Two former employees of Kaspersky Lab have accused the malware protection software company of seeding competitors? products with fake malware signatures intended to make them erroneously label benign files on customers? computers as malicious. The allegations, made in a report published by Reuters Friday morning, have been strongly denied by a Kaspersky Lab spokesperson.
According to Reuters, the ?junk? files were tailored to have the same signature as legitimate files, based on the fingerprinting mechanisms of competitors? products. To do this, the two former employees alleged, Kaspersky assigned employees to reverse-engineer competitors? products to see how they identified malware and then tailored samples that would match the signatures of common, harmless files.
The report does not include many specifics about the alleged faked signatures, such as which files were targeted for identification as false positives.
While there have been incidents reported by Microsoft, Symantec, and others of attacks by outside parties aimed at creating false positives by submitting ?junk? files as malicious, none had publicly suspected Kaspersky of creating them. Microsoft's Dennis Batchelder and Hong Jia reported such attacks in a presentation at the Virus Bulletin conference (PDF) in October 2013. The files were in some cases widely shared by antivirus vendors, and some were submitted anonymously over the Tor network.
Liam O?Murchu, a reverse engineer and security researcher at Symantec, acknowledged similar attacks on Symantec?s products in a post to Twitter, saying, ?We had investigated these attacks but could not find out who was behind them. We had some suspects, Kaspersky was not one of them.?
According to the two former employees cited by Reuters, Kaspersky Lab employees have been spreading these types of faked malware fragments for the past decade as part of a campaign to undermine competitors? malware protection tools, in some cases at the direct order of cofounder Eugene Kaspersky. One of the former Kaspersky Lab employee told Reuters that Kaspersy felt that some malware providers were too closely copying Kaspersky Lab?s software, and ?Eugene considered this stealing.? Company researchers were assigned for months at a time to reverse engineer competitors? software to determine how to trick them into falsely identifying good files as potential malware, according to the Reuters report.
Continued
Report claims Kaspersky faked malware to trip up competitors? products | Ars Technica