• 0 Posts
  • 20 Comments
Joined 1 year ago
cake
Cake day: October 21st, 2023

help-circle


  • It’s all relative. My cheap Chinese spyware SmartLife devices are free to report the hours I turn my lights on back to China as they please, but they sit on a segmented VLAN with per client isolation.

    If they ever EOL’d them, I’ve got more than my money’s worth, and yes, some of them can be flashed, but I’d probably just buy another well established cheap Chinese competitor.

    But I agree, the above is not the use case and situation for every IoT device out there, and there are plenty of devices that I would never consider an internet/SaaS dependent version of e.g. medium to large home appliances.





  • I think you’ve confused my previous comments as some sort of moral equivocation, which they really weren’t meant to be, but since you brought it up…

    You may believe that America’s intelligence agencies, on balance, are more moral than Russia, and you’re probably right, but that is damning by faint praise.

    Espionage is literally the act of committing crimes on behalf of a government. It’s not altruistic and it’s not used to fight the good fight of corruption, or the mafia. In fact, it’s often done in conjunction with those actions and organizations, because that is what the job often requires.

    Either way, Russia doesn’t need Kaspersky to run its domestic surveillance network or it’s myriad of police state apparatuses.

    FYI oftentimes terrorism is blowback from actions taken by intelligence agencies years, or decades, prior. That is, the groups and ideologies they fund, train, and use, for their own ends, don’t cease to exist just because they’re no longer useful, or needed, by those agencies.


  • Retail generates the most margin, while enterprise generally the most revenue.

    At least, that’s how it works at most vendors that operate both B2C and B2B sales and product channels.

    But no, Kaspersky is a major legacy player in the B2B security market with both mature and cutting edge products/solutions.

    A better question might be, which companies in America were still using Kaspersky up until this month, and why.

    My guess that is a mix between budgetary constraints, incompetence, and weighted risk analysis.

    Imagine you’re a Midwestern ice cream wholesaler, it’s been a bad few years, and your 200 Kaspersky licenses were renewed with deep discounts.

    You’re not likely to lose any contracts for using Kaspersky, nor be a target of state sanctioned espionage, but spending $10,000 between new licensing and man hours, to rip, replace, and configure a new solution, now that could cause real issues for you.

    So, between a rock and a hard place, you just wait it out as long as possible and hope that when the other shoe drops, it doesn’t wreck your budget.


  • No problem, happy it helped.

    Your summary is mostly accurate, but I think a better way to understand it would be like this:

    Low level security software, by nature, is the ultimate attack vector, if compromised.

    Assume that all countries that have both a domestic tech sector, and a well-resourced national security apparatus, have some version of on demand government initiated supply chain attack capabilities.

    So it’s not like I believe that all Kaspersky installs include a RAT piped directly to some GRU/FSB unit, just the ability for a malicious payload to be inserted - just as the NSA can do with American tech companies.

    Not every risk can be mitigated, but some risks just shouldn’t be taken.


  • That is so wrong that it’s actually impressive.

    Either you’ve never worked in this space, or because it wasn’t present in the few IT departments you’ve worked in, you extrapolated that to mean it wasn’t present in any large organization.

    By all means, I don’t disagree that American firms should not be using Kaspersky, just as Russian firms should not be using Sophos (UK based), but to pretend that they aren’t one of the oldest and most well-established brands in the space is misinformed at best.

    I think you’ve actually confused the fact that they have a retail product presence, to mean that they don’t have serious enterprise solutions, but they do. NDR, XDR, agentless for hypervisors, etc.


  • No, yes, sorta, but no different than how most, if not all, large American security and tech vendors have either over, or covert, links to the the American Security State.

    Kaspersky is a long established pioneer and leader in the security space, hands down one of the best track records over the long run, and you should take their reporting and disclosures seriously.

    I’m not saying that to dismiss the very valid concerns about installing Kaspersky on sensitive private sector and government systems, but to contextualize my answer.

    On a sort of related note, earlier I said that the American security state has both overt, or covert, links all across the American tech sector.

    What that means is that, even if a company holds their principles not compromising their customers or their product, the US government can either get a court order to force it, or they’ll be targeted by something like the Pentagons Signature Reduction program and have sheep dipped employees worked into their organization.

    Point is, Kaspersky is one of the few remaining Russian brands and entities still holds a lot of credibility in it’s field, but again, that doesn’t mean the concerns of Western government’s aren’t valid, just that they should be viewed in a wider context.


  • Not that Israel needs an excuse to commit a war crimes on any day that ends in Y, but I don’t believe this is a violation of the Geneva convention.

    It was a mass targeted assassination campaign against an opposition military force structure. I’m not saying it’s not a crime, just that I don’t believe it’s a war crime.

    But I’m open to the very real possibility that I am wrong about that. So if I am, can you point me to the article(s) it’s in violation of?

    I genuinely would like to fill that gap in my knowledge, if it exists.