3

According to Kaspersky, its antivirus software "automatically uploaded [malware samples] to Kaspersky’s specialists for further analysis." Is this common practice for antivirus software? How do they make sure they're not uploading personal files infected with malware?

I understand that antivirus software initially checks some hash of samples found on an infected computer and checks a database for a match first. I'm asking about the case where they don't find a match and have a potentially "new" malware.

1
  • Kaspersky does not upload personal files by default
  • Kaspersky will upload possible viruses for analysis only if YOU specify that

Since it is unclear what version you refer to, I'll give you a general example:

  • Options for this are very well controllable. Even on older versions (like KAV 2013), if you open the application settings window, in the left part of the window, you can select the Advanced Settings section. In the Operating mode section, you can click the Settings button and the Operating mode window opens. There, you can select the Enable dump writing check box to enable the application to write application dump files. You can then select the Send dump and trace files to Kaspersky Lab check box or choose to clear the Send dump and trace files to Kaspersky Lab check box.

If the file is not actually found to be infected but you still consider it suspect, you can upload it manually for analysis using VirusDesk ( https://virusdesk.kaspersky.com ).

  • In the current versions of Kaspersky Security Center, you also have the clear option (Under Advanced --> Application management): I agree (or not) to participate in Kaspersky Security Network.

As for propaganda like "Russian hackers exploited vulnerabilities in the antivirus program to breach an NSA contractor’s computer in 2015 and steal classified files" it's totally irrelevant. Some big corporations wanted some revenge because Kaspersky was the only anti-virus that disclosed what some big manufacturers were doing to potentially or directly (i.e. seagate) spy anyone using their components. That's why all the fuss in the US against Kaspersky.

I've been using various anti-virus solutions since the MS-DOS era and I can say hands down that currently Kaspersky is one of the best AV solutions up there, even no.1 at this moment.

Note that What I considered the best AV varied a lot every few years, because some AV companies improved a lot while others made bad choices. My view on this was always impartial.

  • 1
    I think that care should be taken when expressing opinions about political and tactical business motives. While what you say about motive may be true, there are other issues you haven't mentioned such as the security breaches with Kaspersky themselves. The main take-away from all this is the extreme stupidity of the contractor who took secret data home and put it on a computer already compromised using cracked software and who left configuration such that critical data was uploaded to the Kaspersky servers. – Julian Knight Nov 12 '17 at 15:42
  • Agreed, but note that there has been no large software company ever that did not had at least one security breach, so that's not an argument. – Overmind Nov 15 '17 at 10:27
  • Can you provide evidence on the point of corporations influencing US government policy to ban Kaspersky and Israels involvement? – McMatty Feb 6 '18 at 22:46
  • I did encounter direct reports of such high level recommendations in the big document packs that I obtained. If you really want, I can dig up more on the subject, but given the number of documents it's a very long duration process. I wish I had the time to filter and categorize everything. – Overmind Feb 7 '18 at 11:20
1

Q : I'm asking about the case where they don't find a match and have a potentially "new" malware.

There is similar controversial that some research claims on carbon black(CB) , which is due to manual setting, by default, even experiment heuristic detection will stay inside the user quarantined folder. However, some AV might practice to send sha256 hash of the detected file to keep it as statistic ( This raise another issue. I.e. in Europe, to compliance with GDPR, the IP address and all possible fingerprinting info of the user must be strip.) . In addition, there is also logistic issue to analyze user files, e.g. storage, resources to analyze the file.

For enterprise, most prominent AV vendor "enterprise/business" solution always keep the file inside the organization, which may also lock the user client AV from changes (like change the setting to submit the infected file).

In short Prominent AV will not collect detected file. Submission of sample is always an opt-in/voluntary.

  • Stripping of that data for GDPR is not a requirement. The requirement is for the data to have appropriate use and for the users to be clearly informed of the use, the risks and the benefits before being asked for explicit consent. – Julian Knight Nov 12 '17 at 15:44
  • A SHA256 hash of an infected file would be of little benefit for analyzing viruses which attach to other files (it can be used for tracking standalone malware) – symcbean Jan 7 '18 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.