Kaspersky analysis of the backdoor in XZ (web.archive.org)
from lemmyreader@lemmy.ml to linux@lemmy.ml on 14 Apr 2024 11:57
https://lemmy.ml/post/14444858

#linux

threaded - newest

0x01@lemmy.ml on 14 Apr 2024 13:13 next collapse

Ngl kaspersky is the close to the last group I care to hear from about security

techopedia.com/…/kasperskys-us-ban-a-long-history…

lemmyreader@lemmy.ml on 14 Apr 2024 13:27 next collapse

Right. After posting this I saw the blog post by jfrog, which seems to do a very good job : jfrog.com/…/xz-backdoor-attack-cve-2024-3094-all-…

TheAnonymouseJoker@lemmy.ml on 14 Apr 2024 21:44 next collapse

Kaspersky is more trustworthy than CIA and Washington propaganda machinery on security matters.

ikidd@lemmy.world on 14 Apr 2024 22:21 collapse

Well, it doesn’t invalidate the analysis.

This was a sophisticated attack happening over 2 years, from knowing the current maintainer was emotionally vulnerable to the structure of using the build system to introduce the patched code to Linux distro repos.

I’m guessing Kaspersky will come to the same conclusions many others have; that this was a state actor or similiarly well heeled group.

Xavienth@lemmygrad.ml on 15 Apr 2024 13:52 collapse

First time I’ve seen somebody acknowledge that it’s not just nation states with such capabilities. There are some huge organized crime syndicates.

Cysioland@lemmygrad.ml on 15 Apr 2024 20:34 collapse

But from what I’ve seen cybersec is mostly about blaming Russia/China/DPRK

[deleted] on 14 Apr 2024 13:18 next collapse

.

UprisingVoltage@feddit.it on 14 Apr 2024 13:51 next collapse

Source?

possiblylinux127@lemmy.zip on 14 Apr 2024 16:41 next collapse

They are based in Russia

UprisingVoltage@feddit.it on 14 Apr 2024 18:47 next collapse

I was curious whether some scandal about data being sent to russian govt had emerged after the war, but apparently things are as they used to be.

Mind you, AVs have a scary control over your system, and I totally respect not wanting to use one headquartered in Russia (and since the government security agencies have ties within those companies even in the “free world” (lmao) it’s safe to assume Russian govt has them inside Kaspersky too).

With that being said, kaspersky is actually a multinational corporation present in many areas of the world, I wonder how much influence Moscow actuallt has over them.

possiblylinux127@lemmy.zip on 14 Apr 2024 20:14 collapse

Honestly AVs are kind of snake oil. I wouldn’t use any of them.

UprisingVoltage@feddit.it on 14 Apr 2024 20:44 collapse

I agree and I also support the “common sense is the best av” argument, but for less tech savy people and workplaces I do think it’s necessary to have a last hope safety net against malware

porous_grey_matter@lemmy.ml on 15 Apr 2024 05:54 collapse

That’s not a source. By that metric every American AV has an NSA backdoor. And, ok, both of these are probably true tbh. But Kaspersky publishes extremely good security research and analysis which is just technical and totally possible to verify independently, so there’s no reason to avoid those, even if you don’t want to use their software.

possiblylinux127@lemmy.zip on 15 Apr 2024 13:41 collapse

I don’t use any of that software because it is a proprietary black box

isVeryLoud@lemmy.ca on 18 Apr 2024 20:39 collapse

That’s a different topic, you’re moving the goalposts :P

TheAnonymouseJoker@lemmy.ml on 14 Apr 2024 21:45 next collapse

US government. Let him tell you that.

[deleted] on 15 Apr 2024 12:43 collapse

.

UprisingVoltage@feddit.it on 16 Apr 2024 10:10 collapse

Kaspersky has faced controversy over allegations that it has engaged with the Russian Federal Security Service (FSB)—ties which the company has actively denied. The U.S. Department of Homeland Security banned Kaspersky products from all government departments on September 13, 2017. In October 2017, subsequent reports alleged that hackers working for the Russian government stole confidential data from the home computer of an American National Security Agency contractor via Kaspersky antivirus software. Kaspersky denied the allegations, reporting that the software had detected Equation Group malware samples which it uploaded to its servers for analysis in its normal course of operation.[13] The company has since announced commitments to increased accountability, such as soliciting independent reviews and verification of its software’s source code, and announcing that it would migrate some of its core infrastructure for foreign customers from Russia to Switzerland. In November 2020, Kaspersky finished relocating the data of its customers from Russia to Switzerland.[14][15] The company has also opened multiple transparency centers in Switzerland, Brazil, Canada, Spain and Malaysia which allow state agencies, government experts and regulators to review its source code.[16][17]

admin@lemmy.my-box.dev on 14 Apr 2024 15:44 collapse

*their (x2)

What_Religion_R_They@hexbear.net on 14 Apr 2024 13:21 next collapse

Kaspersky is probably the best company to hear from regarding such high profile compromises. Their discovery and breakdown of the recent Apple chip backdoor revealed how the American spy machine infiltrated Apple.

independantiste@sh.itjust.works on 14 Apr 2024 14:17 next collapse

Maybe Kaspersky is Russia backed and is filled with backdoors. Idk, and I don’t care because I don’t use their products. But I do know they have great security experts and when they publish analysis like thesez they are generally very complete and informative, like when they discovered the remote hack on iPhones thing: securelist.com/…/110916/

airikr@lemmy.ml on 14 Apr 2024 21:28 collapse

Indeed. Their knowledge and detailed articles are pure gold!

t7tis@lemmy.ml on 15 Apr 2024 11:49 collapse

Straight from the horse’s mouth!