Kaspersky Labs Hacked "By Government"

Kaspersky Lab, one of the biggest security software firms, says its own internal network was attacked by hackers. The company heavily implied that a national government was behind the hack.

Owner Eugene Kaspersky says the hackers were able to access confidential internal data relating to research and development into new and improved security techniques. The attack didn't delete or change any data, or affect any performance. The company is also quick to stress that no customers were affected by the move and that it's products continue to work as designed.

Attack Method Impressive, Kaspersky Concedes

According to Kaspersky, the attack method was "a generation ahead of anything we'd seen earlier -- it uses a number of tricks that make it really difficult to detect and neutralize." Speaking from a practical, rather than moral perspective, he even described the technical approach as "quite brilliant." (Source: forbes.com)

One of the key features of the attack was that the malware wasn't installed on the servers and hard drives of Kaspersky computers. Instead it was distributed and hid within memory in a way that meant it remained active, yet undetected for some time.

While crediting the technical approach, Kaspersky called the attack a dumb move, saying that because his firm was eventually able to detect and analyze the attack, the hackers have "lost a very expensive technologically-advanced framework they'd been developing for years."

Hacking likely the Work of Government

Kaspersky has dubbed the attack group "Duqu 2.0", which refers to a form of malware developed from the Stuxnet attacks. That was widely distributed malware, commonly believed to be the work of the US government, with the primary aim of compromising Iranian nuclear technology.

According to Kaspersky, the same people who attacked his firm have used the same techniques to try to spy on attendees at an Auschwitz liberation anniversary commemoration and talks on Iran's nuclear program.

He says the attacks were "presumably state-sponsored" and that "governments attacking IT security companies is simply outrageous. We're supposed to be on the same side as responsible nations." Kaspersky adds that as well as publicizing the attacks, the company has reported it to law enforcement officials, something that's company policy regardless of who the suspected attackers are. (Source: kaspersky.com)

What's Your Opinion?

Is it legitimate for governments to use malware as part of their international security agency operations? Would such a government be responsible for the consequences if and when the malware spreads to the general public? If such a strategy is valid, does spying on a security firm which is trying to counter such malware go too far?