Tech giants flash Russia their code blueprints in exchange for access Cisco, IBM, HP, McAfee and SAP are among plenty of western technology companies that have been showing their source code to Russian authorities in exchange for the right to sell their products in the country. Documents seen by Reuters state that in the past three years, the Russian FSB (what used to be called the KGB) and its …
USA could certainly prohibit companies from showing Russians NSA source code, but when the code is not supposed to be there in the first place, I suppose that presents a logical conundrum. The original code could be clean, but spying could be present in firmware or software upgrades. I presume that the Russians are allowed to compile the source to make sure that it is byte-identical to the distributed code. I'm not sure that the clean room thing is much help. Russian "programmers" could memorize the code, even tens of thousands of lines, and reproduce it later. Hell, Britain has memorizers who could do the same. That's if you don't want hidden or skull-embedded cameras or screen sensing (which preceded wardriving as a hobby).
Putting aside attempts to game the outcome, I admire the Russians' chutzpah in calling the TLAs' bluff. It's a propaganda win for them, even if it has nil practical worth.
Looking for vulnerabilities their security services can exploit is almost certainly the real motive. The US should implement a similar policy against Russian software makers such as Kaspersky, which the heads of six U.S. intelligence agencies testified on Capitol Hill that they have treated the company as a threat.
"The enemy of my enemy is my friend."
If we assume that the NSA has already reviewed the source code and identified issues, then knowing that the Russians have reviewed the same source code may result in the NSA alerting developers to the bugs. Probably way too optimistic.
On a similar note, I suggest there is merit choosing security software that those you fear most have the least ability to influence. To put it another way would you prefer the local law enforcement agency to have your secrets or an overseas power?
To put it another way would you prefer the local law enforcement agency to have your secrets or an overseas power?
Naturally I would prefer neither, but if these are the only two options, then I'd go with an overseas power. At least they won't be bothered to use the information against me to settle a petty bar argument, or to track me down when my dog poops on the mayor's lawn. In fact an average bloke on the street has nothing to fear from an "overseas power" regardless of what they know about him.
... trying to protect themselves from our wholesale slurping of their data. The cheek!
Frankly, given that we know about the extent of spying and hacking by the US, Russians, British, Germans, Chinese, Norks, and so on, no sane country contemplating pursuing independent policies should use closed-source software supplied by companies outside their direct control. Even with code reviews, the truly sensitive data shiuld not be trusted to systems where you do not control all the components - both hardware and software.
Which is exactly why both Russians and Chinese do invest in developing fully-independent computing capability. And so they should; and bigger fools are those of us who do not do likewise and continue to rely unreservedly on systems developed by the US.
As noted above if you can't convert the source through the same tool chain and then do a byte for byte comparison, using your own comparison tools, and account for all discrepancies found then who knows what's actually running in the box?
And then of course there's the massive open hole of the Intel server admin co processor.....
... if you can't convert the source through the same tool chain and then do a byte for byte comparison ...
That's not a guarantee of anything in particular. If on the other hand, you can reproduce the binaries from a reviewed source using a cross-compiler under your complete control, you known that the backdoor is not in the source or the toolchain. However, this still does not guarantee the absence of a backdoor - it still could exist in the firmware, in the CPU microcode, or in one of the peripheral devices or controllers.
I somehow suspect that when Russian FSB reportedly switched to mechanical typewriters for their most sensitive data, the decision was not borne out of the idle paranoia.
At a government level, there is only one solution : download a Linux distro and compile the source code. That is the only guarantee against backdoors and other nasties.
For the life of me I can't understand why companies today keep with the Windows treadmill. Yes, historically I get it, Windows is everywhere and everyone is using and/or coding for that platform. But for today's companies, most of what they really need is on Linux, and what's left can just as well be coded for that platform instead of Windows, so why all the heartache over Windows ?
The only reason I see is that Windows is easy. Not in the sense that Linux isn't, but in the sense that the current managerial crop thinks it knows it, and then there's all that legacy environment. Okay for the business side of things, but government should not have that problem.
Should being the operating word.
"government should not have that problem.
Should being the operating word."
At a recent public sector role, raised the idea of using non-Windows machines for people whose primary applications were browser-based, and on a network where Citrix was already being used for delivering Office.
Was given a point blank "no", as it the screen "looks different, right from when they switch it on", it will be called a change and everyone affected would need a minimum half-day familiarisation course, with more for those who "feel they need" - and even that would only be allowed if the Union reps agreed it was not a material change in working practices. I thought that was an exaggeration, just one senior manager's view, until a member of staff walking past saw my demo desktop, and categorically (and quite emphatically) shared his view that "management ar*holes better not be thinking about changing our PCs unless they ask the unions first". (italics mine, his emphasis was more .... direct)
@AC: I always thought the public service was the last resting place of the useless c*nt. I have now witnessed this first hand by consulting in quasi public service organisations in order to help fix up their shit. The amount of piss poor excuses I have witnessed for not doing your job is seemingly endless. If they really dislike working so much they should quit. From "my machine looks different" to "has this been cleared with the union" to "I need a stand-up desk costing several thousand because old-mate over there has one". Utter mouth-breathing productivity detractors - like driving with the handbrake on.
of the likes of GCHQ and the NSA to hoard vulnerabilities that they find. The Russians, and likely other ''bad guys'', are probably going to find the same set of vulnerabilities.
If they really wanted to do their job of protecting us they would tell the vendor and we would all be a lot safer.
But, like every group of 'leet Black hats (and AFAIK they are all Black hats if they are trying to get into my system) they are totally convinced that no one is as smart as they are at finding these vulns.
Now I could see that if a group stakes out a specific piece of a system that most people haven't considered as a way in this might possibly be true.
But for all the common pathways is it really plausible that one side has developed vuln finding tools that are so much better than any other groups, even those who are also have state backing?
Just a small point. Every vuln the NSA finds in Windows reinforces Windows reputation as a safe OS.
While still leaving the Intel supplied gaping hole of the management server co processor in the ISP's they can attack with no credentials at will (provided of course no one else has got there first).
is one I asked (well, submitted on a card) at a talk given by Bill Gates. (it did not "make the cut" to be actually asked). He had mentioned giving Windows Source to the Chinese government, and I wanted to know if they had in turn ever submitted any bug reports. What's better than having _one_ TLA hoarding vulns? How about seven or more?
So American companies can sell their tech to Russia if they wish but I can't even send a second hand PSP to my Brother in Law in Moscow because the Spanish post office says it contravenes the rules of the trade embargo between the West and Russia.
My Brother in Law is a military engineer with the rank of Major so he is lkely to be a user of those products but can't play World of War while he's waiting for the bus?
PSP = Play Station, the post office requires a customs declaration form for Russia and likes to see what is in the packet before you seal it,anything they don't like won't be accepted.
Spain in general is unhappy with the embargo as prior to it they exported a vastamount of Agri goods to Russia, the embargo has cost Spain big time but PO workers are little jobsworths.
All government workers in Franco's Spain were expected to report on anything and everything they thought dodgy.
I have had the odd drink with the Commissioner of Police and used to know the Commissioner of the Secret Police on one of the Islands
1. Russian-"vetted" versions of Western software will have spyware, backdoors and security weaknesses identified and cleaned out.
2. Russian-reengineered versions of Western software will creep back to the West, riddled with Russian spyware, backdoors and sabots.
3. If software is selling in Russia, that becomes a sign it cannot be trusted in the West.
4. So we return to status ante: the only software anyone can trust is open-source stuff you can inspect and compile yourself.
5. The infotech equivalent of the condom!
Then again, that may change if more evidence of Russian involvement in government hacking comes to light. …. Iain Thomson in San Francisco 24 Jun 2017 at 00:57
Hmmmm? Hi, Iain, is that not more accurately reported …. Then again, that may change if any evidence of Russian involvement in government hacking comes to light.
Meanwhile ..... in the West are cyber shenanigans that feed hosts of trolls feted ....... http://www.zerohedge.com/news/2017-06-25/obama-ordered-cyberweapons-implanted-russias-infrastructure
IT's a Mad, Mad, Mad, Mad World and getting even crazier. You can be sure that there are greater things to be worried about than Russians.
> You can be sure that there are greater things to be worried about than Russians.
Britain's favourite pastimes are gossiping about the neighbours and criticising the Russians, not necessarily in that order.
Do you have many neighbours in Mars?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
