Nota Bene

Quite a lot of folks seem to think that the automobile of the 21^st century is a mechanical device. Sure, it has added electronics for this and that, some more than others, but still, at the end of the day – it’s a work of mechanical engineering: chassis, engine, wheels, steering wheel, pedals… The electronics – ‘computers’ even – merely help all the mechanical stuff out. They must do – after all, dashboards these days are a sea of digital displays, with hardly any analog dials to be seen at all.

Well, let me tell you straight: it ain’t so!

A car today is basically a specialized computer – a ‘cyber-brain’, controlling the mechanics-and-electrics we traditionally associate with the word ‘car’ – the engine, the brakes, the turn indicators, the windscreen wipers, the air conditioner, and in fact everything else.

In the past, for example, the handbrake was 100% mechanical. You’d wrench it up – with your ‘hand’ (imagine?!), and it would make a kind of grating noise as you did. Today you press a button. 0% mechanics. 100% computer controlled. And it’s like that with almost everything.

Now, most folks think that a driver-less car is a computer that drives the car. But if there’s a human behind the wheel of a new car today, then it’s the human doing the driving (not a computer), ‘of course, silly!’

Here I go again…: that ain’t so either!

With most modern cars today, the only difference between those that drive themselves and those that are driven by a human is that in the latter case the human controls the onboard computers. While in the former – the computers all over the car are controlled by another, main, central, very smart computer, developed by companies like Google, Yandex, Baidu and Cognitive Technologies. This computer is given the destination, it observes all that’s going on around it, and then decides how to navigate its way to the destination, at what speed, by which route, and so on based on mega-smart algorithms, updated by the nano-second.

A short history of the digitalization of motor vehicles

So when did this move from mechanics to digital start?

Some experts in the field reckon the computerization of the auto industry began in 1955 – when Chrysler started offering a transistor radio as an optional extra on one of its models. Others, perhaps thinking that a radio isn’t really an automotive feature, reckon it was the introduction of electronic ignition, ABS, or electronic engine-control systems that ushered in automobile-computerization (by Pontiac, Chrysler and GM in 1963, 1971 and 1979, respectively).

No matter when it started, what followed was for sure more of the same: more electronics; then things started becoming more digital – and the line between the two is blurry. But I consider the start of the digital revolution in automotive technologies as February 1986, when, at the Society of Automotive Engineers convention, the company Robert Bosch GmbH presented to the world its digital network protocol for communication among the electronic components of a car – CAN (controller area network). And you have to give those Bosch guys their due: still today this protocol is fully relevant – used in practically every vehicle the world over!

// Quick nerdy post-CAN-introduction digi-automoto backgrounder: 

The Bosch boys gave us various types of CAN buses (low-speed, high-speed, FD-CAN), while today there’s FlexRay (transmission), LIN (low-speed bus), optical MOST (multimedia), and finally, on-board Ethernet (today – 100mbps; in the future – up to 1gbps). When cars are designed these days various communications protocols are applied. There’s drive by wire (electrical systems instead of mechanical linkages), which has brought us: electronic gas pedals, electronic brake pedals (used by Toyota, Ford and GM in their hybrid and electro-mobiles since 1998), electronic handbrakes, electronic gearboxes, and electronic steering (first used by Infinity in its Q50 in 2014).

BMW buses and interfaces

Read on…

It’s been a long, long time since humanity has had a year like this one. I don’t think I’ve known a year with such a high concentration of black swans of various types and forms in it. And I don’t mean the kind with feathers. I’m talking about unexpected events with far-reaching consequences, as per the theory of Nassim Nicholas Taleb, published in his book The Black Swan: The Impact of the Highly Improbable in 2007. One of the main tenets of the theory is that, with hindsight, surprising events that have occurred seem so ‘obvious’ and predictable; however, before they occur – no one does indeed predict them.

Example: this ghastly virus that’s had the world in lockdown since March. It turns out there’s a whole extended family of such viruses – several dozen coronaviridae, and new ones are found regularly. Cats, dogs, birds, bats all get them. Humans get them; some cause common colds; others… So surely vaccines need to be developed against them as they have been for other deadly viruses like smallpox, polio, whatever. Sure, but that doesn’t always help a great deal. Look at flu – still no vaccine that inoculates folks after how many centuries? And anyway, to even start to develop a vaccine you need to know what you’re looking for, and that is more art than science, apparently.

So, why am I telling you this? What’s the connection to… it’s inevitably gonna be either cybersecurity or exotic travel, right?! Today – the former ).

Now, one of the most dangerous cyberthreats in existence are zero-days – rare, unknown (to cybersecurity folks et al.) vulnerabilities in software, which can do oh-my-grotesque large-scale awfulness and damage – but they often remain undiscovered up until the moment when (sometimes after) they’re exploited to inflict the awfulness.

However, cybersecurity experts have ways of dealing with unknown-cyber-quantities and predicting black swans. And in this post I want to talk about one such way: YARA.

Briefly, YARA helps malware research and detection by identifying files that meet certain conditions and providing a rule-based approach to creating descriptions of malware families based on textual or binary patterns. (Ooh, that sounds complicated. See the rest of this post for clarification.:) Thus, it’s used to search for similar malware by identifying patterns. The aim: to be able to say: ‘it looks like these malicious programs have been made by the same folks, with similar objectives’.

Ok, let’s take another metaphor: like a black swan, another water-based one; this time – the sea…

Let’s say a network you (as a cyber-sleuth) are studying (= examining for the presence of suspicious files/directories) is the ocean, which is full of thousands of different kinds of fish, and you’re an industrial fisherman out on the ocean in your ship casting off huge drift nets to catch the fish – but only certain breeds of fish (= malware created by particular hacker groups) are interesting to you. Now, the drift net is special: it has special ‘compartments’ into which fish only get into as per their particular breed (= malware characteristics). Then, at the end of the shift, what you have is a lot of caught fish all compartmentalized, and some of those fish will be relatively new, unseen before fish (new malware samples) about which you know practically nothing, but they’re in certain compartments labeled, say, ‘Looks like Breed X’ (hacker group X) and ‘Looks like Breed Y’ (hacker group Y).

We have a case that fits the fish/fishing metaphor perfectly. In 2015, our YARA guru and head of GReAT, Costin Raiu, went full-on cyber-Sherlock mode to find an exploit for Microsoft’s Silverlight software. You really need to read that article on the end of the ‘case’ link there but, if very briefly, what Costin did was carefully examine certain hacker-leaked email correspondence (of ‘Hacking Team’: hackers hacking hackers; go figure!) published in a detailed news article to put together out of practically nothing a YARA rule, which went on to help find the exploit and thus protect the world from all sorts of mega-trouble.

So, about these YARA rules…

We’ve been teaching the art of creating YARA rules for years. And since the cyberthreats YARA helps uncover are rather complex, we always ran the courses in person – offline – and only for a narrow group of top cyber-researchers. Of course, since March, offline training have been tricky due to lockdown; however, the need for education has hardly gone away, and indeed we’ve seen no dip in interest in our courses. This is only natural: the cyber-baddies continue to think up ever more sophisticated attacks – even more so under lockdown. Accordingly, keeping our special know-how about YARA to ourselves during lockdown looked just plain wrong. Therefore, we’ve (i) transferred the training format from offline to online, and (ii) made it accessible to anyone who wants to do it. For sure it’s paid, but the price for such a course at such a level (the very highest:) is very competitive and market-level.

Introducing! ->

Read on…

Business done successfully will always tend toward becoming bigger. C’est la vie.

It often goes like this: In a given field, the big and strong gobble up the small and… smart (exceptions prove the rule). But what also sometimes happens is the big and strong with breakthrough technologies in one field gobble up everyone in different field. Example: once upon a time there was the giant, all-powerful Kodak, but then the era of digital photography came along, and the film-based photography field was wiped out. And this is how scientific-technical revolutions come about, and they’re useful: they help humanity progress.

But there’s another scenario: the big and strong become… so incredibly big and strong that they start dictating rules to all the other players in their industry, they strangle the natural selection of innovative and successful companies, and even try to hamper the development of any allied companies or markets that represent potential danger for their business. And in this case, antimonopoly bodies have to intervene to put a stop to such abuse of power so as to protect progress.

This latter scenario is being played out right now on a (socially-distanced) stage in a suspenseful IT-show whose main characters are Amazon, Apple, Facebook and Google – operators of the world’s largest online platforms – three of which (all bar Facebook) also act as the world’s largest online marketplaces. The other main characters in the show are the U.S. authorities, which are trying to rein in these online platforms – meaning checking they’re not unfairly taking advantage of their powerful positions – including hindering their ability to be judge, jury and executioner in their marketplaces. They are trying to prevent unfair competition – including exertion of pressure on competitors to ease promotion of the marketplaces’ own products. I’ve already written about one such high profile show case like this: the one where Apple has been driving out independent developers of parental control applications from its App Store.

Let me give an analogy here:

A landlord starts to lease out his land to farmers on equal terms and conditions, which suit everyone just fine. But at the same time, the landlord keeps a close watch on the farmers to see which are doing best. The following year, he starts doing what those successful farmers do himself. He also changes the terms and conditions of the leases ‘to protect worms’: now all farmers under those leases aren’t allowed to use spades – they must use trowels, and they should stop using fertilizer. But this rule doesn’t apply to the landlord. It’s like, he’s not actually preventing the farmers from going about their farming business – and he’s declaring worthy intentions – but how on earth can the farmers with trowels compete with the landlord with his spades and the very latest fertilizer?

Sounds all very Middle Ages, right? But a similar thing is happening in 2020 – only not in farming but in the modern digital economy; however, finally, the powers-that-be appear to be waking up to the fact. Or so it seems…

In early 2019, U.S. Senator Elizabeth Warren gave a watershed interview to The Verge, in which she stated that she “would classify any company that runs a marketplace and makes more than $25 billion a year in revenue as a ‘platform utility’, and prohibit those companies from using those platforms from [sic] selling their own products.” Put simpler – incidentally when referring to Apple in particular – she stated: “Either they run the platform or they play in the store”.

And that was that: despite the fact these were Very Big Boys she was talking about, the starting gun was duly fired…

Read on…

Nearly 30 years ago, in 1993, the first incarnation of the cult computer game Doom appeared. And it was thanks to it that the few (imagine!) home computer owners back then found out that the best way of protecting yourself from monsters is to use a shotgun and a chainsaw ).

Now, I was never big into gaming (there simply wasn’t enough time – far too busy:); however, occasionally, after a long day’s slog, colleagues and I would spend an hour or so as first-person shooters, hooked up together on our local network. I even recall Duke Nukem corporate championships – results tables in which would be discussed at lunch in the canteen, and even bets being made/taken as to who would win! Thus, gaming – it was never far away.

Meanwhile, our antivirus appeared – complete with pig squeal (turn on English subs – bottom-right of video) to give fright to even the most fearsome of cyber-monsters. The first three releases went just fine. Then came the fourth. It came with a great many new technologies against complex cyberthreats, but we hadn’t thought through the architecture well enough – and we didn’t test it sufficiently either. The main issue was the way it hogged resources, slowing down computers. And software generally back then – and gaming in particular – was becoming more and more resource-intensive by the day; the last thing anyone needed was antivirus bogarting processor and RAM too.

So we had to act fast. Which we did. And then just two years later we launched our legendary sixth version, which surpassed everyone on speed (also reliability and flexibility). And for the last 15 years our solutions have been among the very best on performance.

Alas, leopards are thought to never lose their spots. A short-term issue affecting computer performance turned into a myth – and it’s still believed by some today. Competitors were of course happy to see this myth grow… to mythical proportions; we weren’t.

But, what has any of this K memory-laning got to do with Doom? Well…

Read on…

We’ve done it again! For the second time we’re in the Derwent Top 100 Global Innovators – a prestigious list of global companies that’s drawn up based on their patent portfolios. I say prestigious, as on the list we’re rubbing shoulders with companies such as Amazon, Facebook, Google, Microsoft, Oracle, Symantec and Tencent; also – the list isn’t just a selection of seemingly strong companies patents-wise: it’s formed upon the titanic analytical work of Clarivate Analytics, which sees it evaluate more than 14,000 (!) candidate companies on all sorts of criteria, of which the main one is citation rate, aka ‘influence’. And as if that wasn’t tough enough, in five years the threshold requirement for inclusion in the Top-100 on this criterion has risen some 55%:

In a bit more detail, the citation rate is the level of influence of inventions on the innovations of other companies. For us, it’s how often we’re mentioned by other inventors in their patents. And to be formally mentioned in another company’s patent means you’ve come up with something new and genuinely innovative and helpful, which aids their ‘something new and genuinely innovative and helpful’. Of course, such an established system of acknowledging other innovators – it’s no place for those who come up with mere BS patents. And that’s why none of those come anywhere near this Top-100. Meanwhile, we’re straight in there – in among the top 100 global innovator companies that genuinely move technological progress forward.

Wow, that feels good. It’s like a pat on the back for all our hard work: true recognition of the contributions we’ve been making. Hurray!

Still reeling – glowing! – from all this, ever the curious one, I wondered which, say, five, of our patented technologies are the most cited – the most influential. So I had a look. And here’s what I found…

5^th place – 160 citations: US8042184B1 – ‘Rapid analysis of data stream for malware presence’.

Read on…

Most probably, if you’re normally office-based, your office right now is still rather – or completely – empty, just like ours. At our HQ the only folks you’ll see are the occasional security guards, and the only noise you’ll hear is the hum of the cooling systems of our heavily-loaded servers given that everyone’s hooked up and working from home.

You’d never imagine that, unseen, our technologies, experts and products are working 24/7 protecting the cyberworld. But they are. But the bad guys are up to new nasty tricks at the same time. Just as well, then, that we have an early-warning system in our cyber-protection collection of tools. But I’ll get to that in a bit…

The role of an IT security guy or girl in some ways resembles that of a forest ranger: to catch the poachers (malware) and neutralize the threat they pose for the forest’s dwellers, first of all you need to find them. Of course, you could simply wait until a poacher’s rifle goes off and run toward where the sound came from, but that doesn’t exclude the possibility that you’ll be too late and that the only thing you’d be able to do is clear up the mess.

You could go full-paranoiac: placing sensors and video cameras all over the forest, but then you might find yourself reacting to any and every rustle that’s picked up (and soon losing sleep, then your mind). But when you realize that poachers have learned to hide really well – in fact, to not leave any trace at all of their presence – it then becomes clear that the most important aspect of security is the ability to separate suspicious events from regular, harmless ones.

Increasingly, today’s cyber-poachers are camouflaging themselves with the help of perfectly legitimate tools and operations.

A few examples: opening a document in Microsoft Office, a system administrator being granted remote access, the launch of a script in PowerShell, and the activation of a data encryption mechanism. Then there’s the new wave of so-called fileless malware, leaving literally zero traces on a hard drive, which seriously limits the effectiveness of traditional approaches to protection.

Examples: (i) the Platinum threat actor used fileless technologies to penetrate computers of diplomatic organizations; and (ii) office documents with malicious payload were used for infections via phishing in the operations of the DarkUniverse APT; and there are plenty more. One more example: the fileless ransomware-encryptor ‘Mailto’ (aka Netwalker), which uses a PowerShell script for loading malicious code directly into the memory of trusted system processes.

Now, if traditional protection isn’t up to the task, it’s possible to try and forbid to users a whole range of operations, and to introduce tough policies on access and usage of software. However, given this, both the users and the bad guys will eventually probably find ways round the prohibitions (just like the prohibition of alcohol was always gotten around too:).

Much better would be to find a solution that can detect anomalies in standard processes and for the system administrator to be informed about them. But what is crucial is for such a solution to be able to learn how to automatically determine accurately the degree of ‘suspiciousness’ of processes in all their great variety, so as not to torment the system administrator with constant cries of ‘wolf!’

Well – you’ve guessed it! – we have such a solution: Adaptive Anomaly Control, a service built upon three main components – rules, statistics and exceptions.

Read on…

The first few years after the founding of the company were the toughest of all because we really had to put the hours in, aka, bust our asses. It was like we were compressing a spring for it only later to be released to take the company up high and far beyond the horizon and in the right direction of pipe dreams (be careful what you have pipe dreams of:). After the formal registration of KL in 1997, with very little we did an awful lot. We had no money and hardly any resources, but the cybersecurity conveyor waits for no one: new technologies were needed, and the market demanded new products. So we toiled and slogged, working most weekends, and with hardly ever a vacation. So what were we working on? Here’s an example…

June 1998: the global Chernobyl (CIH) virus epidemic. All the other AV companies either didn’t notice it or didn’t bother with it, or were on vacation; we were almost the only one with a product that not only caught, but also cured systems infected with this pathogen. The www (i.e., already not just Runet:) was dotted with links to our site. That’s how we were rewarded for our super-speedy reactions to new threats – that and our ability to launch quick updates with procedures for treatment of specific threats. While this specific virus-threat incredibly craftily installed itself into Windows memory, hooked file-access calls, and infected executable files – all of which required a custom-designed dissection process that would have been impossible to deliver without flexible functionality of updates.

So – tough: yes; but we were getting results and growing. And then, two months later, we received a helping hand (of fate?!) of the most unexpected kind…

August 1998: the Russian financial crisis, featuring devaluation of the ruble, plus Russia defaulting on its debt. It was bad for most Russians on the whole, but we were reeeaaal lucky: all our foreign partners paid us in advance in foreign currency. We were an exporter. Our operating/working currency – a heavily devalued ruble; our income – dollars, pounds sterling, yen, etc. We were in the money!

But we didn’t rest on our ‘lucky’ laurels amid the financial crisis. We used the period also to take on new, professional – expensive! – managers. Soon we had commercial, technical and finance directors. And a little later we started to take on mid-level managers too. This was our first ever ‘restructuring‘ – when the ‘team’ became a ‘company’; when friendly, organic relations were replaced by a more formal organizational structure, subordination and accountability. The restructuring could have been painful; thankfully it wasn’t: we just got on with it without too much nostalgia for the old family-like times.

// For all about this kind of reorganization-restructuring-‘reengineering’ – I highly recommend the book Reengineering the Corporation by Michael Hammer and James Champy. It’s a real good one. Other useful books – here.

In 1999 we opened our first foreign office – in Cambridge in the UK. But, like, what with the British market being perhaps one of the toughest to crack for foreigners, why there? Actually, it was kinda just by chance (I’ll tell you how below). Still, we had to start somewhere, and anyway, our first experiences – including many mistakes and lessons learned – in the UK helped in making development of the business in other countries run a lot smoother…

Our first ever press tour took place in London, as we were in the British capital anyway for an IT security conference (InfoSecurity Europe). On that press tour we proudly announced our intention of opening an office in the UK. But the journalists would simply ask why, given that there were already Sophos, Symantec, McAfee and so on already comfortably established in the country. So we switched to geek mode: we told them all about how our company was a truly innovative one, and all about our unique technologies and products and how – because of them – we’re better than all the competition they’d just mentioned. All this was noted with much surprised interest (and another bonus: ever since then really silly questions have never been asked of us!). Meanwhile, at InfoSecurity Europe I gave my first ever speech to an English-speaking audience made up of… two journalists, who turned out to be from our friends at Virus Bulletin who already knew plenty about us! Still, that was the first – and last – time any of our presentations weren’t full-house (btw: details – here).

As regards our first ever partner conference, here’s how that came about..

Some time in the winter of 1998-1999 we were invited to the partner conference of our OEM partner F-Secure (Data Fellows). And that’s how we learned about the whole partner-conference format and what a great idea it is: to gather everyone together, share all the latest information about technologies and products, to hear out partners’ concerns and problems, and to discuss new ideas. Not ones to hang about – within a year (in 1999) we put on our own partner conference, inviting ~15 partners from Europe, the U.S. and Mexico to Moscow. Here we all are, on Revolution Square next to Red Square and the Kremlin:

Read on…

Malicious code… – it gets everywhere…

It’s a bit like a gas, which will always fill the space it finds itself in – only different: it will always get through ‘holes’ (vulnerabilities) in a computer system. So our job (rather – one of them) is to find such holes and bung them up. Our goal is to do this proactively; that is, before malware has discovered them yet. And if it does find holes – we’re waiting, ready to zap it.

In fact it’s proactive protection and the ability to foresee the actions of attackers and create a barrier in advance that distinguishes genuinely excellent, hi-tech cybersecurity from marketing BS.

Here today I want to tell you about another way our proactive protection secures against yet another, particularly crafty kind of malware. Yes, I want to tell you about something called fileless (aka – bodiless) malicious code – a dangerous breed of ghost-malware that’s learned to use architectural drawbacks in Windows to infect computers. And also about our patented technology that fights this particular cyber-disease. And I’ll do so just as you like it: complex things explained simply, in the light, gripping manner of a cyber-thriller with elements of suspense ).

First off, what does fileless mean?

Well, fileless code, once it’s gotten inside a computer system, doesn’t create copies of itself in the form of files on disk – thereby avoiding detection by traditional methods, for example with an antivirus monitor.

So, how does such ‘ghost malware’ exist inside a system? Actually, it resides in the memory of trusted processes! Oh yes. Oh eek.

In Windows (actually, not only Windows), there has always existed the ability to execute dynamic code, which, in particular, is used for just-in-time compilation; that is, turning program code into machine code not straight away, but as and when it may be needed. This approach increases the execution speed for some applications. And to support this functionality Windows allows applications to place code into the process memory (or even into other trusted process memory) and execute it.

Hardly a great idea from the security standpoint, but what can you do? It’s how millions of applications written in Java, .NET, PHP, Python and other languages and for other platforms have been working for decades.

Predictably, the cyberbaddies took advantage of the ability to use dynamic code, inventing various methods to abuse it. And one of the most convenient and therefore widespread methods they use is something called reflective PE injection. A what?! Let me explain (it is, actually, rather interesting, so do please bear with me:)…

Launching an application by clicking on its icon – fairly simple and straightforward, right? It does look simple, but actually, under the hood, there’s all sorts goes on: a system loader is called up, which takes the respective file from disk, loads it into memory and executes it. And this standard process is controlled by antivirus monitors, which check the application’s security on the fly.

Now, when there’s a ‘reflection’, code is loaded bypassing the system loader (and thus also bypassing the antivirus monitor). The code is placed directly into the memory of a trusted process, creating a ‘reflection’ of the original executable module. Such reflection can be executed as a real module loaded by a standard method, but it isn’t registered in the list of modules and, as mentioned above, it doesn’t have a file on disk.

What’s more, unlike other techniques for injecting code (for example, via shellcode), a reflection injection allows to create functionally advanced code in high-level programming languages and standard development frameworks with hardly any limitations. So what you get is: (i) no files, (ii) concealment behind trusted process, (iii) invisibility to traditional protective technologies, and (iv) a free hand to cause some havoc.

So naturally, reflected injections were a mega-hit with developers of malicious code: At first they appeared in exploit packs, then cyber-spies got in on the game (for example, Lazarus and Turla), then advanced cybercriminals (as it’s a useful and legitimate way of executing complex code!), then petty cybercriminals.

Now, on the other side of the barricades, finding such a fileless infection is no walk in the cyber-park. So it’s no wonder really that most cybersecurity brands aren’t too hot at it. Some can hardly do it at all.

Read on…

We’d just started getting used to – even comfortable with – working from home every day and to ‘social’ distancing (wouldn’t ‘physical’ distancing have been a better term?:). Our partner conferences and other events had only just got back up to pre-lockdown scale in terms of the number of folks taking part – albeit online. I’d just gotten used to 10/15/20 kilometers of running of a morning before breakfast. In short, everything was going in one direction. But then the other day, out of the blue, suddenly things seemed to slam into reverse when I was asked, via the good K folks in our PR department, to do an interview – ‘on camera, in the office – tomorrow please!’. Well, well. All righty!…

Indeed, it looks like were heading back, slowly, to ~normality, despite the masks and sanitizer, after months without normal daily social interaction in person. Part of me thinks: ‘Good’ – let’s get back to work‘ (a fave phrase of mine). Another part of me recalls: ‘But, we have been working – as normal – throughout the whole of lockdown!’. Still, I do miss the office – seeing people, being among people, talking to people in person, as I’m sure many do, despite some of the upsides to working from home which surprisingly became apparent.

Anyway, the other day, I gave my first physically face-to-face interview in over three months. It was about one of our (cloud-related) business partnerships. Hmm – actually, it wasn’t quite ‘face-to-face’; it was ‘mask-to-mask’ – for practically the whole film crew and interviewer, of course, were masked up. I suggested to them that I join in and put one on, but they didn’t fancy that idea much. Still, as you can see, the ‘social distancing’ (even ‘distant socializing’ might be a better phrase:) rules were strictly followed.

Read on…

Back with more K cyber-nostalgia – this post takes us back to a very special year for the company – the year of its founding! And as you can see from the date on our company registration certificate – that founding took place on June 26, 1997:

And that’s why we have our yearly mega-birthday-bash every June July (don’t ask; what’s a month among friends?!) – only not this year: the first time we’ve ever not had one. Shame. But what can you do?

I remember our first birthday party the following year in 1998, in a fairly rough bowling alley. Not too impressed with such a setting, we made amends the following year – already branching out into the countryside surrounding Moscow, where it’s been every year since, and where I really hope it will be again next year.

Here’s another curious K-tale from the summer of 1997…

Read on…