Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Businesses Security Politics

Office Depot, Best Buy Pull Kaspersky Products From Shelves (bleepingcomputer.com) 155

Catalin Cimpanu, reporting for BleepingComputer: Both Office Depot and Best Buy have removed Kaspersky Lab products from shelves. The ban has been in effect since mid-September, and the two chains are offering existing Kaspersky customers replacement security software. The first store to remove Kaspersky products from shelves was Best Buy, on around September 8. At the time, the FBI was pressuring the private sector to cut ties with the Russian antivirus maker, which was the subject of a Senate Intelligence Committee on the suspicion it may be collaborating with Russian intelligence agencies. Kaspersky vehemently denied all accusations. A week after Best Buy removed Kaspersky products from shelves, the Department of Homeland Security (DHS) issued a Binding Operational Directive published ordering the removal of Kaspersky Lab products off government computers. A day later, Office Depot announced a similar decision to ban the sale of Kaspersky products in its stores. Additionally, Office Depot is letting customers exchange their Kaspersky copy with a one-year license for McAfee LiveSafe.
This discussion has been archived. No new comments can be posted.

Office Depot, Best Buy Pull Kaspersky Products From Shelves

Comments Filter:
  • by mi ( 197448 ) <slashdot-2017q4@virtual-estates.net> on Monday October 09, 2017 @12:31PM (#55336887) Homepage Journal

    I'm perfectly willing to believe, the authors of the Kaspersky software and the owners of the company want to have to provide a good anti-virus and do not want to cooperate with Russia's spies. But the decision may not be up to them — Russian government has many more instruments at their disposal to convince businesses and individuals to "cooperate", than do the governments of free(er) countries.

    Yes, American government has some such instruments as well — just pick, who you trust more...

    • by mysidia ( 191772 ) on Monday October 09, 2017 @01:01PM (#55337173)

      Russian government has many more instruments at their disposal to convince businesses and individuals to "cooperate"

      While that might be true; I doubt they would risk it.

      Probably you are at a MUCH higher risk if you replace Kaspersky software with McAfee LiveSafe, just because the McAfee offering is crap.

      Also, the risk of VULNERABILITIES in your AV product is at a much higher risk than an intentional backdoor existing (IMO).

      Personally; I use neither antivirus product favoring WebRoot instead, but I have some respect for Kaspersky, and nobody's shown any evidence specific to Kaspersky that they could not be trusted.

      • by rahvin112 ( 446269 ) on Monday October 09, 2017 @01:22PM (#55337369)

        While that might be true; I doubt they would risk it.

        Why? What does the Russian Government have to lose?

        The fact that the ownership of Kapersky was shuffled around such that a guy with deep connections to the FSB (Former KGB) has significant control over the corp should scare anyone. This should be enhanced by the fact that the American government has apparently seen something so concerning that they are reacting to it with law enforcement assets and have bared it's use within the DOD.

        This isn't much different than ZTE's three top owners being top Army officials in the PRC along with deep connections to their spy apparatus. I'd be concerned about using any Tech where the top people and owners are all connected to and beholden to that states spy apparatus. For all the talk no one on the board of Microsoft or Cisco is a top retired general that's got deep connections with the NSA. From what we learned from Snowden the NSA does their backdoor stuff on the sly by diverting packages and installing compromised firmwares after it leaves the factory instead of writing the backdoor directly into the software.

        If Kapersky is truly using virus scanning to scan for files they want then they've created a tool with unparalleled power. Any computer with Kapersky software is having it's contents scanned and reported back to Russia and the Russian government is apparently able to review the database for targets. It would be trivial for them in such a situation to have the software grab the contents for them, after all it already has kernel Ring 0 access by virtue of it's status as a virus scanner. That's reason alone not to run windows.

        • by Archon ( 13753 ) on Monday October 09, 2017 @01:45PM (#55337559)

          "This should be enhanced by the fact that the American government has apparently seen something so concerning that they are reacting to it with law enforcement assets and have bared it's use within the DOD."

          Is this the same government that deliberately start wars and invade other countries based on their own propaganda (aluminum tubes and babies being pulled from incubators, anyone)? Yeah, I thought so. So now it's show your proof or GFY.

        • by AmiMoJo ( 196126 )

          Why would they throw away such a useful tool on such a relatively trivial thing?

        • by rtb61 ( 674572 )

          Pfft, most likely reason for ban, no US CIA/NSA back doors, maybe FSB ones but definately no US ones. Who is most likely to hack, the US government, they have an insane spy on everyone and control everyone policy. So paying for one, I would go with the Russian Kaspersky because they spend their time fending off the CIA/NSA rather than cooperating with them. Are Kaspersky innocent, not in US government eyes, they are guilty as hell for in all likelihood being unwilling to install CIA/NSA back doors, not that

      • Here are some quotes for you:
        Larry Ellison co-founded Oracle Corporation in 1977 with Bob Miner and Ed Oates under the name Software Development Laboratories (SDL). ...
        Ed Oates graduated with a BA in mathematics from San Jose State University in 1968, and worked at Singer, the US Army Personnel Information Systems Command (PERSINSCOM) (drafted), Ampex, and Memorex before co-founding Oracle. ...
        In-Q-Tel: A Glimpse Inside the CIA’s Venture-Capital Arm ...
        In-Q-Tel has been an early backer of start-ups la

      • In-Q-Tel has also invested in FireEye for example.

    • by Rick Schumann ( 4662797 ) on Monday October 09, 2017 @01:15PM (#55337281) Journal

      Do as we say or we'll confiscate your business, your assets, imprison your family, and beat you senseless

      That's about how I'd figure that conversation would go in Putin's Russia.

      The real question here is: In 2017, can we trust ANYTHING to run on our computers that we didn't compile ourselves, after personally vetting the sourcecode -- and then, can we trust the compiler to not be compromised, too? Really, honestly, seriously, I'm starting to feel like we're getting to that point -- and even if what we're running isn't compromised as soon as it's installed, there doesn't seem to be much of anything that can prevent the mahcine from being compromised externally, unless you're never connected to the Internet, ever -- and even then, security researchers keep exposing exploits that can compromise a computer that's completely air-gapped.

    • by Gravis Zero ( 934156 ) on Monday October 09, 2017 @01:19PM (#55337335)

      Yes, American government has some such instruments as well — just pick, who you trust more...

      I trust Linux more than either government. ;)

      • by mi ( 197448 )

        I trust Linux more than either government. ;)

        How very Libertarian of you... But is that even a dichotomy, though? Linux has [eteknix.com] quite a bit of NSA-developed code [nsa.gov]...

        • by F.Ultra ( 1673484 ) on Monday October 09, 2017 @03:15PM (#55338273)
          Yes but #1 that is code from the part of NSA whose job it is to increase security and #2 that code has been verified and vetted from top to bottom, it's not like they supplied a binary blob. Not to mention that the code itself have been heavily altered by the community over the years.
          • by mi ( 197448 )

            Yes but #1 that is code from the part of NSA whose job it is to increase security

            So sure you are... Besides, they may as well be increasing security by planting things with certain backdoors [wordpress.com]. The actual readable code may just be arcane and hard to read — but innocent. Innocent, until a specially-crafted USB-stick is plugged-in. Or a specially crafted ICMP-packet arrives — its content containing a proper key to open things up for the NSA (but not to anyone actually hostile)... Or until a binary d

            • So sure you are... Besides, they may as well be increasing security by planting things with certain backdoors [wordpress.com]. The actual readable code may just be arcane and hard to read — but innocent. Innocent, until a specially-crafted USB-stick is plugged-in. Or a specially crafted ICMP-packet arrives — its content containing a proper key to open things up for the NSA (but not to anyone actually hostile)... Or until a binary driver for some cool gadget is loaded into kernel...

              I'm sure because in contrast with you I am an actual developer and have looked at the very code that I am talking about (would be a hypocrite otherwise). So first it was SELinux that was the problem and now there are hidden backdoors everywhere that you can unlock with ICMP packages, I do think that you should stop looking at shows like The Blacklist.

              it's not like they supplied a binary blob

              How do you know, when you download the latest nVidia-driver, for example, that it contains no NSA-provided code?

              That one is easy because I don't download the latest nVidia driver since I'm using the open AMD drivers at home and the open Intel drivers at work.

      • The problem is that open source projects can be contributed to by anyone, including state sponsored bad actors.

        Heartbleed. Tell me that the Heartbleed bug, the heartbeat function it fucked up the security on, and the RFC the heartbeat function was based on weren't all state sponsored.
        • by Gravis Zero ( 934156 ) on Monday October 09, 2017 @02:03PM (#55337701)

          The problem is that open source projects can be contributed to by anyone, including state sponsored bad actors.

          You're not even wrong! However, it requires someone accept the contribution and never have someone notice the flaw. In the closed source model, nobody will ever have the chance to notice the flaw. Also, with a bit of pressure, a business will insert whatever blatantly evil code a state-sponsored actor insists on.

          Heartbleed. Tell me that the Heartbleed bug, the heartbeat function it fucked up the security on, and the RFC the heartbeat function was based on weren't all state sponsored.

          I can tell you for a certainty that shitty code occurs in the wild without the help of any state-sponsorship. OpenSSL was neglected but hey, thanks for the conspiracy theory!

        • If so then you have to somehow connect Robin Seggelmann with some state since he was one of the authors of the RFC and the one that introduced the bug in OpenSSL (the bug is however only in this particular implementation and not in the RFC itself).
      • by mspohr ( 589790 )

        I don't run any anti-virus software on Linux. I trust the user community to discover and patch any problems much more than I trust any anti-virus vendor. So far, no problems.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Pick the one that can hurt you the least. Who is the greater threat Russian secret police or American? Trust but verify. RR

    • "Russian government has many more instruments at their disposal to convince businesses and individuals to "cooperate", than do the governments of free(er) countries." - and if you think the US is free then I'm afraid you've swallowed the poison cool-aid.
    • by Anonymous Coward

      > Russian government has many more instruments at their disposal to convince businesses and individuals to "cooperate", than do the governments of free(er) countries.

      Pshaw! Russia doesn't have anything on the US in that regard.
      http://www.reuters.com/article/us-usa-security-rsa/exclusive-secret-contract-tied-nsa-and-security-industry-pioneer-idUSBRE9BJ1C220131220 [reuters.com]

      As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.

      And don't forget all those US anti-virus firms that reluctantly updated their products to scan and remove the Sony rootkit DRM shit only after t

    • I'm perfectly willing to believe, the authors of the Symantec software and the owners of the company want to have to provide a good anti-virus and do not want to cooperate with United States' spies. But the decision may not be up to them — US government has many more instruments at their disposal to convince businesses and individuals to "cooperate", than do the governments of free(er) countries.

      Yes, Russian government has some such instruments as well — just pick, who you trust more...

      https://w [reuters.com]

    • by Hentes ( 2461350 )

      Yes, American government has some such instruments as well

      Yep, like spreading FUD about AV that doesn't cooperate and coercing businesses to stop using/selling it.

    • Um, that doesn't make them innocent, that makes them guilty but coerced. Innocent would be if the Russian spies were sniffing through their telemetry without them knowing, but that still means they are just as much of a security hole. I will admit that I didn't know that anti-virus software sent the user's files off-site for "inspection" if they were "suspicious". That is ridiculously insecure for the user's private data.
      • Um, that doesn't make them innocent, that makes them guilty but coerced. Innocent would be if the Russian spies were sniffing through their telemetry without them knowing, but that still means they are just as much of a security hole. I will admit that I didn't know that anti-virus software sent the user's files off-site for "inspection" if they were "suspicious". That is ridiculously insecure for the user's private data.

        Your "innocent" scenario is exactly what Kaspersky says (may have) happened in the case with the case where an NSA contractor's files were scanned by Kaspersky and then immediately hacked by the Russians. From Eugene Kaspersky: [kaspersky.com]

        Even though we have an internal security team and run bug bounty programs, we can’t give a 100% guarantee that there are no security issues in our products ... Now, if we assume that what is reported is true: that Russian hackers exploited a weakness in our products installed

    • by Anonymous Coward

      Consider this... The US has equal "instruments" in McAfee as Russia has in Kaspersky. Which is more likely to cause you a run in with a government body?

    • I'm perfectly willing to believe, based on, plenty of evidence, that you, write like, a retard.

    • The operational directive (linked below) lists ten Kaspersky branded products that are banned. It explicitly excludes Kaspersky code embedded in the products of other companies. If DHS had real concerns why would they allow any of those products on government networks?
      https://www.federalregister.go... [federalregister.gov]
    • Antivirus are snake oil.

    • by johanw ( 1001493 )

      I would treat the The Russians more of course. They don't care if I download movies or music from American studios or protest against some western policy. Perhaps they might be interested in the later and even want to pay me for it, so all the better.

  • by gweihir ( 88907 ) on Monday October 09, 2017 @12:35PM (#55336915)

    And now they are killed via a classical attack on their reputation, which may or may not be completely without merit. Of course, this only concerns the US market.

    • by Narcocide ( 102829 ) on Monday October 09, 2017 @12:44PM (#55336995) Homepage

      It's also possible that the software is fine as delivered by Kaspersky as far as they know, but altered/backdoored covertly while in transit, somehow. The U.S. government has done as much to Cisco hardware that has been shipped worldwide, so it's not like there wouldn't be precedent.

    • You think the NSA told a Russian Security company with possible ties to the Russian government about its walware?

      • Yes. Just like other malware creators are required by law to submit samples to AV companies.
      • Do you really think that US Intel isn't upset that the Kaspersky crew busted them for stuxnet?
      • by gweihir ( 88907 )

        This is not how this goes. Kaspersky is a pretty good AV company. They have sensors and are probably finding NSA malware all on their own without being told about it. They may then get a request to remove certain signatures, though.

        • This is not how this goes. Kaspersky is a pretty good AV company. They have sensors and are probably finding NSA malware all on their own without being told about it. They may then get a request to remove certain signatures, though.

          Which tells Kaspersky that a certain piece of malware come from the NSA, which then potentially tells Russian Intelligence what systems the NSA is targeting and what information they may have collected.

          I still don't see the NSA telling Kaspersky about it's malware.

          • by gweihir ( 88907 )

            I still don't see the NSA telling Kaspersky about it's malware.

            That is an issue on your side, not on mine...

    • by tinkerton ( 199273 ) on Monday October 09, 2017 @01:52PM (#55337613)

      That's the best explanation. Now everyone has received the warning. If you don't cooperate with the US three letter organisations we'll get you. They've got nothing on Kaspersky except that the software performed as expected and that is by detecting malware. Give it some time and every AV that is left on the market is forcibly unreliable.

      • by gweihir ( 88907 )

        It may be a good idea to run Kaspersky in addition to your regular scanner on everything suspicious. It may also be an excellent idea to buy their product to make sure they stay on the market. At least against US government malware, it seems they are currently getting the highest endorsement possible.

  • Oh wait, they can't -- MS Office will not run.
  • by burtosis ( 1124179 ) on Monday October 09, 2017 @12:42PM (#55336969)
    Are they at least going to update my NSA backdoors that kaspersky removed?
  • trumpistan (Score:3, Interesting)

    by Anonymous Coward on Monday October 09, 2017 @12:44PM (#55336989)

    we take in products from hundreds of different countries, including digital products that are in the heart of infrastructure. we allow outsourcing of sensitive data processing all over the planet.

    but this one company is being singled out by the federal government and destroyed without a trial.

    lets look at companies who actually took money from Russian operatives to place political advertisements on their networks. Facebook, Google, Twitter, directly profited from Russian interference in the election, and will never face any consequences.

    this has nothing to do with protecting security, it is all about nationalism and isolation, Trump thinks that by cutting out foreign competition it will somehow provide an economic boost to domestic companies.

    what he doesnt seem to realize is that every isolationist country, from Japan to Russia, has a stagnating population and a stagnating economy. Interacting with the world is how China lifted itself out of poverty - us cutting ourselves off from the world is how we are going to sink into it.

    • That would be a great theory, except that the MSM and all the big players in DC have been telling us for the last 1.5 years that Russia has Trump in their pocket.

      It makes way more sense if you said this was the Three Letter Agencies involved and their deep state overlords ordered this a payback for "Russia Hacking The Election".

      Further, if it is what you say it is, it defeats the whole "Russia Hacked The Election" at several levels, namely it backfiring on the Russians. They probably have more dirt on Clint

    • singled out by the federal government and destroyed without a trial.

      Stores need not be forced to carry your product, customers need not be forced to buy it - government, corporate, or otherwise. There's no place for a trial here.

  • by xxxJonBoyxxx ( 565205 ) on Monday October 09, 2017 @12:44PM (#55336993)
    Remember when you'd buy software? With a disc in a cardboard package? From a retail store you'd have to enter?

    No? Me either.
    • Remember when you'd buy software with a disc in a cardboard package?

      I 'member! /Memberberries

      • by geirlk ( 171706 )

        I 'member getting my member stuck in it when I didn't receive proper instructions.

    • by Nkwe ( 604125 )

      Remember when you'd buy software? With a disc in a cardboard package? From a retail store you'd have to enter? No? Me either.

      Pepperidge Farms remembers

    • So you're not old enough to legally drink?
  • Best Buy pulled Kaspersky on 9/8, then 8 days (1 week + 1 day) later Office Depot announced the same.

    I know /. is slow in posting stuff but why is this even posted on 10/9?

  • They should've... (Score:5, Insightful)

    by nwaack ( 3482871 ) on Monday October 09, 2017 @01:18PM (#55337323)
    They should've just let themselves get hacked and had all their customer's information stolen. Then the IRS would've probably given them a multi-million dollar contract!
  • 1. Considering the fact that American companies are forced to "cooperate" with the American government
    2. Considering the spying habit of the NSA
    3. Considering that I live in Canada, where Russia has no influence (the chance that I would be extradited to Russia for wrong think are nil)

    I'd much rather use a Russian antivirus than an American one! (That is, I'd much prefer that Russia spies on me than the US.)

    • by PPH ( 736903 )

      Just wait until your Toronto to Vancouver Air Canada flight is diverted over Montana, you are detained and your laptop is confiscated for flying through US airspace with Kaspersky software.

    • by AHuxley ( 892839 )
      Recall the US "Magic Lantern" keystroke logger and demands for antivirus vendor cooperation.
      Magic Lantern (software) https://en.wikipedia.org/wiki/... [wikipedia.org]
  • Pretty bad when your AV software is worse than the shit it's supposed to stop.

  • by fredrated ( 639554 ) on Monday October 09, 2017 @01:42PM (#55337535) Journal

    Or do we just trash businesses based on opinion?

    • It's not just opinion ... Hillary lost so Trump is illegitimate so Russian Hackers so Kaspersky conspiracy.

      QED

      Maybe you disagree because you're a fascist.

      'Murca.

  • by AHuxley ( 892839 ) on Monday October 09, 2017 @04:37PM (#55338901) Journal
    Stuxnet
    Flame
    Equation Group
    Duqu
    https://en.wikipedia.org/wiki/... [wikipedia.org]
    Highly sophisticated malware gets found and the internet is safer.
    • by Anonymous Coward

      mod parent up!

  • exchange their Kaspersky copy with a one-year license for McAfee LiveSafe.

    for McAfee LiveSafe.

    McAfee

    Worst trade ever.

  • As much as I loathe antivirus software, it does seem like the government pressure to ban Kaspersky is actually a huge endorsement for its effectiveness in rooting out malware. Too bad its malware the government doesn't want found, he he. Is it just me, or is the whole concept of "cyber warfare" with "cyber weapons" just plain stupid in both concept and execution?
  • If you live in the US, who do you want spying on you? the Russians? or the NSA?
    Pick your poison...personally, as a non-combatant, I think I'd prefer the Russians as they have no legal reach to me....
    but since I run a 'nix variant, I don't run any AV anyway, a non-issue for me.

Men occasionally stumble over the truth, but most of them pick themselves up and hurry off as if nothing had happened. -- Winston Churchill

Working...