Interviews: Ask What You Will of Eugene Kaspersky 115
Eugene Kaspersky probably hates malware just as much as you do on his own machines, but as the head of Kaspersky Labs, the world's largest privately held security software company, he might have a different perspective — the existence of malware and other forms of online malice drives the need for security software of all kinds, and not just on personal desktops or typical internet servers. The SCADA software vulnerabilities of the last few years have led him to announce work on an operating system for industrial control systems of the kind affected by Flame and Stuxnet. But Kaspersky is not just toiling away in the computer equivalent of the CDC: He's been outspoken in his opinions — some of which have drawn ire on Slashdot, like calling for mandatory "Internet ID" and an "Internet Interpol". He's also come out in favor of Internet voting, and against SOPA, even pulling his company out of the BSA over it. More recently, he's been criticized for ties to the current Russian government. (With regard to that Wired article, though, read Kaspersky's detailed response to its claims.) Now, he's agreed to answer Slashdot readers' questions. As usual, you're encouraged to ask all the question you'd like, but please confine your questions to one per post. We'll pass on the best of these for Kaspersky's answers. Update: 12/04 14:20 GMT by T : For more on Kaspersky's thoughts on the importance of online IDs, see this detailed blog posting.
What Color Is Your Hat? (Score:5, Interesting)
Where in the world is John McAfee ? (Score:5, Funny)
Sorry could not resist :)
Re:Where in the world is John McAfee ? (Score:4, Funny)
I think you're confusing Kaspersky with Broderbund.
Re: (Score:1)
Re: (Score:3)
Where in the world is John McAfee ?
There's no world in which McAfee and Kaspersky can both exist at the same time.
On Your Exploit-Free OS (Score:5, Interesting)
Architecturally, the operating system is constructed in such a way that even a break-in into any of the components or applications loaded onto it won’t allow an intruder to gain control over it or to run malicious code.
Could you expound on this? Are you writing this code or still in the design phase? Or better yet, could you compare it to something like, say, CentOS or Debian and tell us how your architecture is going to be more secure? I understand you're scoping down the requirements of your OS to be more easily manageable but the skeptic in me feels like it just can't be done. The cat and mouse game must be played in some form or fashion.
Re: (Score:2)
Re: (Score:2)
Not an OS in the traditional sense. It's mission specific firmware code tailored for single purposes.
So.... its freedos run as virtualization images? An awful lot of embedded work got done before modern OS and its still getting done more or less despite them.
Re: (Score:1)
Re: (Score:2)
I don't think RTOS like being virtualized very much. Overhead. I use linuxcnc on my milling machine and the devs make a big deal out of microseconds.
Re:On Your Exploit-Free OS (Score:4, Interesting)
Well, yes, but I think Kaspersky is advocating that we swing the pendulum in the opposite direction: instead of making trade-offs against security, we make a niche OS that makes all of its trade-offs in favor of security, trying to keep in mind the specific needs of industrial control systems. He's also advocating -- if you'll forgive me -- a paradigm shift, in which security becomes the mantra, rather than stability. This is unsurprising, coming from a security professional. I can't say whether he's an ideological fool or a visionary, but they are not mutually exclusive.
Of course, convincing people to use an operating system that made all of its trade-offs against ease-of-use, backwards compatibility, features, and stability may end being even harder than writing it.
Re: (Score:2)
Of course, convincing people to use an operating system that made all of its trade-offs against ease-of-use, backwards compatibility, features, and stability may end being even harder than writing it.
Nah, it's not hard to convince people that matter to use the operating system. Or, rather, I should say that shouldn't be a goal to get mainstream adoption. I too am creating a secruity focused operating system from scratch -- Uses separate isloated call stacks rather than place data and code pointers in the same stack, and some other tricks to keep code pointers in heap data structures from being modified. My design calls for a different compilable programming language other than C as a base because C's
Re: (Score:2)
And there already is a niche OS that makes all of its trade-offs in favor of security, it's called OpenBSD. It's BSD licensed, so could be a good starting point for an industrial control OS focused on security and stability.
Re: (Score:2)
A read-only OS is called a Live CD (or more generally Live distro, since they're rarely used from CDs anymore). The downside of course is that updates are more challenging.
If you can netboot, you can get the advantages of a read-only system while not being a pain to update by simply making sure the network machines can't write to whatever they're booting from. Admins can still write changes in, then updates become as easy as making the change once and telling people to reboot. Unfortunately this has the
Did.... (Score:2)
Wired - Corrected Link (Score:5, Informative)
The link in the summary is invalid. Here is the correct one:
http://eugene.kaspersky.com/2012/07/25/what-wired-is-not-telling-you-a-response-to-noah-shachtmans-article-in-wired-magazine/ [kaspersky.com]
Your secure OS (Score:3)
You plan on making a secure OS for for industrial/infrastructure systems do you plan on basing it on preexisting open kernals, BSD, Linux, Haiku, Mach. Will it be a Unix/Posix like? will it be a monolithic or micro kernal? or are you think of more of hypervisor that host and monitor the guest os for the scada systems?
2-3 digital concepts young people should learn? (Score:5, Interesting)
There's much talk about combating malware through technical solutions (e.g., adding transparency to communication, building increasingly sophisticated scanning systems, etc).
But what interests me is what we should be teaching our young people (students, in primary and secondary school) with respect to the expertise we wished that all adults possessed.
In your estimation, what are 2-3 things that, if young people understood well, would help them excel in the face of cyber adversity (e.g., malware, privacy theft, etc)?
--Dave
Online anonymity (Score:5, Interesting)
Recent protest movements and the Arab Spring have shown that the ability to use the Internet anonymously is crucial to organising resistance and circumventing censorship or oppression. In light of that. have you modified your views on the "Internet ID"?
easiest way to wipe? (Score:5, Funny)
Re: (Score:2)
VAIO S Series 15 Custom Laptop (Score:3)
Description: VAIO S Series 15 Custom LaptopComponent: 750GB (7200rpm) hard drive
Component: 3rd gen Intel® Core i7-3632QM quad-core processor (2.20GHz / 3.20GHz with Turbo Boost)
Component: NVIDIA® GeForce® GT 640M LE (2GB) hybrid graphics with Intel® Wireless Display technology
Component: Windows 8 64-bit
Component: Internal lithium polymer battery (4400mAh)
Component: Kaspersky® Internet Security (30-day trial)
Component: Black
Natalia Kaspersky's Support of Government Malware? (Score:5, Interesting)
Re: (Score:1)
By your definition, what firewall isn't malware?
The ones that allow a user to configure them as they please. Once that level is abstracted, it's under someone else's control and is limiting and disabling user desired computer interaction. Everyone should run a firewall, no one should be subjected to another man's firewall.
Anonymous Internet IDs (Score:5, Interesting)
Do you believe everyone could be issued an ID, and still remain anonymous? What I mean is, I believe that you could ensure each of your users is unique, but not necessarily know who they are. If everyone is issued a certificate signed by some trusted authority, one could verify that the certificate is valid, without the certificate exposing the information about who you are. You could even have a scheme that lets the authority issue you multiple IDs, but only one for each unique ForUseWithDomain attribute, such that if you wanted to keep your identity from being correlated across different sites, you could do so. This could probably even be automated.
This would ensure that if you banned a malicious user from your site, they wouldn't be able to come back without compromising someone else's certificate. Yet, you still get a high level of anonymity.
Sites that require non-anonymous access could deny anonymous certificates, and require that you authorize access to full name perhaps. This would be like OpenID in the way it will prompt you for a site requesting additional information, like your email.
Re: (Score:2)
"If it comes to a root, people can trace it up to the root."
Maybe I misunderstand what you mean here. Yes, they can trace it to the certificate authority. This is like knowing who issued the ID, it doesn't tell you anything about the ID itself. In fact, this is property is key to ensuring the ID isn't forged/self signed, because anyone can verify it with the cert authority. It is like a client side SSL certificate that doesn't include any of the attributes that identify the organization/company. All yo
Let's say you kill a guy (Score:5, Funny)
In a small Latin American country like Belize. You've gone on the run, the police are hunting you and your options for escape are coming up short. You've started a blog to discuss your situation, but no external entities have helped. What's your next step?
-- John
Why do we still use the black list security model? (Score:4, Insightful)
Malware continues to be successful despite our current efforts. Why do we continue to use the same failed security model? Automated white listing seems like a better answer to modern security problems.
Re: (Score:2)
You missed the part where I said 'automated'.
Imagine a whitelist that checks with a central repository that reputable software manufacturers send their updates to. Even with updates, checking the software you regularly run is now a simpler problem then comparing everything you run to a list of all the malware in existence.
Are you planning on moving to Belize? (Score:1)
For a life of adventure? It seems to be the in thing for writers of AV software these days.
What's... (Score:3, Insightful)
What is an internet ID? (Score:2)
Kaspersky's relationship with the government? (Score:5, Interesting)
Does Kaspersky have a relationship with the Putin administration or the FSB?
Do either of these organizations have any influence on the business practices or technology of Kaspersky antivirus?
Should a security minded person be concerned with the geographic origin of security software?
Ken Thompson's Hack (Score:5, Interesting)
One of the threats I expect to see more of is in the vein of Ken Thompson's hack [bell-labs.com], where a compiler (or any other build tool) hosts a trojan and infects other programs it compiles (or links, assembles, etc.) practically undetectably. With open-source software taking an ever-more-vital role in the Internet's core systems, will this kind of attack be easier to detect (perhaps due to the widespread availability of still-clean compilers), or more difficult (perhaps due to the wide network of trusted developers)?
Fully Countering Trusting Trust (Score:2)
Mentions of Ken Thompson's Reflections on Trusting Trust should also mention David A. Wheeler's "Fully Countering Trusting Trust" [dwheeler.com] which provides a means of identifying and resolving a malicious compiler.
Re: (Score:2)
well you could in the case of a open source compiler read the source or if you don't have the expertise in that are hire a(team of) code analyst / auditors / programers. you could also compare the binaries of two different standard complaint compilers that have compiled the same code on the same hardware. you also write you own compiler and boot strap you own system from source ala gentoo/linux from scratch
Re: (Score:2)
No, actually, you can't. Its computationally infeasible to find deliberately hidden malware in a body of code, whether source or object. So no amount of analysis and/or testing can ever reliably tell you whether in fact your existing system is corrupt. You can only accomplish that by starting with a formal set of requirements that you can then successively refine into code that is (a) minimal, and (b) demonstrably maps directly to your formal specifications and their requirements. Any excess beyond what
Are you safe Mr. Kaspersky? (Score:2)
Mr. Kaspersky are you safe?
Your operating out of the same country that has a ton of botnet operators and raking in some decent dought with cheap pharmaceutical sales thanks to people desperate or naive enough to do so.
There are have been some interesting stories hailing from your corner of your world. How do you feel with your ability to run your company the way you want and without any threats to you or your staff?
why no Bootable Discs anymore?? (Score:2)
I was surprised that companies don't rig the install disc to be self booting anymore Why is this??
would not be a problem but an updated bootable copy seems to be either Vodoo or in the form of download a full copy every time
Internet X meme (Score:5, Interesting)
You seem to support the "Internet X" meme where X is whatever we have in the physical world. ID, passport, voting, interpol, perhaps others. Why?
I mean we are all techies here, OK, so we don't have to act all "marketing" with each other about our new "selling dog food over the internet" patent and so forth.
I've got a perfectly good ID in the physical world that I share with amazon.com called my postal addrs and my CC number, and we're both perfectly happy with that situation. I've got a perfectly good paper and ink passport for crossing international borders, an internet one seems pointless. I/we have an Interpol who already handle crime about as well as any multinational police force could ever hope to, so I'm unclear what one on the internet would do that the real one isn't already fully responsible for. I have a perfectly good voting site 2 blocks from my house where I can vote in person using optical scanned ballots in perfect safety for like 12 hours on voting day, with no intimidation, and very limited to non-existent corruption because there's both a paper and ink ballot and an instant optical scan, what needs fixing about that or moving to the internet?
You've listed some things that have evolved over time to, basically, work pretty well. What is the point of lets replicate that "... on the internet"? Wouldn't we be all better off if we just improved the real Interpol, instead of making a second shadowy clone? Or improved voting, not just "add internet voting". Or improved ID, not "add another form of ID to be stolen"?
Or looking at it another way, why not "Internet X" where X is stuff that doesn't work. Health care. Taxes. Politics. Debating.
I don't see this as a strictly financial self interest question, for example you can probably make as much dough, or more, selling to the real Interpol as selling instead to a shadowy secondary clone. What do you care what the name on the invoice is?
From a techie perspective I/we see this as weird. Say my video card is getting slow/flakey. I could fix the one I have by blowing the dust off the fan, but, naah I'll get a shadowy secondary video card that is a mystery and not nearly as debugged, and try to get them to work in parallel... No that's just now how techies work. We know better.
So why "Internet X"? Not just "improve X"?
govt vs corporation (Score:2)
criticized for ties to the current Russian government.
You'll have to give me a break because all the links WRT this topic in our provided summary were 404 when I checked a couple seconds ago, so if I mischaracterize anything then its all timothy's fault.
Anyways WRT to corp govt relations, I'm guessing the model of the disagreement is:
In the US the corps completely own and control the govt and no other groups or individuals have any input or control over the govt, and we expect everyone else to live that way, but in .ru, the relationship is not quite as central
Healthcare/Industry-specific software (Score:1)
Class A1 design? (Score:3)
Given the the long established history with reference monitors and Class A1 design, will your from-scratch OS follow TCSEC (Orangebook) guidance so as to provide verifiable assurance that no trap doors or Trojan horses exist in the code? If not, what is your approach, instead?
Who is winning? (Score:3, Interesting)
Mr. Kaspersky,
Who is winning the Cyberwar?
Re: (Score:3)
Segmentation to represent security objects? (Score:2)
Give the long established practice in high assurance computer systems design to use segments to represent base-level security objects (so as to maximize alignment of hardware-enforced security policies with promised protections of the objects), will your new OS design rely on segments to represent security objects, or if not, what hardware abstraction will you use, instead?
Re: (Score:2)
if there was do you think he would honestly answer your question?
Re: (Score:3)
What's wrong with AHA?
It'll be gone
In a day or two!
KGB/FSB links (Score:3)
Any comment on these allegations?
malware history and future (Score:1)
You've been in computer security a long time, and have seen many things come and go.
DOS/bootsector viruses, Windows viruses, macro viruses, rise of worms to replace them, and now the commercialization of malware with botnets, extortion-ware and the targeted weaponised malware like the one that hit Iran (and who knows what else).
What's changed? What's remained the same? What about the malware creators - has their motivation changed?
Where do you believe things are headed?
"Approved" Spyware (Score:3)
Why be a Formula One Racing sponsor ? (Score:2)
What brought about the move to sponsor the Ferrari Formula One Racing team in 2011 and 2012?
Eugene Kaspersky *loves* malware (Score:2)
Of course, malware is making him rich and famous, how could it be otherwise.
Other things E.K. loves: poorly conceived O/Ses ; lack of education in users ; and the status quo in matters of computer security.
I'm personally convinced that anti-malware software is a useless hack. Without it, we would have moved away long ago away from easily hackable systems.
Eliminate the competition (Score:2)
What arm of the Russian mafia did you send to whack John McAfee's neighbor? :-)
Assembly code and vulnerability of Apple (Score:2)
This is kind of a two part question. Or more like one statement and one question.
We see Apple growing in market share and one of the memes that has been accepted by a large part of the community is that Apple is not targeted by malware authors in part because the return on investment is not as high as it is for Windows machines. To put it another way, if a malware author targets Windows they get millions of home users, but more importantly, they also have the potential to infect corporate systems, server
Do you create malware? (Score:2)
Are there any grounds to allegations that antivirus companies may be involved with creating malware, as a form of job security?
Which OS/OSs do you run? (Score:3)
While MS Windows is the most common computer OS around, there are obviously many others. For your personal use, what is your main OS, and how do you keep it secure (do you, e.g. run MS Windows with anti-malware software, or do you run Ubuntu Linux with the defaults)? Is this a setup that you would suggest for others, or is it too esoteric?
How will your business model change for Linux? (Score:2)
The Moral Equivalent of War (Score:2)
[Introduction] (My apologies for the long introduction to the question, but Slashdot only allows one!)
Mr. Kaspersky,
In the 1970's, following an Arab enforced oil embargo on Israel, the United States found itself a midst an energy crisis. President Jimmy Carter educated America on the Energy Crisis, warning that the issue could escalate into a national crisis, and equating the energy crisis "the Moral Equivalent of War." President Carter outlined 10 policies which touched on reducing demand through conserv
Criminal malware vs Government sponsered malware (Score:1)
With your experience in malware research. What percentage of malware in use today do you see as being from criminals vs how much is from rogue governments such as China or the US and how do you see that percentage changing over the next ten years? Technically two questions but they are deeply related.
Everyone's question (Score:2)
Share some of your local viewpoint with us, please (Score:1)
Mr. Kaspersky,
Your position running a leading high technology company out of a former Iron Curtain country gives you a unique perspective combining a deep knowledge of information technology with a deep local knowledge of the strengths and weaknesses and possibilities in the largest country in the world. Please spell out for us how Russia could become the dominant country in high tech by the end of the 21st century, displacing Silicon Valley, by making the best use of various local strengths. Please focus y
Re: (Score:2)
You're doing what annoying people sometimes do at conferences: disguising an overly pompous and wordy opinion as a question. Don't do that.
consumer behavior (Score:3)
Hello,
If there was one piece of behavior you could change in home Internet users, what would it be?
Regards,
Aryeh Goretsky
Re: (Score:2)
Hello,
I think that's actually a pretty damn valid question. While it might be interesting for us to ask Mr. Kaspersky technical questions (technology used by his lab, questions about the OS he's developing, etc.), when it comes down to, a large amount of malware which attacks corporate infrastructure is hosted on consumer (i.e., residential) IP blocks. Of course, there's also things like targeted infections, spearphishing, etc., but even those have to deploy from somewhere.
Remediation also tends to be a l
Working with supression (Score:1)
The last 0.1% (Score:2)
Most commercial AV software is pretty slow and bogs down your system. In comparison Microsoft Security Essentials doesn't. The argument has always been that MSE and similar light weight AV software won't give you 100% protection, but is the extra 0.1% worth the weight of a full "internet security" suite?
Mgmt Server (Score:1)
Re: Enumerating Badness (Score:2)
Because there is no money in enumerating goodness