Kaspersky to US: Check Our Source Code

Cybersecurity expert Eugene Kaspersky has volunteered to turn over his company's software source code to allay fears about possible ties with the Russian government, The Australian reported last week. Kaspersky made the offer public at CeBIT Australia.
Kaspersky to US: Check Our Source Code

Some U.S. officials have expressed concerns that Kaspersky Lab might have a close working relationship with the Russian government.

Kaspersky five years ago replaced a number of high-level managers with people who had ties to Russia's military or intelligence services, Bloomberg reported in 2015.

Some of them reportedly have provided data from the 400 million customers using Kaspersky's software to Russia's intelligence agency, the FSB.

Also, Kaspersky himself reportedly visits saunas with Russian officials on a regular basis.

Kaspersky studied at a university backed by the KGB -- the precursor of the FSB -- in the 1980s, according to reports, and he served as a software engineer with Soviet military intelligence before leaving for the private sector.

The heads of five U.S. intelligence agencies recently expressed suspicions regarding Kaspersky Lab to the U.S. Senate Select Committee on Intelligence, but they "don't have an option due to political reasons," Kaspersky suggested on Reddit.

"Recently, inaccurate statement and claims about Kaspersky Lab have circulated in public," the company said in a statement provided to TechNewsWorld by corporate communications manager Denise Bertrand.

"Eugene never worked for the Russian government," Kapersky Lab contended. "He grew up in the Soviet Union era when almost every education opportunity was sponsored by the government in some manner."

The university Kaspersky studied at "was sponsored by four state institutions, one of which was the KGB," Kaspersky Lab said. He was placed at a Russian Ministry of Defense scientific institute as a software engineer upon graduating, because "it was routine for university faculty to determine students' post-graduate positions."

Stirring a Hornet's Nest

Kaspersky did itself no favors with its all-out pursuit of hackers and malware authors linked to the U.S.

It has uncovered sophisticated malware or spyware connected to U.S. intelligence sources, including Stuxnet, Flame, Shamoon, and The Equation Group.

Kaspersky didn't seem to look equally hard for state-sponsored malware released by Russia, an acknowledged haven for cybercriminals.

Possibly because of that, and also because of the controversy surrounding Russia's possible meddling in the U.S. presidential elections, Kaspersky now is under the microscope.

The FBI is looking into Kaspersky's ties with the Russian government, as is the Senate.

Separately, the NSA and the UK's GCHQ reportedly have been trying to hack into Kaspersky for years.
Is Kaspersky Targeted Unfairly?

The NSA could be behind the latest scrutiny of Kaspersky Lab and its CEO.

"It's always dangerous to piss off three-letter agencies," said Rob Enderle, principal analyst at the Enderle Group.

"Doing so while operating out of Russia would be even more problematic," he told

However, the likelihood of Kaspersky maintaining a wall between its work with the FSB and Russian government, and its work with other clients is effectively zero," said Michael Jude, a program manager at Stratecast/Frost & Sullivan.

Like a John LeCarre Novel

The situation is "like a John LeCarre novel come to life," said Laura DiDio, principal analyst at ITIC.

"You're not going to be able to prove absolutely whether or not Kaspersky has ties to the Russian government, she told

"He has done all he can do -- offer to give the U.S. government his source code," she pointed out.

"The problem isn't whether Russia built a back door into the Kaspersky code, but that Russia may have copies of the source code," Jude told

"Regardless of whom Kaspersky turns his code over to, his reputation is shot," Jude said. "If it's Russia, the U.S. market is dead; if it's the U.S., then just about every non-U.S. market is dead."

How to protect yourself while on the Internet

When sending confidential information over the Internet, such as usernames, passwords, or credit card numbers, only send it securely. To verify this, look for a small lock in the bottom right corner of your browser window or next to the address bar (as shown below). If visible, this lock should also be in the locked position and not unlocked.

We also suggest making sure the URL begins with https, as shown above.

While the lock is in the locked position, data is encrypted, which helps anyone from understanding the data if it's intercepted. When no lock is visible or in the unlocked position, all information is plaintext and could be read if intercepted. If a web page is not secure, such as an online forum, use a password you wouldn't use with protected sites, such as your online banking website.

Use a safe password

Websites that store confidential data, such as an online bank site, need to use strong passwords. Also, it is highly recommended that you use a different password for each website that requires a login. If you need help remembering your passwords, consider using a password manager.

When available always enable two-factor authentication

Two-factor authentication adds additional protection by requiring an additional step in verifying a login. Typically with two-factor authentication, after verifying your password, if the service does not recognize your computer, it sends your phone a text message with a verification code. If someone had your password but did not have your phone, even with a valid password, they cannot access your account.

Tip: Two-factor authentication should at the very least be enabled on your e-mail account. Most account passwords can be reset using the forgot password feature, which sends a new password or link to reset the password to the e-mail address on file. If anyone has access to your e-mail account, they could get the new password for your account.

E-mail is not encrypted

Never transmit confidential data over e-mail, such as passwords, credit card information, etc. E-mail is not encrypted and if intercepted by a third-party, it could be read.

Be aware of phishing scams

Familiarized yourself with phishing scams and techniques, which are used to trick you into divulging your account information. Online banking sites, Paypal, eBay, Amazon, and other popular sites that require logins are popular targets.

Use caution when accepting or agreeing to prompts

When prompted to install any program or add-on, make sure to read and understand the agreement before clicking on the Ok button. If you do not understand the agreement or feel it is not necessary to install the program, cancel or close the window.

Additionally, when installing any program, watch for any check box that asks if it's ok to install a third-party program, toolbar, etc. These are never required and often cause more issues than good. Leave these boxes unchecked.

Be cautious where you're logging in from

Business

Your place of work can install key loggers or use other methods of monitoring the computer while online. Someone who has access to this information could read these logs and gather usernames and passwords. Also, do not store any passwords in your browser if your computer is shared with other coworkers.

Wireless network

When on a wireless network, realize that all information being sent to and from your computer can be intercepted and read by someone nearby. Prevent this from happening by only logging onto a secure network using WEP or WPA (only use WEP if WPA is not available). If this is a home wireless network, make sure it is secure.

Friends house

Be concerned when logging into an account on a friend's computer. A computer or network you are not familiar with could intentionally or unintentionally log usernames and passwords. Finally, when logging into any site on a friend's computer, never save the password information on their browser.

Use an alternative browser

Older versions of Internet Explorer are notoriously insecure. If you are using Internet Explorer as your browser, consider an alternative browser such as Google Chrome or Mozilla Firefox. If you are running Windows 10 and want to continue to use a Microsoft browser, consider using Microsoft Edge instead of Internet Explorer.

Be aware of those around you

While at work, school, library, or anywhere that has people around who could look at the monitor, be cautious of anyone shoulder surfing. Someone could watch you type in your password, which would give them access to your account.

If you need information displayed on the screen to remain private, consider a privacy filter for the display.

Update Internet browser plugins

Often many attackers find security vulnerabilities through browser plugins, such as Adobe Flash. Make sure all installed Internet plug-ins are up-to-date.

Secure saved passwords

Make sure to store passwords and login information in a secure area. Never write login information on a sticky note or in a text file that is not encrypted.

 

To save your passwords, we recommend using a password manager, which stores all login information and securely encrypts and password protects that information.

When saving password information in a browser, it may be visible to anyone who has access to your Internet browser. For example, without a master password setup in Firefox, anyone can see all stored passwords.

Protect yourself against malware, spyware, and viruses

Protect your computer from viruses by installing an anti-virus program on the computer. If you do not want to install anti-virus protection and your computer is running a newer version of Windows, at least have Windows Defender running on the computer. Also, having a malware protection program on the computer, such as Malwarebytes, is also a good method of protecting your computer against malware and spyware.

Is the World Wide Web (WWW) the same as the internet?

Many people use the terms internet and World Wide Web interchangeably, but in fact the two terms are not synonymous. The internet and the web are two separate but related things. The World Wide Web is a way of accessing information over the medium of the internet. The web uses the HTTP protocol (hypertext transfer protocol), which is only one of the many “languages” spoken over the internet, to transmit data. Email, instant messaging, and uploading and downloading files are all things that you do on the internet but aren’t part of the HTTP protocol. The web utilizes special software called browsers to access web documents (more commonly known as web pages) that are linked to each other via hyperlinks. Web pages contain some or all of the following: text, images, audio, and video. If you walk into a car dealership and say “I want to buy a vehicle...” Well, a vehicle can be any number of things: a car, a van, a truck, an SUV, a motorcycle, maybe even a boat. “Vehicle” is a very general term. If you walk into a car dealership and say “I want to buy a car,” then you are being (somewhat) more specific and eliminating trucks, vans, SUVs, and so forth from your buying options. Think of the term “vehicle” as being similar to the internet. It’s a broad term that covers a lot. Think of “World Wide Web” as a term similar to car—it’s a bit more specific. While the vast majority of “vehicles” on the road are in fact cars, not all vehicles are cars. Similarly, while the vast majority of what you may do on the internet involves the World Wide Web, not everything on the internet is part of the web. 

What is the internet used for? 

A lot of different things! People use the internet to apply for jobs, play games, do research, watch movies, listen to music, go to school, stay in contact with friends, family, and co-workers, run a small business, buy or sell products, and much more. 

How do you connect to the internet? 

There are many different ways to connect to the internet from your personal computer. The most popular ways are listed below.  Dial-up: With a dial-up connection you can connect to the Internet via a telephone line and an internet service provider (ISP). This method is inexpensive, yet obsolete. It provides the user with the slowest overall connection speeds. However, it may suit the purposes of the occasional internet user without a need for a fast or consistent connection.  Broadband: Cable, DSL, and fiber optics are in this category. With a cable connection, the user must subscribe to a cable television/internet service. These connections offer speeds up to 70 times faster than dial-up. They also allow the user to stay connected to the internet at all times; the user need only open a browser window to access the internet, as there is no log-on process to complete. Like cable internet service, DSL offers much faster speeds than those available with dial-up modems. However, there are a wide range of speeds available from different providers. With DSL, normal telephone wires are used to combine usually separate voice and data lines, allowing users to connect to the internet and talk on the phone via the same telephone line. The newest technology, fiber optics, allows speed even greater than DSL or Cable. Fiber optic connections are more expensive than DSL and Broadband, and are not available in all areas (yet).  Wi-Fi: It’s even possible to connect to the internet wirelessly from home or while you are out and about. Wireless technology allows users to have mobile connections, accessing the web where and when they need to. Wi-Fi networks can be found at many businesses, restaurants, and other public areas (parks, schools, libraries) or a home connection can be set up through your ISP. These technologies vary in terms of connectivity, reliability, and cost, but they all allow users to connect whether they are at home, school, work, or on the road.

   

Opening up the browser One thing you will notice about the computer as you become more comfortable with it—there are usually at least three different ways to do everything. For example, on most computers there will be an icon on the desktop for your internet browser. Typically it will be the brand name of the browser, for example the icon will usually say “Internet Explorer.” By double clicking on this icon, your browser should automatically open up and take you to your home page. The home page is the first webpage that is displayed when you open your internet browser. If you don’t see the icon on the desktop for Internet Explorer, try clicking on the Start button on the lower left hand corner of the screen. Often right there on the start button menu you will see an option for Internet Explorer. A single click of the mouse will take you to the internet from here. Sometimes you might even have a little logo next to the Start button on your desktop taskbar. If you have IE on your computer, it will probably look like a lowercase blue “e” with a yellow ring around it. This is the logo for Internet Explorer, and clicking on it will open the browser. None of these options for opening up a browser are “right” or “wrong”—it’s just a matter of personal preference. They all take you to the same final destination! 

Basic parts of the browser 

When you open your browser window, no matter which browser you use, you will usually see several main parts: The address bar is where the web address of the page you are currently on is displayed. It’s the white bar at the very top of your page. If you want to go to a new website and know the Uniform Resource Locator (URL), or web address, of the site you'd like to go to, you can click in the address bar and type in the address, click the enter button on your keyboard, and go directly to that page. 

Whether you’re looking for a last-minute Christmas gift or just a little treat for yourself, you may be able to score a great deal this week on one of the best phones around: Sprint, Verizon and T-Mobile are each offering customers savings of up to $400 on a brand new Pixel.
While you can’t buy the Pixel at Sprint or T-Mobile, there are still deals to be had. Take an unlocked Pixel into either carrier’s stores and you will receive $240 in discounts on the Pixel and $325 on the Pixel XL, spread out over two years, a savings of $10 and $13.55 per month, respectively. While T-Mobile is advertising the offer to anyone, it seems that Sprint is being a little coy about it. As Android Police explains, you may have to jump through some customer representative hoops before the deal is applied.The catch is you need to be willing to stick with the same company for at least 24 months to get the full savings. The best deal we could find is at Verizon, Google’s exclusive partner for the Pixel. While you’ll get a slightly modified version of the phone—and have to rely on Big Red for updates—the carrier is offering a pretty sweet deal, selling the 32GB Pixel for just $10 a month and the $128GB model for $15 a month. If you’re looking to upgrade to the Pixel XL, it’ll run you $15 a month for the 32GB model and $20 a month for the 128GB one. That works out to about $400 in savings over the course of the contract.

Network Visibility: More than Just Simple Management

It seems like virtually everyone is aware of the need for greater network visibility these days, but there is very little guidance, other than from vendors selling products, as to what should be monitored, and how.

On a basic level, network visibility is about not only tracking the interplay of switches, routers and other devices, but drilling deep into network traffic and implementing deep packet inspection to glean a wealth of information regarding the carriage of enterprise data.

This offers a number of benefits beyond mere network management, says AGC Research analyst Robert Haim. Yes, it helps with resource planning and allocation, as well as fault resolution and service recovery, but it also goes a long way toward ensuring top application performance and customer satisfaction, not to mention improved security and access authorization. In addition, strong network visibility can help improve the effectiveness and extend the lifecycles of legacy monitoring systems, as well as the advanced analytics engines that are starting to leverage Big Data to optimize increasingly complex data flows.
 Indeed, from a vendor perspective, the race is on to provide the deepest levels of visibility on the block. Ixia recently expanded the capabilities of its CloudLens platform with the Virtual Packet Broker (vPB) to allow admins to peer into virtual network traffic across their private clouds. The system is intended to address the connectivity and dynamic workflow characteristics that arise with east-west, M2M traffic, particularly as volumes start to overwhelm traditional monitoring tools. The system provides data aggregation, filtering, dedupe and a host of other functions using a virtual appliance that can be deployed in conjunction with dynamic virtual networks.

Meanwhile, Brocade just added new visibility features to the SLX switch family to support the expanded Workflow Composer automation suite. The aim is to deliver broad network agility at all layers of the data center stack, allowing users to define the parameters of their networking environments and quickly adapt to new technologies and service models as they arise. Visibility is managed through the SLX Insight Architecture, which is embedded onto every switch and router in the network to provide rapid fault location and remediation. Some models like the SLX 9140 and 9240 also include a programmable ASIC that extends visibility from physical layers to virtual networks and workloads.

Different enterprises, and even different workloads, will have different needs when it comes to visibility, of course, but in general it should be implemented as a core networking function for both management and security purposes, says APCOM CEO Richard Rauch. A key element in the desire to peer directly into network traffic is the deployment of TAP (test access points) and SPAN (switch port analyzers) on all nodes. This provides full visibility in real time of both physical and virtual traffic and, provided the monitoring is kept out-of-band, ensures that data flows will not be impeded.

It might be tempting to think that too much visibility is just as bad as too little. But issues regarding data overload diminish once network management is placed on an automated footing. In fact, a steady flow of monitoring information is likely to prove vital in the near future as data environments learn to adapt and change to dynamic application requirements on the fly.



The old adage “you can’t monitor what you can’t see” is proving to be particularly accurate as network environments become more distributed and abstract, which is why the enterprise must deploy increasingly sophisticated technologies as their data footprints extend beyond the data center walls.

And since much of this distributed networking infrastructure is built and maintained by third-parties, the only way to know what’s really going on out there is to monitor traffic.

Canada declares ‘high-speed’ internet essential for quality of life

Canada has recognized the obvious and declared high-speed broadband internet access a “basic telecommunications service” that every citizen should be able to access. Previously, only landline telephone services had received this designation from the country’s national telecoms regulator, CRTC, and the change is supported by a government investment package of up to $750 million to wire up rural areas.

“The future of our economy, our prosperity and our society — indeed, the future of every citizen — requires us to set ambitious goals, and to get on with connecting all Canadians for the 21st century," said CRTC chair Jean-Pierre Blais at a news conference. “These goals are ambitious. They will not be easy to achieve and they will cost money. But we have no choice.”

As part of declaring broadband a “basic” or essential service, the CRTC has also set new goals for download and upload speeds. For fixed broadband services, all citizens should have the option of unlimited data with speeds of at least 50 megabits per second for downloads and 10 megabits per second for uploads — a tenfold increase of previous targets set in 2011. The goals for mobile coverage are less ambitious, and simply call for “access to the latest mobile wireless technology” in cities and major transport corridors.

The CRTC estimates that some two million Canadian households, or 18 percent of the population, do not currently have access to their desired speeds. The $750 million government fund will help to pay for infrastructure to remedy this. The money will be distributed over five years, with the CRTC expecting 90 percent of Canadians to access the new speeds by 2021.

The new digital plan also touches on accessibility problems, with CRTC mandating that wireless service providers will have to offer platforms that address the needs of people with hearing or speech disabilities within six months. Blais said this timeline was necessary, as the country “can’t depend on market forces to address these issues.”

Apple’s new Support app is a one-stop shop for appointments and advice

Apple has launched its dedicated iOS support app in the US. An early version of the app was leaked back in 2015 and appeared in other markets earlier this year; now, though it’s available to download from the App Store.

The app is named Apple Support, and does, well, exactly what you’d expect. Once downloaded, you can use it find out information about your registered Apple products; browse guides and tutorials on subjects like iCloud and photo editing; and schedule repairs and appointments at local Apple stores. You can even message, call, or email staff straight from the app, as well as get guidance for common problems like forgotten Apple IDs or poor battery life. 

  it’s possible that Apple Support will take the place of the company’s Tips app. And by “possible” we mean “we very much hope so.” Tips was launched with iOS 8 but is probably ignored by most users. Too inconspicuous to attract the people who might need it; too banal to interest anyone else. Putting guides into an app with a definite function (booking Apple Store repairs) is a much better way to go.