- Tuesday, 10 November 2009
- INQ Mobile
- RSS
Many people lose their tempers merely from seeing you keep yours - Frank Moore Colby
Kaspersky hacked
ANTI-VIRUS firm Kaspersky Labs has had its US website violated by an anonymous hacker who claims to have gained access to the company's customer database. Rushing (shurley Russian? - Ed) to its own defence, Kaspersky dismissed the hack, saying "the vulnerability was not critical and no data was compromised from the site".
But the un-named hacker begged to differ with Kaspersky, publishing details of his findings on a website called Hackersblog.org, whilst noting he would not release confidential customer information, because he was just a good guy, trying to point out the gaping security flaws in big rich companies who treat their punters' information so callously.
According to the secret security superhero, Kaspersky "doesn't need to worry about us spreading their confidential stuff. Our staff will never save or keep any confidential data. We just point our fingers to big websites with security problems". The hacker's discretion may be a very lucky break for Kaspersky, especially as the hacker boasted he'd been able to gain access to users accounts, activation codes and even personal data, backing up his claims with several screenshots of the different tables available in the database.
The hack, which would appear to be nothing more than an SQL injection attack, is even more embarrassing for Kaspersky because almost every single one of the firm's sites has been hacked in the past few years. That's what you call giving the Russian firm a red face. µ
L'Inq
Hackersblog.org
Share this:
ShareBusiness Intelligence Software
Customer Relationship Management (CRM)
Enterprise Accounting Software
Enterprise Resource Planning (ERP)
Enterprise Systems Management
The guy pictured really gives me the creeps. Who he?
That is an edited picture of Eugene Kaspersky, one of the two founders of Kaspersky Lab, creator of antivirus software. His forehead is not really that big (just in case ronch can't figure that out)
:-)
That's why I only get the KAV, not the KIS. KIS seems to confict with everyother security software available on the market...
And I thought this sounded like good software.
Maybe a good ass kicking every once in a while will help keep perspective.
Step 1) find an email that says you site has been hacked, with a detailed explanation and all necessary proof.
Step 2) Dismiss the mail out of hand. After all, your site is secure, no ? YOU are the professional, right ? Do not contact email author. Put mail in loony bin.
Step 3) Get a phone call from a journalist asking about a posting on a site that describes the hacking of your web site.
Step 4) Deny that anything has occurred.
Step 5) Get another phone call from journalist asking about screenshots posted on another site.
Step 6) Check out screenshots.
Step 7) Swear vehemently (alternatively, throw chairs).
Step 8) Call back and admit that, while there may have been a breach, promise that no private data has been violated. Explain strenuously that the breach was quickly contained and nothing important was leaked.
Step 9) Fire off an email to the IT department demanding to know what the hell happened and I need to know NOW !
Step 10) Check the screenshots again.
Step 11) Break out in cold sweat when you see just how much data was swiped.
Step 12) Take an alka-seltzer.
Step 13) Emergency meeting about the breach. Distasteful details come to light (like: it's not the first time).
Step 14) Face the fact that not only have you been royally screwed, but it's blind luck that an honest guy found the issue first and now that knowledge is in the public domain.
Step 15) Take another alka-seltzer.
Step 16) Put on your best "serious" face.
Step 17) Call the journalists and explain, in all seriousness, that this issue has not actually, to your knowledge (small internal prayer at this point), affected anyone, and it is now under analysis by your highly-competent team of top-level engineers.
Step 18) While the engineers slave away at plugging the hole, check out the articles concerning the issue and find out how it is being reported in the media.
Step 19) After CPR, when the medics are gone, belatedly realize that you do not actually dictate reality, and it might be a good idea to review your bug reporting procedures.
Step 20) Fire that good-for-nothing QA analyst who is responsible for this whole mess in the first place.
Step 21) Hire a new QA analyst and sternly admonish him about how important his position is to the company and how this latest issue must be, in the future, avoided at all costs.
Step 22) Go home with your bonus cheque after having done a good day's work.
I had recently interviewed with Kaspersky. In my past I have designed firewalls and internal security. Also I have completed quite a few audits. They asked me at Kaspersky what I was interested in and I said security. They said they were not interested in security. At first I thought this was odd but then found out they were hacked it made me think twice about taking a job with them.