Kaspersky problem?

[IBMJunkman]

Apparently Kaspersky knows everywhere you go.

Jump down to the Kaspersky section.

https://www.grc.com/sn/SN-728-Notes.pdf

 

[UsandThem]

Here's a website for users to see what this is about, instead of having to download and search through a PDF file.

https://www.tomsguide.com/news/kaspersky-antivirus-software-exposed-millions-to-web-tracking

Kaspersky response:

https://usa.kaspersky.com/blog/tracking-ids-bug/18470/

 

[VirtualLarry]

Wow, just wow. Didn't Kaspersky learn from the PIII ID foible? They were around back then, I think.

 

[mikeymikec]

I'm more than a little sceptical about Kaspersky's intentions here.

I can think of only one (non-malicious) reason why such an ID would be communicated, and that would be for Kaspersky's activation system, but to broadcast it to every website the user visits is utterly absurd: why send it everywhere, it's potentially disruptive to the functionality of the site when being browsed on that user's machine, and it provides valuable information to an attacker.

The fact that they made it a UI configurable option blatantly shows that it's not a bug, it's a feature. I also find it interesting that they offered no explanation for why the feature is there.

Their second reason why "it's not a big deal" is utterly hilarious though:

The second is that a malefactor could’ve harvested those addresses and built malware that targets only users of Kaspersky products — and spread it among them. The same is true of every program that changes Web page code on the user side. That scenario is highly unlikely; an attacker would need not only to create such malware, but also to deliver and run it. That would require luring the user onto a malicious website, but our antiphishing and Web antivirus keep users away from malicious websites.

An attacker targeting a specific product? Inconceivable! Not to mention luring users to their website. That's literally never happened to a Kaspersky user, ever.

it reminds me of when Microsoft once responded, "that vulnerability is purely theoretical!".

Well Kaspersky, I've thought of your products as competently designed, but now in my view you're wearing the clown shoes of the security business. I do hope the black hats go out in force to give you a proper spanking for this.

- edit - after thinking about this a bit more, it seems to me that Kaspersky is playing the fool while giving out no useful information whatsoever.