Kaspersky and spying for Russian Federation


Recommended Posts

30 minutes ago, adrynalyne said:

Ok then. Let's see a screenshot of it sending your private information to that IP. Full headers and data. You can use fake details and reproduce I am sure. 

I removed it from all my PCs'. If you want to see evidence by yourself then you are more than welcome to install Kaspersky trial on your own PC :). I have provided links and external sources. It does not invalidate fact that, browser tries to send sensitive data to Kaspersky's servers, even if Kaspersky blocks traffic to its own domains later. It is still a big security hole.

5 minutes ago, EJocys said:

I removed it from all my PCs'. If you want to see evidence by yourself then you are more than welcome to install Kaspersky trial on your own PC :). I have provided links and external sources. It does not invalidate fact that, browser tries to send sensitive data to Kaspersky's servers, even if Kaspersky blocks traffic to its own domains later. It is still a big security hole.

That isn't how this works. You made the claim. Burden of proof is on you friend. 

 

From everything you you have posted so far, I think you just misunderstood what you saw. Feel free to prove otherwise though. 

  • Like 2
9 minutes ago, adrynalyne said:

That isn't how this works. You made the claim. Burden of proof is on you friend. 

 

From everything you you have posted so far, I think you just misunderstood what you saw. Feel free to prove otherwise though. 

 

Facts and evidence are very obvious:

 

a) Kaspersky is using ie.kis.scr.kaspersky-labs.com domain for injection URLs on Internet Explorer

b) ie.kis.scr.kaspersky-labs.com points to external server (185.85.13.154) on the Internet. Proof:

https://who.is/dns/ie.kis.scr.kaspersky-labs.com

 

P.S.: How long do you think it takes for Kaspersky devs to update DNS records to 127.*.** and claim honest mistake?

Edited by EJocys
8 minutes ago, EJocys said:

 

Facts and evidence are very obvious:

 

a) Kaspersky is using ie.kis.scr.kaspersky-labs.com domain for injection URLs on Internet Explorer

b) ie.kis.scr.kaspersky-labs.com points to external server (185.85.13.154) on the Internet. Proof:

https://who.is/dns/ie.kis.scr.kaspersky-labs.com

 

P.S.: How long do you think it takes for Kaspersky devs to update DNS records to 127.*.** and claim honest mistake?

Not proof nor evidence of sending sensitive data home, and to the Kremlin at that. It's far more likely that IE doesn't have the plugin needed to use internal routing like ff. 

 

Is it a good practice how they have it set up? Nope. Is it indicative of phoning home with your bank details to Russia?  Nope. 

  • Like 2
12 minutes ago, adrynalyne said:

Not proof nor evidence of sending sensitive data home, and to the Kremlin at that. 

If you cannot understand evidence, which I have supplied in my previous posts and security implications of Kaspersky's solution, then no evidence will convince you. It is not only about sending data, it is about huge security hole in implementation, which looks like definition of the back door.

 

I have screenshot (taken before I got rid of Kaspersky) which relates to injection on IE. You can see script loading from ie.kis.scr.kaspersky-labs.com domain. I do not expect people to believe it and this is the reason, why I provided instructions on my first post on how to replicate it.

KasperskyIE.PNG

Edited by EJocys
2 minutes ago, EJocys said:

If you cannot understand evidence which I've supplied in my previous posts and security implications of Kaspersky's solution, then no evidence will convince you. It is not only about sending data it is about huge security hole in implementation which looks like definition of the back door.

I think everyone reading this thread can agree: you have provided no such evidence and instead only what you think is evidence. 

 

Again, nobody denies the script injection and I'm sure most of us agree that it's not a good way to handle it. That's not what you are on the line for though. You made a claim that it is sending home your sensitive data and have yet to provide any evidence. 

  • Like 2
17 minutes ago, adrynalyne said:

Again, nobody denies the script injection and I'm sure most of us agree that it's not a good way to handle it. That's not what you are on the line for though. You made a claim that it is sending home your sensitive data and have yet to provide any evidence. 

So, according to you, web browser trying to open https://ie.kis.scr.kaspersky-labs.com/1B74BD89-2A22-4B93-B451-1C9E1052A0EC/init?url=https%3A%2F%2Ffc1.retail.santander.co.uk%2Fquery%2F1%2FfwyK.html%3Feu%3Dhttps%3A%2F%2Fretail.santander.co.uk%2FLOGSUK_NS_ENS%2FChannelDriver.ssobto%3Fdse_operationName%3DLOGON&nocache=1fdc6, when ie.kis.scr.kaspersky-labs.com points to external Internet server (185.85.13.154) do not qualify as evidence of browser trying to sending sensitive data to external server?

 

Please note that, I am not trying to prove that destination server gets the data. What is obvious that web broser is trying to delive it to server with remote address. I've provided you with the screenshot from IE debugger and proof that domain point to external source is also there:

https://who.is/dns/ie.kis.scr.kaspersky-labs.com

 

 

1 minute ago, EJocys said:

So, according to you, web browser trying to open https://ie.kis.scr.kaspersky-labs.com/1B74BD89-2A22-4B93-B451-1C9E1052A0EC/init?url=https%3A%2F%2Ffc1.retail.santander.co.uk%2Fquery%2F1%2FfwyK.html%3Feu%3Dhttps%3A%2F%2Fretail.santander.co.uk%2FLOGSUK_NS_ENS%2FChannelDriver.ssobto%3Fdse_operationName%3DLOGON&nocache=1fdc6, when ie.kis.scr.kaspersky-labs.com points to external Internet server (185.85.13.154) do not qualify as evidence of browser trying to sending sensitive data to external server?

 

Please note that, I am not trying to prove that destination server gets the data. What is obvious that web broser is trying to delive it to server with remote address.

 

Ok? Where in that url is sensitive data???

  • Like 1
11 minutes ago, adrynalyne said:

Ok? Where in that url is sensitive data???

That link contains URL and GET data used by my bank. GET requests frequently contain usernames; secret and password reset keys and sometimes passwords (depending on implementation). Kaspersky does it with every single page and browser tries to submit every single request to Kaspersky server. Another problem that browser tries to load external script (main.js) into encrypted secure connection which poses security issues on its own.

7 minutes ago, EJocys said:

That link contains URL and GET data used by my bank. GET requests frequently contain usernames; secret and password reset keys and sometimes passwords (depending on implementation). Kaspersky does it with every single page and browser tries to submit every single request to Kaspersky server. Another problem that browser tries to load external script (main.js) into encrypted secure connection which poses security issues on its own.

Please point out the portions that contain your sensitive data. 

Enable any sniffer and check if any sensitive data was delivered to Kaspersky servers.

 

Stop your paranoia, Kaspersky KIS just comparing your JS and dangerous file with his catalog of dangerous files.

 

Kasperky Application Advisor at 

http://whitelisting.kaspersky.com/advisor?lang=es-MX#search/c9b3b344c26c697eca4939d54f9036df

  • Like 3
2 minutes ago, adrynalyne said:

Please point out the portions that contain your sensitive data. 

So the, fact that that browser tried to inform Kaspersky's server which bank I am using and passed data used in GET method is not sensitive enough :). Are you trying to prove that Kaspersky knows which GET data is sensitive and eliminates it before browser tries to post it to remote server? I have no intention to post more data which is even more sensitive on public forums. I've posted just enough to make my point.

2 minutes ago, EJocys said:

So the, fact that that browser tried to inform Kaspersky's server which bank I am using and passed data used in GET method is not sensitive enough :). Are you trying to prove that Kaspersky knows which GET data is sensitive and eliminates it before browser tries to post it to remote server? I have no intention to post more data which is even more sensitive on public forums. I've posted just enough to make my point.

The only point you have made is that you don't understand what you are reading. You have already been shown to be wrong about t going to the Kremlin. Further you have not shown any evidence of data sent past a query string that contains no sensitive information. 

 

Stop wasting our time. 

10 minutes ago, Alejandro779 said:

Enable any sniffer and check if any sensitive data was delivered to Kaspersky servers.

 

Stop your paranoia, Kaspersky KIS just comparing your JS and dangerous file with his catalog of dangerous files.

 

Kasperky Application Advisor at 

http://whitelisting.kaspersky.com/advisor?lang=es-MX#search/c9b3b344c26c697eca4939d54f9036df

You don't understand the problem. Problem is that Kesperky injects scripts into encrypted content and browser tries to post data to external servers on the internet.

3 minutes ago, EJocys said:

You don't understand the problem. Problem is that Kesperky injects scripts into encrypted content and browser tries to post data to external servers on the internet.

Omg!  What data is being posted? You are making claims and delivering proof on none of them!

12 minutes ago, adrynalyne said:

The only point you have made is that you don't understand what you are reading. You have already been shown to be wrong about t going to the Kremlin. Further you have not shown any evidence of data sent past a query string that contains no sensitive information. 

 

Stop wasting our time. 

I have same opinion about you :). I provided links and screenshots which clearly shows browser requests and replies. I've provided IP addresses by using independent DNS services. You managed to ignore it and even misunderstand my "Kremlin" references, despite providing you with clear proof that IP geographical location is pointing to Kremlin and noting that it is a technical record and in reality location can be different (which probably is). At this point you are trying hard to misrepresent my points and missed security flaw consequences in Kasperskys "injection" implementation.

 

Just now, EJocys said:

I am have same opinion about you :). I provided links and screenshots which clearly shows browser requests and replies. I've provided IP addresses by using independent DNS services. You managed to ignore it and even misunderstand my "Kremlin" references, despite providing you with clear proof that IP geographical location is pointing to Kremlin and noting that it is a technical record and in reality location can be different (which probably is). At this point you are trying hard to misrepresent my points and missed security flaw consequences in Kasperskys "injection" implementation.

 

 This whole thread reeks of ignorance. Have fun misunderstanding what you are seeing and making claims you either can't or don't know how to backup. I'm tired of wasting my time. 

3 minutes ago, adrynalyne said:

 This whole thread reeks of ignorance.

Yes, because you are posting on it :). Why don't you install Kaspersky Trial. Login to your bank, reset your password, look at account details and post all browser request/reply details involving Kaspersky's URL here.

3 hours ago, EJocys said:

There is no need to use Fidler because integrated debug tools of the browser reported all links and traffic just fine. Extension was using real domain registered in Russia (ie.kis.scr.kaspersky-labs.com). If there were, no need to go outside then https://localhost:port would be enough. It probably would be fine if "ie.kis.scr.kaspersky-labs.com" had 127.0.0.0 assigned internally, but that was not the case. Supplying data with GET requests also is interesting, because I used same method as a workaround to bypass web Brower’s cross-domain security in some of my applications. What I was seeing was browser extension with intentional back door used by antivirus. Do you think it was a mistake, for company, specializing in security and linked to Russian KGB and FSB to inject secure web content with externaly pointing URL? I don't think so.

 

URL for Firefox users (ff.kis.scr.kaspersky-labs.com) resolves to 127.245.107.154 which is internal, but URL for Internet Explorer (ie.kis.scr.kaspersky-labs.com) resolves directly to Kremlin: 185.85.13.154.

 

If you don't know what you're doing and what you're analyzing or what the reports from the "tools" you are using says.  Then you shouldn't write an post about how you found someone spying on you. it'll just lead you you being on youtube, telling people how to hack with tracert...

9 minutes ago, HawkMan said:

If you don't know what you're doing and what you're analyzing or what the reports from the "tools" you are using says.  Then you shouldn't write an post about how you found someone spying on you. it'll just lead you you being on youtube, telling people how to hack with tracert...

I've used debugging tools of "Internet Explorer" and "Firefox" to analyse requests made by web browser which is exactly the right tool I need to see all requests made to hosts. My point was to prove that Kaspersky is forcing web browser to send data to external addresses on the Internet. Point was to prove that Kaspersky opens "back door" unnecessary. I don't care if it closes/blocks later.

8 minutes ago, HawkMan said:

If you don't know what you're doing and what you're analyzing or what the reports from the "tools" you are using says.  Then you shouldn't write an post about how you found someone spying on you. it'll just lead you you being on youtube, telling people how to hack with tracert...

He totally knows what he is doing...

 

After all:

 

I am writing comercial software (including network capturing and encryption), websites and network mobile apps and debug them by using network tools for 21 years now. I know that I am reading.

19 minutes ago, adrynalyne said:

He totally knows what he is doing...

 

After all:

 

Sure I do, for example: ported System.Security.Cryptography classes (RSA, AES-256) for JavaScript: http://www.codeproject.com/Articles/22073/Object-Oriented-JavaScript-Class-Library-in-C-NET. I don't know everything. But I think, that your assumption, that I don't know, how to use network sniffing tools, is based on your misunderstanding. I am not a native English speaker, maybe it contributes to that.

 

Please note that I asked for people to check this issue (gather evidence) by themselves.

 

Edited by EJocys
2 minutes ago, EJocys said:

Sure I do, for example: ported System.Security.Cryptography classes (RSA, AES-256) for JavaScript: http://www.codeproject.com/Articles/22073/Object-Oriented-JavaScript-Class-Library-in-C-NET. I think, your assumption, that I don't know, how to use network sniffing tools, is based on your misunderstanding. I am not a native English speaker, maybe it contributes to that.

 

Your lack of ability to provide evidence is what contributes to it. Your lack of knowledge of ip geolocation and how inaccurate it can be contributes to it. 

 

i think it is true in any language--if you make a bold claim, back it up. You are not doing that here. 

2 hours ago, EJocys said:

I am not planing to install KAV anymore. I am writing comercial software (including network capturing and encryption), websites and network mobile apps and debug them by using network tools for 21 years now. I know that I am reading. It is hard to mis-unbderstand or misread web brower debug tools. It is not the rocket science. It looks like, it is not the first time Kaspersky is injecting scripts. While I understand the purpose of it (antivirus must have access to plain content in order to analyse it), I don't agree with "back door" implementation method of it i.e. Using live domains and live IPs.

You could try getting Xkeyscore to see what's really going on on your system and with your traffic :D 

6 hours ago, EJocys said:

So, if you have Kaspersky on your computer, then please open secure site like https://www.google.com, press F12 for debug mode, go into “Network” tab, refresh page, see for yourself and report your opinion.

i just tried this and i have no traces of any kaspersky entries in that log.

i have been using kaspersky for years, but i am not using every protection it offers, e.g. i always disable the browser addon and i also deactivate the URL and HTTPS scan options.

 

 -andy-

  • Like 2
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Ford execs say they made a mistake when they replaced human engineers with AI by David Uzondu Ford recently announced that over the last three years, it's had to rehire about 350 "gray beard" engineers to mentor younger staff and reprogram diagnostic systems and AI tools that were failing to meet up to quality expectations. The company's VP of vehicle hardware engineering, Charles **** said that leaders overlooked the deep experience of veterans who survived many product cycles. **** admitted that simply replacing them with AI was a huge mistake, and that while AI is "a fantastic tool," it remains "only as good as the information you use to train it." The rehired engineers now run mandatory meetings to troubleshoot vehicles and reprogram automated engineering software and AI tools to prevent glitches before production. These technical specialists hunt for failure points before a part ever reaches the plant floor. This hands-on process prevents the massive recalls and defects that previously cost the company billions. CEO Jim Farley noted that this return to human oversight quickly decreased warranty coverages and recall costs. The change saves the automaker hundreds of millions of dollars as it aims to cut one billion dollars in expenses this year. In last year's JD Power Quality Survey, an annual study that measures the quality of a car during the first three months of ownership, Ford finished 10th among mainstream brands and scored below the industry average. But this year, JD Power ranked the automaker as the top mainstream brand, placing it above the likes of Toyota Motor Corp. and Honda Motor Co. Ford attributed this massive improvement directly to the expertise of these returned engineers. Ford's realization that AI cannot magically design and test quality vehicles without senior human oversight is just the tip of the iceberg. When Careerminds looked at companies that conducted AI-driven layoffs, researchers found out that 35.6% of those companies had to rehire more than half of the employees they previously fired. Another 32.7% had to rehire between 25% and 50% of them. In 2024, Sebastian Siemiatkowski, CEO of Klarna, proudly announced that its new chatbot was doing the work of 700 full-time customer service agents. As a result, the fintech company froze hiring and cut hundreds of positions. But by mid 2025, and into 2026, Klarna was scrambling to recruit human agents again because customer satisfaction had plummeted. It turns out, while AI is very good at answering basic questions like how to check an account balance, when faced with complex customer issues that require nuance, the thing usually resorts to the unhelpful, robotic corporate jargon we all know and love.
    • Free AI in IDEs is shifting to paid models Or you know, you could just learn to actually design and code apps, use frameworks to handle the repetitive parts and not use AI at all - and voila... free for life!
    • In a sane world US antitrust laws wouldn't even allow these companies to be in the position to be subjected to EU directives. As you say, better than oligarch nothing.
    • Apple reportedly has a second-generation iPhone Fold planned for 2027 Good grief, Apple hasn't even released a first folding phone and the Apple faithful is already obsessing over the sequel? Seriously people, go out and touch grass... because this level of obsession is borderline stalkery/neurotic.
    • I checked on the IPs associated with every login and they're all mine... And whenever I get a new prompt, there is no activity to show for it. 
  • Recent Achievements

    • Enthusiast
      Xonos went up a rank
      Enthusiast
    • Conversation Starter
      Admir earned a badge
      Conversation Starter
    • First Post
      The_Focal_Point earned a badge
      First Post
    • Apprentice
      daryld went up a rank
      Apprentice
    • Contributor
      Carltonbar went up a rank
      Contributor
  • Popular Contributors

    1. 1
      +primortal
      405
    2. 2
      +Edouard
      169
    3. 3
      PsYcHoKiLLa
      129
    4. 4
      neufuse
      69
    5. 5
      Xenon
      68
  • Tell a friend

    Love Neowin? Tell a friend!