WHOA @USTreasury just sanctioned leadership at 🇷🇺Russian antivirus company @kaspersky.
Comes on heels of yesterday's @CommerceGov ban on sales of their antivirus to the US.
Huge-but-somewhat-anticipated blow to #Kaspersky whose fortunes in the US have been falling since the 2017 @DHSgov binding directive to remove their products from gov systems.
Will be fascinating to see if other governments echo some of these actions.
2/ The case of @Kaspersky is a good teachable moment to talk about some painful truths about antivirus software.
1- Massive marketing has instilled the instinctive and INCORRECT belief that in regular users that antivirus products are the most important security step.
This is massively out of step with expert security recommendations. Source: a consistent finding in surveys of expert vs regular user security perceptions.
People continue to get soaked by AV companies selling products that don't provide nearly as much protection as they think.
3/. It's not just that Antivirus products don't provide users the kind of security they think they do...
Antivirus products themselves must have, by design, a ridiculously invasive view into what you are doing on your computer.
How else could they check every file for badness, right?
And for the company to keep detecting new things, lots of information about your files are going to be headed up into their systems when you run scans.
And the access to files doesn't end there.
You can learn a lot and, potentially, do a lot with the kind of access users have to grant an antivirus for it to work.
This is an under-appreciated privacy and security concern for anyone with an antivirus installed.
It is a big reason why the US, and every other government, is worried by the possibility that an antivirus vendor might be untrustworthy.
Great. Just someone claiming to offer some #Pegasus spyware source code for sale.
True or scam, this reminds me of 2018, when an NSO employee stole code & did exactly that.
As I testified to Congress: the mercenary spyware industry continues to recklessly proliferate very sophisticated capabilities once limited to a handful of governments.
Given how many times the industry has gotten caught, I have a hard time believing that these companies can maintain enough control over all facets of their capabilities...
.... to prevent parts of their tech from inevitably leaking to criminals & other non-state actors, turbocharging cybercrime & disruptive ransomware attacks.
2/ Now for some grim good news in this case: even if the person is in fact offering some portion of Pegasus spyware source code, and not trying to scam people, they are not even claiming to have the working exploits used to infect phones.
Important distinction, since even if the spiciest & most-helpful-to-criminals aspects of NSO Group's codebase were leaked & incorporated into cyber criminal toolkits... criminals would still need to source the (expensive & complex) exploits required to actually infect phones. And then make them work reliably, etc etc.
3/ Here's the 2018 story of an employee stealing code.
Reading this? Your blood probably contains some amount of toxic forever chemicals made by @3m.
How much & is there enough to spike your risk of certain cancers & illnesses?
Without complex blood testing you have no idea.
Why is their toxin running in your veins? Well, the companies that made this stuff (3M & DuPont) kept their discoveries of the harms secret... even as their toxin was incorporated into...everything.
From french fry bags to chairs.
They even gaslit their own scientists.
And they regularly dumped & released their chemicals into the environments around their plants, creating toxic zones.
You should read this shocking profile of corporate greed and cynicism @fastlerner & @propublica.