‘Kaspersky feigned malware to harm rivals’ – update

According to ex-employees, Russian antivirus company Kaspersky Lab has tried to trick competitors’ antivirus programs into thinking that innocent files are dangerous. As a result, other companies were discredited.

Reuters writes this on the basis of statements from two ex-employees of the antivirus giant. The campaign is said to have targeted Microsoft, AVG Technologies NV, Avast Software and other rivals. By tampering with virus definitions, the company reportedly caused other virus scanners to delete important files, sometimes causing entire systems to malfunction.

Some of the attacks specifically targeted smaller competitors who, according to Kaspersky founder Eugene Kaspersky, were copying the company’s technology rather than inventing their own. The founder thought that ‘stealing’ and therefore considered it permissible to hack these companies, say the ex-employees.

Kaspersky Lab also vehemently denies that it tried to trick competitors into categorizing normal files as ‘false positives’. Kaspersky: “Our company has never engaged in covert actions to harm competitors. Such actions are unethical, unfair and the legality of such actions is questionable to say the least,” it said in a statement to media outlets. sent.

Sources at Microsoft, AVG and Avast are said to have told Reuters that unknown parties have tried to give the virus scanners false positives in recent years. All companies did not comment on the accusation against Kaspersky.

Kaspersky has 400 million users and 270,000 business customers. According to the two ex-employees, the company wanted a bigger market position, which was the reason for the sabotage. To achieve this, competitors’ software had to be studied to find out how a program could be fooled. With more sharing between programs that detect viruses and other malware, it would have become easier to trick others.

In 2010, Kaspersky addressed the problem that many companies use the same techniques. As a one-off experiment, the company created 20 harmless files and told VirusTotal that the company suspected they were malicious. Google’s VirusTotal is an aggregator for suspicious files and shares this information with other security companies. Within a week and a half, several companies had adopted the virus definitions.

In 2012, Kaspersky said it was the victim itself after an unknown source uploaded false positives to VirusTotal. It then spoke with several antivirus vendors behind closed doors to further denounce this issue. Kaspersky recognizes the importance of trusting each other and says it has improved its algorithms to protect itself against false positives.

Update, 5:55 PM – Kaspersky’s response slightly rewritten after release statement