Kaspersky and spying for Russian Federation


Recommended Posts

Hi Neowinians. I would like to ask you to check your Kaspersky Antivirus and return back with opinions.

 

My browser debug console shows that it sends sensitive data to Russia, even when I use HTTPS secure connection.

You can press F12 key to open console and choose "Network" tab to see all requests your browser makes when you open the web page. I was amazed to find that Kaspersky reporting all my secure google requests and bank sessions to ie.kis.scr.kaspersky-labs.com (185.85.13.154) which is located here:

 

185.85.13.154
Kaspersky LAB AO
Moscow
Russian Federation
Latitude: 55.752220153809
Longitude: 37.615558624268

Source: https://www.ip2location.com/demo/185.85.13.154
Map: https://www.google.co.uk/maps/@55.7522201,37.6155586,16z

 

For example: Every time I was using secure search on google.co.uk, Kaspersky would make connections to server in Russia and load JavaScript which in itself enables ability to send all my logins, passwords and other sensitive data to file providers, because it was running from inside a secure connection and all sensitive data was available in plain text:

https://ie.kis.scr.kaspersky-labs.com/55EA892A-F489-2A4A-BF5D-9E631C44C50C/main.js
https://ie.kis.scr.kaspersky-labs.com/55EA892A-F489-2A4A-BF5D-9E631C44C50C/websocket?url=https%3A%2F%2Fwww.google.co.uk%2F&nocache=1471773767577
https://ie.kis.scr.kaspersky-labs.com/C05C44C136E9-D5FB-A4A2-984F-A298AE55/vk/VkTooltipBanner.png

 

When I was authorising into my bank with security details, Kaspersky would send links like that:

https://ie.kis.scr.kaspersky-labs.com/1B74BD89-2A22-4B93-B451-1C9E1052A0EC/init?url=https%3A%2F%2Ffc1.retail.santander.co.uk%2Fquery%2F1%2FfwyK.html%3Feu%3Dhttps%3A%2F%2Fretail.santander.co.uk%2FLOGSUK_NS_ENS%2FChannelDriver.ssobto%3Fdse_operationName%3DLOGON&nocache=1fdc6

 

Responses from Kaspersky looked like static content. It means that there is no need to for Kaspersky to supply metadata to Russian Federation in order to protect its customers from viruses. Kaspersky developers could choose to load these scripts from locally running web server (127.0.0.1) and not to compromise customer's security. This is not the rocket science. Decision to send sensitive data to Russian Federation and enable possibility for Russian government to track every web site visit of Kaspersky's customer and acquire all logins and passwords does not look like a rookie mistake.

 

Data goes to Russia; it means Russian law applies to it. Recently President Putin signed the Yarovaya bill into law, which is draconian law designed to collect data, make cryptographic backdoors mandatory and allow access to it by Russian security services for 3 years. Kaspersky accessing your sensitive data and sending it to ie.kis.scr.kaspersky-labs.com is exactly that - cryptographic backdoor.


So, if you have Kaspersky on your computer, then please open secure site like https://www.google.com, press F12 for debug mode, go into “Network” tab, refresh page, see for yourself and report your opinion.

 

Thank you.

Edited by EJocys

That's not at all what is happening. Use a real tool like fiddler and see what it is really sending and where. What you are seeing is browser extension stuff used with the antivirus. 

Hello,

 

Perhaps they are checking the HTTP stream for malware or exploits, doing reputational analysis or something else in their protection cloud.

 

Regards,

 

Aryeh Goretsky

  • Like 3
2 hours ago, EJocys said:

Recently President Putin signed the Yarovaya bill into law, which is draconian law designed to collect data, make cryptographic backdoors mandatory and allow access to it by Russian security services for 3 years. 

The USA PATRIOT ACT was enacted 15 years ago. 

 

P.S. No one is forcing you to use KAV.

1 hour ago, adrynalyne said:

That's not at all what is happening. Use a real tool like fiddler and see what it is really sending and where. What you are seeing is browser extension stuff used with the antivirus. 

There is no need to use Fidler because integrated debug tools of the browser reported all links and traffic just fine. Extension was using real domain registered in Russia (ie.kis.scr.kaspersky-labs.com). If there were, no need to go outside then https://localhost:port would be enough. It probably would be fine if "ie.kis.scr.kaspersky-labs.com" had 127.0.0.0 assigned internally, but that was not the case. Supplying data with GET requests also is interesting, because I used same method as a workaround to bypass web Brower’s cross-domain security in some of my applications. What I was seeing was browser extension with intentional back door used by antivirus. Do you think it was a mistake, for company, specializing in security and linked to Russian KGB and FSB to inject secure web content with externaly pointing URL? I don't think so.

 

URL for Firefox users (ff.kis.scr.kaspersky-labs.com) resolves to 127.245.107.154 which is internal, but URL for Internet Explorer (ie.kis.scr.kaspersky-labs.com) resolves directly to Kremlin: 185.85.13.154.

 

Edited by EJocys
45 minutes ago, goretsky said:

Perhaps they are checking the HTTP stream for malware or exploits, doing reputational analysis or something else in their protection cloud.

Doing analysis in a such way is a huge security flaw, especially if a thirparty injects its own JavaScript (main.js in case of the Kaspersky) . Properly secured websites must not include links to third party domains when when doing authentication. Loading third party scripts from domains which points to external source in real environment is a  https://ie.kis.scr.kaspersky-labs.com/55EA892A-F489-2A4A-BF5D-9E631C44C50C/main.js is a seriois security threat to its customers.

23 minutes ago, EJocys said:

There is no need to use Fidler because integrated debug tools of the browser reported all traffic just fine. Extension was using real domain registered in Russia (ie.kis.scr.kaspersky-labs.com). If there were, no need to go outside then https://localhost:port would be enough. It probably would be fine if "ie.kis.scr.kaspersky-labs.com" had 127.0.0.0 assigned internally, but that was not the case. Supplying data with GET requests also is interesting, because I used same method as a workaround to bypass web Brower’s cross-domain security in some of my applications. What I was seeing was browser extension with intentional back door used with the antivirus.

Show some fiddler logs proving it because it sounds like you don't understand what you are reading. 

  • Like 2
42 minutes ago, Mirumir said:

The USA PATRIOT ACT was enacted 15 years ago. 

 

P.S. No one is forcing you to use KAV.

I have uninstalled KAV already. Problem is that EU sells Kaspersky products everywhere while at the same time using sanctions against Russia, which fights hybrid wars against pro-European countries. Now I am looking for Antivirus, which would not inject web pages with URLs pointing outside.

10 minutes ago, Gary7 said:

Maybe this belongs in The Tin Foil Hat section :p

It's just a case of someone not understanding what they are seeing. Fiddler would likely clear this up to show that the data likely isn't actually being sent back to Kapersky but instead the local antivirus. Kapersky actually explains how it works on their forums. You see all sorts of people complaining about how Kapersky does it but none of them actually thinks it's phoning home with login credentials. 

15 minutes ago, adrynalyne said:

Show some fiddler logs proving it because it sounds like you don't understand what you are reading. 

I am not planing to install KAV anymore. I am writing comercial software (including network capturing and encryption), websites and network mobile apps and debug them by using network tools for 21 years now. I know that I am reading. It is hard to mis-unbderstand or misread web brower debug tools. It is not the rocket science. It looks like, it is not the first time Kaspersky is injecting scripts. While I understand the purpose of it (antivirus must have access to plain content in order to analyse it), I don't agree with "back door" implementation method of it i.e. Using live domains and live IPs.

 

One year ago: https://www.reddit.com/r/privacy/comments/3frjqw/psa_kaspersky_injects_remote_javascript_into_all/

4 minutes ago, EJocys said:

I am not planing to install KAV anymore. I am writing comercial software (including network capturing and encryption), websites and network mobile apps and debug them by using network tools for 21 years now. I know that I am reading. It is hard to mis-unbderstand or misread web brower debug tools. It is not the rocket science. It looks like, it is not the first time Kaspersky is injecting scripts. While I understand the purpose of it (antivirus must have access to plain content in order to analyse it), I don't agree with "back door" implementation method of it i.e. Using live domains and live IPs.

 

One year ago: https://www.reddit.com/r/privacy/comments/3frjqw/psa_kaspersky_injects_remote_javascript_into_all/

If what you are saying is true, you wouldn't rely on browser debugging tools to tell you the full story about network traffic (everyone on the Internet is a security guru). As for your link, did you even read it? It isn't even a routable IP. Nobody denies the script injection, least of all Kapersky. Your accusation of it reporting your bank details to Russia is unfounded and is what is in question. 

 

 

image.png

22 minutes ago, adrynalyne said:

Fiddler would likely clear this up to show that the data likely isn't actually being sent back to Kapersky but instead the local antivirus.

You would be right if  https://ie.kis.scr.kaspersky-labs.com was pointing to internal IP i.e. 127.*.*.*. But on my PC it points to extearnal source on the Internet (185.85.13.154).

Edited by EJocys
3 minutes ago, EJocys said:

You would be right if  https://ie.kis.scr.kaspersky-labs.com if was pointing to internal IP i.e. 127.*.*.*. But on my PC it points to extearnal source on the Internet (185.85.13.154).

Ok then. Let's see a screenshot of it sending your private information to that IP. Full headers and data. You can use fake details and reproduce I am sure. 

1 hour ago, EJocys said:

There is no need to use Fidler because integrated debug tools of the browser reported all links and traffic just fine. Extension was using real domain registered in Russia (ie.kis.scr.kaspersky-labs.com). If there were, no need to go outside then https://localhost:port would be enough. It probably would be fine if "ie.kis.scr.kaspersky-labs.com" had 127.0.0.0 assigned internally, but that was not the case. Supplying data with GET requests also is interesting, because I used same method as a workaround to bypass web Brower’s cross-domain security in some of my applications. What I was seeing was browser extension with intentional back door used by antivirus. Do you think it was a mistake, for company, specializing in security and linked to Russian KGB and FSB to inject secure web content with externaly pointing URL? I don't think so.

 

URL for Firefox users (ff.kis.scr.kaspersky-labs.com) resolves to 127.245.107.154 which is internal, but URL for Internet Explorer (ie.kis.scr.kaspersky-labs.com) resolves directly to Kremlin: 185.85.13.154.

 

http://www.ip2location.com/demo/185.85.13.154 ip2location states that ip is from kaspersky, not from kremlim.

  • Like 2
22 minutes ago, Gary7 said:

Maybe this belongs in The Tin Foil Hat section :p

You would be right if there was no evidence. External websites also report external IPs:

 

https://who.is/dns/ie.kis.scr.kaspersky-labs.com

ie.kis.scr.kaspersky-labs.com TTL=1637 A=185.85.13.154

 

Firefox users seems to be fine and not reporting to mothership:

https://who.is/dns/ff.kis.scr.kaspersky-labs.com

ff.kis.scr.kaspersky-labs.com TTL=399   A=127.245.107.154

 

P.S.: It is interesting to note that TTL for external IE address is much bigger. Probably just to make sure that network packages are not lost on local network adapter :). /s

 

 

1 minute ago, EJocys said:

You would be right if there was no evidence. External websites also report external IPs:

 

https://who.is/dns/ie.kis.scr.kaspersky-labs.com

ie.kis.scr.kaspersky-labs.com TTL=1637 A=185.85.13.154

 

Firefox users seems to be fine and not reporting to mothership:

https://who.is/dns/ff.kis.scr.kaspersky-labs.com

ff.kis.scr.kaspersky-labs.com TTL=399   A=127.245.107.154

 

P.S.: It is interesting to note that TTL for external IE address is much bigger. Probably just to make sure that network packages are not lost on local network adapter :). /s

 

 

Well if you are using Windows 10 it does it as well. Not to Kaspersky but to Redmond. Why would Firefox be OK and all other Browsers not?? If Kaspersky were doing this it would do it to all browsers. I used it in the past without any problems but now all I use is Windows Defender as MS tells me that is all I need. I do scan with MBAM once in awhile.

5 minutes ago, EJocys said:

You would be right if there was no evidence. External websites also report external IPs:

 

https://who.is/dns/ie.kis.scr.kaspersky-labs.com

ie.kis.scr.kaspersky-labs.com TTL=1637 A=185.85.13.154

 

Firefox users seems to be fine and not reporting to mothership:

https://who.is/dns/ff.kis.scr.kaspersky-labs.com

ff.kis.scr.kaspersky-labs.com TTL=399   A=127.245.107.154

 

P.S.: It is interesting to note that TTL for external IE address is much bigger. Probably just to make sure that network packages are not lost on local network adapter :). /s

 

 

I'm waiting for the evidence of it sending your personal data...

  • Like 3
12 minutes ago, Aokromes said:

http://www.ip2location.com/demo/185.85.13.154 ip2location states that ip is from kaspersky, not from kremlim.

This IP is linked to Latitude: 55.752220153809, Longitude: 37.615558624268

Source: https://www.ip2location.com/demo/185.85.13.154

Location of this IP points to Kremlin:

Map: https://www.google.co.uk/maps/@55.7522201,37.6155586,16z

IP points to Kaspersky Lab in Kremlin.

 

Of course, it doesn't mean that Kasperky Lab is actually located in Kremlin, but technically it is :).

2 minutes ago, EJocys said:

This IP is linked to Latitude: 55.752220153809, Longitude: 37.615558624268

Source: https://www.ip2location.com/demo/185.85.13.154

Location of this IP points to Kremlin:

Map: https://www.google.co.uk/maps/@55.7522201,37.6155586,16z

IP points to Kaspersky Lab in Kremlin.

 

Of course, it doesn't mean that Kasperky Lab is actually located in Kremlin, but technically it is :).

You do know that IP geolocation is not very accurate, right?

8 minutes ago, EJocys said:

This IP is linked to Latitude: 55.752220153809, Longitude: 37.615558624268

Source: https://www.ip2location.com/demo/185.85.13.154

Location of this IP points to Kremlin:

Map: https://www.google.co.uk/maps/@55.7522201,37.6155586,16z

IP points to Kaspersky Lab in Kremlin.

 

Of course, it doesn't mean that Kasperky Lab is actually located in Kremlin, but technically it is :).

You know.... geolocalization services don't gives exact coords.....

http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/

https://www.google.es/maps/dir/Ленинградское+шоссе,+39а,+Kaspersky+Lab,+Moscow,+Rusia,+123060/55.7503429,37.6157499/@55.7882977,37.5545582,13.25z/data=!4m8!4m7!1m5!1m1!1s0x43ddce7b7f14fe57:0x8e916c8c42a0d656!2m2!1d37.4814785!2d55.8371809!1m0

6 minutes ago, Gary7 said:

Well if you are using Windows 10 it does it as well. Not to Kaspersky but to Redmond. Why would Firefox be OK and all other Browsers not?? If Kaspersky were doing this it would do it to all browsers. I used it in the past without any problems but now all I use is Windows Defender as MS tells me that is all I need. I do scan with MBAM once in awhile.

Firefox or Windows can send data to their servers on their own if there are no secure data, but there is difference when third party app injects links, which points to external servers, inside a secure (HTTPS) connection. As I have said. That would be not a problem if injected URL pointed to internal IP address, but it points to external address on the Internet.

1 minute ago, EJocys said:

Firefox or Windows can send data to their servers on their own if there are no secure data, but there is difference when third party app injects links, which points to external servers, inside a secure (HTTPS) connection. As I have said. That would be not a problem if injected URL pointed to internal IP address, but it points to external address on the Internet.

Evidence of it sending your private data home please. 

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • You've tried DuckDuckGo and Brave Search, now get serious with SearXNG by Paul Hill Over the last decade, it has become quite trendy to dump Google Search in favor of privacy-preserving alternatives such as DuckDuckGo, Startpage, and Brave Search. These search engines have done a very good job at highlighting dodgy practices by Google, such as adjusting search results based on what it thinks you’ll like (filter bubble) and stalking you around the web to advertise to you. While these search engines are good starting points when compared to non-private services like Google, there are still quite a few issues with them. For example, both DuckDuckGo and Brave Search require running non-free JavaScript in your web browser, which is comparable to running proprietary software on your computer, meaning you can be sure about what it’s actually doing in the background. Another issue is that these search engines are hosted on the respective companies’ servers, and you are using a service that you don’t control. Finally, DuckDuckGo, while offering privacy features, relies heavily on Microsoft’s infrastructure for its results and, in the past, has permitted Microsoft tracking scripts. If you are looking for a more private search solution than DuckDuckGo, Brave Search, and Startpage, then I recommend taking a look at SearXNG. It is a privacy-respecting metasearch engine that can be used via different public instances, which is useful for mobile users, or you can install it on your computer or server and run it locally with maximum control. Unlike Google, Bing, or Brave Search, which crawl the web and have their own search indexes, SearXNG is a metasearch engine, meaning it taps other search engines, stripping your identifying data, such as IP address, user agent, and cookies, in the process. Your search query is sent to the other search engines you enable before aggregating the results. SearXNG has deployment flexibility. If you are a casual user or a mobile user and don’t want to run SearXNG locally, you can use a public instance that is hosted by someone else. The main problem with this is that you are putting trust in the maintainer of the instance regarding stuff like logs that they may keep; good hosts should have a privacy policy explaining their policies. If you are trying to use SearXNG, you can also install the software on your device and then head to 127.0.0.1:8080 in your browser and search from there. While you don’t have to worry about a third-party admin like the public instances, search engines could ultimately block your IP address if they frown on you pulling in their search results locally. If you want to run it locally, it’s a good idea to use proxies or VPNs to hide your actual IP. You don’t have to worry about this with a public instance, as search engines never see your IP address. The main privacy benefit of using SearXNG is that it isolates your identity from the underlying engines that it’s capable of searching, such as Google and Bing. These search engines will only see requests coming from a generic server, so they can’t profile you and create a bubble filter that influences what results you see. This also ensures that your search engine doesn’t turn into an echo chamber that prevents you from reading alternative points of view. As a free software project, you are allowed to inspect SearXNG to make sure there are no negative features bundled inside. This sets it apart from the privacy search engines mentioned earlier because you can’t check their source code. As a meta search engine, you are not restricted to getting results from one source. Due to the fact that it scrapes content from other websites, your SearXNG instance will periodically get blocked from different providers, so it’s good to select a range of sources as a backup. While enabling all of the services will give you great results, this can make searching slower. I am personally happy with slower searches for the best results, but you can always check which providers are slowing down your search from the search results page and disable them to speed things up. If you want decent results quickly, enable the main search providers such as Google, Brave, DuckDuckGo, Qwant, Bing, and Yahoo. This way, you get wide coverage without the latency. On the Engines tab in Preferences, do note that there are different tabs, such as General, Images, and Videos, with their own providers that can be toggled and are not covered by "Enable all" while on the General tab, so be sure to dig into each. Just a note, if you want to enable everything, press "Enable all" in one tab, then hit save at the bottom of the page, then do the next tab, and so on. If you press "Enable all", then do that in each tab, and then save, nothing will stick. When I had just some of the search engines enabled, I searched “define nefarious” and results came back with the definition of “define” - obviously that was a sucky result. However, when I had everything enabled, it found dictionary pages for the word “nefarious” and even had an inline definition on the sidebar, which is quite nice too - that was delivered by WolframAlpha for anyone wondering! Probably the worst thing about this meta search engine is that the engines you select are saved with a cookie, so you must enable them on every new device you use SearXNG on, including if you decide to go into incognito mode with your web browser. Honestly, I would say this is the most annoying aspect, and perhaps if your browser lets you choose a separate private browsing search engine, then it would be best to use DuckDuckGo for this portion of your browsing. Another weakness of SearXNG is the random blocking of it by search providers. When you are on the results page, expand the “Response time” box, and it will show things like “Suspended: too many requests” or “access denied”. This is why it is good to enable several providers so that there is always a fallback to get results from. I won’t pretend SearXNG will be for everyone, however, if you enable all of the providers and put up with the slower response time, the results can be really amazing. Even if you don’t want to use it as your daily driver, keeping a bookmark handy that links to it is a good idea if you ever feel like doing a deep dive into a niche topic where other search engines are just failing to bring up any good result, due to the amount of sources it looks on. If you’re interested in radical user control over the software you use, installing SearXNG locally can also be a good idea, but be prepared to be temporarily blocked from sites if you trigger bot sensors without a VPN. Personally, I’ve opted to use a public instance, rather than install it myself. If you want to use it via a public instance, head over to searx.space to find a provider. Let us know in the comments if you have used SearXNG or its predecessor, Searx. What do you think about the quality of the results?
    • Dear Neowin, If it is not too much trouble, can you start using the new-ish designations for Insider Preview? "Experimental" is different than "former Dev" as it can apply to different models, eg 26H1 or 26H2 etc, right? No need to seed confusion IMHO. And, please "finally" update your graphics. OK?
    • Did you see their FAQ, its quite good. Have a look in the Advanced section. https://delta.chat/en/help
    • Just install Linux Mint that is a real blessing and many times cheaper because you can continue using your old Windows computer/laptop with the latest Linux updates.
    • Interesting share -- however it does not make sense: Email messages get stored somewhere, so how is Delta Chat "based on email" and decentralized without actually storing anything? By Web3 standard practices, the various Relays would require dedicated storage to make messages available to the recipients (like a large series of message queue channels, akin to racks of traditional post office boxes)... and Contacts must be two-way confirmed in order for encryption keys to be exchanged (ostensibly every key-pair is uniquely bound between sender and recipient) and the Relays would preserve the public keys in order to facilitate message carriage... or every device stores all sorts of keys and contact info. All of this to say, decentralized messaging is like running Bluesky nodes except instead of discovering/browsing public feeds by various posters (at the given node) these Delta Chats would be relaying encrypted messages (via Relays) that only trusted recipients would have the appropriate decryption key (their own private key) to read it. But this doesn't solve the "it's like email" sales pitch. The only way it's like email is that there's encrypted binary stuff being transported from your app into the federated ether of Delta Chat Relays for others to decrypt (hopefully only the intended recipient)... but outside of this federated relays framework, it is absolutely nothing like email.
  • Recent Achievements

    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      504
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      160
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!