Surveying Practices of 17 AV Firms

Questions ISMG posed to the AV companies:

Quote:

---

1) What steps do you take to secure suspicious file samples when they are transmitted from a user's PC to your researchers? For example, are all such communications encrypted?

2) Could outside attackers eavesdrop on those communications, and if so, how? What defenses are in place to prevent this?

3) Do you ever share copies of these files with VirusTotal, law enforcement agencies, or intelligence agencies domestic or foreign?

4) For a user, is sharing suspicious files with your researchers optional? If so, do users "opt in" - or must they "opt out"?

5) Do you anonymize the source of suspicious files, and if so, how (and at which point[s] in the submission chain)?

6) Has your firm engaged in any marketing that suggests that Kaspersky Lab products are not reliable, and does it have any hard evidence - aside from U.S. media reports - that cite anonymous sources) to back up these assertions?

---

See here for the answers.

Interestingly, all of the UK and US AV firms declined to comment their practices.

Quote:

---

Originally Posted by article

3) Do you ever share copies of these files with VirusTotal, law enforcement agencies, or intelligence agencies domestic or foreign?

---

they share with each other and with governmental agencies, this is normal, they all want to be up-to-date with malware detection abilities

Quote:

---

6) Has your firm engaged in any marketing that suggests that Kaspersky Lab products are not reliable, and does it have any hard evidence - aside from U.S. media reports - that cite anonymous sources) to back up these assertions?

Israeli intelligence allegedly hacked into Kaspersky Lab's network and found Russian intelligence was already monitoring the company's communications with endpoints, as well as running searches for interesting-looking files on customers' PCs.

---

there is currently a heavy anti-russian propaganda campaign going on, from the usual suspects (usa, nato, eu, israel officials and their major media outlets), so this is probably just fabricated "evidence" as a part of this campaign

Quote:

---

Who to Trust?

---

these are all private companies, there is no way to prove their claims, nor to be able to check on the current status of these claims
under certain conditions all their data can be seized, inspected or monitored by their governments (during wartime or under patriot act or the like)

7) Do you know how TLS works? =]

http://www.zdnet.com/article/google-...rashing-https/
http://news.softpedia.com/news/zero-...s-493958.shtml

Quote:

---

Originally Posted by anon

7) Do you know how TLS works? =]

Google and Mozilla's message to AV and security firms: Stop trashing HTTPS | ZDNet
Zero-Day Exploit Found in Avast Antivirus

---

I hate when AV are MITM-ing my connection. I check it with SSLEye or with the FF addon CheckMyHttps every time I test any AV.

I disabled all the cipher suites without forward secrecy, SSLv2 and v3, MD5 and mixed content in all my browsers, and also trimmed my list of trusted CAs to the bare minimum (see https://github.com/pyllyukko/user.js...relaxed/CAs.md). These changes break some sites, but that's their fault. You can check your setup at https://www.badssl.com/. Most of the red-colored links should be blocked.

I also read a ton of articles and papers about TLS this year and learned just as much. It was amazing to find out how ignorant I was about basically everything.

Also, I just realized you and I have been talking about security for almost a decade! Aren't we just the best =]