Senator Wyden Wants To Know If The NSA Is Still Demanding Tech Companies Build Backdoors Into Their Products

from the build-them-or-we'll-just-build-our-own dept

It's been more than a half-decade since it made headlines, but the NSA's hardware manipulation programs never went away. These programs -- exposed by the Snowden leaks -- involved the NSA compromising network hardware, either through interception of physical shipments or by the injection of malicious code.

One major manufacturer -- Cisco -- was righteously angered when leaked documents showed some of its hardware being "interdicted" by NSA personnel. It went directly to Congress to complain. The complaint changed nothing. (Cisco, however, changed its shipping processes.) But even though the furor has died down, these programs continue pretty much unhindered by Congressional oversight or public outcry.

One legislator hasn't forgotten about the NSA's hardware-focused efforts. Senator Ron Wyden is still demanding the NSA answer questions about these programs and give him details about "backdoors" in private companies' computer equipment. The DOJ and FBI may be making a lot of noise about encryption backdoor mandates, but one federal agency is doing something about it. And it has been for years.

Not only has the NSA installed its own backdoors in intercepted devices, it has been working with tech companies to develop special access options in networking equipment. This allows the agency to more easily slurp up communications and internet traffic in bulk. Senator Wyden wants answers.

The agency developed new rules for such practices after the Snowden leaks in order to reduce the chances of exposure and compromise, three former intelligence officials told Reuters. But aides to Senator Ron Wyden, a leading Democrat on the Senate Intelligence Committee, say the NSA has stonewalled on providing even the gist of the new guidelines.

“Secret encryption back doors are a threat to national security and the safety of our families – it’s only a matter of time before foreign hackers or criminals exploit them in ways that undermine American national security,” Wyden told Reuters. “The government shouldn’t have any role in planting secret back doors in encryption technology used by Americans.”

No one knows what's in the guidelines and whether they forbid the NSA from backdooring hardware or software sold to US buyers. All the NSA is willing to say is it's trying to patch things up with domestic tech vendors by, um, giving them more stuff to patch up.

The agency declined to say how it had updated its policies on obtaining special access to commercial products. NSA officials said the agency has been rebuilding trust with the private sector through such measures as offering warnings about software flaws.

This is a welcome change after years of exploit hoarding. But there's no reason to believe the NSA isn't holding useful flaws back until they've outlived their exploitability. As for the built-in backdoors, the NSA refuses to provide any details. It won't even answer to its oversight. And if it won't do that, it really needs to stop saying things about "robust oversight" every time more surveillance abuses by the agency are exposed.

There's more to this than potential domestic surveillance. Any flaw deliberately introduced in hardware and software can be exploited by anyone who discovers it, not just the agency that requested it. The threat isn't theoretical. It's already happened. In 2015, it was discovered that malicious hackers had exploited what appeared to be a built-in flaw to intercept and decrypt VPN traffic running through Juniper routers. This appeared to be a byproduct of the NSA's "Tailored Access Operations." While Juniper has never acknowledged building a backdoor for the NSA, the circumstantial evidence points in No Such Agency's direction.

[Juniper] acknowledged to security researcher Andy Isaacson in 2016 that it had installed Dual EC [Dual Elliptic Curve] as part of a “customer requirement,” according to a previously undisclosed contemporaneous message seen by Reuters. Isaacson and other researchers believe that customer was a U.S. government agency, since only the U.S. is known to have insisted on Dual EC elsewhere.

This is the danger of relying on deliberately introduced flaws to gather intelligence or obtain evidence. Broken is broken and broken tools are toys for malicious individuals, which includes state-sponsored hackers deployed by this nation's enemies. It's kind of shitty to claim you're in the national security business when you're out there asking companies to add more attack vectors to their products.

Filed Under: 4th amendment, backdoors, nsa, ron wyden, surveillance
Companies: cisco, juniper

Former Refrigerator Manufacturer Says Companies Using Open Source, Royalty-Free Video Technology Must Pay To License 2,000 Patents

from the this-is-why-we-can't-have-nice-things dept

Video streaming is a key part of today's Internet world. According to research from Sandvine, it represents 60.6% of total downstream volume worldwide. The centrality of video to the Internet experience makes video codecs one of the hottest technologies. The most popular format today is H.264, used by 91% of video developers. But H.264 is getting long in the tooth -- its history goes back two decades. An upgrade is long overdue. There's a successor, H.265, also known as High Efficiency Video Coding, or HEVC. However, the use of H.265 has been held back by patent licensing issues. As Wikipedia explains in painful detail, there are two main patent pools demanding payment from companies that use HEVC in their devices. For one of the pools, the patent list is 164 pages long. Partly in response to this licensing mess, and HEVC's high per-device cost, the Alliance for Open Media was formed in September 2015:

Seven leading Internet companies today announced formation of the Alliance for Open Media -- an open-source project that will develop next-generation media formats, codecs and technologies in the public interest. The Alliance's founding members are Amazon, Cisco, Google, Intel Corporation, Microsoft, Mozilla and Netflix.

In contrast to the proprietary and expensive H.265, the new video standard, called AOMedia Video 1 (AV1), is open source and royalty-free. Those features, and the backing of many of the top Internet companies, would seem to make it an obvious choice for manufacturers to build into their devices, leading to better-quality video streaming for end users at no extra cost.

Life is never that simple. Back in March last year, Sisvel announced a "patent licensing program" for AV1. Sisvel is an Italian company that began as a manufacturer of white goods, particularly refrigerators, and has morphed into a group that "identifies, evaluates and maximizes the value of IP assets for its partners around the world". The AOMedia group wrote in response:

AOMedia is aware of the recent third-party announcement attempting to launch a joint patent licensing program for AV1. AOMedia was founded to leave behind the very environment that the announcement endorses -- one whose high patent royalty requirements and licensing uncertainty limit the potential of free and open online video technology. By settling patent licensing terms up front with the royalty-free AOMedia Patent License 1.0, AOMedia is confident that AV1 overcomes these challenges to help usher in the next generation of video-oriented experiences.

But refrigerator companies don't give up that easily. Sisvel has just announced that more companies have added patents to its pool. There are currently 1,050 patents that Sisvel says must be licensed, but in due course it expects that number will rise to around 2,000. The fact that people can claim that there are 2,000 separate patents involved in a video encoding format is an indication of how far the patenting madness has gone. The sheer number claimed for a single technology is an indication of how trivial most of them must be -- and thus by definition undeserving of monopoly protection.

According to an article on c|net, Sisvel is "willing to pursue companies that don't pay its AV1 licensing fees". This probably means we are in for another few years of utterly pointless legal battles over who "owns" certain ideas. That's bound to cast a chill over this whole area, and to negate some of the benefits that would otherwise flow from an open source, royalty-free video standard. Companies will waste money paying lawyers, and end users will miss out on exciting applications of the technology. And all "because patents".

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: appliances, av1, h.265, patent trolls, patents, refrigerators, software patents, streaming video
Companies: alliance for open media, amazon, cisco, google, intel, microsoft, mozilla, netflix

Cisco Shells Out $8.6 Million For Selling The Government Easily Hackable Tech

from the ill-communication dept

Not keen on competing with cheaper Chinese hardware, Cisco has long lobbied the US government to hamstring Chinese competitors like Huawei for lax security practices. At the beginning of this decade as Huawei began to make inroads into US markets, Cisco could frequently be found trying to gin up lawmaker angst on this subject for obvious, financial gain. And while Huawei (like most telecom giants) certainly does dumb and unethical things, it's fairly obvious that at least a portion of our recent hyperventilation over (so far unproven) allegations that Huawei spies on Americans is good old fashioned protectionism.

Fast forward to this week, when new reports suggested that Cisco should have spent a little more time worrying about its own products. The company was required to pay the government $8.6 million after it was found the company routinely sold the government hackable video cameras, then did nothing to secure the devices once they were in the wild. For years. The vulnerable gear, exposed by a Cisco whistleblower, was sold to a variety of hospitals, airports, schools, state governments and federal agencies.

And while news of the scandal was buried underneath the other, more notable privacy and security scandals of the day, the flaws were not what you'd call modest:

"Hackers could use the flaw not just to spy on video footage but to turn surveillance cameras on and off, delete footage and even potentially compromise other connected physical security systems such as alarms or locks — all without being detected, said Hamsa Mahendranathan, an attorney at Constantine Cannon, which represented the whistleblower James Glenn."

Cisco states that there's no evidence that these vulnerabilities were exploited, though that seems like an impossible claim to make given the scope of the impacted products, many of which aren't even still in circulation. Glenn suggested the vulnerabilities were "trivial" to exploit. He also noted that despite being aware of the issue, Cisco left the cameras unfixed for four years, opening to liability given its contractor relationship to government:

"Glenn, during his work at a Cisco subcontractor called NetDesign over the course of 2008, sent the company “detailed reports … revealing that anyone with a moderate grasp of network security could exploit this software,” but he never got a response, his attorneys said. Glenn was fired by NetDesign in 2009, his attorneys said. They are not alleging that dismissal was in retaliation for pointing out the flaw. He filed the whistleblower lawsuit two years later."

The settlement (astonishingly) marks the first time in US history that a government contractor has been forced to pay out under a federal whistleblower law for failing to have adequate cybersecurity protections, though it's unlikely to be the last. After the Washington Post broke the story, the New York Times found that the settlement will be doled out to an array of US government agencies, including FEMA, Homeland Security, the Secret Service, and all four branches of the military.

Companies: cisco, huawei

As Trump Prepares Ban On Huawei, Few Notice The Major Holes In The Underlying Logic

from the do-as-we-say,-not-as-we-do dept

During the Trump era, the government has dramatically ramped up claims that Chinese hardware vendor Huawei is a nefarious spy for the Chinese government, blackballing it from the U.S. telecom market. From pressuring U.S. carriers to drop plans to sell Huawei phones to the FCC's decision to ban companies from using Huawei gear if they want to receive federal subsidies, this effort hasn't been subtle.

This week, there are rumblings that the Trump administration is about to take things further with a total ban on Huawei gear anywhere inside of the United States. The news is to be formally announced ahead of the Mobile World Congress trade show in Barcelona, likely with a heavy emphasis on how the move will cement U.S. dominance in the "race to 5G," a largely nonsensical concept drummed up by networking hardware vendor marketing departments.

The problem: there's still no public evidence Huawei uses its network gear to spy on Americans, and much of the motivation for this assault on Huawei has been proven to be largely about protectionism, not national security.

There's no doubt that Huawei, like AT&T here in the states, isn't a shining beacon of ethical behavior. At the same time, the dulcet undertones justifying much of the blacklisting is based on the premise that the company spies on Americans. Yet nobody has provided evidence of that. In fact, one 18-month investigation into Huawei in 2011 (the last time we had a flare of up this hysteria) found that there was no evidence supporting that claim:

"We knew certain parts of government really wanted” evidence of active spying, said one of the people, who requested anonymity. “We would have found it if it were there."

Also ignored is that U.S. hardware vendors like Cisco have a very long history of trying to gin up hysteria on Capital Hill on this front among lawmakers who aren't too keen on, well, facts:

"What happens is you get competitors who are able to gin up lawmakers who are already wound up about China,” said one Hill staffer who was not authorized to speak publicly about the matter. “What they do is pull the string and see where the top spins."

Also ignored in most tech press coverage of the moves against Huawei is the fact that the United States is guilty of most of the stuff we accuse Huawei of. In fact, Snowden docs revealed that the NSA (aka the United States) had broken into Huawei as early as 2007 in a bid to steal source code and covertly implant backdoors into Huawei products. Similarly you'll recall how the NSA was also busted intercepting Cisco hardware in transit, taking that gear to a special facility, then outfitting it with backdoors. That sends a pretty clear message: unethical behavior is okay when we do it.

Also ignored is the fact that our own telecom operators don't have stellar backgrounds on this subject either. AT&T, for example, is effectively bone-grafted to our nationwide intelligence apparatus, and almost certainly helps the United States spy on citizens all over the world. AT&T, a company just busted paying $600K to a dubious NYC fixer and confessed criminal, has a long history of turning a blind eye to all manner of frauds and cons being perpetrated on its own customers. Again, the message sent is: unethical behavior is okay when we do it.

Look, Huawei is no pillar of virtue, having been caught copying code and (depending on how the court battle goes) potentially violating sanctions. But a large portion of the justification for blacklisting them (in turn escalating an already troubling and costly trade war) is based on the idea that Huawei has been caught spying on Americans, something that hasn't been publicly proven. And in filings with the FCC (pdf), small carriers say they'll actively be harmed by a ban on this cheaper Huawei hardware, since the lower costs help them better compete with larger U.S. rivals.

In short, this subject is far more complicated than most press coverage suggests, and a little fuller context when it comes to discussing these moves doesn't seem like too much to ask. Especially given that the American press and government would be positively apoplectic were foreign countries to ban our own network gear as punishment for our own, well-documented sins. Patriotism oddly blinds us to our own hypocrisy on this subject, lending some wonderful cover to U.S. companies who've been pressing all the right buttons in DC in a protectionist bid to avoid having to compete with cheaper Chinese gear.

Filed Under: china, competition, donald trump, nsa, surveillance, telco equipment
Companies: cisco, huawei

When A 'Trade War' Involves Seizing And Imprisoning Foreign Execs, It's No Longer Just About Trade

from the it-kinda-leads-to-actual-wars dept

For years we've been writing about the weird US government infatuation with the Chinese telco equipment firm, Huawei. The company has built a widely successful business, but going back many years there's been a loud whisper campaign that the company's equipment would send information back to the Chinese government. Of course, when our own government investigated this, it could find no evidence at all that this was true. It also seems notable that Huawei itself asked for this investigation, claiming that it would clear the company's name, since it wasn't doing anything that people were accusing it of doing. This doesn't mean that the company isn't doing something nefarious, but such claims should have some sort of evidence to back them up, and so far they've been lacking.

Of course, this may have been one of those situations where people assumed that whatever we would do to others, others must be doing to us, because what we do know, is that the NSA broke into Huawei's computers and grabbed a bunch of emails and source code. That bit seems to get left out of all the fear mongering reporting about Huawei. Oh, and it later came out that much of the whisper campaign about Huawei spying for the Chinese government... originated from the US firm Cisco, which was seeing its market share eroded by Huawei.

So we've long taken the claims about Huawei with a large grain of salt, even as most in the media have been willing to repeat the allegations about Huawei without mentioning the lack of evidence, Cisco's involvement, or the fact that the US government swiped a bunch of stuff from Huawei, even though all of those things seem kinda relevant.

By now, of course, you've probably heard that Canadian officials arrested Huawei's CFO, Meng Wanzhou, who also happens to be the daughter of the founder, and there are plans to try to extradite her to the US. While no charges have been revealed, most people claim it has to do with violating US sanctions on Iran by shipping US made equipment to Iran. The details here will matter, but it's still incredibly unusual to have a friendly country arrest a top exec and then try to extradite them.

Even if the official charges have nothing to do with the ongoing trade war with China, as nearly everyone is pointing out, there's no way this doesn't create massive blowback on any new trade agreement. Remember it was just a few days ago (was it really just a few days?) that President Trump announced that he'd agreed to end the senseless trade war he'd started (which has created a massive import tax on American businesses and consumers). Of course, when the Chinese gave their version of the story, it sounded remarkably different than Trump's version.

But, at least it sounded like progress was being made, and maybe we could end the insanity. But, of course, by having an ally arrest a top exec, it's thrown everything up in the air. Imagine, for example, if Sheryl Sandberg was on a trip to Pakistan, and was arrested by authorities there and extradited to China to face criminal charges. That's kind of the equivalent of what the US has just done via Canada.

Then, take it a step further. White House officials have told the press that they believe Meng "could be used as leverage with China in trade talks," and you realize this has fuck all to do with Iranian sanctions. No, that's the White House more or less admitting that they've taken a hostage in a trade war. That's hellishly dangerous. Because China will not hesitate to retaliate. If I were an American business exec, I'd stay far away from China or any of its allies right about now.

Arresting an executive over such a thing, and then admitting you want to use her as "leverage," just as you're negotiating a complex trade deal is... the kind of thing that turns a trade war into an actual war. It's an incredibly dangerous move that should concern everyone.

Filed Under: arrests, china, donald trump, extradition, hostage, iran, meng wanzhou, surveillance, trade war, war
Companies: cisco, huawei

The FCC's Evidence-Optional Blacklist Of Huawei Is About Protectionism, Not National Security

from the evidence-schmevidence dept

Last week we noted that Best Buy was the latest to join a growing, evidence-optional blacklisting of Huawei based on ambiguous "national security" concerns. We also noted how despite a lot of hand-wringing on certain fronts for most of this decade, nobody has been able to provide evidence that Huawei actively spies on American consumers, the justification for similar blacklisting by AT&T and Verizon earlier this year (both bosom bodies with the NSA, it probably goes without saying). Few news outlets bother to mention an 18-month investigation found no evidence of wrongdoing by Huawei.

While it's certainly possible Huawei is embedding backdoors no security researcher has been able to ferret out, it's just as possible that we're engaging in good, old-fashioned vanilla protectionism dressed up as ambiguous national security concerns. As one anonymous source told the Washington Post during the last flare up of Huawei phobia, getting non-tech savvy lawmakers riled up on this subject isn't particularly difficult:

"What happens is you get competitors who are able to gin up lawmakers who are already wound up about China,” said one Hill staffer who was not authorized to speak publicly about the matter. “What they do is pull the string and see where the top spins."

There's a large contingency of folks who breathlessly profess dedication to free trade and open competition at every opportunity, yet can somehow pivot to protectionism on a dime -- despite criticizing China for doing the same thing. That apparently includes the FCC, which this week announced it would be joining the evidence-optional blacklist of Huawei by banning U.S. telcos from buying Huawei gear if they take taxpayers subsidies. From a statement by FCC boss Ajit Pai issued to the media this week:

"Threats to national security posed by certain communications equipment providers are a matter of bipartisan concern. Hidden ‘back doors’ to our networks in routers, switches—and virtually any other type of telecommunications equipment—can provide an avenue for hostile governments to inject viruses, launch denial-of-service attacks, steal data, and more. Although the FCC alone can’t safeguard the integrity of our communications supply chain, we must and will play our part in a government- and industry-wide effort to protect the security of our networks."

Again though, nobody has provided a shred of public evidence that Huawei routinely spies on American consumers. And the evidence that we do have routinely indicates that the United States is in no position to throw stones anyway. Edward Snowden documents revealed that not only did the NSA break into Huawei starting in 2007 to steal source code and implant its own backdoors, but that the agency also intercepted Cisco hardware en route for the same purpose. So again, the real message being sent here is that this kind of behavior is only acceptable if the United States does it.

In his statement, Pai declares that he's solely looking out for the welfare of the American public (you know, like he did during the net neutrality repeal), and that the agency will vote on the proposal next month:

"That’s why I’m proposing to prohibit the FCC’s $8.5 billion Universal Service Fund from being used to purchase equipment or services from any company that poses a national security threat to the integrity of communications networks or their supply chains. The money in the Universal Service Fund comes from fees paid by the American people, and I believe that the FCC has the responsibility to ensure that this money is not spent on equipment or services that pose a threat to national security. On April 17, I hope that my fellow Commissioners will join me in supporting this important proposal to help protect our national security."

But many small cable operators appear to see what this effort is really about. One Oregon cable operator told the Wall Street Journal this week that using Huawei gear saved them around $150,000 when they were trying to expand broadband into rural markets (something you'll recall Pai insists is a priority). They appear to be well aware that this effort is about protectionism and nationalism, not national security:

"“Our margins are pretty thin,” Mr. Franell said. “If you start dictating what kind of equipment I can use, it tips the scales.” He said he thinks the new legislation making the rounds in Washington is more likely driven by nationalism and protectionism than by real concerns about hacking and spying. ”I’m not going to rework my whole business plan based off a rumor or an unsubstantiated allegation,” he said.

Again, there's an ocean of ways China can (and does) spy on the United States without Huawei's help. Chinese hardware is literally everywhere, including in many of the products manufactured by U.S. companies. And given the fact that we're happily connecting security-optional internet of things devices to home and business networks like it's going out of fashion, there's ample opportunities to spy on Americans -- with Americans' oblivious enthusiasm.

U.S. networking and smartphone manufacturers are particularly afraid of losing ground to China in the race to deploy faster fifth-generation (5G) networks and handsets. But instead of competing, we're apparently going to double down on the argument that Huawei (and other Chinese network vendors) are rampant national security threats, while ignoring we routinely engage in the same or worse behavior (except with proof). It's protectionism plain and simple, but if you wave your hands hysterically and patriotically enough, nobody (including the American tech press) will apparently call you on it.

Filed Under: fcc, protectionism, security
Companies: cisco, huawei

Best Buy Bans Huawei Phones Despite Zero Public Evidence Company Spies On Americans

from the hypocritical-protectionism dept

A few years back, you might recall that there was a period of immense government and media hyperventilation over allegations that Chinese hardware vendor Huawei spied on an American consumers. Story after story engaged in hysterical hand-wringing over this threat, most of them ignoring that Chinese gear and components are everywhere, including in American products. So the government conducted an 18 month investigation into those allegations and found that there was no evidence whatsoever to support allegations that Huawei spies on Americans via its products. One anonymous insider put it this way at the time:

"We knew certain parts of government really wanted” evidence of active spying, said one of the people, who requested anonymity. “We would have found it if it were there."

What inquiries into this subject do tend to find is that U.S. networking companies like Cisco, terrified by the added competition from Chinese network vendors, are really effective at scaremongering gullible and non-tech savvy lawmakers into supporting a protectionist stance against Huawei. The hypocrisy of "protectionism is only bad when somebody else does it" is compounded by the fact that Snowden docs revealed that the NSA hacked into Huawei starting back in 2007 to steal source code and...plant backdoors in Huawei gear to spy on people around the world.

In an ideal world, numerous lessons would have been learned from this whole experience.

But this is America! Fast forward to the last few months, and the narrative of Huawei as a villainous, unchecked Chinese spying apparatus is once again all the rage, with nobody apparently heeding the lessons from just a few years ago. As we've been noting, both AT&T and Verizon (who not only help the NSA spy on everyone but have been caught giving advice on how to best tapdance around privacy and surveillance laws) were recently pressured to kill looming business deals with Huawei based on unsubstantiated, unpublished and vague allegations of spying.

While Huawei has some presence here (they helped Google build the Nexus 6P), they'd been making some solid inroads at AT&T and Verizon on deals that would have let them strike major smartphone partnerships. AT&T was just hours away from announcing one such deal at CES earlier this year, when it suddenly announced it would be scrapping the deal. AT&T didn't say why, but later reports indicated it was because of pressure from a handful of lawmakers on the Senate and House Intelligence Committees (again, AT&T has oodles of NSA contracts it would obviously like to protect).

Again though, nobody was able to offer concrete evidence of said spying, nor did anybody seem to remember we just went through this a few years back and found no evidence of Huawei wrongdoing. Fast forward to this week, when Best Buy announced it too would be banning Huawei products from its store shelves (warning: obnoxious autoplay video):

"Best Buy, the nation's largest electronics retailer, has ceased ordering new smartphones from Huawei and will stop selling its products over the next few weeks, according to a person familiar with the situation. Best Buy made the decision to end the relationship, the person said. "We don't comment on specific contracts with vendors, and we make decisions to change what we sell for a variety of reasons," said a Best Buy spokeswoman."

Few news outlets seem to spend too much time worrying about the fact that these decisions are being made completely non-transparently, with no hard evidence being offered to justify them. Again it's not impossible that Huawei helps the government spy, but given the volume and duration of these accusations, you'd think that somebody would be able to drum up a shred of public evidence supporting them. Regardless, protectionism is playing a pretty major role here one way or another, and you'd be hard pressed to find any American tech press coverage that so much as breaches that already documented reality.

While it's obvious that China spies on America, it certainly has an ocean of ways to do so outside of Huawai. Chinese hardware is utterly everywhere in America, including inside of most U.S.-made networking gear and smartphone hardware. And Americans also have a voracious appetite for internet of broken things devices, most of which lack even the most rudimentary privacy and security safeguards. Spying on us at scale doesn't really even require Huawei's help. We volunteer ourselves routinely for the duty courtesy of our collective obsession with "smart" televisions and other easily-hacked devices.

It's routinely amazing how the same individuals and organizations who preach endlessly about the need for healthy, open competition and malign China endlessly for protectionism, are suddenly OK when we're the ones dressing up protectionism under the thin veneer of national security. Similarly there's an endless roster of individuals engaged in all manner of face-fanning when foreign governments spy on us, but don't so much as blink when it's revealed we illegally hack into companies to plant backdoors or intercept U.S. networking gear deliveries for the same purpose.

And again, this hypocrisy is routinely made worse by a U.S. (and Canadian) tech press that's utterly oblivious to how nationalism skews their reporting and allows them to be easily manipulated by companies simply eager to avoid competition. If you're a tech reporter it is, shockingly enough, still your job to provide hard data--even when reporting on murky allegations against "enemies of the state" you may not personally be a fan of.

Filed Under: china, competition, moral panics, surveillance
Companies: best buy, cisco, huawei

CCleaner Hack May Have Been A State-Sponsored Attack On 18 Major Tech Companies

from the good-luck-out-there dept

At the beginning of this week, reports emerged that Avast, owner of the popular CCleaner software, had been hacked. Initial investigations by security researchers at Cisco Talos discovered that the intruder not only compromised Avast's servers, but managed to embed both a backdoor and "a multi-stage malware payload" that rode on top of the installation of CCleaner. That infected software -- traditionally designed to help scrub PCs of cookies and other tracking software and malware -- was subsequently distributed by Avast to 700,000 customers (initially, that number was thought to be 2.27 million).

And while that's all notably terrible, it appears initial reports dramatically under-stated both the scope and the damage done by the hack. Initially, news reports and statements by Avast insisted that the hackers weren't able to "do any harm" because the second, multi-stage malware payload was never effectively delivered. But subsequent reports by both Avast and Cisco Talos researchers indicate this payload was effectively delivered -- with the express goal of gaining access to the servers and networks of at least 18 technology giants, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself.

Cisco's researchers say they obtained a copy of the hackers' command-and-control server from an unnamed source. That server contained detailed logs of the 700,000 or so computers that had "phoned home" to the hackers earlier this month. Subsequent investigation has concluded that the hackers didn't really care about most of the infected customers, and that this may have been a sophisticated state-sponsored attack specifically designed access and copy internal information and trade secrets from major tech firms:

"That target list presents a new wrinkle in the unfolding analysis of the CCleaner attack, one that shifts it from what might have otherwise been a run-of-the-mill mass cybercrime scheme to a potentially state-sponsored spying operation that cast a wide net, and then filtered it for specific tech-industry victims. Cisco and security firm Kaspersky have both pointed out that the malware element in the tainted version of CCleaner shares some code with a sophisticated hacking group known as Group 72, or Axiom, which security firm Novetta named a Chinese government operation in 2015."

One configuration file on the attackers' server was also set for China's time zone, though of course neither of these are enough solid evidence to definitively conclude state-sponsored involvement... yet. In an updated post to its website, Avast has been forced to concede that their initial claim that the second, multi-staged payload was never delivered was false, and that the total number of compromised machines at these targeted companies is "at least in the order of hundreds":

"First of all, analysis of the data from the CnC server has proven that this was an APT (Advanced Persistent Threat) programmed to deliver the 2nd stage payload to select users. Specifically, the server logs indicated 20 machines in a total of 8 organizations to which the 2nd stage payload was sent, but given that the logs were only collected for little over three days, the actual number of computers that received the 2nd stage payload was likely at least in the order of hundreds. This is a change from our previous statement, in which we said that to the best of our knowledge, the 2nd stage payload never delivered."

Cisco also warned impacted tech companies that deleting the software itself off of infected PCs is no guarantee that the threat has been mitigated, since the payload may have installed a second payload on their networks with its own, still-active command and control server. Like previous attacks of this type, the reported scope of the sophisticated attack is likely to only grow as researchers dig deeper.

As several outlets were quick to correctly note the attack on CCleaner highlights a supply-side security problem at a growing number of software companies like Ukrainian accounting software MeDoc and South Korea-based firm Netsarang, which both passed on malware to trusting clients in the last few months. Traditionally we've comforted ourselves by insisting we're safe if we just avoid untrusted app stores, dubious attachments, or questionable links -- but this attack further up the software supply chain erodes public trust, which could deter users from using or updating essential protection.

Filed Under: ccleaner, corporate espionage, espionage, hacks, malware, piggybacking
Companies: avast, cisco