Schneier on Security

Clive Robinson • July 25, 2024 11:09 AM

@ Winter, ALL,

Re : The wrong tree is oft barked at.

With regards,

Russian business is moving forward with another proposal to open up its data and products to third-party review – and prove to Uncle Sam that its code hasn’t been compromised by Kremlin spies.

It’s not it’s code that the US Intel Agencies have bunched their panties over. If it was then it would have been published.

The problem is the virus sample repository which all AV companies have. It’s how they get samples of all those codes that “self erase”.

I’ve previously mentioned that there were two cases where the US Intel Agencies got embarrassed (but it appears to have not passed moderation).

The two cases that are public are,

1, US intel agency malware from TAO at NSA got “uploaded” to the Kaspersky repository and could not ve deleted by the TAO or others.

2, A person working for the NSA thought they had turned Kaspersky software off before they loaded up “data from work”. But apparently did not delete it before turning Kaspersky back on thus it got “uploaded” to the Kaspersky repository.

The fact the NSA had to let it go strongly suggests the NSA / TAO were not “inside” Kaspersky’s systems or repository.

What is probably correct is @ResercherZero’s suggestion of,

the evidence is that a range of intelligence agencies were able to penetrate and monitor KL network traffic without them noticing

This is not a new idea, it’s been stated on this blog before.

It’s known that the NSA where possible avoid going into targets sites, they sit on the first or second router up from the target “teeing-off all traffic”.

This got effectively confirmed by Ed Snowden’s trove in 2013 and China subsequently banning all US designed and manufactured network equipment from core Government, Finance, and Corporate networks.

Thus the US Intel Agencies blame Kaspersky for doing what their customers pay for, which is detecting hostile Malware “Without Fear or Favour”. Unlike most if not all US AV companies that have been clearly demonstrated as,

1, Stealing Kaspersky’s IntProperty…
2, Amazingly not detecting US IC malware ever…

So “Kaspersky Opening Up” is not much more than Kaspersky doing a “Rub their face in it” against US Federal Agencies.

Because at the end of the day, Kaspersky does not in any way have to be compelled to co-operate with the Russian, Israeli, US, UK, Danish, Swedish, and many other governments SigInt agencies, because they all “sit on the wires in the cloud watching the data fly by”.

It realy is that simple, and has been known and discussed for a decade or more in the more educated / knowledgeable security circles.

And as I’ve said not just now but in the past several times on this blog, it’s the repository where the “malware samples” get sent that is the real target of interest. And all those Intel Agencies have to do is basic “Traffic Analysis” on from where it came, to know most of what is going on…

Then and only then maybe do a little “snooping” of the repository it’s self, but as indicated that’s actually unlikely for various reasons, not least because it would be the equivalent of “tipping off” other potentially hostile government agencies.

It will be Interesting to see if this passes moderation or not.

Clive Robinson • July 25, 2024 1:33 PM

@ Andy Farnell,

Re : Kaspersky and Microsoft.

Quite a few times I’ve posted two or three stock phrases,

1, Individual Rights v. Social Responsibility.
2, Security v. Efficiency.
3, What is the valid business case for this computer to have external communications?

Along with a point few want to either understand or take onboard,

“If you don’t ‘Energy Gap’ then you can not say it’s secure.”

All of which apply to your post on CyberShow. But with regards,

“I’m interested because I wrote about Kaspersky here and wondered if I was being too charitable in my claims.”

Even with the full source code I very much doubt you will find the Kaspersky AV doing anything less secure than US AV software.

Because it does not need to be insecure in any way as far as “Intellectual Property”(IP) or “State Security” is concerned.

Put simply it does very few things all of which you would expect and are paying for, as it’s almost exactly the same as other AV software.

One such thing it does is to look for and flag up unusual behaviour by software running on the users system. Unless the user configures otherwise the AV software sends the suspicious behaviour/content file back to an online repository Kaspersky runs.

Such that Kaspersky analysts can look at the file and find out if it is suspect or not.

In theory the file contents are protected by fairly strong encryption via Secure Sockets etc (which as we know has it’s own many security failings).

However what is not protected is,

1, Meta-Data.
2, Meta-Meta-Data.

Whilst most readers here know what “meta-data” in network traffic is considerably less know what meta-meta-data is. And most do not know the significance of both.

Put simply there is something called “Traffic Analysis” that gets depicted as using meta-data to build up traffic/information flows to abstract information of relevance. This provides a level of information that few appreciate. One of which is the likes of “file size” this can not be hidden by encryption you have to go about hiding it by inefficient means like “padding”. With “Security v. Efficiency” the likes of “padding” do not get used. Thus traffic sent from two different computers with the same size at similar times makes it likely in the case of AV software that the files are the same.

But there is also meta-meta-data or “information about information about data”. Let’s say you see computers that should be configured the same way behaving differently. That is meta-meta-data. As individual items it’s often not that helpful but over time a great deal can be learned.

So like all AV software Kaspersky is not running a backdoor, not providing content or much else. And it does not have to cooperate or be forced to cooperate with a Government Entity.

All the Government Entity like a State Level SigInt organisation has to do is get access to a router up-stream of Kaspersky’s repository and watch the packets fly by on the wire.

This by the way is the same for all AV software suspect file repositories.

For years I’ve been telling people to disconnect their “private/work” computer from all external communications because for something like 7 decades now one thing has been true,

“If they can not access the computer they can not attack the computer.”

If you have a need for computers to communicate then get a second computer and harden it. Also do not do anything private/sensitive/work etc on it and most certainly do not do any encryption or decryption on it but always use “End to End Encryption”(E2EE).

It’s not perfect but it does significantly reduce the “attack profile” you present to outsiders.