Antivirus

Biden bans massive antivirus software company due to Russian hacker concerns

Whether you know it or not, odds are good that you have at some point in your life worked with Kaspersky Lab software. Founded in the late 1990s, the Moscow tech company has spent decades cementing its reputation as a global powerhouse in antiviral and cybersecurity products. It claims on its website to serve some

Whether you know it or not, odds are good that you have at some point in your life worked with Kaspersky Lab software. Founded in the late 1990s, the Moscow tech company has spent decades cementing its reputation as a global powerhouse in antiviral and cybersecurity products. It claims on its website to serve some 400 million users and 250,000 corporate clients, all in the name of “building a safer world” in which “technology improves all of our lives.”

Despite its position in the uppermost echelons of elite cybersecurity businesses, Kaspersky has long been dogged by allegations of Russian government influence, leading in part to a 2017 U.S. government ban on using the company’s software on federal computers. Those tensions reached a crescendo last week, however, when Commerce Secretary Gina Raimondo announced plans to “prohibit Kaspersky Lab and all of its affiliates, subsidiaries and parent company from providing cyber security and antivirus software anywhere in the United States” in a call with reporters. While Kaspersky’s alleged susceptibility to Russian influence has “certainly been on the government’s radar for a number of years,” the “malign activity from Russia in particular over the past couple of years” led the government to “more broadly address this threat,” said Commerce Department’s Office of Information and Communications Technology and Services head Liz Cannon to NPR last week.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

https://cdn.mos.cms.futurecdn.net/flexiimages/jacafc5zvs1692883516.jpg

Sign up for The Week’s Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

Read More

Be the first to write a comment.

Leave a Reply

Your email address will not be published. Required fields are marked *

Antivirus

Why This Budget-Friendly VPN & Antivirus Combo Is Blowing Up

If you’re looking to score a two-in-one deal, this discounted VPN + antivirus combo from Surfshark is sure to catch your eye…

If you’re looking to score a two-in-one deal, this discounted VPN + antivirus combo from Surfshark is sure to catch your eye…
Read More

Continue Reading
Antivirus

Hackers are using Google.com to deliver malware by bypassing antivirus software. Here’s how to stay safe

Attackers use real Google URLs to sneak malware past antivirus and into your browser undetected This malware only activates during checkout, making it a silent threat to online payments The script opens a WebSocket connection for live control, completely invisible to the average user A new browser-based malware campaign has surfaced, demonstrating how attackers are


  • Attackers use real Google URLs to sneak malware past antivirus and into your browser undetected
  • This malware only activates during checkout, making it a silent threat to online payments
  • The script opens a WebSocket connection for live control, completely invisible to the average user

A new browser-based malware campaign has surfaced, demonstrating how attackers are now exploiting trusted domains like Google.com to bypass traditional antivirus defenses.

A report from security researchers at c/side, this method is subtle, conditionally triggered, and difficult for both users and conventional security software to detect.

It appears to originate from a legitimate OAuth-related URL, but covertly executes a malicious payload with full access to the user’s browser session.

You may like

  • Google Apps Script abused to launch dangerous phishing attacks
  • Criminals hijacking subdomains of popular websites such as Bose or Panasonic to infect victims with malware: here’s how to stay safe
  • Cybercriminals have found a sneaky way of stealing tax accounts and even encrypted messages: here’s what you need to know

Malware hidden in plain sight

The attack begins with a script embedded in a compromised Magento-based ecommerce site which references a seemingly harmless Google OAuth logout URL: https://accounts.google.com/o/oauth2/revoke.

However, this URL includes a manipulated callback parameter, which decodes and runs an obfuscated JavaScript payload using eval(atob(…)).

The use of Google’s domain is central to the deception – because the script loads from a trusted source, most content security policies (CSPs) and DNS filters allow it through without question.

This script only activates under specific conditions. If the browser appears automated or the URL includes the word “checkout,” it silently opens a WebSocket connection to a malicious server. This means it can tailor malicious behavior to user actions.

Read More

Continue Reading
Antivirus

Hackers Aren’t Just After Your Devices

Antivirus isn’t enough—hackers are after doors they can open…

Antivirus isn’t enough—hackers are after doors they can open…
Read More

Continue Reading
Antivirus

Police takes down AVCheck site used by cybercriminals to scan malware

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. …

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. …
Read More

Continue Reading