"More openness required --> Antivirus companies on government spyware"

Regin Malware

Anti-virus companies have to be more open about the government spyware that they find, says security expert Bruce Schneier . Schneier reigns on the discovery of the highly advanced Regin malware , which would be by the US and British intelligence developed .

Anti-virus companies have known for some time of the malware, but made ​​the existence of Regin until the end of November to the public. It was the first that Symantec came out with a publication because it knew that another party would reveal the malware. This party was news The Intercept. After the report, Symantec also followed F-Secure and Kaspersky Lab with their own findings. All three follow the anti-virus companies said Regin years, where she copies of years ago found.

"Why were all these companies Regin long secret and why they showed us all this time vulnerable?" Schneider asked. Self thinks the expert that the anti-virus companies no incomplete picture wanted to express. Unlike malware cybercriminals is the effect of government spyware much more complex. In addition, Regin was only used against specific targets, which makes it difficult to obtain copies.

"If you're big in the press comes with a newly discovered malware copy you want to have the whole story. Apparently no one thought they had it with Regin," said Schneier. The expert, however, find this no excuse. "Now government malware more often will come we will often not have the whole story." As long as nations will fight each other over the internet, according to the expert, some individuals or organizations are the target and the residual risk to be hit inadvertently by this type of malware.

Even more

Schneier believes that anti-virus companies are at the moment even more incomplete stories on all government malware. "But they should not do. We want and need that our anti-virus companies us all about these threats tell as soon as they can, and not wait for the appearance of a political story so they can no longer remain silent."

Kaspersky - Regin Malware Copy 1999

The Russian anti-virus firm Kaspersky Lab has a copy of the advanced Regin-espionage malware found in 1999. This involves the oldest copy that is known up to now. Earlier, a specimen was labeled in 2003 as a senior. The existence of Regin was recently made ​​public by several anti-virus companies.

Regin Platform Diagram

An analyst at Kaspersky Lab named the malware even more sophisticated than Stuxnet . Yet there was also criticism of the anti-virus companies as long as they would have waited to disclose the information. The Russian anti-virus company this refers to a comparison of Sean Sullivan from F-Secure. He likened the search for Regin with the work of paleontologists who found the bones of an unknown dinosaur. Everyone has a bone, but the entire skeleton is missing.

In the case of Regin Kaspersky Lab discovered in 2012 damaged "bone" of a hitherto unknown malware. Figuring out the size of a particular campaign or espionage malware family can sometimes take months or years, the company notes. As it sometimes worked with other parties who may have other parts of the malware possession. "It makes little sense to publish your discovery until you can confirm that the samples really are big and dangerous," said the Russian anti-virus company.

Most Regin copies date from 2007, 43 pieces in total, followed by 35 copies in 2009. Kaspersky also addresses accusations that anti-virus companies, the existence of Regin would have concealed. "We have never been asked by a customer or government agency to whitelist certain malware or to pass through. We would never meet such a request, no matter who it comes from."