Interesting, and lengthy, article on Eugene Kaspersky and Kaspersky Labs.
I have a couple of questions on it though.
(1) The article is unclear as to *what* types of data are sent to Moscow. It talks about scanning every application, file, and email, but then it only talks about sending *application* back to Kaspersky Labs. Does it also send suspicious files and emails (both vectors of viruses)?
Some documents seem to imply only statistics are sent, not the file itself. Others refer to "analysis of the file" in the lab, which seems to imply the file is sent.
(2) Does the Cisco or Microsoft embedded software provide this "Kaspersky Security Network" capability too?
Some documents I've read implied "no", but others seem to say "yes".
(3) Does the US Government have any policies against using the Kaspersky Security Network to send data to Russia?
Todd
Russia’s Top Cyber Sleuth Foils US Spies, Helps Kremlin Pals
Kaspersky antivirus software increased 177 percent, reaching almost 4.5 million a year—nearly as much as its rivals Symantec and McAfee combined. Worldwide, 50 million people are now members of the Kaspersky Security Network, sending data to the company’s Moscow headquarters every time they download an application to their desktop. Microsoft, Cisco, and Juniper Networks all embed Kaspersky code in their products— effectively giving the company 300 million users.
When a user installs Kaspersky software, it scans every application, file, and email on the computer for signs of malicious activity. If it finds a piece of known malware, it deletes it. If it encounters a suspicious program or a message it doesn’t recognize—and the user has opted to be part of the Kaspersky Security Network—it sends an encrypted sample of the virus to the company’s servers.
Related information:
Kaspersky Security Network whitepaper
1. Information on the newly launched or downloaded applications and visited web pages (URLs) is sent by users of the most recent Kaspersky Lab‟s consumer and corporate products.
2. The files and URLs are checked and added to the Urgent Detection System database if they turn up to be malicious. Legitimate files are added to the “Whitelisting” database.
3. Kaspersky Lab‟s experts finish the analysis of suspicious files, determine their degree of risk and add the description to signature database.
Kaspersky Security Network in Kaspersky Lab 2011 products
The technology also allows sending unknown files or their parts to Kaspersky Lab servers.
|