Kaspersky critical of exploit publicity

A research company has published a report earlier this week that spoke of certain software vulnerabilities in well known security products - including Kaspersky's own Internet Security software suites.

But the ramifications for users could be very big, says security guru Eugene Kaspersky, placing doubt on the way such research is publicised.  "It's a bad idea to report. It's possible to find such a thing", he told PC Authority in an interview, predicting that when one looks for exploits, "no system is 100% secure".

Calling the exploit an 'argument switch', the research, published by security firm Matousec, explains how the security gap works. In its simplest explanation, the flaw works by replacing code used in the security software that detects malware, says one report.

Kaspersky was unhappy with the way the company released the results, claiming it grants an invitation to cyber criminals to use the exploit. He'd prefer the matter was handled confidentially between vendors and research firms.

"In any protection, it's possible to find such exploits. We report it to the vendor, that's it", added Kaspersky. Keeping quiet about any potential security flaw may sometimes be the best course of action, he argued. 

 "Who is happy after this PR? The research company and cyber criminals...nobody knew about it (before), not the antivirus companies, not the criminals and everyone was happy."