Kaspersky Blog

On the point of trusting (big) Apple to keep us safe. This was linked in a similar discussion today. Either they knowingly provide backdoors for state actors or they are being so incompetent that it is laughable. Zero interaction remote exploit of hardware features designed to circumvent their own security measures? Why ? Seriously, find someone worthy of your trust, because that isn't Apple https://www.kaspersky.com/about/press-releases/2023_kaspersky-disclose…

Oh wow this shit again. @joepie91 you are very wrong about VPNs and this is the sort of mess that gist thread leads to if you ever see this. Has OP never heard of responder? Things other than browsers are actively making and accepting network requests all the time. Plenty of sites by default have port 80 open and redirect to 443 (can be intercepted). Please do not spread harmful information. Never (ever) use an open wifi without a VPN. Edit: My favorite APT that abuses this: https://www.kaspersky.com/resource-center/threats/darkhotel-malware-vi… Oh, and if you have corporate VPN make sure there is no split tunneling. And even with a good VPN, make sure to set explicit restrictive host firewall rules. As in no traffic allowed to the public wifi interface subnet aside from captive portal and dhcp (e.g.:wpad)

This is called the ACH network and there's no way to trace, undue, or recall transactions. It has been used in bank robberies [1] and numerous financial institutions and payment processors who are not banks use it, not all of whom are trustworthy. [1] https://www.kaspersky.com/about/press-releases/2015_the-great-bank-rob…

Apple is enough of a behemoth to finally drag this industry forward. I use Apple Pay whenever possible. Mostly because it’s fast and secure. And I don’t mean “fast and secure” like a marketer, but actually fast and actually secure. I can’t believe that the best thing the credit industry could come up with was chip and pin. Slow, insecure[1], and awful experience. Begone, parasites. 1. https://www.kaspersky.com/blog/chip-and-pin-cards-insecure/12787/

I always find this kind of stuff interesting. Albert Gonzales broke into a bunch of my work's servers (for years) at my first job, after a customer of ours pissed him off. I had some AIM coversations and lurked/logged in one of his advertised IRC hangouts. Most of the transcripts went to the secret service, which was very interested in his Credit Card fraud activities (as advertised on IRC). https://usa.kaspersky.com/resource-center/threats/top-ten-greatest-hac…

> What the article doesn't reveal is the attack vector, how did the firmware in these drives come to be infected? http://www.kaspersky.com/about/news/virus/2015/Equation-Group-The-Crow… Classic spying methods to deliver malware The attackers used universal methods to infect targets: not only through the web, but also in the physical world. For that they used an interdiction technique – intercepting physical goods and replacing them with Trojanized versions. One such example involved targeting participants at a scientific conference in Houston: upon returning home, some of the participants received a copy of the conference materials on a CD-ROM which was then used to install the group’s DoubleFantasy implant into the target’s machine. The exact method by which these CDs were interdicted is unknown.

I don't see this as a legitimate site. Looks to me more like a pirated / cracked version of the software. More information on Kaspersky antivirus could be found on their site http://www.kaspersky.com

Though my heart goes out for what happened to Rina, despite her claims that the 6 group chat participants were careful, I resonate with this reply [0]. Most likely, one of her group chat participants may have left a web or desktop session logged in to a public pc or that of a friend or family member who's home may have been raided by the authorities, allowing them access to a logged in session. Another option is they may have done so via malware [1] or a fake site [2]. Or since the government may work closely with mobile operators a SS7 attack [3] or even having an employee of a mobile operator redirect a login text message may all be in the cards and much more accessible than a pricey Pegasus or other mobile attack vector as Rina suggests. I highly recommend to everyone using Telegram (or other web services) to enable their 2nd factor authentication [4]. This combined with reviewing your active sessions and the Telegram channel for login notifications can allow you to defeat any of the above attacks (with the possible exception of the [email protected] email service?)For Telegram, this will prompt for a password in addition to the required code sent to another active Telegram session or if not, via SMS. You can provide an email address for recovery purposes or avoid that entirely (which may be a problem if this password is forgotten). In addition, recently I was prompted in the Telegram settings pane to confirm my number has not changed, and that I still remember…

A part of me wants to suggest that you look into using something other than Windows for hosting sites, since in my experience GNU/Linux servers are far less painful to deal with, especially when it comes to services and file permissions. However, it's likely that you have your own reasons for using it (e.g. many projects out there are stuck with legacy versions of .NET and Mono wasn't really stable for that use case either). On the other hand, i can't help but to wonder about why we don't see more anti virus/malware scanning solutions for GNU/Linux, especially with how coupled our development workflows are to the Internet - i've had Ruby gems with malware in them be stopped by Kaspersky on Windows, and honestly the thought of pip, npm and many other package managers being able to compile god knows what and execute random scripts in a non-sandboxed environment is horrifying. Market share aside, i bet we still see malware targeting *nix be developed, especially in the age of pre-compiled binary blobs and such, especially when the complexity of everything increases to the point where you can't audit everything that's present with your current resources, which will probably only become a larger problem with time. So, why don't we have an equivalent to Windows Defender that's either preinstalled or recommended during installation, like you can choose between different desktops while installing distros? Why don't we talk more about something like…

From a performance impact standpoint, based on just one test suite, it is the worst on the market. https://www.av-comparatives.org/tests/performance-test-october-2019/ (and I linked to the same article in your parents comment...) Avira and Bitdefender manage to rank in the top tier of performance impact and protection every time I check. Both offer free products, and Bitdefender Free is considerably less annoying, in my past experiences. Free antivirus is actually one of the places where market competition forced a bunch of them to clean up their acts and offer a good non invasive product. Avira still has ads, but if you wanted one product on your pc and one on a home server, it might make sense to use two vendors products. https://www.bitdefender.com/solutions/free.html https://www.avira.com/en/free-antivirus-windows For one off system scans, besides the two mentioned above; ESET, F-Secure, Kaspersky, Panda (and Emsisoft which has Avira and Bitdefender built in) all offer great spot check products. ADWCleaner is indispensable. It's interesting that "anti-virus" has now become the free component in suites. You pay for things like VPN, password management, and home network security. Kaspersky goes a step further and offers VPN and password management in a free tier. https://usa.kaspersky.com/free-antivirus

As for what the Israelis think they saw, Kaspersky had a totally reasonable explanation that made for a far less interesting story - aside from the report on the Israeli malware, which was pretty slick. I don’t have any specific information about Kaspersky (and I’m an anonymous internet comment, so I should not be given much weight anyway), but everything about Kaspersky’s version of the events is consistent with how AV companies work. https://www.kaspersky.com/blog/internal-investigation-preliminary-resu… I just don’t buy it. Based on what I know about what kind of flimsy intel it takes to extrapolate to irrefutable proof to support what someone wants to be true, and how products in this space work (I have direct experience here, with competing products) it rings of chasing ghosts. Personally, I think if Kaspersky is compromised, I don’t think it would be from the top down, but rogue insiders. And I don’t think they are unique in that regard. There is indeed a catch 22 with providing proof. On one hand, you can’t burn an important intel source. On the other hand, we can’t take their word for it. Intel analysts never have the full story, and even with the best of intentions, their interpretations can be extremely wrong. According to Hayden, former Director of NSA, they were certain that Iraq had WMDs. According to him, it turns out that they were just wrong. Oops.

"Devices that ship with Android 5.0 are encrypted out of the box. If you set a lock screen, you're given the option to require a security challenge before the device turns on. Enable this and a PIN, pattern, or password prompt will come up even before the boot animation. After you pass authentication, the device decrypts the data partition and mounts it, allowing the device to fully boot." Good news. Not sure if I think it is good news that you can pair the (presumably ok) encryption with face-unlock... though. Seems like it's not possible to (easily) brute force a disk-image off-line any more at least: http://blog.kaspersky.com/full-disk-encryption-android-5/ “In addition to enabling FDE out of the box, Android L is expected to include hardware protection for disk encryption keys, as well as hardware acceleration for encrypted disk access,” Elenkov concludes. “These two features should make FDE on Android both more secure and much faster.” Now we'll just have to wait for the source code, to see if this will be usable by all "tenants" on Android hardware... I hope so -- I'd love to be able to drop to a simpler unlock key, knowing that it's eg: set to self-destruct/severely rate-limit after N tries.

Also some of the free VPN apps support themselves by proxying this kind of traffic: https://www.kaspersky.com/blog/what-is-wrong-with-free-vpn-services/51…

Easy: separate the systems into the safety-critical ones required for driving, and the nice-to-have ones used for things like entertainment. You can now give the car's owner full access to the latter via all sorts of weird 3rd-party apps, as there's no way for that access to cause serious issues. They should be doing this anyways, or else you end up with your Jeep being crashed via wifi [0], and having the blast radius of a corrupt album image [1] restricted to infotainment is probably a really good idea too. [0]: https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-explained/9… [1]: https://www.theregister.com/software/2022/02/10/radio-station-broadcas…

There are some commercially available home security systems that use a version of this tech. - https://www.kaspersky.com/blog/wifi-sensing-motion-detection-howto/538… As a homeowner, the idea of knowing the exact number of people on my property at any time is attractive. Heck, I'm pricing out a new fence to keep deer out, and it would be much cheaper to just have a system that turns the sprinklers on whenever one is detected. But the ethical implications are wild. Unless I'm mistaken, someone could use this link today to track the activities of the couple in the apartment next door.

I had missed the warning that this tech is now widespread. Must have not logged into Hacker News that day https://www.kaspersky.com/blog/nfc-gate-relay-attacks-2026/55116/

This is how researchers were able to remotely hack several Chrysler models. They used a Sprint hotspot to get an IP on the cell network and were able to connect to any other Sprint device. The cellular modems on these cars were on Sprint so they just had to be on the same network. I wonder if Verizon intentionally blocks this. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-explained/9…

Well, that's clearly incorrect: software displaying unsolicited advertisements is called adware, and requires no spying at all. > Spyware is a form of malware that hides on your device, monitors your activity, and steals sensitive information like bank details and passwords [0] > Spyware is loosely defined as malicious software designed to enter your computer device, gather data about you, and forward it to a third-party without your consent. [1] > Spyware is malicious software that secretly monitors your activity and collects sensitive information, like passwords, location data, or browsing habits, without your consent. [2][3] 0: https://www.malwarebytes.com/spyware 1: https://usa.kaspersky.com/resource-center/threats/spyware 2: https://us.norton.com/blog/malware/spyware 3: https://www.fortinet.com/resources/cyberglossary/spyware

This particular feature doesn’t rely on network connectivity or lack thereof. Here’s some info about how some spyware works: https://www.kaspersky.com/blog/commercial-spyware/50813/

> The only way this is an improvement if you think the blockers are malicious Extensions and in turn MV2 blockers can easily be malicious. https://usa.kaspersky.com/blog/dangerous-chrome-extensions-87-million/… Look at how many in Kaspersky’s list are advertised as ad blockers. The majority of users aren’t tech savvy like HN.

Here more on "free VPNs” https://www.kaspersky.com/blog/what-is-wrong-with-free-vpn-services/51… Usually such proxy networks are outright criminal (even if users are not).

I did a google search to respond to your comment because I was pretty sure that the threat was not a mere hypothetical. https://www.kaspersky.com/blog/dangerous-chrome-extensions-87-million/… https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox-extension… https://palant.info/2023/05/31/more-malicious-extensions-in-chrome-web…

Nope. Apple participates in the same pay-for-search-placement scheme, and therefore will happily distribute the same kinds of scams. https://usa.kaspersky.com/blog/dangerous-apps-in-app-store/28975/

Kaspersky took the US allegations very seriously, and moved all of their data collection and processing for the US (and quite a few other nations) to Switzerland. [1] They then made the facilities accessible to US and other "partners" to inspect the code at said facilities, compile it from source (to compare distributed binaries), audit their data handling/processing procedures, and so on. It'd be pretty easy to see if the software was missing Russian state malware both by inspecting the code, or simply installing it on a test machine and then running the scan. If this were the case, it's highly likely the news would be repeating it 24/7. So it seems safe to assume it's doing its job well. [1] - https://www.kaspersky.com/about/press-releases/2020_kaspersky-complete…

That story sounds rather fishy. So your father has found the hidden option to enable developer mode which allows APKs to be sideloaded, and then went to some website to download and install an APK? By the way: According to Kasparsky [1] last year there have been 600 Million downloads of malware that was installed from Google play store, without any sideloading or alternative App stores involved. And of course the Apple App store also is full of malware and shady stuff, think of all the chinese IoT apps that are phoning home etc. [1] https://www.kaspersky.com/blog/malware-in-google-play-2023/49579/

> Apple cares about one group of people: its customers and their security. They literally installed a backdoor into Apple Silicon due to pressure from the CCP (lest they kill Apple by cutting their cheap manufacturing): https://www.kaspersky.com/about/press-releases/2023_kaspersky-disclose…

Note that motion sensors can, in some cases, be used as a microphone: https://www.kaspersky.com/blog/non-standard-smartphone-wiretapping/471…

Link to original report by Kaspersky https://www.kaspersky.com/blog/smb-cyber-resilience-report-2022/

Big tech already knows more about kids than parents do.(1) If they want to protect kids on their platforms we don't even need to talk about end-to-end encryption yet. What would help is big tech sharing daily summaries of child on-device activity with parents. There are lots of parental control apps that do this, and yet they have had to fight Apple for permission to operate.(2) Parents don't want their kids abused either. We can definitely find a win-win situation here if we work at it. References: (1) https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured… (2) https://www.kaspersky.com/blog/apple-fas-complaint/26017/

It's probably good for running TOTP authentificator or some kind of crypto wallet software, especially considering the lack of internet connectivity on this device, which makes it more secure for this purpose (though it may output QR codes on the screen, so actually it's kind of unidirectional data diode, rather than fully isolated device). I would install OpenBSD on such computer. Recent supply chain attacks on the dedicated crypto wallet hardware [1] indicate that we must rely on open source software if we strive to avoid low-entropy backdoors in the random number generator in such systems. The probability of a successful supply chain attack on such a gadget, given the number of user-controlled variables, is close to zero. [1] https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/4815…