Topic: Does F-Secure's AV "hide" Government's malware ?!

[Samker]

Antivirus maker F-Secure has responded to privacy campaigners' concerns over the handling of spook-grade surveillance malware – by insisting its security software slays government spyware wherever it can.

In an open letter to the Bits of Freedom team: http://www.bof.nl/bof_uk.html , F-Secure president and chief exec Christian Fredrikson said his firm stands by its 2001 vow to not discriminate in favor of intelligence agencies when blocking potentially malicious code.

Earlier this month, the campaigners wrote to F-Secure [PDF]: http://www.f-secure.com/weblog/archives/letter-to-antivirus-companies.pdf , which is headquartered in Helsinki, Finland, demanding to know whether the biz had "ever been approached ... by a government requesting that the presence of specific software is not detected, or if detected, not notified to the user of your software."

Fredrikson shot back: "If we would be approached by a government asking us not to detect a specific piece of malware, we would not comply with their request: http://www.f-secure.com/weblog/archives/00002636.html

"To us, the source of the malware does not come into play when deciding whether to detect malware."

The privacy warriors' letter to F-Secure was part of a public call to antivirus vendors to disclose their policies [PDF]: https://www.bof.nl/live/wp-content/uploads/Letter-to-antivirus-companies-.pdf

The campaign, backed by top computer security expert Bruce Schneier, asked companies to come clean on whether they would turn a blind eye to a particular strain of spyware should a government ask.

Fredrikson said his company has encountered government-backed malware samples, citing the 2011 saga of R2D2: http://www.ccc.de/en/updates/2011/staatstrojaner – a secretive package that was allegedly deployed by German police to listen in on VoIP calls: http://wikileaks.org/wiki/Skype_and_SSL_Interception_letters_-_Bavaria_-_Digitask

The chief exec said his firm's software, once it detects malware, grants no special favors to the g-men's software. Fredrikson denied that F-Secure has ever been asked by government agencies to allow spyware through its security checks.

"If it's malware, we will protect our customers from it. Our decision-making boils down to a simple question: would our customers run this program on their system or not," the F-Secure boss continued.

"Obviously the answer for governmental trojans would be a 'no'."

(ElReg)

[Fintech]

Oh yeah, F-secure is Finnish security commpany! 
And it doesn't give mercy to nobody!

[Pez]

This will be over soon. When more and more user moving over to Windows 8.1 and they got logged in thru the Live cloud their is no need to have any spy ware on a computer for the US government. They just connect to the computer true Microsoft cloud according to their secret agreement.  The new problem is the Linux platforms that probably would open up a new area of interest to looking at.
All old Microsoft and Apple OS is probably compromised already by NSA agreement with the company's. They have probably released patches for this system to open up "government security".

So this discussion of security company's don't detect some malware is probably temporary. Probably their would be more interesting to look at the OS capability to open up security holes to the different government. But that would not bee the case because of the hard connection behind the large OS company's and the US government.

Probably their is better to realize that the computer always will compromised by different company's and government and use the computer in that view instead. And try to keep the computer free from malwares form other company's and developers that also try to do something with your computer.
You can't fight the US government in this way. You can just start to get it in light and start the opinion against it and about the personal integrity.

It is the same as a foreign person want to visit the US you need to give up  some of your personal integrity to get in to the US, like your finger print and so. The chose is yours if you want in you need to adopt their rules other ways your not welcome.

[Samker]

...

When more and more user moving over to Windows 8.1 and they got logged in thru the Live cloud their is no need to have any spy ware on a computer for the US government. They just connect to the computer true Microsoft cloud according to their secret agreement. 

...

hmmm... that's is an interesting theory. 

P., do you have any related reference(s) / link(s) ?

[Pez]

...

When more and more user moving over to Windows 8.1 and they got logged in thru the Live cloud their is no need to have any spy ware on a computer for the US government. They just connect to the computer true Microsoft cloud according to their secret agreement. 

...

hmmm... that's is an interesting theory. 

P., do you have any related reference(s) / link(s) ?

Really?
Need evidence for this. Install a Windows 8.1 one of the home edition (I suppose it also is on the pro version if you not set up the computer to a AD-infrastructure). And see what is the default setup that about 98% of the users use.
How do you get the SkyDrive to work seamlessly whit out any fix if you don't use the Live account? just some questions to get answered.

It is some work to find the way to setup a computer without the integration to Live but it is possible. You need to do the installation as a customized installation and then look hard in some sub menus to find the option to just get e local account. I don't know if it even is possible in the OEM versions.

Her is some workaround that I found on the net to fix this issue afterword's but how match functionality do you get lost and how match of the integration do you get off after that you in the beginning registered the computer in Live that is a question.

http://www.techrepublic.com/blog/windows-and-office/quick-tip-change-microsoft-live-to-a-local-account-in-windows-81/

http://superuser.com/questions/661416/how-to-install-upgrade-to-windows-8-1-rtm-without-a-microsoft-account

Compare also this last link and the logon windows (blue) and the Microsoft official instruction from their site that do not show the options to not setup a computer with the Live account.

http://windows.microsoft.com/en-us/windows-8/microsoft-account-tutorial

This Microsoft link shows also the sales argument in Microsoft view way to use the MS Live account and integration for all your MS appliance.

So is their any doubt what is possible to do whit a centralized account database that is so hard integrated with the OS and it's functions? If you read further their is a motivation that you can use your account to log in to your profile from any ware and what is then the limitation in the opposite way to from any ware log in to your computer with a super user account. Look at how it works in a corporate AD infrastructure. The only different this that this is not a corporate it is private computers that can be manage from a other person/company by a license agreement you properly not is a ware about. We are talking of personal integrity.

[F3RL]

I'm with Pez.

Call me paranoid, I am against the idea of associating a computer with an electronic account. Sure, it might add integration with some applications but it's making one's identity available to a corporation. It's a complicated matter, revealing what data is collected, against security of the company or even a nation.

 

[devnullius]

It's a complicated matter, revealing what data is collected, against security of the company or even a nation.

The only company being left out of the NSA discussion is Microsoft.

I really would like to know what is known about the Windows 8 cloud features... What is sent and remembered, and what is inaccessible.

Microsoft, in the 90s, got a lot of harsch critiques concerning privacy. We, the people, found privacy important in the last century. Because of the fierce reactions, Microsoft has become almost an example of how it should be done (privacy).

Only question is: could they resist the NSA?

... Karma!


Devvie


~~~ notemail@facebook.com ~~~

Conare nullius momenti videri fortasse missilibus careant
——
All spelling mistakes are my own and may only be distributed under the GNU General Public License! – (© 95-1 by Coredump; 2-013 by DevNullius)

[devnullius]

Some Microsoft / NSA related articles...

http://bgr.com/2013/11/15/microsoft-data-centers-nsa/
"If Microsoft hasn’t yet implemented the server-to-server encryption that Google has implemented, this means its private data servers are wide open to NSA hacking."

Same info, different approach. Also talks about Yahoo: http://www.techdirt.com/articles/20131114/12075925247/microsoft-admits-it-still-doesnt-encrypt-its-datacenter-links.shtml

Big Software Companies taking legal action together: http://www.theverge.com/2013/10/31/5053438/apple-microsoft-google-and-others-urge-congress-to-enact-nsa-reforms

And the privacy statement from Microsoft: a lot of talk, but no real information. Still, link: http://windows.microsoft.com/en-us/windows-8/windows-8-1-privacy-statement#T1=highlights

Karma!

devnullius

[Pez]

Since 9/11 and the war against terrorism had started then the importance of privacy had a whole different meaning. Now the fight against terrorism is more important then privacy. It is in that view you need to look at what NSA is doing. What happen before 9/11 have no importance because 9/11 change everything regarding a personal privacy.

I can bet on that a account policy for a computer is bidirectional.  Special when you use a account that Is integrated with SkyDrive. If NSA want to look at a computer and the data that the user have they can do this, be shore of that! They don't need to hack the new system for that any more and that is not anything that Apple or Microsoft don't want to publish. The NSA probably just need to show up whit a paper that says that is for national security to open up the access to computers these days.

So regarding NSA and what they can put in pressure on companies to build in changed everything at 9/11.

Regarding the server to server encryption. That is not important for NSA because they probably already have the way to get in to those systems. It is just important to have this encryption for other that want to get in to those systems.

Look at what Snowden have reviled form that short period of 6 month hi had at NSA as a consultant. And he probably did not have access to every thing, but just a small part of the information that NSA is handling. And he probably know more then he had sad. Way do you think he got to stop revile information to even stay in Russia after the pressure US set on Russia. Some of the information he had was probably even to hot for Russia to handle and they probably if they had the chance would want to publish something that US is not better than them in democracy and personal rights. But even for Russia probably some information is to hot to handle.

[devnullius]

More info - I just synchronized an outlook account for Windows 8.1.

After all was done, I got the following feedback:

Microsoft account

devnullius

Picture of devnullius's outlook

Thanks for verifying your identity

Your saved passwords for apps, websites and network will now sync on your PC.

It also knew one of my backgrounds ; -p

Karma,

devnullius