Schneier on Security

Clive Robinson • October 11, 2019 8:16 AM

@ ALL,

The behaviour of the Kaspersky AV software has been long known, the US Gov did drone on about it for long ebough.

Also there was that unnamed person in the US who turned Kaspersky off put malware from a us Gov entity they worked at on their machine dod a few things, but did not clean it up properly. When they turned Kaspersky back on it found what had not been cleaned up.

The US Gov got it’s panties right royaly bunched over it at the time, which as the Kaspersky software was “doing as advertised” did make me laugh.

What Kaspersky will tell you if you ask is that you can permanently didable the “ET Phone Home” behaviour.

What the Kaspersky AV software does is at the end of the day considerably less than Google has put in Android and Microsoft has put in Win10 with neither of those alowing the consumer to turn of “Mothership Calls”.

Plain and simple what has happened here is not Kaspersky AV being “Spyware” or sinister in any other way, but people not reading the documentation and not hsving an iota of OPsec knowledge.

Anyone else old enough to remember the Bob Morris Worm? Well back then people were talking about using isolated networks for testing what we now generically call “propergating malware” or “fire and forget” attacks.

Sometimes I wonder what an earth has gone wrong with the educational process in Information Security. None of this is new, and it’s all well within living memory…

Clive Robinson • October 11, 2019 3:51 PM

@ All,

According to the Vice article, there was going to be a presentation on this at VB2019 in London,

Brian Bartholomew, a researcher with Kaspersky’s Global Research and Analysis Team who will present his findings about SandCat today in London at the VirusBulletin conference.

It’s not one of those confrences I attend, but I believe one of the regulars on this blog was presenting a paper[1].

There is the possibility they heard the presentation and can report what they heard back to this blog?

[1] https://t.co/m80dbaQkcE

Clive Robinson • October 14, 2019 7:42 AM

@ AV User, Yolo,

I turned it off because i sometimes make programs and i want that my programs are only mine. But no antivirus will upload your photos documents, they will check only exe

There are other reasons for turning it off.

Firstly whilst the programs may be publicly available thus “known” your use of them is usually not. As the likrs of pharmaceutical researcers wil tell you, a competitor even knowing what tools you use leaks information about your researc activities.

But not all software is publicly kbown. Back more than a few decades nearly all programs were unique to their users. This did not mean that they were written by the users. Often they were written under contract and subject to Non Disclosure Agreements (NDAs) or similar confidentiality. The reason being that a “bespoke” or “custom tool” reveals much about it’s usage. With say a Banking Security program this obviously has significant implications.

But there is an important fact that people sometimes forget,

Code = Data, Data = Code

That is what you think only as data can also be or contain code. This is especially true of interpreted languages, and worse still for interpreted languages that can be embedded in what you would otherwise consider data files.

PDF files and their predecessors Postscript files are actually code files with embedded data. The language in use “Postscript” is very similar to Forth. Being stack oriented languages and capable of creating new programing words on the fly, they are very “code dense” and “very flexable” whilst being easily implementable on almost any computer. Which makes them ideal for resource limited computers, which printers once were.

Microsoft decided that adding BASIC to Office as “macros” in it’s data files was a good idea, much to the disgust of one of it’s employees. We know this because they put a “proof of concept” virus using the macros on a Microsoft update CD…

Even more simple graphics files due to the need for compression suffer from this “interpreter” problem, and malware writers have used them to carry virus and other malware.

Further HTML is another interpreter mess not just in JavaScript but over half of HTML5.

Even compressed sound files suffer from the interpreter problem.

Thus as time goes on pure data files are heading for extinction and hybrid “Data + Code” very much the norm.

Thus to protect you from malware AV software has to look inside all your data files. Which means that if it’s heuristics find something suspicious then it will if alowed send them back to the mothership.

This has been known for a long time quite publically atleast going back into the last century.

In fact if you think about the way “Turings Tape” worked even before the modern computer was invented. Even Charles Babbage realised this when he was thinking about his “mill” engine, thus back in the 1800’s.