Does F-Secure's antivirus turn a blind eye to spook spyware? CEO hits back

Malware is malware, says top Finn


Antivirus maker F-Secure has responded to privacy campaigners' concerns over the handling of spook-grade surveillance malware – by insisting its security software slays government spyware wherever it can.

In an open letter to the Bits of Freedom team, F-Secure president and chief exec Christian Fredrikson said his firm stands by its 2001 vow to not discriminate in favor of intelligence agencies when blocking potentially malicious code.

Earlier this month, the campaigners wrote [PDF] to F-Secure, which is headquartered in Helsinki, Finland, demanding to know whether the biz had "ever been approached ... by a government requesting that the presence of specific software is not detected, or if detected, not notified to the user of your software."

Fredrikson shot back: "If we would be approached by a government asking us not to detect a specific piece of malware, we would not comply with their request.

"To us, the source of the malware does not come into play when deciding whether to detect malware."

The privacy warriors' letter to F-Secure was part of a public call to antivirus vendors to disclose their policies.

The campaign, backed by top computer security expert Bruce Schneier, asked companies to come clean on whether they would turn a blind eye to a particular strain of spyware should a government ask.

Fredrikson said his company has encountered government-backed malware samples, citing the 2011 saga of R2D2 – a secretive package that was allegedly deployed by German police to listen in on VoIP calls.

The chief exec said his firm's software, once it detects malware, grants no special favors to the g-men's software. Fredrikson denied that F-Secure has ever been asked by government agencies to allow spyware through its security checks.

"If it's malware, we will protect our customers from it. Our decision-making boils down to a simple question: would our customers run this program on their system or not," the F-Secure boss continued.

"Obviously the answer for governmental trojans would be a 'no'." ®


Other stories you might like

  • Emotet malware gang re-emerges with Chrome-based credit card heistware
    Crimeware groups are re-inventing themselves

    The criminals behind the Emotet botnet – which rose to fame as a banking trojan before evolving into spamming and malware delivery – are now using it to target credit card information stored in the Chrome web browser.

    Once the data – including the user's name, the card's numbers and expiration information – is exfiltrated, the malware will send it to command-and-control (C2) servers that are different than the one that the card stealer module uses, according to researchers with cybersecurity vendor Proofpoint's Threat Insight team.

    The new card information module is the latest illustration of Emotet's Lazarus-like return. It's been more than a year since Europol and law enforcement from countries including the United States, the UK and Ukraine tore down the Emotet actors' infrastructure in January 2021 and – they hoped – put the malware threat to rest.

    Continue reading
  • Symbiote Linux malware spotted – and infections are 'very hard to detect'
    Performing live forensics on hijacked machine may not turn anything up, warn researchers

    Intezer security researcher Joakim Kennedy and the BlackBerry Threat Research and Intelligence Team have analyzed an unusual piece of Linux malware they say is unlike most seen before - it isn't a standalone executable file.

    Dubbed Symbiote, the badware instead hijacks the environment variable (LD_PRELOAD) the dynamic linker uses to load a shared object library and soon infects every single running process.

    The Intezer/BlackBerry team discovered Symbiote in November 2021, and said it appeared to have been written to target financial institutions in Latin America. Analysis of the Symbiote malware and its behavior suggest it may have been developed in Brazil. 

    Continue reading
  • HelloXD ransomware bulked up with better encryption, nastier payload
    Russian-based group doubles the extortion by exfiltrating the corporate data before encrypting it.

    Windows and Linux systems are coming under attack by new variants of the HelloXD ransomware that includes stronger encryption, improved obfuscation and an additional payload that enables threat groups to modify compromised systems, exfiltrate files and execute commands.

    The new capabilities make the ransomware, first detected in November 2021 - and the developer behind it even more dangerous - according to researchers with Palo Alto Networks' Unit 42 threat intelligence group. Unit 42 said the HelloXD ransomware family is in its initial stages but it's working to track down the author.

    "While the ransomware functionality is nothing new, during our research, following the lines, we found out the ransomware is most likely developed by a threat actor named x4k," the researchers wrote in a blog post.

    Continue reading

Biting the hand that feeds IT © 1998–2022