Kaspersky Lab Research Articles

АНАЛИЗ ПРЕДПОСЫЛОК УЧАСТИЯ «ЛАБОРАТОРИИ КАСПЕРСКОГО» В ИННОВАЦИОННЫХ ПРОЕКТАХ ГОСУДАРСТВЕННО-ЧАСТНОГО ПАРТНЕРСТВА

The presented article examines the current problem of development of the information technology sector through the mechanism of public-private partnership (hereinafter referred to as PPP) with the participation of AO Kaspersky Lab. The purpose of this study is to assess the qualifications and prospects for the company to pass the preliminary competitive selection and participate in innovative PPP projects in the IT field. In this work, scientific methods such as abstraction, deduction, induction, synthesis, and analysis were used. The company’s activities, the company’s place in the IT field in Russia and the world, geography of presence, expertise, experience, accumulated competencies, technological cooperation of the company with technology partners, government and international organizations, industry diversification of customers, diversification of the company’s product portfolio by type of market and clients, quality and recognition of the company’s products on the market, a standard PPP project for the creation of an information infrastructure facility with the participation of AO Kaspersky Lab was proposed, the main advantages of this project for public and private partners were considered, an enlarged risk matrix for the proposed project was proposed, and examples of products being developed were also given companies that can act as objects of information infrastructure for this project, and also assessed the qualifications and prospects for the company to pass a competitive selection to participate in an innovative PPP project in the IT field.

Казус Родиона Раскольникова, который не смог убить Алену Ивановну. Опыты альтернативной истории

The paper concerns a question of great importance for history as a science, namely the problem of the limits of factual veracity and connected to them the phenomenon of alternate history — a phenomenon that does exist despite the repeated assertion that history does not tolerate the subjunctive mood. The author of the paper is convinced that intellectual and artistic reflection about the past, both personal and social, is indispensable for people, countries, and the whole world. Fyodor Dostoevsky, in his Pushkin speech (1880), successfully exercised the right to think in terms of alternate history. According to Dostoevsky, had Pushkin lived longer, he could have solved the problems which not only had not been solved by the end of Dostoevsky’s life, but had been aggravated to the extreme. The paper analyses the animated series created by Kaspersky Lab under the general title “History Could Have Gone Differently.” The series has five parts: “Raskolnikov,” “Pushkin,” “Chapayev,” “Charles Darwin (Evolution),” “Jack the Ripper.” It is worth mentioning that the image of Raskolnikov has been taken by the creators of the series as such a well-known character that he came to be treated as a real historical person. The animated cartoon “Raskolnikov” sheds light on important features of alternate history: in most cases, it does not provide universally valid solutions and functions selectively, fragmentarily, paving the so called “other way” not for all and not always. We cannot invent any technical devices for saving people preventively from destructive theories and criminal designs: in order to make Raskolnikov’s story go another way other means are needed.

PREVENTION OF TELEPHONE FRAUD (CRIMINOLOGICAL ASPECT)

The problems of committing fraud using telephone communication are updated. The relevance of issues related to the prevention of telephone fraud, first and foremost caller ID spoofing and phishing, is substantiated. The article analyzes the methods of preventing telephone fraud, such as the possibility of establishing the number of fraudsters through electronic search services, special free services, Viber and WhatsApp messengers, Sberbank Online, caller ID for incoming calls on "Avito" and "Yula", through applications for iPhone and Android, caller ID from "Kaspersky Lab" – Kaspersky Who Calls, through the Internet search engine "Yandex" and other applications. It is recommended to use the methods of victimologic counter-strategy in relation to telephone fakers, such as psychological self-defense, criticality (prudence) in their own actions (mainly those of a financial nature), safe behavior in a non-standard situation, a critical level of trust, awareness of possible risks. It is necessary to take precautions not to become a victim of telephone fraud, not to lose self-control and vigilance, to use all opportunities to check the source of telephone fraud, to report such cases to law enforcement agencies. Personal interest in maintaining personal security, the desire for self-defense and timely informing law enforcement agencies will become an obstacle to the spread of telephone fraud.

Emotion Recognition by Audio Signals as one of the Ways to Combat Phone Fraud

The relevance of the study is dictated by the current state in the field of telephone fraud. According to research conducted by Kaspersky Lab, the share of users who encountered various unwanted spam calls in the spring of 2022 was at the level of 71%. The subject of the research is machine learning and deep learning technologies for determining emotions by the timbre of the voice. The authors consider in detail such aspects as: the creation of a marked-up dataset; the conversion of WAV audio format into a numerical form convenient for fast processing; machine learning methods for solving the problem of multiclass classification; the construction and optimization of neural network architecture to determine emotions in real time. A special contribution to the study of the topic is that the authors implemented a fast method of conversion sound formats into numerical coefficients, which significantly increased the speed of data processing, practically without sacrificing their informativeness. As a result, the models were trained by machine learning algorithms quickly and efficiently. It should be particularly noted that the architecture of a convolutional neural network was modeled, which allowed to obtain the quality of model training up to 98%. The model turned out to be lightweight and was taken as the basis for training the model to determine emotions in real time. The results of the real-time operation of the model were comparable with the results of the trained model. The developed algorithms can be implemented in the work of mobile operators or banks in the fight against telephone fraud. The article was prepared as part of the state assignment of the Government of the Russian Federation to the Financial University for 2022 on the topic "Models and methods of text recognition in anti-telephone fraud systems" (VTK-GZ-PI-30-2022).

The Features of the Russian Fakes Spreading in Ukraine

The article reveals the concept of fake and fake information; their types, purpose, and the main task of distribution are characterized; fake classifications are singled out. The study highlighted the most accessible channels for the distribution of fakes – Internet platforms, social networks, and messengers. It has been proven that bots and trolls use all the possibilities of social networks effectively. It has been determined that information isolation of the occupied territories has been a serious problem in Ukraine for a long time and that social networks are an extremely effective manipulative tool and a powerful source of (dis)information, thanks to which the fake industry is constantly strengthening. It is revealed that Russian propaganda fakes built destabilizing and destructive codes against Ukrainians: “armed coup”, “Kyiv regime”, “junta”, “desertion” and emphasized Russia’s heroism – “Russia helps fraternal peoples”, “Russia does not wage war”, “Russian army is noble and peaceful”. It is determined that with the beginning of hostilities in Donbas the communication strategies of the Ukrainian, Russian and pro-Russian mass media became significantly radicalized. It is emphasized that another feature of Russian fakes is the combination of “negative” Ukrainians with the “West as a key enemy”, which is waging a global geopolitical war against Russia. According to the Russian media, it is the West, the United States, and NATO that are waging war in Ukraine, and as proof of this, headlines to sensational materials. Facebook has been analysed as the largest social media service in every major country, which has become a means of spreading fake news and other propaganda. Many examples of the use of fakes, manipulations in social networks have been studied. It is worth noting that in Ukraine for 4 years there is a ban on Russian Internet services, which in May 2017 banned Kaspersky Lab and Dr. Web, all Yandex services, ABBYY, 1C, and Mail.ru Group, which owns the social networks VKontakte and Odnoklassniki. It has been proven that it is extremely difficult to fight the spreading of fakes, so refuting them is not the most effective approach to combating them, even if there are facts and arguments to refute them. The author offers a number of useful tips that should be followed to effectively avoid the spread of fakes throughout Ukraine.

Восприятие кибербезопасности на российском рынке в B2C-сегменте: проблемы и решения в контексте маркетинговой стратегии

Russian cybersecurity market shows insignificant positive growth rates due to development of the B2B segment: launch of individual projects in the sphere of digitalization at the federal level, as well as adoption of security systems to deflect cyber attacks and proactively identify threats from major market players. At the same time, the B2C segment is really inferior to B2B. This is primarily attributable to the fact that ordinary consumers do not realize the need to protect digital data. The present paper will consider the main parameters of the macroenvironment, competitive saturation and will analyze a modern consumer of cybersecurity services. These factors will help to identify the roots of negative perception of cyber services among Russian consumers. The article authors suggest a marketing communication strategy to improve the current situation on the example of Kaspersky Lab and the target IT Administrators audience.

Demarcation of the public and private in the interaction of the state and citizens on digital network platforms

Digital network platforms are built on sociotechnical interaction between actors and actors. The creation and development of new public services based on digital platforms inevitably leads to the transformation of the relationship between the state and citizens. The attractiveness of state digital platforms for citizens increases when resolving the contradiction between the possibilities of new forms of social interaction and the threat of misuse of personal data, the risk of harm or persecution.The article presents the results of the analysis of the boundaries of the public and private in the interaction of the state with citizens on digital network platforms. The research method is a comparative analysis, which is based on the dichotomy of public and private, reflected in the concept of private and public X. Arendt, concepts of the public sphere J. Habermas, regulatory and legal concepts of privacy by R. Gavison. The empirical base was made up of a sociological study conducted to obtain information about the boundaries of privacy and publicity of personal data in the digital network space (n = 1 000 among the population over 18 years old living in metropolitan megacities and median regions by the level of informatization, 2020) and the results of Kaspersky Lab surveys conducted in 2019–2020.The conducted research allows us to assert that almost 2/3 of citizens have faced the misuse of confidential information on the Internet. Most of the respondents are aware that websites, social networks and search engines can collect data for web analytics. At the same time, citizens consider it possible to transfer personal data to the authorities in a generalized form for making managerial decisions. Half of the surveyed population does not object to the implementation of digital control over the actions and movements of citizens. Thus, despite the existing negative experience, it is unlikely that there will be any obvious resistance to organizing the collection of personal information on digital network platforms.

How industrial companies are changing their approach to cybersecurity as a result of the pandemic

Kaspersky Lab experts spoke about how the pandemic affected the work of industrial enterprises from the point of view of cybersecurity. They drew their conclusions based on expert interviews conducted in 2020 with specialists from Russian manufacturing companies.

ANALYSIS OF ICT COMPANIES’ NEEDS FOR THE ENHANCEMENT OF ICT HIGHER EDUCATION AT MASTER LEVEL: THE CASE OF KAZAKHSTAN

The correspondence between ICT master programmes and requirements of ICT companies is shaped via needs analysis. The research aim: The aim of the present article is to analyse the empirical results of the study of needs of ICT companies, underpinning the elaboration of implications on ICT master programmes. The primary methods used: Exploratory research has been implemented within the present work. The representatives of four ICT companies, namely CISCO, KAIB, Kaspersky Lab and Soft Com, took part in the focus group interview organised at International Information Technology University, Almaty, Kazakhstan, in October 2019. A brief description of the main research results: The theoretical findings of the present research allow concluding that ICT companies and the universities belong to the local or regional community. The structuring content analysis allows identifying the areas of universities-companies cooperation, namely academic staff training, students’ training, provision of universities with modern equipment, joint elaboration of the content of ICT master programmes, organisation of joint laboratories including virtual laboratories, ensuring practice and internships for students, etc. The summarising content analysis highlights the need in cooperation between universities and companies to strengthen the sustainable development of the digital economy in the region. The novelty of the present work is formulated in the implications on ICT master programmes. Directions of further research are formulated.

Antitrust regulation of product ecosystems: The case study of Kaspersky Lab. – Apple Inc.

Implementation of the ecosystem business model can not only bring significant gains to a company, but also entail additional risks, including those of violating antitrust laws. The article analyses the Apple Inc. ecosystem, which has recently become the subject of a number of complaints from independent software developers and of antitrust investigations. The study shows how a unique position within the ecosystem can lead a company to market dominance. As a result, actions aimed at creating preferential conditions for the company’s services can be interpreted as restricting competition through fostering a discriminatory environment and preventing independent software developers from entering the market. The analysis is based on public information about Apple’s actions against third-party developers and the recent investigation into the company’s conduct in response to the complaint by Kaspersky Lab. The reason for the initiation of legal proceedings was Apple’s actions setting new rules for the App Store and resulting in improper functioning of the parental control application “Kaspersky Safe Kids”. Methodologically, the study relies on ecosystem theory and the theory of industrial organization. The main research method is case study. The research demonstrates how Apple’s actions can be interpreted in terms of such concepts as essential facilities, tying practices, aftermarkets, and leveraging of market power. These concepts are applicable to Apple’s conduct, including the closed type of the ecosystem built by the company.

BitScout: Remote Digital Forensics Toolkit

Forensic Science has been full of challenges for most of the Law Enforcement Agency (LEA) as we need to physically visit the crime scene, acquire evidence, then preserve it for forensic analysis. The path of collecting evidences from crime site and then bringing it to the Forensic Labs. becomes much cumbersome as the evidence may be corrupted or altered during transit. So why not to adopt a system for readily analysis of a compromised system without going to the crime site and sitting on one’s chair or forensic workstation? The answer may be yes, we can but will it be easy and ethical to acquire evidence from a system remotely without visiting the crime scene physically. Vitaly Kamluk from Kaspersky Labs made this possible now by launching a new forensic tool called BitScout . To solve this problem, security researchers and Forensic Investigator can now use BitScout to collect remotely, key forensic evidences, to acquire full disk images via the network or locally attached storage devices, or simply to assist in malware incident handling. Evidence data can be viewed and analysed remotely or locally while the source data storage remains intact through reliable container-based isolation. BitScout is an open-source and free tool developed by security researchers for all people interested in digital forensics and cyber crimes investigations.

Аналіз проблем безпеки IoT пристроїв

The paper considers the problems securing of protection of access to IoT-devices and their networks. A study by Microsoft experts, who found that the biggest problems in IoT networks are related to network-level security, was analyzed. The presence of a large number of insufficiently protected devices facilitates DDoS-attacks, in which home devices can be used to attack corporate systems. The main reason for the failure of IoT component manufacturers to implement security features is the high computational costs that reduce the service life of device batteries. HPE (Hewlett Packard Enterprise) experts recommend paying attention to both device owner issues and developer issues, and provide some tips on setting up IoT devices. HPE experts have identified about 25 different vulnerabilities in each of the studied devices (TVs, door locks, household scales, home security systems, electrical outlets, etc.) and their mobile and cloud components, compiled a list of major vulnerabilities and made a disappointing conclusion: a safe ecosystem IoT does not exist today. The statistics of attacks on IoT devices recorded during the last 2 years with the help of honeypots, collected by Kaspersky Lab specialists, are considered. It turned out that the number of attacks increases with the number of IP addresses. A list has been compiled of the countries with the highest number of attempted attacks. The largest number of attacks came from China and Brazil. The list of threats provided by Trend Micro is considered. The most common attack technologies, which can cause significant damage, are analyzed. Such technologies include: amplification, change of route information, selective mailing, bottomless funnel Sinkhole Attack, shamanic attack Sybil attack, wormhole attack Wormhole attack, flood attack HELLO flood attack. The list of basic recommendations for security in the IoT system is presented, namely: password protection, use of separate networks, refusal of automatic connection to the network. Keywords: Internet of Things (IoT), industrial devices of the Internet of Things (IIoT), inter-machine interaction (M2M), smart home, smart city, information security (IS), DDoS-attack.

Mining nested flow of dominant APIs for detecting android malware

According to the Kaspersky Lab threat report, mobile malware attacks almost doubled in 2018. A study conducted in 2018 by Accenture found malware attacks to be the most expensive to resolve. Android Operating System (OS) is the most dominating platform on mobile devices. This makes Android OS susceptible to malware attacks. We need to develop new techniques and methods to stop this influx of malware attacks. In this paper, we propose a novel technique named DroidDomTree that mines the dominance tree of API (Application programming interface) calls to find similar patterns in Android applications for detecting malware. Dominance is a transitive relation. A dominance tree of API calls highlights a strong flow of path and identifies the nesting structure of APIs and hence emphasizes the importance of certain APIs in an application. It also helps in finding modules and their interaction in an application. If a malicious module is embedded in an application, then this provides strong evidence that the application contains malware. We use these properties and develop a nested model of the dominance tree of API calls and a new scheme for assigning weights to each node in the dominance tree for efficient feature selection. During 10-fold cross-validation, with eight different classifiers using real malware Android applications, DroidDomTree achieved detection rates in the range of 98.1%–99.3% and false positive rates in the range of 1.7%–0.4%.

Five ICS cybersecurity myths based on Kaspersky Lab ICS CERT experience

Abstract Today, industrial cybersecurity is in the early stages of its development, gradually evolving into a science and technology discipline that will become the cornerstone of industrial manufacturing and construction technologies, the infrastructure of modern cities, transportation, healthcare, etc. The community of researchers and engineers is constantly looking for solutions to protect both existing systems and future technologies. As we depart from the starting point, we must build our assumptions on an objective assessment of the current situation, because, at this stage, even seemingly insignificant misconceptions can cause major fluctuations that prevent us from choosing the right strategy. In this article, we will discuss typical misconceptions and common errors in assessing the security of industrial control systems that Kaspersky Lab ICS CERT experts encounter in their day-to-day communication with people from different industrial sectors and the community of information security experts. We will support our conclusions with the results of the past several years’ research into the various cyberthreats affecting industrial enterprises.

Biometrics the secret to securing industrial control systems

Industrial control systems automate activity in many key industrial facilities such as petrochemical plants, refineries and power plants (see box, page 9). Given their importance, it is perhaps not surprising that the frequency of cyber-attacks involving industrial control systems (ICSs) is significant: an ICS decoy, set up by cyber-security company Kaspersky Lab, attracted 1,300 attempts to gain unauthorised access in just one month 1 . In the face of this threat, biometric technology can be implemented to significantly improve ICS security.

Средства анализа сетевого трафика локальной вычислительной сети в ретроспективе

The article considers the problem of detecting a time-distributed network attack. Reportson the state of information space security from Kaspersky Lab and IBM Security are analyzed, aswell as stages of a retrospective analysis of network traffic based on research in the field of computer forensics are identified. Assumptions were made about possible problems at each stageand solutions were proposed. Existing network traffic analysis systems used to solve the existingproblem are investigated, a comparative description is made and their limitations are revealed

The Dangers of Rooting: Data Leakage Detection in Android Applications

Mobile devices are widely spread all over the world, and Android is the most popular operative system in use. According to Kaspersky Lab’s threat statistic (June 2017), many users are tempted to root their mobile devices to get an unrestricted access to the file system, to install different versions of the operating system, to improve performance, and so on. The result is that unintended data leakage flaws may exist. In this paper, we (i) analyze the security issues of several applications considered relevant in terms of handling user sensitive information, for example, financial, social, and communication applications, showing that 51.6% of the tested applications suffer at least of an issue and (ii) show how an attacker might retrieve a user access token stored inside the device thus exposing users to a possible identity violation. Notice that such a token, and a number of other sensitive information, can be stolen by malicious users through a man-in-the-middle (MITM) attack.

The ABC of ransomware protection

‘Your files have been encrypted!’ These five words have the potential to instil alarm as the realisation dawns that your system has fallen victim to ransomware. How it happened and what happens next, rather depends upon the precautions that may or may not have been taken beforehand. And as we will explore in this article, taking some basic steps in advance could help save a lot of problems later. Ransomware has become a significant problem and is now one of the most keenly recognised threats in the security landscape. And it's likely to get worse. Steven Furnell of the University of Plymouth and David Emm of Kaspersky Lab UK examine the history of ransomware and why it's so effective. And they detail the steps individuals and organisations can take to defend themselves from this growing menace, including using anti-malware, back-ups and patching.

Attacks on industry

Although the majority of industrial organisations believe they are well-prepared for cyber-security incidents, around half of firms using industrial control system (ICS) technology experienced between one and five incidents last year, according to research by Kaspersky Lab, and 4% experienced more than six. Meanwhile, a major new threat has emerged.

Design of Security Training System for Individual Users

A technique to induce access to a website falsely made through a message figured out as being sent by a trustworthy person or a simple spam, circulate a malicious code and cause additional security damage is called Phishing. According to security company Kaspersky Lab, 3,730,000 people were exposed to Phishing attack between 2012 and 2013. In addition, recently, the mobile malicious code increased eight times in 2012 due to the propagation of Smartphones compared to 2011, so security threats are increasing. Phishing is carried out by e-mail Phishing using the social engineering attack or SMSishing using short message service (SMS). To prevent this, there are preparation methods such as antivirus software or Phishing filtering systems and security preparation training or education. Yet, social engineering attack such as Phishing e-mail or SMSishing uses human psychology, so there is a limit with security software or system, and general individual users cannot possibly understand its seriousness. Therefore, this study aims to propose a security training system for individual users to be prepared for an e-mail Phishing attack or SMSishing attack. The proposed system consists largely of three types of structures such as trainee, Center System and Monitoring and Reporting System, so it plans to try a virtual social engineering attack by using e-mail and SMS through PCs or Smartphones of the trainees. When the trainees are attacked, they will learn a coping method and have an ability to cope with the e-mail Phishing and SMSishing attack. In addition, through a test using this system, it was found that the click rate of virtual Phishing e-mail messages decreased from 47 to 33 %, and the click rate of threatening links decreased from 16 to 4 % so that the usefulness of this study was examined. From this result, training against security threats in Phishing e-mail for individual users would be possible through the proposed security training system and preparation for the Phishing attack as a result would be possible.