Antivirus

Biden bans massive antivirus software company due to Russian hacker concerns

Whether you know it or not, odds are good that you have at some point in your life worked with Kaspersky Lab software. Founded in the late 1990s, the Moscow tech company has spent decades cementing its reputation as a global powerhouse in antiviral and cybersecurity products. It claims on its website to serve some

Whether you know it or not, odds are good that you have at some point in your life worked with Kaspersky Lab software. Founded in the late 1990s, the Moscow tech company has spent decades cementing its reputation as a global powerhouse in antiviral and cybersecurity products. It claims on its website to serve some 400 million users and 250,000 corporate clients, all in the name of “building a safer world” in which “technology improves all of our lives.”

Despite its position in the uppermost echelons of elite cybersecurity businesses, Kaspersky has long been dogged by allegations of Russian government influence, leading in part to a 2017 U.S. government ban on using the company’s software on federal computers. Those tensions reached a crescendo last week, however, when Commerce Secretary Gina Raimondo announced plans to “prohibit Kaspersky Lab and all of its affiliates, subsidiaries and parent company from providing cyber security and antivirus software anywhere in the United States” in a call with reporters. While Kaspersky’s alleged susceptibility to Russian influence has “certainly been on the government’s radar for a number of years,” the “malign activity from Russia in particular over the past couple of years” led the government to “more broadly address this threat,” said Commerce Department’s Office of Information and Communications Technology and Services head Liz Cannon to NPR last week.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

https://cdn.mos.cms.futurecdn.net/flexiimages/jacafc5zvs1692883516.jpg

Sign up for The Week’s Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

Read More

Be the first to write a comment.

Leave a Reply

Your email address will not be published. Required fields are marked *

Antivirus

Bitdefender Total Security review: One of the top antivirus options you can buy

Bitdefender bundles antivirus and anti-malware with other digital privacy tools to keep you safer. Here’s how it works…

Bitdefender bundles antivirus and anti-malware with other digital privacy tools to keep you safer. Here’s how it works…
Read More

Continue Reading
Antivirus

Best free antivirus 2024: Keep your PC safe without spending a dime

A lot of time is spent looking at the best paid antivirus suites, but free antivirus solutions are worth discussion, too. After all, free versions are based on their paid counterparts. Good news is, when you see a free alternative to a paid version you like…

A lot of time is spent looking at the best paid antivirus suites, but free antivirus solutions are worth discussion, too. After all, free versions are based on their paid counterparts.

Good news is, when you see a free alternative to a paid version you like…
Read More

Continue Reading
Antivirus

Avast security tools hijacked in order to crack antivirus protection

Researchers spot new campaign that can turn off antivirus protection Malware uses legitimate Avast Anti-Rootkit driver to access kernel level Once antivirus is deactivated, the malware can proceed without detection Hackers are using a legitimate Avast Anti-Rootkit driver to disguise their malware, turn off antivirus protection, and infect systems, experts have warned. The vulnerable driver


  • Researchers spot new campaign that can turn off antivirus protection
  • Malware uses legitimate Avast Anti-Rootkit driver to access kernel level
  • Once antivirus is deactivated, the malware can proceed without detection

Hackers are using a legitimate Avast Anti-Rootkit driver to disguise their malware, turn off antivirus protection, and infect systems, experts have warned.

The vulnerable driver has been exploited in a number of attacks since 2021, with the original vulnerabilities being present since at least 2016, research by Trellix, has claimed, noting the malware can use the vulnerable driver to end the processes of security software at the kernel level.

The malware in question belongs to the AV Killer family, with the attack using a vector known as bring-your-own-vulnerable-driver (BYOVD) to infect the system.

Virus can turn off antivirus

Trellix outlined how the malware uses a file named ‘kill-floor.exe’ to place the vulnerable driver named ‘ntfs.bin’ into the default Windows user folder, before using the Service Control executable (sc.exe) to register the driver using the ‘aswArPot.sys’ service.

Included within the malware is a hardcoded list of 142 processes used by common security products, which is used to check system process snapshots for any matches.

The malware then uses the ‘DeviceIoControl’ API to run the relevant commands to end the process, thereby preventing the antivirus from detecting the malware.

The hardcoded list includes processes belonging to a number of security products from names such as McAfee, Avast, Microsoft Defender, BlackBerry, Sophos, and many more.

As BleepingComputer points out, this isn’t the first time a BYOVD attack has exploited a vulnerable Avast driver, with the 2021 Avoslocker ransomware attacks abusing an Avast Anti-R

Read More

Continue Reading
Antivirus

The best antivirus software for staying protected online

The top antivirus software options to protect your personal and financial data when shopping or browsing online…

The top antivirus software options to protect your personal and financial data when shopping or browsing online…
Read More

Continue Reading