US Officials Are Warning About A Russian Cybersecurity Company's US Government Ties

[pnwmom]

Last edited Tue May 9, 2017, 03:42 AM - Edit history (4)

Source: BuzzFeed News

WASHINGTON, DC US intelligence officials are expressing concern over a Russian cybersecurity companys access to US government systems and pushing the General Services Administration for answers on how long it has been approved for use by US agencies.

Three US intelligence officials told BuzzFeed News they were concerned by what they categorized as a close relationship between the company, Kaspersky, and the Russian government, and what giving the company access to US government systems could mean. All of the officials who spoke with BuzzFeed News requested anonymity to discuss internal intelligence community conversations about Kaspersky.

A spokesperson for Kaspersky told BuzzFeed News that the company has no ties to any government, and the company has never helped, nor will help, any government in the world with its cyberespionage efforts. For 20 years, Kaspersky Lab has been focused on protecting people and organizations from cyberthreats, and its headquarters location doesnt change that mission--just as a U.S.-based cybersecurity company doesnt send or allow access to any sensitive data from its products to the U.S. government, Kaspersky Lab products also do not allow any access or provide any secret data to any countrys government. The concern over Kasperskys access to US government agencies comes amid rising alarm in Washington over the security of government systems, and the hacking of the DNC and Clinton campaign, which the intelligence community has blamed on Moscow.

The officials said that they had not seen any evidence linking Kaspersky to the Kremlins election operation, but said the concerns are, instead, stemming from broader concern over Russian meddling in US affairs.

Read more: https://www.buzzfeed.com/alimwatkins/us-officials-are-warning-about-a-russian-cybersecurity?utm_term=.vnAWyJLML#.jgpYB03Z3

---

The problem is obscured, according to the article, by contractors that work for the US government and subcontract work out to Kaspersky. And it gets worse: "Kaspersky software appears to be a 'licensed component of other cyber products' sold by other vendors in use by the US government."

ON EDIT: Here is an article I just found, about Kaspersky holding a competition for students from 19 universities in the US and the UK -- related to technology for DIGITAL VOTING SYSTEMS.

So America's best and brightest are being hooked up with Kaspersky while they're still in school. And they're working on voting machine software. Great.

https://blog.kaspersky.com/cybersecurity-case-study/13575/

[div class"excerpt"]Over the past few weeks, teams from 19 universities in the US and UK competed in Kaspersky Labs Cybersecurity Case Study Competition, hosted by The Economists Which MBA? site. The teams were challenged with a complex task:

Can technology play a greater positive role in democracy and the way people make important decisions about the future of their countries? With digital voting, a new wave of challenges rolls in: from guaranteeing the anonymity of voters to the prevention of fraud, all the while ensuring the security of the voting system itself. One small vulnerability or oversight could very well change the course of a nations history.

NEW UPDATE: Michael Flynn was paid $11,250 to give a speech to Kaspersky Labs. Why?

https://www.democraticunderground.com/10029033674

[marybourg]

1. I've refused to load Kaspersky products

into my computer for at least a decade on the general principle of "why look for trouble". I guess the U.S. government doesn't know that principle.

[TheBlackAdder]

18. Same here. The software seemed to "phone home" too often for my likes.

[FormerOstrich]

2. I've been trying to bring attention to Kaspersky for a long while.

Kaspersky is a Russian company and the worlds largest privately-held software developer of security/threat management systems. You are right, it is bundled (or components) in with other products.

Kaspersky is running on millions servers and workstations worldwide (400 million USERS according to Wiki). I wish I had the time, money, and energy to research it.

I posted comments back in 2014 (and commented even more recently):

http://www.democraticunderground.com/1014839869
http://www.democraticunderground.com/1014862027

Here is the wiki link: https://en.wikipedia.org/wiki/Kaspersky_Lab

[pnwmom]

3. Thanks for your efforts to enlighten us. Keep trying! Maybe more people will listen now. n/t

[IthinkThereforeIAM]

7. Eugene is known former KGB...

... or at least trained by the KGB. As per the wikipedia link you offered.

[Eyeball_Kid]

4. Do they develop voting machine software?

[pnwmom]

6. Or are they in a piece of voting machine software developed by others? Important questions. n/t

Last edited Tue May 9, 2017, 12:42 PM - Edit history (1)

[hamsterjill]

29. Very important questions!!!!!

n/t

[Hekate]

5. Kick

[mdbl]

8. I like how Kaspersky "thinks" they can exist in Russia

without answering to the Kremlin. Yeah sure - yawn.

[pnwmom]

9. Having his employee get arrested for treason -- for cooperating with US authorities,

according to reports -- sort of torpedoes that idea.

[mdbl]

10. Time to get our cybersecurity away from other countries

I don't care how effective we think they are. We need to get off our butts and do the work in the U.S. This should have been a no-brainer all a long. Speaking of no brains look at our congress and the president.

[pnwmom]

11. Did you hear that Kaspersky is suing Microsoft, for monopolizing its product?

I hope Kaspersky loses.

[mdbl]

12. Well, with repuglicans in charge

I don't have much hope for the U.S. winning anything since all someone has to do is pay off the dolts in congress.

[BumRushDaShow]

15. The story of that arrest

https://thestack.com/security/2017/01/25/russian-cybersecurity-expert-arrested-over-treason-charges/

The article notes at the end -

Founded in 1997, Kaspersky Lab is based in Moscow and operates worldwide in over 200 countries and territories. The company ranks fourth globally for revenue in the anti-virus market, according to 2010 research from analyst IDC.

That company was founded under Yeltsin and I wouldn't be surprised if it has been very much co-opted for use by the current President of Russia.

[pnwmom]

16. Wow. Fourth in the world. And now they're trying to sue Microsoft for dominating the market.

I don't love Microsoft but I hope they win.

[BumRushDaShow]

17. Doing some hunting around, I need to stop!

<...>

Both the NSA and the GCHQ heavily targeted the Russia-based antivirus company Kaspersky Lab, The Intercept reports, citing documents leaked by NSA whistleblower Edward Snowden.

Targeting antivirus software is highly strategic. Security products often run on operating systems using the highest of computer privileges. If attackers are able to exploit such softwares, it's possible for the hackers to do even more damage with the elevated control the software grants.

The new documents indicate the NSA was able to gain access to a trove of Kaspersky-specific information, including:

"Leaky" user information that was being transmitted through the company’s networks

Private emails sent to the firm

Lists of new malware that were flagged for Kaspersky

This sort of cyberespionage has become somewhat common, with governments trying to find vulnerabilities in security software and antivirus companies trying to discover state-led attacks. The report explains:

Spy agencies seem to be engaged in a digital game of cat and mouse with anti-virus software companies; the U.S. and U.K. have aggressively probed for weaknesses in software deployed by the companies, which have themselves exposed sophisticated state-sponsored malware.

<...>

http://www.businessinsider.com/snowden-documents-reveal-nsa-targeted-kaspersky-and-other-antivirus-companies-2015-6

[pnwmom]

25. Keep going! You made me remember something else. The Rasputin attack that was made public

a few weeks after the election.

Remember? Some hacker named Rasputin had dug into the Election Assistance Commission -- the gov body that is in charge of election security, including voting machines. And the hacker was caught trying to sell the info.

They tried to reassure the public, saying that in this kind of hack it was unlikely that the seller had had the info for very long -- i.e., long enough to have actually influenced the election weeks before, because usually these sellers try to sell their info as fast as possible.

But they ALSO said the vulnerability could have been exploited by others while it was open. So how do we know the vulnerability wasn't exploited by the Russians weeks before?

[BumRushDaShow]

26. Yup

especially if they already had a "company" that was expert in vulnerabilities and exploits.

It's just a mess.

[Ghost Dog]

13. But is there any evidence to contradict Kaspersky's statement?

A spokesperson for Kaspersky told BuzzFeed News that the company has no ties to any government, and the company has never helped, nor will help, any government in the world with its cyberespionage efforts. For 20 years, Kaspersky Lab has been focused on protecting people and organizations from cyberthreats, and its headquarters location doesnt change that mission--just as a U.S.-based cybersecurity company doesnt send or allow access to any sensitive data from its products to the U.S. government, Kaspersky Lab products also do not allow any access or provide any secret data to any country's government.

[pnwmom]

14. And RT, Russian Television, also insists that it is not a Russia propaganda outlet,

but we know better.

Do you think Kaspersky Labs would ADVERTISE the fact that it is controlled by the Russian government? Do you think any western countries would buy its products under those circumstances?

So why should you believe anything they say about that? Russia is an authoritarian kleptocracy -- not a Democracy. Any company that manages to be successful in that environment is cooperating with the government.

Here's some evidence: one of their employees was arrested this winter for TREASON - because the employee had been assisting the US in a cybercrime investigation. If Kaspersky Labs was a private company, how could doing their job result in charges of treason?

[Ghost Dog]

21. You are of course free to 'believe' what you choose

to, without evidence, and to employ strawman arguments, but your final paragraph appears to offer 'fake news' as evidence, viz:

"The case against this employee does not involve Kaspersky Lab," company officials wrote in a statement issued following the report. "The employee, who is Head of the Computer Incidents Investigation Team, is under investigation for a period predating his employment at Kaspersky Lab."

https://arstechnica.com/security/2017/01/kaspersky-labs-top-investigator-reportedly-arrested-in-treason-probe/

[pnwmom]

23. You are accusing me of fake news because I am not gullible enough to believe

the public relations statement provided by a Russian company whose employee has just been accused of treason, and was led away with his head in a bag.

[dembotoz]

19. I have used and like the product...

It has blocked and fixed stuff
And it doesn't crash my computer like others

[TomVilmer]

20. Kaspersky's tools might work to keep CIA's out...

... and vice versa. So I happily chose my anti virus gear as a mix from different countries. But I have had none running daily at my PC for the last ten years, except for the firewall. Just use them for a clean up once in a while.

[dembotoz]

37. thats a thought

[Chakaconcarne]

22. Didn't we just offer up some of our web cybersecurity secrets right after Trump was elected?

I read that somewhere..

[pnwmom]

24. Yes! I remember that, too.

[defacto7]

27. Damn... I'm going to say "I told you so."

I have been warning about this for years. Does anyone listen? Hell no. Who would listen to some old guy with 10 outdated servers who's been playing tag with cyber hacks since the 80s just for the hell of it. You would think governments with billions could figure this stuff out while this novice tech saw it in the works for practically nothing. It amazes me how cyber inept we've become as a nation. And I'm noboby.

[pnwmom]

28. Keep warning, defacto7. And please connect some dots while you're at it.

You're someone who knows something about computers, unlike me. We need people like you to work on this.

[defacto7]

33. Thanks pnwmom...

My fascination with the Internet and server security is just a hobby but maybe that's what makes it more obvious to me. I'm not prone to look the other way for the sake of the money or be controlled by the politics of it.

[IthinkThereforeIAM]

34. Yes...

... I did my site creation and hosting as a hobby, not into it anymore, I could but...

[defacto7]

38. Understood... nt

[pnwmom]

39. You have a chance to serve the country now with your hobby. Go for it!

When have you ever had a better excuse to indulge your "hobby"?

[hamsterjill]

30. It's simple.

They don't look for the "simple".

Would be pretty powerful if Kaspersky was "invited" onto many computers in the United States (and the world) and then just turned everything off all at once, wouldn't it?

Simple is usually more effective than difficult.

[defacto7]

35. It is definitely the simplicity that makes it stealthy

Cyber crime, espionage, whatever, plays on fear of the unknown until people give in and give up their privacy to experts. Trusting experts on the idea that money can buy security and more money buys more security is a foolish premise. Trusting any expert to make sure we can live dangerously under their umbrella is a fools game. It is and always has been up to every person to be up to the task of securing our own important data and be able to test any company we need to be connected with. If we can't do that, then don't use the net for anything important.
The untrustworthy will always try to make security just beyond the average person's reach and pick their target from the surface dwellers. Unfortunately, I think our government is mostly made of surface dwellers. Easy pickins.
There's just something about trusting "big daddy" that makes me wary.

[pnwmom]

40. My relative who works in a bank doesn't do her banking online. So neither do I.

She only does hers in the secured server at work, and that's not available to me, so I still go into the physical bank.

[defacto7]

42. That's great. It's a pain I know...

Sometimes the easy way seems to be a wonderful opportunity, but it can also be a headache if it's not properly implemented and banks aren't always setup well...and who is to know if they are? One thing is for sure, if you don't use it, it won't hurt you. If one does use the net for important information then they need to know what they're doing and the possible consequences if they don't. Sounds like you and your relative know what to do and that is good for all of us!

[IthinkThereforeIAM]

32. I used to create and host a few sites...

... in the early 2000's. So I have been aware of Kaspersky, too. I never felt I could trust it, although their alerts were interesting. Too many weird coincidences reading their history and things they brag on as of today...

[defacto7]

36. That's the old game..

Build trust and look like a saviour then conquer or the better analogy might be Trojan Horse. I just take what data is relevant and never bite their bait. You certainly can't listen to their pitch. I have little confidence in any company that offers security. Security doesn't exist on the net. The trick is to be as wary and educated as possible about the basics.

[Blue_Tires]

31. I've been telling folks this for awhile... They don't try to hide it...

There's also a Kaspersky connection to Snowden, but that's not my business...

[dalton99a]

41. No Kaspersky. Don't need it, don't want it, don't trust it.