Kevin BeaumontKonto zweryfikowane

Genuine fear: If you look at supply chain attack targets, #1 = Microsoft. They good. #2 = antivirus and InfoSec companies. Risky business.

Until very recently one AV used just HTTP for updates and didn't check signatures. Big targets + InfoSec issues = red flag.

Usually orgs only have one AV per system + they allow fully automated updates, inc code, as that's how AV updates work. No barrier.

This is what I've been trying to say w.r.t. why Kaspersky is such a big risk. Automatic updates, phone-home telemetry, SYSTEM permissions...

That's a different thing, 'how much do you trust the AV companies themselves re the countries they operate in', as opposed to attackers.

Not so much different as it is cumulative. One is generic infosec risk: modern AV maps out your network, has perms everywhere, auto-updates;

and the other is natsec: do you trust a company with that data, that permission, that running code to be operated in adversarial territory?