Nota Bene

Mid-spring this year, at the very peak of the everyone-at-home period, it became obvious that things were looking very bleak for the world, and would stay bleak for a long time. Business would be hard hit, to put it mildly, while the tourism industry would be fairly devastated, with many a business within it not pulling through the crisis. So we at K did what we often always do – put our thinking caps on – and decided… to help out this most badly affected of industries.

Early May I announced that the ‘Kaspersky Exploring Russia’ tourism accelerator had started accepting applications. But I never guessed that more than 500 would be sent in – from 47 countries (nearly a quarter of all the countries in the world!) on five continents (all bar Antarctica!). And looking through them I realized just how much potential there is in the tourism industry – so many ideas, and so many great startups and existing projects. There were no geographical restrictions for applications: they could have – and did – come from anywhere on the planet, but they had to describe tourism ideas that could either tap the potential of Russian tourism or be applied in Russia. We sifted through all the applications to pick a top-10 very best ideas, and those 10 entered the accelerator program.

And for two weeks the 10 projects took part in online master classes and lectures. Each team had a series of specially tailored consultations with mentors. Leading industry figures shared with participants their experiences and know-how for building up a successful business. Mentors included: Vikas Bhola, regional director of Booking.com; Gemma Rubio, founder of Define the Fine; Vadim Mamontov, general director of Russia Discovery; and other industry professionals. And over those two weeks the participants also polished their presentations, which they then gave to the jury, which I was on.

Last week the finalists gave their presentations and answered our questions in the final demo-day of the accelerator. Out of those, we chose three winners, to which were awarded prizes from our partners. Let me tell you a bit about each of them…

First place was taken by 360 Stories. It’s a mobile augmented reality app with a live guide. They say their mission is to ‘modernize the traditional touring experience by powering interactive live tours using real-time guides’. With 360 Stories folks can now remotely roam their favorite cities and attractions by signing up for a personalized touring experience with a real-time local guide.

Btw: 360 Stories nearly lost – by oversleeping and not turning up! Its presentation was given at 05:30 local time – New York. Given such an early rise, Mr. 360 Stories slept in, despite having set his alarm. He wakes up eventually, and calls the organizers to ask why he had 20 missed calls on his phone. They were all to tell him he’d won, and ask – ‘where are you?!’

Read on…

Our first month of summer in lockdown – done. And though the world seems to be opening up steadily, we at K decided to take no chances – remaining practically fully working-from-home. But that doesn’t mean we’re working any less effectively: just as well, since the cybercriminals sure haven’t been furloughed. Still, there’ve been no major changes to the global picture of threats of late. All the same, those cyberbaddies, as always, have been pulling cybertricks out of their hats that fairly astonish. So here are a few of them from last month.

A zero-day in ‘super-secure’ Linux Tails 

Facebook sure knows how to spend it. Turns out it spent a very six-figure sum when it sponsored the creation of a zero-day exploit of a vulnerability in the Tails OS (= Linux, specially tuned for heightened privacy) for an FBI investigation, which led to the catching of a pedophile. It was known for some time beforehand that this deranged paranoiac used this particular – particularly secure – operating system. FB’s first step was to use its strength in mapping accounts to connect all the ones the criminal used. However, getting from that cyber-victory to a physical postal address didn’t work out. Apparently, they ordered development of an exploit for a video-player application. This choice of software made sense as the sex-pest nutcase would ask of his victims’ videos and would probably watch them on the same computer.

It’s been reported that developers at Tails weren’t informed about the vulnerability exploited, but then it turned out that it was already patched. Employees of the company are keeping shtum about all this, but what’s clear is that a vulnerability-to-order isn’t the best publicity. There does remain some hope that the exploit was a one-off for a single, particularly nasty low-life, and that this wouldn’t be repeated for a regular user.

The takeaway: no matter how super-mega-secure a Linux-based project claims to be, there’s no guarantee there are no vulnerabilities in it. To be able to guarantee such a thing, the whole basic working principles and architecture of the whole OS need overhauling. Erm, yes, actually, this is a cheeky good opportunity to say hi to this ).

Hacking-as-a-service 

Here’s another tale-from-the-tailor-made-cyber-nastiness side. The (thought-to-be Indian) Dark Basin cybercriminal group has been caught with its hand in the cyber-till. This group is responsible for more than a thousand hacks-to-order. Targets have included bureaucrats, journalists, political candidates, activists, investors, and businessmen from various countries. Curiously, the hackers from Delhi used really simple, primitive tools: first they simply created phishing emails made to look like they’re from a colleague or friend, cobbled together false Google News updates on topics interesting to the user, and sent similar direct messages on Twitter. Then they sent emails and messages containing shortened links to credential-phishing websites that look like genuine sites, and that was that – credentials stolen, then other things stolen. And that’s it! No complex malware or exploits! And btw: it looks like the initial information about what a victim is interested in always came from the party ordering the cyber-hit.

Now, cybercrime-to-order is popular and has been around for ages. In this case though the hackers took it to a whole other – conveyor – level, outsourcing thousands of hits.

Source

Read on…

Last week I realized I’d been in lockdown-isolation-quarantine for a full quarter-year. Three months sat at home, with only a couple of brief trips to the deserted office, plus every weekend at the dacha with the similarly isolated family. Like for everyone – a very extraordinary daily existence. For me – no planes/airports, no hotels, no meetings or speeches: in short – very little travel.

However, everything’s relative: in three months we’ve all traveled 230+ million kilometers (a quarter of a full orbit of Earth around the sun)! And that’s without taking into account the fact that the Solar System itself travels at some crazy speed. One thing that hasn’t changed much since lockdown began is business meetings – they’ve simply all moved online. Ah yes – and all our business in general is carrying as usual, unaffected by biological viruses ).

But enough lockdown talk; you’re probably tired of hearing anything in connection with it. Accordingly, herewith, I continue with more of my tales from the cyber-past side; this time – interviews with newspapers, magazines, radio, TV, plus assorted other public performances. (I was reminded of my ‘media relations’ activity while recalling my week of interview-hell at CeBIT long ago the other day when compiling my CeBIT recollections (Cyber-yesteryear, pt. 4). And it turns out I’ve plenty to relate to you about interesting experiences talking to the media and public speaking and all that – plenty that’s fun and unusual, plus of course a few (brightened and polished) photos too.

And there’ll be all sorts of different sizes and flavors of media-tales coming up too: from speeches in practically empty halls – to rammed stadiums! From unknown tiny local media publications – to top-tier global media household-name conglomerates! From professional lectures at leading universities and/or with specially tech-equipped audiences – to informal lectures about the wonders of arithmetic on a ship sailing to… Antarctica via Drake Passage! Eugene is the name; variation is the game ).

Right. I guess the logical place to begin is right at the start…

Read on…

Hi folks!

Quite often, technical matters that are as clear as day to techie-professionals are somewhat tricky to explain to non-techie-folks. Still, I’m going to have a go at doing just that here today. Why? Because it’s a darn exciting and amazingly interesting world! And who knows – maybe this read could inspire you to become a cybersecurity professional?!…

Let’s say you need to build a house. And not just a standard-format house, but something unique – custom-built to satisfy all your whims and wishes. First you need an architect who’ll draw up the design based on what you tell them; the design is eventually decided upon and agreed; project documentation appears, as does the contractor who’ll be carrying out the construction work; building inspectors keep an eye on quality; while at the same time interior designers draw up how things will look inside, again as per your say-so; in short – all the processes you generally need when constructing a built-to-order home. Many of the works are unique, as per your specific instructions, but practically everything uses standard materials and items: bricks, mortar, concrete, fixtures and fittings, and so on.

Well the same goes for the development of software.

Many of the works involved in development are also unique, requiring architects, designers, technical documentation, engineer-programmers… and often specific knowledge and skills. But in the process of development of any software a great many standard building bricks libraries are used, which carry out all sorts of ‘everyday’ functions. Like when you build a house – you build the walls with standard bricks; the same goes for software products: modules with all sorts of different functionalities use a great many standardized libraries, [~= bricks].

Ok, that should now be clear to everyone. But where does cybersecurity come into all of this?

Well, digital maliciousness… it’s kinda the same as house-building construction defects – which may be either trivial or critical.

Let’s say there’s some minor damage done to a completed house that’s ready to move into, which isn’t all that bad. You just remedy the issue: plaster over, re-paint, re-tile. But what if the issue is deep within the construction elements? Like toxic materials that were used in construction in the past? Yes, it can become expensive painful.

Well the same goes for software. If a contagion attaches itself to the outside, it’s possible to get rid of it: lance it off, clean up the wound, get the software back on its feet. But if the digital contamination gets deep inside – into the libraries and modules [= bricks] out of which the final product [house] is built… then you’ve got some serious trouble on your hands. And it just so happens that finding such deep digital pestilence can be reeeaaally tricky; actually extracting the poison out of the working business process – more so.

That’s all a bit abstract; so how about some examples? Actually, there are plenty of those. Here are a few…

Even in the long-distant past, during the Windows 98 era, there was one such incident when the Chernobyl virus (also called CIH, or Spacefiller) found its way into the distributions of computer games of various developers – and from there it spread right round the world. A similar thing happened years later in the 2000s: a cyber-infection called Induc penetrated Delphi libraries.

Thus, what we have are cyberthreats attacking businesses from outside, but also the more serious threats from a different type of cyber-disease that manages to get inside the internal infrastructure of a software company and poison a product under development.

Let’s use another figurative example to explain all this – a trip to your local supermarket to get the week’s groceries in… during mask-and-glove-wearing, antiseptic-drenching lockdown!… Yes, I’m using this timely example as I’m sure you’ll all know it rather well (unless you’re the Queen or some other VIP, perhaps live off the land and don’t use supermarkets… but I digress).

So yes: you’ve grabbed the reusable shopping bags, washed your hands for 20 seconds with soap, donned the faced mask, put the gloves on, and off you go. And that’s about it for your corona-protective measures. But once you’re at the supermarket you’re at the mercy of the good sense and social responsibility and sanitary measures of the supermarket itself plus every single producer of all the stuff that you can buy in it. Then there are all the delivery workers, packing workers, warehouse workers, drivers. And at any link in this long chain, someone could accidentally (or on purpose) sneeze right onto your potatoes!

Well it’s the same in the digital world – only magnified.

For the supply chain of modern-day ‘hybrid’ ecosystems of IT development is much, much longer, while at the same time we catch more than 300,000 brand new cyber-maliciousnesses EVERY DAY! What’s more, the complexity of all that brand new maliciousness itself is rising constantly. To try and control how much hand-washing and mask-and-glove wearing is going on at every developer of every separate software component, plus how effective cyber-protection systems of the numerous suppliers of cloud services are… – it’s all an incredibly difficult task. Even more difficult if a used product is open-source, and its assembly is fashionably automated and works with default trust settings and on-the-fly.

All rather worrying. But when you also learn that, of late, attacks on supply chains happen to be among most advanced cyber-evil around – it gets all rather yikes. Example: the ShadowPad group attacked financial organizations via a particular brand of server-infrastructure management software. Other sophisticated cybercriminals attack open source libraries, while our industry colleagues have reminded us that developers are mostly unable to sufficiently verify that components they install that use various libraries don’t contain malicious code.

Here’s another example: attacks on libraries of containers, like those of Docker Hub. On the one hand, using containers makes the development of apps and services more convenient, more agile. On the other, more often than not developers don’t build their own containers and instead download ready-made ones – and inside… – much like a magician’s hat – there could be anything lurking. Like a dove, or your car keys that were in your pocket. Or a rabbit. Or Alien! :) ->

Read on…

Herewith, more tales from back in the day about how our company went from humble beginnings to what we are today. And this cyber-yesteryear series – it’s all thanks to… lockdown! I’d have never found the time for such meanderings down cyber-memory lane otherwise…

Just in case you missed them, here are the previous installments:

Part 1
Part 2
Part 3
Part 4

All righty. Part 5: 1996. Truly a fateful, watershed year…

First, at KAMI, where I was still working, the owners decided to break away. As a result KAMI was split up into several independent organizations. And in the following year – 1997 – we broke away too.

Second, we signed an OEM (original equipment manufacturer) contract with the German company G-Data to supply them with of our antivirus engine. That contract ran for a full 12 years – up to 2008! – when we became No.1 on the German retail market. That’s just how it went. Our original-tech prowess was unstoppable! But what were we to do? But, anyway, it was G-Data who’d approached us (we weren’t able to actively seek out tech-partners back then), offering Remizov – boss of KAMI – cooperation, culminating in the signing of the contract at CeBIT, as described in Part 4. And that was how our technology-licensing business took off.

After the Germans (in 1995) came the Finns – F-Secure (in 1996), then known as Data Fellows. Let me tell you about how our cooperation with them started.

In August 1995, the first ever macro virus appeared, which infected Microsoft Word documents. It turned out that writing macro viruses was very straightforward, and they were being spread at alarming rates among a great many unsuspecting users. This caught the attention of other virus writers, and very quickly macro viruses became the biggest headache for the antivirus industry. Detecting them was far from easy, since the format of a Word document is most complex (who knew?:). So for several months AV firms played shamen using various methods, until when, in early 1996, McAfee (the company:) announced the ‘correct’ disassembly method for the format of Word documents. That news was latched onto by our colleague Andrey Krukov (who’d joined our collective in 1995), and he quickly came up with a most elegant and effective tech solution. I put the word out about this, and pretty soon companies started approaching us with offers to buy our technology. Having garnered several such offers, we arranged a meet with them all – at the upcoming Virus Bulletin Conference in Brighton, UK, where Andrey and I traveled to in the fall of 1996.

In Brighton, things hardly went to plan: none of those meetings ever came to anything! However…

Read on…

Finally, summer’s arrived. Took it’s time! But I’m not sure it’s the blessing it normally is, since we’re all still sat at home working remotely. Sure, there have been ‘easings’ here and there around the world, but we here at K are in no rush to… rush things. I think that goes for other IT companies too that will be working from home till at least fall, while some have signaled they’re on for staying home until the end of the year. And of course business trips are still being cancelled, as are exhibitions and conferences and Olympic Games and Cannes Festival and a whole load of other large-scale events. Some countries still have closed borders too.

So yep: we’re all still cooped up, not getting out much, and getting a bit stir crazy with the cabin fever. At least that’s how things are for many, I’m sure. There are others who are taking advantage of all the extra time and getting more exercise than ever, the devils! I’m somewhere in-between. Sometimes tired of Groundhog Every-Day, but staying busy. And that includes dusting off and delving into my archives to dig up some old photos, which lead to fond memories (plus reminders of how quickly the world is changing), which lead to… my next cyber-yesteryear post!

Yes, this series combines cyber-nostalgia, plus various personal and business insights I’ve picked up along the cyber-way, which I hope will be useful to some, or just interesting to others. Accordingly, I continue here today with part four, and I continue my tales, begun in part three, about CeBIT…

CeBIT – we loved it to bits! It was just sooo new and different and massive and…

Read on…

Looks like I’m just in time with the third and final part of my book recommendations series: stay-at-home restrictions are easing seemingly everywhere. Still, staying home looks like what many will continue to do anyway, so this part-three isn’t too late really. But, even during ‘normal’ times, reading is totally must-do, surely? It’s not like these recommendations have an expiry date! Ok, enough intro; here are my recommendations – category: science fiction!

Yes, I’m a science fiction buff, and have been since I was a kid. I remember looking forward to our regular visits to some friends of my parents who had a really impressive (for the times) collection of sci-fi on their shelves. I’d just disappear for hours, fixated by a work like those by Jules Verne (Captain Nemo), H.G. Wells (The Time Machine, The War of the Worlds, The Invisible Man), and Alexander Belyayev (Amphibian Man, Professor Dowell’s Head), which I’d get through in a few hours! Later came Bradbury’s Martian Chronicles, Asimov’s Three Laws of Robotics and I, Robot, Arthur C. Clarke’s A Fall of Moondust, Simak’s parallel worlds (proto-multiverses), Ursula K. Le Guin‘s Earthsea stories, and much more.

I could dig endlessly on this topic, but here, for brevity’s sake, I’ll stick to my top-3 all-time fave sci-fi writers; rather – top-4, as two brothers wrote together (the Strugatskys). Btw – I have the complete works of the Strugatskys, and also of Kurt Vonnegut in hardback! (Yes, I prefer actual books; we stare at screens enough IMHO:). 

Arkady and Boris Strugatsky

The master-maestros of the genre. They started out in the 1950s writing utopian-heroic-communist texts, but later changed their tune big time – their heroes changed, as did the problems they had to deal with.

There are a great many super sci-fi writers, but these two are to me the very best. Deeper, more emphatic, more audacious – the thinking person’s sci-fi: more ‘literature’ than sci-fi!

Later in their careers they became all the more philosophical, and conducted literary experiments on identity and society.

I remember clearly my first Strugatsky novel: Beetle in the Anthill, published in 1979 in a Soviet magazine – one chapter per edition (waiting impatiently each month for the next chapter). 

Read on…

I hope you liked the first part of the ‘greatest hits’ on my bookshelves – business books. Time now to turn to another category: about how the world ‘ticks’: the history, societies and governments of human beings, and more…

On China, by Henry Kissinger

For those who find a few Wikipedia pages ok but insufficient on detail to satisfy their curiosity and quest for learning more about China – this is the book to go for. In it you’ll learn all sorts about the country’s ancient history, its economy and more. There’s the estimation that the GDP of mediaeval China was something like a third of world GDP (!), there’s all the treachery of the opium wars, there’s the Communist past, and the country’s renaissance. Highly recommended. But be warned: there’s a TON of detail in there. Some pages I just scanned. So let me adjust my recommendation: I highly recommend you read… the best bits sections of this book ).

Read on…

Working remotely is one thing. Learning a new hobby or even profession – also remotely: super. But you need to take a break now and again otherwise that learning suffers. Also – since you’ve no commute, your free time of an evening tends to be a bit longer. What I’m getting to is… it’s high time – to read!

But read what?

Well, I personally read all sorts. Just as well, as I’m often asked what books I might recommend to others. Fine by me – as I’ve plenty of recommendations. That many, in fact, that when I decided to put fingers to keyboard and come up with a list, there were just too many. Accordingly, I’ve split my recommendations into three separate posts. Today’s post: business books I highly recommend.

Good to Great, by Jim Collins

I reckon that if I had to line up the business books I’ve read on my bookshelf in order of importance from left to right, this one would be first – furthest left. But might it be outdated already? After all, it was published in 2001, and given that our world is changing at dizzying speed, sure, that seems like a fair question. Actually – no. For the main topics in the books are somewhat timeless and are as relevant today as they were back then. In plain language and with lots of practical examples, the author convincingly analyzes the traits commonly found in various types of leaders (manager-leader, team leader, company leader). It’s one of the few good books, IMHO, on how to build a great business.

Read on…

Around four years ago cybersecurity became a pawn used in geopolitical games of chess. Politicians of all stripes and nationalities wag fingers at and blame each other for hostile cyber-espionage operations, while at the same time – with the irony seemingly lost on them – bigging-up their own countries’ cyber weapons tools that are also used in offensive operations. And caught in the crossfire of geopolitical shenanigans are independent cybersecurity companies, who have the ability and gall guts to uncover all this very dangerous tomfoolery.

But, why? It’s all very simple…

First, ‘cyber’ is still really quite the cool/romantic/sci-fi/Hollywood/glamorous term it appears to have always been since its inception. It also sells – including newspapers online newspaper subscriptions. It’s popular – including to politicians: it’s a handy distraction – given its coolness and popularity – when distraction is something that’s needed, which is often.

Second, ‘cyber’ is really techy – most folks don’t understand it. As a result, the media, when covering anything to do with it, and always seeking more clicks on their stories, are able to print all manner of things that aren’t quite true (or completely false), but few readers notice. So what you get are a lot of stories in the press stating that this or that country’s hacker group is responsible for this or that embarrassing/costly/damaging/outrageous cyberattack. But can any of it be believed?

Generally, it’s hard to know if it can be believed or not. Given this, is it actually possible to accurately attribute a cyberattack to this or that nation state or even organization?

There are two aspects to the answer…

From the technical standpoint, cyberattacks possess an array of particular characteristics, but impartial system analysis thereof can only go so far in determining how much an attack looks like it’s the work of this or that hacker group. However, whether this or that hacker group might belong to… Military Intelligence Sub-Unit 233, the National Advanced Defense Research Projects Group, or the Joint Strategic Capabilities and Threat Reduction Taskforce (none of which exist, to save you Googling them:)… that is a political aspect, and here, the likelihood of manipulation of facts is near 100%. It turns from being technical, evidence-based, accurate conclusions to… palm or coffee grounds’ readings for fortune-telling. So we leave that to the press. We stay well away. Meanwhile, curiously, the percentage of political flies dousing themselves in the fact-based ointment of pure cybersecurity grows several-fold with the approach of key political events. Oh, just like the one that’s scheduled to take place in five months’ time!

So yes, political attribution is something we avoid. We stick to the technical side; in fact – it’s our duty and what we do as a business. And we do it better than anyone, I might modestly add ). We keep a close watch on all large hacker groups and their operations (600+ of them), and pay zero attention to what their affiliation might be. A thief is a thief, and should be in jail. And now, finally, 30+ years since I started out in this game, after collecting non-stop so much data about digital wrongdoing, we feel we’re ready to start sharing what we’ve got – in the good sense ).

Just the other day we launched a new awesome service aimed squarely at cybersecurity experts. It’s called the Kaspersky Threat Attribution Engine (KTAE). What it does is analyze suspicious files and determine from which hacker group a given cyberattack comes from. For knowing the identity of one’s attacker makes fighting it much easier: informed countermeasure decisions can be made, a plan of action can be drawn up, priorities can be set out, and on the whole an incident response can be rolled out smoothly and with minimal risk to the business.

So how do we do it?

Read on…