Kaspersky said that at no point did he cooperate with the Federal Security Agency, the successor agency to the KGB, as the Flame virus was not a threat to Russian citizens. Kaspersky Lab, he said, felt justified exposing the Flame virus because the company was working under the auspices of a United Nations agency. But the company has been noticeably silent on viruses perpetrated in its own backyard, where Russian-speaking criminal syndicates controlled a third of the estimated $12 billion global cybercrime market last year, according to the Russian security firm Group-IB.
Some say there is good reason for that. "He's got family," said Sean Sullivan, a security adviser at F-Secure, a computer security firm in Helsinki. "I wouldn't expect them to be the most aggressive about publicizing threats in their neighborhood for fear those neighbors would retaliate."
Last year, Kaspersky's 19-year-old son was kidnapped by criminals demanding a ransom. The kidnappers did not appear to have ties to any of Russia's online criminal syndicates, but Sullivan says,
"It was probably a wake-up call."
Some computer security firms say Kaspersky's researchers have hyped Flame. It is too early, his critics say, to call the virus a cyberweapon and to suggest it was sponsored by a state. Joe Jaroch, a vice president at Webroot, an anti-virus maker, says he first encountered a sample of Flame in 2007. He says he did not publicize the discovery because he did not consider the code sophisticated. "There are many more dangerous viruses out there," he said. "I would be shocked if this was the work of a nation state."
Sullivan, from F-Secure, said: "It's interesting and complex, but not sleek and stealthy. It could be the work of a military contractor - Northrop Grumman, Lockheed Martin, Raytheon and other contractors are developing programs like these for different intelligence services. To call it a cyberweapon says more about Kaspersky's Cold War mentality than anything else. It has to be taken with a grain of salt."
Whether the skepticism is authentic or professional jealousy, no one doubts the Kaspersky Lab's skills.
Kaspersky studied cryptography at a high school that was co-sponsored by the KGB and Russia's ministry of defense, and later took a job with the Russian military. He started tracking computer viruses as a side project in 1989, after his work PC was infected with one. In 1997, he co-founded Kaspersky Lab with his wife at the time, Natalya, in their Moscow apartment.
The headquarters of the team that unraveled Flame is an open-plan office of cubicles overlooking a park on the edge of Moscow. Kaspersky eschews suits and his researchers wear Converse shoes and tattered jeans, much as their counterparts in the U.S. do. A Darth Vader mask adorns one desk.
Talent also abounds. The Belarussian virus hunter who first found the Stuxnet virus in 2010, Sergei Ulasen, now works for Kaspersky Lab.
Today, the company is one of Russia's most recognizable exports. It commands 8 per cent of the world's software security market for businesses, with revenue reaching $612 million last year.
Yet Kaspersky says he often has to refute suggested ties to Russia's security services. Analysts say suspicions about the firm's Russian roots have hindered its expansion abroad.
"The US government, defense contractors and lots of US companies won't work with them," said Peter Firstbrook, director of malware research at Gartner, a research firm. "There's no evidence that they have any back doors in their software or any ties to the Russian mafia or state. It's a red herring, but there is still a concern that you can't operate in Russia without being controlled by the ruling party."
Kaspersky said his company tackled Flame upon the request of the International Telecommunications Unit, a branch of the UN He assigned about three dozen engineers to investigate a virus that was erasing files on computers at Iran's oil ministry.
Kaspersky researchers, some of whom had analyzed suspected USand Israeli viruses that destroyed centrifuges in Iran's nuclear program two years earlier, were already following up on complaints from Iranian clients that Kaspersky's anti-virus software was not catching a new type of malware on their systems, Kaspersky officials said.
"We saw an unusual structure of the code, compressed and encrypted in several ways," Vitaly Kamlyuk, a researcher on the team that cracked the virus.
It was the first virus to look for Bluetooth-enabled devices in the vicinity, either to spread to those devices, map a user's social or professional circle, or steal information from them. The program also contained a command called "microbe" that silently turned on users' microphones to record their conversations and sent audio files back to the attackers. It was clearly not a virus made by criminals.
"Anti-virus companies are in a not easy situation," Kaspersky said. "We have to protect our customers everywhere in the world. On the other hand, we understand there are quite serious powers behind these viruses."
Even though finding viruses first is usually a boon for anti-virus companies, cracking Flame, Kaspersky said, might hurt his business in one regard. "For the next five years, we can forget about government contracts in the United States."
Source:TOI
