining to a clueless boss that they didn't use av software og something bad happened.

I don't mind having an antivirus on Windows but I despise having real-time file scanning when I have a computer with spinning rust. Node Package Manager install or yarn install creates thousands of tiny files and my understanding is that these "antivirus" software try to scan each file at the same time as npm wants to create them or in earlier days even as subversion was trying to do something. I imagine things are d…

I was using a spinny disk for a few weeks and I upgraded back to SSD the other day. The difference is incredible. Browser used to take 10 seconds to start, now it's instant. The only good thing is, I got so frustrated waiting constantly that I optimized my software to minimize IO (eg disabled browser history) so now it's even faster.

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#92

Post by MikusR »

buboard wrote: post #63
manishsharan wrote: post #12

Do we even need A/V for windows ? I think Microsoft Defender along with "proper digital hygeine" obviates the need for dedicated A/V solutions.

The only annoying thing about it is that it periodically notifies me that "It has not found any threats". I guess even computer programs feel lonely at times.

It can be turned off. But I kinda understand why they do that. Every other antivirus constantly show various "licence is ending", "some component is outdated" messages.

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#93

Post by tammysmith »

I have been seeing some strange calls from my husband phone and yet am unable to locate his phone or even get the number that have been calling him. i was so lucky enough that i went online to hire a hacker who was gonna help me in tracking my husband phone and also giving me access to his phone. while i was searching i saw jamesscotthacker@gmail.com as the best and i hired him this hacker was so good that he delivered me with my husband call logs,whatsapp,facebook, pictures, deleted call logs, all calls where recorded from last year till date i also had access to his text messages and also deleted messages. all this i had access right on my phone just with a very cheap price you can also text him :1(323)4214332

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#94

Post by zaarn »

mirimir wrote: post #38
bboygravity wrote: post #31

Earlier quoted context omitted.

So all the telemetry that Windows collects from the VM's you're running are sent to Microsoft through nested VPNs over TOR? I don't think Microsoft minds or cares that your Windows VM telemetry gets send to them that way or any other way? How are your VPNs and TOR helping you with the Microsoft you don't trust?

Microsoft can collect anything it wants from those VMs. Because they contain nothing that I don't want them to know. In particular, they don't contain anything about my meatspace identity. Sometimes I do need to put data on VMs that I want kept private. For that, I clone a Windows VM, add a virtual disk containing the data, and then start it with no network connectivity. When I'm done, I detach the data disk, and del…

Are you sure they don't leak any information sufficient to identify you? Let's play this through; 33 bits of information leak your identity (assuming 8 billion humans)

If you set your timezone; that's already leaking 5 bits of information (37 timezones), it lets an observer narrow down your location. The times the VM is active can confirm this (by observing when the VM is more active vs not, your sleep pattern can be derived)

Your language setting can nail down north vs south hemisphere, that leaks another bit of information.

Since you come from a Tor endpoint, we can exclude with high probability old demographics and very young demographics (>65 and We're down to 19 bits; Only 500'000 people share these traits with you.

By profiling which websites you visit and the fact you're using tor, one can take a guess at your gender, likely male. Another bit is gone, 250'000 people left.

Identifying 1 in 250'000 people based on them using a VPN; depending on region between 18 and 30% of people use a VPN atleast once per month (statista), that fact alone leaves you with 13 bits on both ends of the range.

1 in 8000 people.

Are you certain you can hide among 8000 people? Because things like movies being watched or social network usage can further leak entropy and reduce your anonimity set. Your meatspace identity is protected by 13 bits.

And if you visit very specific websites, like LGBT-related content, this can be used to identify you as LGBT, moving you down to 4 bits of entropy. 16 people.

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#95

Post by RaleyField »

zik wrote: post #79
FDSGSG wrote: post #65

Earlier quoted context omitted.

>By default, there are no services listening. Desktop linux , not "the Linux kernel". The kernel isn't amazing, but on the desktop side you regularly see downright absurd stuff like this https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit... and less surprising bugs like this https://donncha.is/2016/12/compromising-ubuntu-desktop/ The quality of software outside of some widely deployed server software tends…

> you regularly see downright absurd stuff like this That's a bug which only occurs on five year old distributions and which was fixed years before any exploit was ever found. Honestly if that's being brought up as a bad example Linux is looking pretty good compared to other operating systems.

ls -l ~/.bashrc and by design.

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#96

Post by vinceguidry »

hawski wrote: post #89
HeavenFox wrote: post #24

Earlier quoted context omitted.

Every single company I worked for installed AV on our work computers, which was a huge resource hog and made the highest-specced MacBook Pros feel like cheap netbook. I suspect it is mandated by some sort of compliance requirement, and the IT departments are just ticking a box. Maybe that's how this industry is still alive.

Reading sibling comments I have an idea for a startup. Make an AV, that does not really do anything, but can be used by thoughtful companies to "tick the box". Sell licenses and then do only the minimum required for compliance. It could be described that it uses Windows Defender service to provide the basis of AV solution.

As far as I'm aware, there are no governmental regulatory requirements to use AV software. All such requirements are generated by individual organizations, for example this one by NC State: https://policies.ncsu.edu/regulation/reg-08-00-10/

Nobody told NC State to require anti-virus, and the same company that created the requirements isn't going to accept some "minimal" solution to check their own box. Instead they will maintain a list of approved software, and your solution won't be on it.

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#97

Post by tempay »

vbezhenar wrote: post #71
tempay wrote: post #42

Earlier quoted context omitted.

Many antivirus applications install a local certificate authority so they can MITM HTTPS. From my experience most fail to check the original CA meaning anyone can intercept your traffic...

They should generate that certificate along with private key on your local machine, so it does not allow anyone else to intercept your traffic. Even seemingly harmless applications can do that. For example Blizzard Battle.net Launcher (used for all games) does that.

The issue is that you must check the external connection, i.e. in:

  User  antivirus  Site
If not a hostile actor can inject themselves in a way which is completely invisible to the user:

  User  antivirus  Hostile  Site
Actually checking is tricky but many antivirus tools don't even try.[1]

[1] https://news.ycombinator.com/item?id=10727431

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#98

Post by unnouinceput »

andai wrote: post #91
mcny wrote: post #68

Earlier quoted context omitted.

I don't mind having an antivirus on Windows but I despise having real-time file scanning when I have a computer with spinning rust. Node Package Manager install or yarn install creates thousands of tiny files and my understanding is that these "antivirus" software try to scan each file at the same time as npm wants to create them or in earlier days even as subversion was trying to do something. I imagine things are d…

I was using a spinny disk for a few weeks and I upgraded back to SSD the other day. The difference is incredible. Browser used to take 10 seconds to start, now it's instant. The only good thing is, I got so frustrated waiting constantly that I optimized my software to minimize IO (eg disabled browser history) so now it's even faster.

I will blow your mind when I will tell you to use a RamDisks for fastest run times wink wink

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#99

Post by goatinaboat »

heavenlyblue wrote: post #85
goatinaboat wrote: post #22

Earlier quoted context omitted.

The reason the Windows Defender is so good these days is https://docs.microsoft.com/en-us/graph/security-concept-over... The idea is everyone pools their threat data and immunity to new threats can be rapidly disseminated via Azure. The time window any new malware has to exploit Windows 10 anywhere in the world is measured in 10s of minutes now. It’s impressive stuff. The ISG can spread immunity much faster than malw…

How does it help against new threats exactly, if they are not auto-detected in the first place?

Suspicious files - if you fully buy into the solution - are uploaded to Azure and “controlled detonation” in a VM assesses if they’re malware. Then a signature is generated and distributed. It’s super slick. MS are serious about rehabilitating their security reputation.

Re: Kaspersky AV injected unique ID allowing sites to track users in incognito mode

#100

Post by mirimir »

zaarn wrote: post #94
mirimir wrote: post #38

Earlier quoted context omitted.

Microsoft can collect anything it wants from those VMs. Because they contain nothing that I don't want them to know. In particular, they don't contain anything about my meatspace identity. Sometimes I do need to put data on VMs that I want kept private. For that, I clone a Windows VM, add a virtual disk containing the data, and then start it with no network connectivity. When I'm done, I detach the data disk, and del…

Are you sure they don't leak any information sufficient to identify you? Let's play this through; 33 bits of information leak your identity (assuming 8 billion humans) If you set your timezone; that's already leaking 5 bits of information (37 timezones), it lets an observer narrow down your location. The times the VM is active can confirm this (by observing when the VM is more active vs not, your sleep pattern can be…

For the most part, I only use Windows VMs when I need Excel for >50MB spreadsheets. Or to test Windows VPN clients.

Your analysis strikes me as implausible. Few adversaries could see all of those parameters. For example, it's typically Tor through a nested VPN chain. So it'd be nontrivial for a local observer to know that I'm using Tor. Or for a remote observer to know that I'm using VPNs.

And seriously, why would I use my meatspace timezone? But actually, I do sometimes, just to be more random. Also, my sleep schedule is highly irregular, as one can tell from my HN posting history.

Post reply on HN