Kaspersky Labs: Warning over Russian anti-virus software

The British government has issued a fresh warning about the security risks of using Russian anti-virus software.

The National Cyber Security Centre is to write to all government departments warning against using the products for systems related to national security.

The UK cyber-security agency will say the software could be exploited by the Russian government.

Security firm Kaspersky Labs, accused in the US of being used by the Russian state for espionage, denied wrongdoing.

Kaspersky Labs is widely used by consumers and businesses across the globe, although they are not being advised to stop using the software, as well as by some parts of the UK government. Around the world, 400 million people use Kaspersky products.

In other news, Barclays has stopped offering free Kaspersky software to customers as a "precautionary decision".

www.bbc.co.uk

Still using Kaspersky software? You have been warned...

Israeli spies looked on as Russian hackers breached Kaspersky cyber-security software two years ago, US media report.

The Russians were allegedly attempting to gather data on US intelligence programs, according to the New York Times and Washington Post.

Israeli agents made the discovery after breaching the software themselves.

Kaspersky has said it was neither involved in nor aware of the situation and denies collusion with authorities.

Last month, the US government decided to stop using the Russian firm's software on its computers. The Israelis are said to have notified the US, which led to the ban on Kaspersky programs.

www.bbc.co.uk

Use Kaspersky software? Time for a rethink - read this...

The German Federal Office for Information Security (BSI) warned organizations against using Kaspersky antivirus software over fears it could be exploited for cyber-espionage or launching cyberattacks amid Russia’s ongoing war in Ukraine.

While the office is not explicitly banning the use of Kaspersky software, the security agency is urging German organizations to replace products made by the Moscow-headquartered firm with alternative software from non-Russian vendors, warning that Russia’s military and intelligence activities in Ukraine, along with its threats against Europe, NATO, and Germany, means there is “a considerable risk of a successful IT attack.”

“A Russian IT manufacturer can carry out offensive operations itself, be forced to attack target systems against its will, or be spied on without its knowledge as a victim of a cyber operation, or be misused as a tool for attacks against its own customers,” the BSI said in a statement, explaining that antivirus software such as Kaspersky’s have deep system access and must maintain a permanent, encrypted and non-verifiable connection to the manufacturer’s servers. “Companies and authorities with special security interests and operators of critical infrastructures are particularly at risk,” the statement adds.

www.techcrunch.com

Hackers hijacked ASUS software updates to install backdoors on thousands of computers

Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world’s largest computer makers, was used to unwittingly install a malicious backdoor on thousands of its customers’ computers last year after attackers compromised a server for the company’s live software update tool. The malicious file was signed with legitimate ASUS digital certificates to make it appear to be an authentic software update from the company, Kaspersky Lab says.

ASUS, a multi-billion dollar computer hardware company based in Taiwan that manufactures desktop computers, laptops, mobile phones, smart home systems, and other electronics, was pushing the backdoor to customers for at least five months last year before it was discovered, according to new research from the Moscow-based security firm.

The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines.

Kaspersky Lab said it uncovered the attack in January after adding a new supply-chain detection technology to its scanning tool to catch anomalous code fragments hidden in legitimate code or catch code that is hijacking normal operations on a machine. The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore. In the meantime, Kaspersky has published some of the technical details on its website.

www.motherboard.vice.com

Use Kaspersky software? Read this...

Russia’s growing aggression toward the United States has deepened concerns among U.S. officials that Russian spies might try to exploit one of the world’s most respected cybersecurity firms to snoop on Americans or sabotage key U.S. systems, according to an ABC News investigation.

Products from the company, Kaspersky Lab, based in Moscow, are widely used in homes, businesses and government agencies throughout the United States, including the Bureau of Prisons. Kaspersky Lab’s products are stocked on the shelves of Target and Best Buy, which also sells laptops loaded by manufacturers with the firm’s anti-virus software.

But in a secret memorandum sent last month to Director of National Intelligence Dan Coats and Attorney General Jeff Sessions, the Senate Intelligence Committee raised possible red flags about Kaspersky Lab and urged the intelligence community to address potential risks posed by the company’s powerful market position.

www.abcnews.go.com

'Very high level of confidence' Russia used Kaspersky software for devastating NSA leaks

Three months after U.S. officials asserted that Russian intelligence used popular antivirus company Kaspersky to steal U.S. classified information, there are indications that the alleged espionage is related to a public campaign of highly damaging NSA leaks by a mysterious group called the Shadow Brokers.

U.S. investigators “now believe that those manuals [leaked by Shadow Brokers] may have been obtained using Kaspersky to scan computers on which they were stored.”

www.yahoo.com

Kaspersky, China Telecom, China Mobile named 'threats to US national security'

 

The United States Federal Communications Commission (FCC) has labelled Kaspersky, China Mobile, and China Telecom as threats to national security.

The three companies join Huawei, ZTE, Chinese radio-comms vendor Hytera, and Chinese video surveillance systems vendors Hangzhou Hikvision Digital Technology Company and Dahua Technology Company.

Kaspersky is the first non-Chinese company to be added to the FCC's list, but the agency did not tie its decision to Russia's illegal invasion of Ukraine.

The companies were named under the USA's Secure and Trusted Communications Networks Act of 2019 – a law that "prohibits the use of certain federal funds to obtain communications equipment or services from a company that poses a national security risk to US communications networks."

www.theregister.com

Facebook Messenger Spam Leads to Adware, Malicious Chrome Extensions

A virulent spam campaign has hit Facebook Messenger during the past few days, according to recent warnings issued by Avira, CSIS Security Group, and Kaspersky Lab.

The Facebook spam messages contain a link to what appears to be a video. The messages arrive from one of the user's friends, suggesting that person's account was also compromised.

The format of the spam message is the user's first name, the word video, and a bit.ly or t.cn short-link.

Users that click on the links are redirected to different pages based on their geographical location and the type of browser and operating system they use.

It's been reported that Firefox users on Windows and Mac are being redirected to a page offering a fake Flash Player installer. Kaspersky says this file installs adware on users' PCs.

On Chrome, the spam campaign redirects users to a fake YouTube page pushing a malicious extension. It is believed that crooks use this Chrome extension to push adware and collect credentials for new Facebook accounts, which they later use to push the spam messages to new users.

www.bleepingcomputer.com