Kaspersky Lab Unveils Spy Network

Experts of the Russian antivirus company Kaspersky Lab uncovered a large-scale spy network. It has been established that cybercriminals for five years illegally collected data from mobile devices and computers of diplomatic departments and government agencies. The attackers target were organizations in Eastern Europe, the CIS, and also in North America.

"The first data came to us in October 2012 of the year. One of our partners sent a suspicious infected malware file, which we analyzed and quickly realized that this attack was quite high profile and interesting. By the set of files that interest attackers, it was clear that they interested in documents, ”said Vitaly Kamlyuk, a leading antivirus expert at Kaspersky Lab.“ The list of victims makes it clear that they are interested in some specialized organizations, embassies, as a rule, Eastern Europe. We also Delivered that a number of companies from the film industry, oil and aerospace have been infected. "

“Research institutes were infected. Accordingly, they were also interested in the format relating to modern scientific research,” the expert said. “What distinguishes this program from others that we have seen is, perhaps, the fact that in this case we see a massive development for the first time with so much malicious code. And here is a trace of Russian-speaking developers. This is unique because we haven’t met this before. "

Comments

[Nevsky]

He eats a lot of operative ....

[Alexander Romanov]

The question is who remains open or do everyone understand where the legs grow from

[Ross]

It is quite obvious why the states of the cyber command created. That is why it is necessary to close our programmers from cooperation with western companies.

[Maks111]

It is just necessary for officials not to buy all kinds of iPhones, but the usual simplest phones where there is not even Internet.

[domokl]

For information that needs to be protected, it’s not so much that it’s eating ... But it’s something else, it’s about the fact that the spies worked for quite a long time in the most classified organizations ...

[Dinver]

For some reason, it is thought in Israel, since this is the only country that has already been seen in the spread of spyware and sabotage viruses and trojans.

[bdolah]

Moreover, Russian language is not an exceptional phenomenon there. Yes, also China, after all, he generally has a full-time unit of hackers in the army.

[tronin.maxim]

Quote: Nevsky

He eats a lot of operative ....

But nadezhin!

[Cavas]

Quote: tronin.maxim

But nadezhin!

Yes there.
I sometimes get a provider at home, I was shocked at first, then I got used to it!

[bdolah]

But it’s reliable, after dismissal and the Sun I worked as an electronic engineer in the IT department, for the sake of curiosity, and to gain experience in choosing a product, I tested almost all antivirus programs. Only Norton internet security was compared with Kaspersky. But it is much more expensive, and is designed for a Western consumer who does not like to strain their brains, customizing the program for themselves. So personally, I am for Kaspersky, especially in modern computers with Ozu not less than 2 hectares ....

[Averias]

Yes, there is not one antivirus working 100%. No, and never will be. All these are fairy tales. Forgive you for testing, did you sit and write all conceivable variants of malicious code? How many times have I encountered that Casper does not see the trojan, while other antiviruses see it. And vice versa. And no antivirus will find a specific code written specifically for something.

[bdolah]

Elementary Watson - they took the computer, infected with viruses known to everyone at that time (do not write yourself do not worry, it’s easy to infect the computer), except for those that obviously disable the hardware (then there will be nothing to test), installed the trial, updated and cleaned the computer, recorded the results and so on for six months, then compared by the number of detected, neutralized or missed threats. At the enterprise, we had more than 800 computers on the network, among other things, therefore the directorate did not want to spend astronomical amounts on corporate versions of an ineffective antivirus. Especially when our entire network became due to a virus like Kido, which the sophisticated and awesomely expensive American Trend Micro not only did not neutralize, but also did not see. Only Casper then saved. Hence the work done.
About 100% I completely agree with you, therefore, systematically monitored also with various utilities.

[Averias]

It is always a pleasure to deal with an intelligent person.

[Focuser]

Quote: Averias

And no antivirus will find a specific code written specifically for something

And no one will look for the code! Well, in this case. Modern antiviruses analyze the activity of certain programs. I think that is why Casper, for example, eats so much memory. And already from this activity, the antivirus understands whether the program is malicious or not. Did you notice that Casper sometimes blocks some completely harmless programs? Here ..

[Averias]

I repeat in the question. But what about BotNet. And what about the banal trojan that he did not recognize and the case is not an isolated one.

[Focuser]

Well, Kaspersky is not clairvoyant! Information about malware accumulates gradually. Gradually, the Trojans that were not recognized initially are locked. And I don’t understand what Botnet are you all writing about? Does this botnet have any name?

[Averias]

Well, of course, Botnet - about a quarter of computers connected to the Internet are part of the Botnet, the owners in most cases have no idea that their computers are part of this network, DDoS attacks mainly occur through the Botnet. And for the computer to become part of this network, it means that there must be something like a client installed on the computer. Only now, more than one antivirus does not see this. To Google's request - how to check a computer for the presence of a Botnet, the answer is in no way or there is a lengthy argument about running processes, about controlling Internet traffic, about unknown programs in running processes, and so on that an ordinary user cannot do. How can a user, for example, identify and calculate and heap running "SVCHOST.EXE" malicious? And as an ordinary user, he can generally know which processes are necessary and which can be a virus. For most, for example, the command line "cmd" and everything connected with it is a dark forest. And then there are some obscure processes to track. Ehh, where are the times of good old DOS

[Focuser]

I know what a botnet is) I just decided that you are talking about a specific botnet that is currently active and the possible participation of your computer in which you are concerned.
And how do you know that not a single antivirus sees a botnet client? Did you check?

[Averias]

Yes, until I manually walked through the running processes, and did not find a strange process, the description of which I did not find, but what I found confirmed that this process is clearly superfluous, and there were some difficulties with deleting it. But I can’t say that it relates specifically to the botnet network. It’s just that I talked with many system administrators, everyone says that it’s a matter of seams (this is about finding out if a computer belongs to a botnet network)

[postman]

Quote: bdolah

Only Norton internet security was compared with Kaspersky.

Independent ratings however say something else:
for the 3rd quarter of 2011

Quote: bdolah

But it is much more expensive, and is designed for Western consumers,

Not quite so, the prices are comparable, and the "setting" is no easier.

[Focuser]

Quote: Postman

Independent ratings however speak differently

So this is just the survey results! And at bdolah test results.

[postman]

Quote: Focker

And bdolah has test results.

not to pin everything. not jpg
Hold then tests

(below)
OR like this:

And this is from the most Kaspersky

Quote: Focker

And bdolah results testing.

- I WOULD LIKE EXCEPT ALSO WORDS AND LOOK (results, not chat), if not sorry

REM:(below)

[Focuser]

Basil, and you choose anti-virus software for these tests? I don’t quibble, just interesting. For me, for example, what antivirus is installed on the computer is the tenth thing.

[postman]

Quote: Focker

do you choose for these tests?

I haven’t had 3 years already :: Avast. Occasionally F-Secure
Kaspersky is not "heavy", even for my 8GB ....

Quote: Focker

installed antivirus on the computer is the tenth thing.

Not for me. It is enough to "hit" once
===================================
If there are doubts about my competence I can show thanks from mail.ru, vodafone.de, hotel.de and also from private owners / firms

[Focuser]

I have no doubts)

[Averias]

In, and you respected minus slapped. Fans are raging

[Dinver]

At the expense of antiviruses and other protection I can enlighten a little (from my own experience of illegal activities not doing xnumx for a year ):

1. 100% protection does not exist in principle.
2. The principle of operation of antiviruses: the antivirus laboratory finds the virus, adds it to the database, then updates the signatures and it is detected on the PC with the antivirus installed. That is, before the antivirus software is added to the database, the virus can sit on the PC with the antivirus for years without detection. There are also viruses with a mutable code (the code can change at least every minute), such viruses can be detected and neutralized only by behavior, and then only if the behavior does not change dynamically either.
3. The most secure PC can be killed by a person by entering a light password, opening RDP, Telnet or other remote access options, downloading questionable software, opening a questionable letter, and so on ...
4. "Schedule of admins" starts with a slight forgotten to close remote access, forgot to transfer backups (backups) to an external media, forgot to password-protect the database on the server, does not monitor Internet traffic, does not look at server logs, and so on.

From my experience, I can say that the last 2 factors I met: ATMs, cash desks, payment terminals, servers of famous Western universities, in various companies and firms, even once there was a main seaport server (if you wanted, you could send a ship or cargo to another part planets), freight companies, shops, the entire network of the mayor's office of one Italian town, and so on ... If you describe everything, then enough for a small book

[Averias]

Well, at least someone thinks sensibly. Well done +

[Lord of the Sith]

And why on TV did they say that Chinese hackers, but here in the news this is not?

[Focuser]

And on the tape it says that obviously Russian!
http://lenta.ru/news/2013/01/14/virus/
Who to believe?))

[Dinver]

Quote: Sith Lord

And why on TV did they say that Chinese hackers, but here in the news this is not?

Quote: Focker

And on the tape it says that obviously Russian!

Well, the Chinese (China would not miss the opportunity to spy in the euro zone, but as it was said the trojan spread to the CIS) and the Russians (spy at their own enterprises * facepalm *) disappear by themselves. It is necessary to look at whom it is beneficial, but it is beneficial: the USA, Israel, the EU countries, from this list you can select a country that has already been implicated in these scandals (see 1 post) ...

[Dinver]

Here is the infection map:

[Lord of the Sith]

All but China and the poop in Africa

[igor12]

The best antivirus, I have a computer with Dr.Web for half a year I caught so many viruses that it slowed down in a terrible way, but Kaspersky didn’t fail more than once, so it’s better to install Kaspersky even if it’s a little operative and eats up any viruses if they eat it with a weak antivirus two times more.

[Dinver]

Quote: igor12

The best antivirus

I use Linux OS for it there are no viruses at all ...

[Felix200970]

Quote: Nevsky

He eats a lot of operative ....

so after all, he is also looking for 300 meters around the computer

[Averias]

Well, okay, even on mail.ru, then Kasper is being promoted (only he and no one else discover "terrible" viruses, the last "masterpiece" they found is a Flame type virus, the size of which is 20MB !!!!! a kind of virus for all occasions with plug-ins plugins - in like, hit of sales on Gorbushka , some unknown malicious codes and other horror stories), then iPhones are PR not childish. Well, mail okay, for a long time already the yellow press has become like. But from TopWar did not expect this, chesslovo.

[Averias]

Who is this lover of Casper minus shut up, show yourself "hero". People, akstite, the more gadgets are included in our life, the more it plays into the hands of spies. Here's a fact for thought - All the well-known social networks are a project of the British military. Look at what it has become, this is a dream of the special services, people voluntarily lay out everything about themselves.

[Averias]

Hey the minusers, justify. Somehow strange happens, it turns out that Casper stands breastfeeding and is looking for and looking for something. And others mean suckers. The question of backfill, the famous BotNet (network) knows, but they can’t do anything. Not one antivirus can not determine whether a computer is infected with a BotNET element or not. So for that minus that. Or is that all ardent admirers of Casper? Then this is pure trolling.

[Averias]

Well, for sure, an ardent fan of Kasper minus. I have a question, there is a well-known "K" department, and there guys - don't put your finger in your mouth. So it is with the special services. It turns out they are suckers, they missed - but Casper is our hero. Then can they change their roles, Kasper will look for and catch pins? It's just that in recent years, I've already read so much about Casper's "discoveries", revelatory ones, I'm already amazed. Or maybe everything is simpler, maybe the demand for their products has fallen. And to have institutes, laboratories as customers, and in general to transplant everyone (in the obligatory order) to Kaspersky - this is a Klondike. Come on, minus.

[bdolah]

Well, there were even versions that most of the viruses are written by the antivirus manufacturers themselves in order to maintain demand. Maybe so - do not check. In my life, I came across the fact that when a new paid parking lot was opened in our microdistrict, the number of tires punctured at night sharply increased.

[Averias]

In, again, the words of an intelligent person, there is such a suspicion. Just look at the number of viruses in the database during the next update. It seems that a whole army of virus writers does just that, they write and write, write and write. The question is, why? Since in the bulk these viruses would just be neighing, the harm from them is like spitting in a bear. I have this opinion, the bet here is on corporations and large users. From the ordinary user what to take, from a pirate he rocked and was satisfied. But for large users, for every computer update a pretty penny comes out. That's all the math.

[Focuser]

Analysis of the activities of botnets, viruses, etc. not only Kaspersky is engaged in malicious software! All antivirus vendors do this. And in close collaboration with companies operating system manufacturers such as Microsoft .. + there are still many different independent researchers. If Kaspersky was involved in writing viruses, then he would have redeemed for a long time. In the meantime, as far as I know, there are no facts that would indicate that Kaspersky is doing this. These are all just rumors.

[Averias]

And I do not insist, but vague doubts torment me. So many absolutely stupid virus viruses, the impression that shkolota is naughty.

[Focuser]

Quote: Averias

So many absolutely stupid virus viruses, the impression that shkolota is naughty

I think the impression is not false. Now rare people write viruses themselves, how can I judge .. code something. Basically, this is a shkolota who learned something at hacker forums, downloaded a couple of already compiled programs and try to hack something that is poorly protected.

[MG42]

Quote: bdolah

I’ve come across the fact that when a new paid parking lot was opened in our microdistrict, the number of tires punctured at night sharply increased.

In Ukraine, those parked in the courtyards simply set fire to the watchmen of these paid parking lots at night. thus stimulating motorists not to be greedy. As for antiviruses, it happens that one "sees" some Trojans, another sees others. There is no 100% reliability. if the antivirus terribly slows down the computer. >>>> it is also not very comfortable.

[military]

Quote: Averias

Then maybe they will change roles, Casper will search for and catch spinners?

why not assume that today Casper not only (and not so much) "protects" as he himself "sucks" the information? ...

[omsbon]

As I understand it, posters like "The enemy is eavesdropping.", "Chatterbox is a find for a spy", etc. have not lost their relevance. If so, then they need to be republished.

[Byordovvv1]

This is not news. The Internet is access to private and public secrets. The time has passed when, risking your life, you need to get into the camp of an opponent and steal documents with the "SS" stamp. The proposed update of programs on the Internet is, in part, nothing more than the introduction of surveillance on your computer.

[Averias]

Well, why generalize like this, serious offices have two types of networks - external and internal. Which do not communicate with each other. Sometimes internal networks even use specific transmission protocols, plus, the rooms in which the computers are located are shielded and protected from all types of EM exposure. Therefore, information such as - computers of the FSB were hacked by hackers, delirium of a gray mare or a horse of Tygydymskaya. This is the same as hacking or picking "codes" for a nuclear suitcase. It is only in Hollywood films that the networks of any special services are hacked with the help of three mouse clicks. If there is no access to a computer with information (neither network, nor any), if only 1-2 people have access to the computer, and they receive only the information they need - how to hack it. If the computer even has no USB connectors, only the keyboard and the monitor.

[Averias]

But the fact that scientific and research institutes sit rotozei (in the old fashioned way I ignite from a match) and store data on unprotected computers, or use the password 123, is not only with us, such incidents are known all over the world.

[Byordovvv1]

I meant it. They steal (get) the data before the documents are generalized and put a security stamp.

[Yuri11076]

If you use normal computers, not 10-year-old "calculators", then Casper is an excellent antivirus solution ...

[Averias]

Quote: One of our partners sent a suspicious infected malicious file

How did he understand that? A malicious file is also malicious, for this the antivirus is also worth it. Variants 3 - either remove or treat or quarantine. How did he understand that this file is not only malicious but also suspicious? What, he opened it, looked at the program code and realized that this code was suspicious. Then he is a genius, since he keeps all the libraries in his head, the question arises - if he is a genius, then why did he go to Casper?

[Focuser]

Averias, I don’t want to offend you, but in my opinion, what you write and what questions you ask suggests that you know little about how anti-virus programs in general and Kaspersky in particular work.

[Averias]

What are you talking about, I just said that since the end of 2012, it’s only heard in different news feeds, Kaspersky found something, found it. Especially Maylites are strong in this. And this leads to certain thoughts. It turns out he alone is standing guard over our secrets, the other suckers. So what? Then answer the simple question, why does BotNet still exist?

[Focuser]

Even if it’s Kaspersky’s PR, for example, I doubt it, then I think that you need to be glad that you have world-class antivirus software manufacturers in your country and that they don’t bend .. Or do you want your systems and networks protected by Western antivirus? I think that in that case it would be one big backdoor))

[Averias]

So what am I, am I really against, I am always ready to support our manufacturer. Simply, I repeat, lately Kaspersky does not spit anywhere. And you know this is a little annoying, it's not for nothing that I cited a mail as an example, then Ogryzok then Casper. Such "unobtrusive" advertising loads a little. Those who are on your side with computers have no problems with the antivirus and generally with security, but those who blindly believe that if they put themselves some kind of software "miracle" that promises 100% security and reliability, they cannot be fixed. I was always amazed by people who use all sorts of system accelerators (Auslogics BoostSpeed ​​and the like) and then on all forums take out the brain with a question - why the system is stupid and slows down, I bought a "miracle" program

[Bezarius]

: facepalm: Trojan horse, in the common people "virus" is primarily a program. For the program to work, you need to run it, when the program starts, a process is created (in any case). The process can be hidden / masked. In the end, everything that can be hidden can be found. If you find the process, you can also find the source file. Anderstend?

[Averias]

Yeah, especially when this process has done its job (and there is no need to tell common truths). For some reason, all these "exposing" of hacker and virus programs occurs after they have already worked on computers for a fair amount of time. So where is the "fight"? Or here's a joke, like a computer with a disconnected Internet (in general, the network cable is not plugged in), and the antivirus periodically reports on the suppression of external network attacks? The fairy tales that were spread around Flame, StuxNet say that they have not really figured out them. When viruses are written by lone individuals to make a mess - this is one thing, when it is an order of the state (military, special services) and it is written by a group of people who have great knowledge in those areas for which the virus is intended - it is not realistic to detect it at the time of introduction. This article is an example.

[Bort radist]

During the Iron Curtain and the lack of computers in the USSR, there was such an anecdote:
CIA meeting: - what is known about MOSAD's plans and covert operations ?,
- 80 percent is under control.
- Great Britain M-15, M-16?
- Yes, everything is in full view.
- KGB?
- 0 information, they keep secret documents in drawers and safes!
I have Avast free and AVZ checked periodically. Well, I think a little
And the article looks like an advertisement. If they had found, disinformation would start draining long ago .........

[Averias]

Gold words. They’re just minus me, but he said the same thing

[Focuser]

Quote: Bort Radist

And the article looks like an advertisement.

I do not think. Here, just not everyone wrote. On the tape, for example, more information ..
http://lenta.ru/news/2013/01/14/virus/

[Bort radist]

And here there are many "hot" ones - first they minus, then they think. Cool down and add up for nothing.

[sashka]

Put on Windows, use Linux and you will be happy ..

[TSOOBER]

totally agree

[Slevinst]

Well done Kashpirovsky, they work well, but for a long time

[DAGESTAN333]

Casper is beautiful! Thank you labs! Access to our computers should have only the FSB and state. intelligence and not TsRUshniki!

[Khabarov]

The best programmers in Silicon Valley are from the Soviet Union, from the Soviet education system. before you destroy, you need to create something better. Well, or recreate the best that was.

[sniper]

Good day friends! I was very pleased that among the members of the forum there are so many people who are well versed in the topic, only the trouble is, I do not belong to this category, computer literacy is already past me and somehow it’s not easy to figure it out on my own, as the big half the terms used by advanced users are completely incomprehensible to a simple user ... It would be useful for many (I’m not the only one), well, some kind of overview article or something, or if it doesn’t quite fit into the theme of our site, maybe just a couple of links to clear resource ... If I more or less understood the hardware, then there are some problems with the software. Thanks in advance ...

[Averias]

Write in PM how I can help with joy.

[Focuser]

The most correct and easiest way to find out the meaning of this or that term is to search on google. Just like there is a question to write, for example: "What is a botnet?" The first link will be to wiki or otvet.mail.ru or some other Q&A service (Q&A service), where there will be an explanation.
This is a universal method that applies to computer terms and any other.

[sniper]

Focuser This is understandable, just reading the text with the dictionary does not contribute to digestibility, especially the text written supposedly in Russian, but where you can understand only the names of programs that are in English, and thanks for the advice, Khukhlya often helps out

Quote: Averias

how can i help

Thank you so much !!!

[Focuser]

well then Habr You can still advise: http://habrahabr.ru
This is the No. 1 IT resource in Runet. There are walkthroughs and there are just review articles and a bunch of everything ..
Select the hub of interest ( http://habrahabr.ru/hubs/ ) and read..
The resource policy is such that there are not welcome unnecessary abbreviations of the terms that cover the Russian language. only well-known people who are easy to recognize in google if they are not familiar. So I think you will like it)

[Artyom]

I don’t know, but I like Avast.
1. Free version for a year with an extension.
2. constantly updated.
3. blocks infected sites
4. and does not brake
and for those who like to risk the health of their computer, I can recommend sandbox programs

[xzWhiteWolf]

Everybody usually says that clearly, Casper or Nod ...
But you know, they are all annoying because they often do not even ask and do not notify, and simply delete normal files.
My choice fell long ago on "Avira" for several reasons ...
- Sane Firewall, of the best for me.
- Excellent protection even when working with search engines in a browser where Kaspersky could not cope and the computer crashed ..
- Built-in backup
- Very fast work (all the antiviruses that I tested are searched and work 3-4 times slower), and it was unnoticed even on an old computer with 4GB of operational.
- Finds the maximum. Often I set friends, neighbors after the defeat of the PC, who had the drweb, avast, kaspersky, node ... And avira found and coped with the task.
And most importantly, he will never delete what you need. It will block and will give a decision to accept only to you.
- Convenience, understanding.
- Protection of mail, phone ..
- German quality) Avira was already distinguished by the leadership of the 2012 model, now I switched to version 12, but I have not seen any new tests yet. While satisfied, added a lot of useful things.
I advise everyone to try. Forbids and catches everything you tell him. Though games, even programs are jokes. Deceitful programs .. In general, put not regret it. There is simply no alternative for me .. Although I have been trying for a long time to be friends with the node, Casper and others .. the NOD generally has an unrealistic firewall for the house ..

[andrei332809]

Well, what about without a "Russian-speaking trace". long arms kgb. and in general, openness of information is a sign of democracy. Isn't that how they taught us ping-do-sy? true, for some reason unilaterally

[Zabvo]

Casper has a federal tire.