Kaspersky Blog

Though my heart goes out for what happened to Rina, despite her claims that the 6 group chat participants were careful, I resonate with this reply [0]. Most likely, one of her group chat participants may have left a web or desktop session logged in to a public pc or that of a friend or family member who's home may have been raided by the authorities, allowing them access to a logged in session. Another option is they may have done so via malware [1] or a fake site [2]. Or since the government may work closely with mobile operators a SS7 attack [3] or even having an employee of a mobile operator redirect a login text message may all be in the cards and much more accessible than a pricey Pegasus or other mobile attack vector as Rina suggests.

I highly recommend to everyone using Telegram (or other web services) to enable their 2nd factor authentication [4]. This combined with reviewing your active sessions and the Telegram channel for login notifications can allow you to defeat any of the above attacks (with the possible exception of the recovery@telegram.org email service?)For Telegram, this will prompt for a password in addition to the required code sent to another active Telegram session or if not, via SMS. You can provide an email address for recovery purposes or avoid that entirely (which may be a problem if this password is forgotten).

In addition, recently I was prompted in the Telegram settings pane to confirm my number has not changed, and that I still remember…

A part of me wants to suggest that you look into using something other than Windows for hosting sites, since in my experience GNU/Linux servers are far less painful to deal with, especially when it comes to services and file permissions. However, it's likely that you have your own reasons for using it (e.g. many projects out there are stuck with legacy versions of .NET and Mono wasn't really stable for that use case either).

On the other hand, i can't help but to wonder about why we don't see more anti virus/malware scanning solutions for GNU/Linux, especially with how coupled our development workflows are to the Internet - i've had Ruby gems with malware in them be stopped by Kaspersky on Windows, and honestly the thought of pip, npm and many other package managers being able to compile god knows what and execute random scripts in a non-sandboxed environment is horrifying.

Market share aside, i bet we still see malware targeting *nix be developed, especially in the age of pre-compiled binary blobs and such, especially when the complexity of everything increases to the point where you can't audit everything that's present with your current resources, which will probably only become a larger problem with time.

So, why don't we have an equivalent to Windows Defender that's either preinstalled or recommended during installation, like you can choose between different desktops while installing distros? Why don't we talk more about something like…

As for what the Israelis think they saw, Kaspersky had a totally reasonable explanation that made for a far less interesting story - aside from the report on the Israeli malware, which was pretty slick. I don’t have any specific information about Kaspersky (and I’m an anonymous internet comment, so I should not be given much weight anyway), but everything about Kaspersky’s version of the events is consistent with how AV companies work.

https://www.kaspersky.com/blog/internal-investigation-preliminary-results/19894/

I just don’t buy it. Based on what I know about what kind of flimsy intel it takes to extrapolate to irrefutable proof to support what someone wants to be true, and how products in this space work (I have direct experience here, with competing products) it rings of chasing ghosts.

Personally, I think if Kaspersky is compromised, I don’t think it would be from the top down, but rogue insiders. And I don’t think they are unique in that regard.

There is indeed a catch 22 with providing proof. On one hand, you can’t burn an important intel source. On the other hand, we can’t take their word for it. Intel analysts never have the full story, and even with the best of intentions, their interpretations can be extremely wrong. According to Hayden, former Director of NSA, they were certain that Iraq had WMDs. According to him, it turns out that they were just wrong. Oops.

From a performance impact standpoint, based on just one test suite, it is the worst on the market. https://www.av-comparatives.org/tests/performance-test-october-2019/ (and I linked to the same article in your parents comment...)

Avira and Bitdefender manage to rank in the top tier of performance impact and protection every time I check. Both offer free products, and Bitdefender Free is considerably less annoying, in my past experiences. Free antivirus is actually one of the places where market competition forced a bunch of them to clean up their acts and offer a good non invasive product. Avira still has ads, but if you wanted one product on your pc and one on a home server, it might make sense to use two vendors products.
https://www.bitdefender.com/solutions/free.html https://www.avira.com/en/free-antivirus-windows

For one off system scans, besides the two mentioned above; ESET, F-Secure, Kaspersky, Panda (and Emsisoft which has Avira and Bitdefender built in) all offer great spot check products. ADWCleaner is indispensable.

It's interesting that "anti-virus" has now become the free component in suites. You pay for things like VPN, password management, and home network security. Kaspersky goes a step further and offers VPN and password management in a free tier. https://usa.kaspersky.com/free-antivirus

"Devices that ship with Android 5.0 are encrypted out of the box. If you set a lock screen, you're given the option to require a security challenge before the device turns on. Enable this and a PIN, pattern, or password prompt will come up even before the boot animation. After you pass authentication, the device decrypts the data partition and mounts it, allowing the device to fully boot."

Good news. Not sure if I think it is good news that you can pair the (presumably ok) encryption with face-unlock... though. Seems like it's not possible to (easily) brute force a disk-image off-line any more at least:

http://blog.kaspersky.com/full-disk-encryption-android-5/

“In addition to enabling FDE out of the box, Android L is expected to include hardware protection for disk encryption keys, as well as hardware acceleration for encrypted disk access,” Elenkov concludes. “These two features should make FDE on Android both more secure and much faster.”

Now we'll just have to wait for the source code, to see if this will be usable by all "tenants" on Android hardware... I hope so -- I'd love to be able to drop to a simpler unlock key, knowing that it's eg: set to self-destruct/severely rate-limit after N tries.

Kaspersky took the US allegations very seriously, and moved all of their data collection and processing for the US (and quite a few other nations) to Switzerland. [1] They then made the facilities accessible to US and other "partners" to inspect the code at said facilities, compile it from source (to compare distributed binaries), audit their data handling/processing procedures, and so on.

It'd be pretty easy to see if the software was missing Russian state malware both by inspecting the code, or simply installing it on a test machine and then running the scan. If this were the case, it's highly likely the news would be repeating it 24/7. So it seems safe to assume it's doing its job well.

[1] - https://www.kaspersky.com/about/press-releases/2020_kaspersky-completes-its-data-processing-relocation-to-switzerland-and-opens-new-transparency-center-in-north-america