Nota Bene

As you might guess from the title, today we’ll be talking about rootkits. At heart this is an interesting topic, but often that ‘heart’ is out of sight: in the press rootkits are rarely covered at all, and if they are the articles are filled with nothing but horror stories that have nothing in common with reality. There are of course many technical articles, but these don’t help the wider audience – the general public.

But the problem exists.

The majority of anti-virus software is making great strides towards protection from rootkits. But this isn’t necessarily a good thing, since not all of it does it properly. The ability to fight them first depends on, and is indicative of, the technological progressiveness and overall level of anti-malware expertise of the developer. And not all ‘developers’ are technologically progressive – so their so-called anti-rookit technologies aren’t up to scratch, leaving overall protection against rootkits around the world  lower than it could and should be. And let’s not forget that many botnets use rootkit technologies, and the ability to draw out this contagion is the best protection there is from cybercriminals.

So let’s go through all the salient points about rootkits in order.

More > The basics, the threat and the remedy …

Windows 8 is coming! In line with its tendency to introduce high-profile security features in each new version of its operating system, Microsoft is unleashing some pretty interesting new protection technologies with its next OS release. In fact, some of them may dramatically change the cyber threat landscape and bring the security industry a set of very handy tools for protecting users against sophisticated threats like rootkits.

Today my “in the Spotlight” guest is Alexey Polyakov, the Head of KL’s Global Emergency Response Team, our consulting service that assists enterprises in investigating security incidents, and auditing and improving corporate security policy.

Ever since graduating from Moscow State University with an M.Sc. in Physics, Alexey’s been working in the IT security industry – now for 15 years – with a résumé featuring positions at McAfee, IBM, Symantec and Microsoft.

Prior to joining us at KL Alexey worked as a senior security program manager at Microsoft, where he became the proud founder of the Microsoft Security Response Team and was one of the key members of the company’s security development. He’s authored and co-authored security technologies protected by 12 patents, and one such technology was Secure Boot – perhaps the most ambitious advance in Windows 8 in terms of security.

So, let’s see what our man can tell us about what to expect from Windows 8 from the security standpoint, and how this might change the security market.

Microsoft’s recent ‘Build’ conference made rather a splash in the industry by announcing many useful features in its upcoming Windows 8. While mostly addressing the new user interface, performance issues and multi-platform support, the company also presented a number of security innovations.

What do you think about Microsoft’s products’ security in general?

More > Some nice tools to make cyber criminals’ life harder…

Hi everybody,

Last week I was lucky enough to have been enjoying true Irish hospitality at the oh-so-special-yet-informal F.ounders 2011 conference.

It was a great experience, even for me – a person whom it’s quite difficult to surprise with an event. Some people call F.ounders the “Davos for Geeks”, and frankly speaking I would in some ways agree with this description! But “geek” I think has some negative connotation, if only jokingly. Here though – there was only positivity – tons thereof. Unique!

The recipe for the event was quite simple.

You mix together renowned IT-entrepreneurs, high-profile press, investors and promising start-uppers; then pour the mixture into a beautiful city, add lashings of real draft Guinness (the sort that takes aeons to settle before a top-up – only found in Ireland, (sadly)), then heat up with personal attendances of national leaders and local celebrities, and you’re done! What you get is the delicious F.ounders cocktail!

More > Bono leads the way on a Dublin pub crawl!

I’m very excited about today’s guest. Very few industry experts know him by name, even though he’s the guy who first discovered the notorious Stuxnet worm in 2010. His name is Sergey Ulasen.

First, a few background words about Sergey. I’m happy to say that he joined the company in August 2011, immediately starting to contribute to the ever growing expertise of our malware analysis team, which now consists of more than 100 experts around the world. He’s a very professional and high spirited man, possessing the expert knowledge and experience for tackling even the most sophisticated threats.

Sergey graduated in 2006 from the Belorussian State Technical University with a B.Sc. in software development. He began his professional career with local anti-virus vendor VirusBlokAda as a programmer. Later Sergey joined the team that engineered the company’s anti-virus engine, and in 2008 he became the team leader. He was also involved in developing anti-rootkit and system rescue technologies, and helped with solving the most sophisticated malware incidents.

Then he joined KL. Me very happy.

Sergey, let’s go back to the moment when your team first discovered the Stuxnet sample. How did it all come about?

See more > Ten questions casting light on Stuxnet’s discovery …

Anti-malware: it’s a dirty job, but someone’s got to do it. Or at least it used to be… but I’ll get to that later…

For your average Joe it can be hard to understand all the finer details of the work of an anti-malware company. But oh how we want to tell everyone about them! So we’re trying as best we can to translate them all into understandable, non-gobbledygook language – not to mention also in the English language!

The tip of the malware-fight iceberg one gets a peek at from collections of facts and figures, which illustrate the basic ins and outs of anti-malware. For example, here we have the kinds of infographics we issue on a regular basis:

[click on the image to see the details]

One of the most frequently asked questions we get is: “How many viruses do you find every day?“.

See more > So, how many viruses do we find every day?

Here we are continuing the world airport theme.

I’d heard a lot of good things about the new Pudong airport in Shanghai (Shanghai Pudong is written 上海浦东, and is translated, probably, as “High-Sea Pu-East”; the Han character “pu” – 浦 – I’m told has no meaning on its own).

Anyway, like I was saying, I’d heard a lot of good things about it. Now, after experiencing it, I’m ready to join in chorus of praise.

The building is huge – no, it’s ein Koloss! (since I’m writing this in Frankfurt Airport, I couldn’t resist getting a little bit of Deutsch in here!). Tons of space and air… The only thing that spoils it all is the grey sky outside the stained-glass windows… Ground services move about between the planes on a four-lane route painted on the apron. Now there’s a first.

In short: brand spanking new, big, convenient and quick (by the time you’ve walked from the arrival gate to baggage retrieval, your luggage is already on the conveyor). Do you remember my tale about JFK airport here? Well, in Pudong, it’s the exact opposite! It seems to me that China is preparing for becoming the most flown to and from country in the world (or has it made it already?).

Here’s a rather unusual but nice and shiny sculpture in the arrivals hall. Though you can’t quite see it in the pic, behind it water runs down the walls.

See more > VIP lounges, kids area and a beautiful sky …

So, my expectations were fulfilled. My recent post on an AV performance test caused more than a bit of a stir. But that stir was not so much on the blog but in and around the anti-malware industry.

In short, it worked – since the facts of the matter are now out in the open and being actively discussed. But that’s not all: let’s hope it won’t just stimulate discussion, but also bring the much-needed change in the way AV tests are done, which is years overdue, and is also what I’ve been “campaigning” for for years.

So, how should AV be tested?

Well, first, to avoid insults, overreaction and misplaced criticism, let me just say that I’m not here to tell testers how to do their job in a certain way so that our products come out top – to have them use our special recipe which we know we’re better than everyone else at. No, I’m not doing that, and anyway, it’s rare when we don’t figure in the top-three in different tests, so, like, why would I want to?

Second – what I’ll be talking about here isn’t something I’ve made up, but based on the established industry standards – those of AMTSO (the Anti-Malware Testing Standards Organization), on the board of which sit representatives of practically all the leading AV vendors and various authoritative experts.

See more > One don’t, one maybe and one definitely yes …

I’ve a superstitious belief. If a journey isn’t easy (starting with getting a visa at the consulate, if necessary) and various hindrances arise all along it – it normally means that what goes on at the destination at the end of the journey is mega-worthwhile and effective.

And that, gladly, is how things turned out this time too.

At JFK International Airport – the gateway to the Big Apple and of course the whole country – we were welcomed by a 2.5-hour line! And there was me thinking Sheremetyevo was bad!

A colleague told me he’d be lucky if his laptop battery life would make it until past immigration since he fancied watching a movie to ease the boredom. We should have taken a photo of his display of experienced-traveler know-how: he placed his laptop on top of its bag, which was positioned on top of his upright-standing suitcase, and this structure was somehow made all secure – yet mobile. Then, to the envy of all around, he successfully enjoyed a full feature film standing up! From beginning to end. Oh yes – and the battery made it – just!

But I digress. So, what were we doing there?

See more > Why were we in NYC for two days?

I can honestly say that news of infected military drones is in no way amusing to me. This is for real, not Hollywood.

Indeed, it appears that for once the film industry can’t keep up with the latest reports from the computing world. And making an action film these days about cyber warfare is a tricky business: in the time between a pre-release trailer and the release of a movie, the script of the movie can be played out on the evening news.

So what am I talking about here? That malware has in fact – not fiction – gotten inside Predator and Reaper drones.

See more > Any chance to solve the problem?

I am really excited about interviewing my guest today – Stephen Orenberg. This is a special man I both very much respect and admire for his business talent, besides being the perfect gentleman, of course. Steve performed nothing less than a miracle for the company’s U.S. operations, transforming the business from a lesser-known start up into one of the major players in a mature and crowded market.

Actually, this is the third company in the security industry he has worked for. Steve started U.S. operations for Dr Solomon’s Software in 1995 (later the company was acquired by McAfee), and just prior to joining Kaspersky Lab he held a similar role at Sophos.

When he came to the company in 2004 it was to start the business in the U.S. and get it up and running. Now, more than six years later, as Chief Sales Officer Steve is responsible for all sales and business development activities in North America and Western Europe. He has also been a member of the Kaspersky Lab board of directors since 2007.

As Chief Sales Officer, he now has the ambitious goals of, first, launching corporate solutions in the company’s two key markets, and second, contributing substantially to strengthening our global market positions so we can become the world’s #1 anti-virus vendor. And I have honestly no doubt we can do this. Just wait and see!

Steve, it’s been quite a long time we’ve been working together. Please remind me of how we first met and what your first impression of the company was.

See more > How we made our way to No.1 in U.S. retail?