Kaspersky databases are extremely out of date

#KASPERSKY DATABASES ARE EXTREMELY OUT OF DATE HOW TO#

вЂњWe know that we can get some part of them, but pretty sure we never get 100 percent. вЂњWe have sometimes false positives because we are unable to gather all the clean files in the world,вЂќ Sharov said. Programs that have never been seen before are nearly alwaysВ given more scrutiny, but they also are a frequent source of false positives. Such systems, he said, include exhaustive вЂњclean fileвЂќ tests,В which scan incoming samples to make sure they are not simply known, good files. вЂњItвЂ™s unacceptable.вЂќДЄccording to Sharov, a good antivirus product actually consists of two products: One that is sold to customers in a box and/or or online, and the second component that customers will never see - the back-end internal infrastructure of people, machines and databases that are constantly scanning incoming suspicious files and testing the overall productВ for quality assurance. вЂњThe security industry in that case becomes bullshit, because people believe in those products and use them in their corporate environments without understanding that those products are just following others,вЂќ Sharov said. Sharov said the experiments by both Dr.Web and Kaspersky - although conducted differently and independently - were attempts to expose the reality that many antivirus products are simply following the leaders. But we never flagged these ourselves as bad.вЂќ вЂњWe then observed the evolution of these two files, and a week later, half of the antivirus products were flagging them as bad. A little bit modified, but clean, harmless files,'вЂќ Sharov recalled of an experiment the company said it conducted over three years ago.

вЂњAt this point, we were very confused, because our explanation was very clear: вЂWe are sending you clean files. Sharov said the testing lab came back very quickly with an answer: Seven antivirus products detected the clean files as malicious. Could you please check what your system says about that?'вЂќ вЂњWe went to the В testing laboratories and said, вЂWe are sending you clean files, but a little bit modified. вЂњWe did the same kind of thing,вЂќ Sharov said.

In an interview with KrebsOnSecurity, Sharov said Dr.Web conducted similar analyses and reached similar conclusions, although he said the company never mislabeled samples submitted to testing labs. вЂњWhen KasperskyвЂ™s complaints did not lead to significant change, the former employees said, it stepped up the sabotage.вЂќД®ugene Kaspersky posted a lengthy denial of the story on his personal blog, calling the story a вЂњconflation of a number of facts with a generous amount of pure fiction.вЂќ But according to Dr.Web CEO Boris Sharov, Kaspersky was not alone in probing which antivirus firms were merely aping theВ technology of competitors instead of developing their own. вЂњWithin a week and a half, all 10 files were declared dangerous by as many as 14 security companies that had blindly followed KasperskyвЂ™s lead, according to a media presentation given by senior Kaspersky analyst Magnus Kalkuhl in Moscow in January 2010,вЂќ wrote ReutersвЂ™ Joe Menn. The story said the campaign targeted antivirus products sold or given away by AVG, Avast and Microsoft. Reuters cited an experiment that Kaspersky first publicized in 2010, in which a German computer magazine created ten harmless files and told antivirus scanning service that Kaspersky detected them as malicious (Virustotal aggregates data on suspicious files and shares them with security companies). Such errors, known in the industry as вЂњfalse positives,вЂќ can be quite costly, disruptive and embarrassing for antivirus vendors and their customers.

#KASPERSKY DATABASES ARE EXTREMELY OUT OF DATE HOW TO#

The Reuters piece cited anonymous, former Kaspersky employees who said the company assigned staffВ to reverse-engineer competitorsвЂ™ virus detection software to figure out how to fool those products into flagging good files as malicious. But according to interviews with the CEO of Dr.Web -В KasperskyвЂ™s main competitor in Russia - both companies experimented with ways toВ expose antivirus vendors who blindly accepted malware intelligenceВ shared by rival firms. A recent Reuters story accusing Russian security firm Kaspersky Lab of faking malware to harm rivals prompted denials from the companyвЂ™s eponymous chief executive - Eugene Kaspersky - whoВ called the story вЂњcomplete BSвЂќ and noted that his firm was a victim of such activity.

Kaspersky databases are extremely out of date