[autonomous]

“There is a huge, hidden near war going on, and the US is not doing well.”

A top Department of Homeland Security (DHS) official has admitted on record that electronics sold in the U.S. are being preloaded with spyware, malware, and security-compromising components by unknown foreign parties. In testimony before the House Oversight and Government Reform Committee, acting deputy undersecretary of the DHS National Protection and Programs Directorate Greg Schaffer told Rep. Jason Chaffetz (R-UT) that both Homeland Security and the White House have been aware of the threat for quite some time.

When asked by Rep. Chaffetz whether Schaffer was aware of any foreign-manufactured software or hardware components that had been purposely embedded with security risks, the DHS representative stated that “I am aware of instances where that has happened,” after some hesitation.

A directive, reported by Bloomberg, had gone out from the Commerce Department to large telcoms (Verizon and AT&T among them) demanding confidential information about their networks. Specifically, they were asked to divulge the extent of foreign-made equipment on their networks and to itemize security incidents, especially those pertaining to unauthorized hardware that redirected information to third parties.

The survey represents “very high-level” concern that China and other countries may be using their growing export sectors to develop built-in spying capabilities in U.S. networks, said a senior U.S. intelligence official who asked not to be named because he wasn’t authorized to speak on the matter.

Should we be heartened that the Obama administration is diving into this? At least some veteran spooks say we should hold the applause. “This administration is naive and weak,” emailed one.

http://www.internetevolution.com/author.asp?section_id=852&doc_id=236600

http://www.bloomberg.com/news/2011-11-30/obama-invokes-cold-war-security-powers-to-unmask-chinese-telecom-spyware.html

http://www.salon.com/2011/07/11/trade_terrorism/

[Fiddlerdave]

Gee, ya think?

Americans should simply assume EVERY piece of computer and IT hardware and relevant individual chips are loaded layers upon layers with back doors, from our own government as well as low level layers of access from the manufacturer, and anyone who care to pay the manufacturers or manufacturer's engineers some money to add back door.

Because the chances are VERY good they are. Why not? There is no downside. As a routine, nobody even CHECKS this stuff, probably not even in the military procurement channels! Commercial and business equipment? NO WAY, NOTHING is checked.

Just like Mattel toys that were obviously priced too low to have adhered to safety standards, the only concern is what is the lowest price vendor bid or the vendor who pays the best commissions to purchasing agents.

[Cloud9]

We are babes in the woods. When the Chinese are ready, they will flip a switch and the whole country will be sitting in the dark. I three weeks time the big cities will be eating themselves while China plunders the world for its remaining resources. Read Sun Tzu.

[basil_hayden]

The only thing that Chinese malware could infect would be our landfills.

[ColossalContrarian]

The only thing that Chinese malware could infect would be our landfills.

...that would be nice if it were true....the consumer hasn't thrown the gadgets away though so they're in our homes and on our person 24/7....

[Cloud9]

Have bought any computer chips lately? The chips in my tasco game camera came straight out of China.

[ian807]

All I can really say here is "Duh, no shit, sherlocks."

Unfortunately, the sherlocks happen to be the managers and CEOs of major electronics companies and the USA's military, trying to save a few bucks by buying off-the-shelf hardware from China and outsourcing code production to third-party companies who in turn outsource it to India and our buddy, Pakistan.

Outsourcing. It's plausible deniability on the cheap for everybody.

[autonomous]

We are babes in the woods. When the Chinese are ready, they will flip a switch and the whole country will be sitting in the dark.

Exactly right. It was reported in April 2009 that "hackers believed to be backed by the Chinese communist regime" had infiltrated computers critical to the functioning of the US electric power grid and deposited software that would allow them to "catastrophically disrupt service” when ordered.

The scale of this cyber-war is enormous:

In November 2010, a US Congressional advisory group reported that a Chinese state-owned telecommunications company had hijacked US Internet traffic. The incident occurred on 8 April 2010 and lasted for 18 minutes, during which time traffic was re-routed by China Telecom from major US Government and military Web-sites (including those of the US Senate and the Office of the Secretary of Defense) to China, where Chinese officials were able to monitor the traffic. The re-routed traffic amounted to about 15 percent of global Internet traffic.

Many gadgets you own are at risk for having pre-loaded Chinese malware:

Chinese manufacturers of electronic gadgets, such as iPods, digital picture frames, and navigation gear, have been found to have installed viruses in their products that subsequently send information back to Beijing.

http://www.securitychallenges.org.au/ArticlePDFs/vol7no2Ball.pdf

Paranoia is helpful here. I for one am switching everything over to security-enhanced linux for computer systems and routers. But it is very disconcerting to think that backdoors may exist somewhere in the actual hardware. The best thing to do is pull the plug on as much as possible until you get a better handle on what is going on.

[Loki]

The Chinese can pry my porn out of my cold, dead, sticky hands.

Seriously, though, the Chinese have been waging trade war on us for years, now they're waging cyberwar. And our "leaders" are aiding and abetting them at every turn.

Chickens coming home to roost I suppose (he says as he types on a "Made in China" netbook).....

[Keith_McClary]

Counterfeit electronics flood Pentagon supply

One day before a Senate Armed Services Committee hearing on the issue, Sens. Carl Levin, D-Mich., and John McCain, R-Ariz., offered details of the panel's ongoing investigation and described a deceptive process in which parts are burned off old circuit boards, washed in rivers, dried on streets and sanded down to remove identifying marks.
...
The investigators found that counterfeit or suspect electronic parts were installed or delivered to the military for several weapons systems, including military aircraft such as the Air Force's C-17 and the Marine Corps' CH-46 helicopter, as well as the Army's Theatre High-Altitude Area Defence (THAAD) missile defense system.

[Outcast_Searcher]

The scale of this cyber-war is enormous:

In November 2010, a US Congressional advisory group reported that a Chinese state-owned telecommunications company had hijacked US Internet traffic. The incident occurred on 8 April 2010 and lasted for 18 minutes, during which time traffic was re-routed by China Telecom from major US Government and military Web-sites (including those of the US Senate and the Office of the Secretary of Defense) to China, where Chinese officials were able to monitor the traffic. The re-routed traffic amounted to about 15 percent of global Internet traffic.

And so, to be careful, you can use things like 2K or 3K encryption keys with PGP to encrypt your sensitive documents. I routinely do this when sending my statements to my tax guy, electronically.

So, when I heard China did this, I was pissed, but I was not alarmed -- it's like I've locked my car, so they'll probably go looking for an easier mark.

Unless you believe all PC's are infested with so much malware that they can detect and grap EVERYTHING before it is decrypted, and send it to some secret base in China (without anyone noticing, of course) -- I think there is a bit of overreaction.

OTOH, with all the hacking, spyware, and general corporate indifference to security, I think anyone sending anything very sensitive in cleartext via email is COMPLETELY INSANE.

...

Now, as INCOMPETENT as our government is, it wouldn't surprise me if there were a lot of sensitive stuff in government-sourced emails. Which always amuses me that the left assumes that MORE government with MORE funding is the solution to ALL problems, but that's another story...

[Keith_McClary]

Unless you believe all PC's are infested with so much malware that they can detect and grap EVERYTHING before it is decrypted, and send it to some secret base in China (without anyone noticing, of course) -- I think there is a bit of overreaction.

OTOH, with all the hacking, spyware, and general corporate indifference to security, I think anyone sending anything very sensitive in cleartext via email is COMPLETELY INSANE.

I shopped for an antivirus for a Windoze PC (not mine ) and settled on Panda. Found out when the Visa statement came they're German - is that better than a USA company, considering the Patriot Act "Total Information Awareness" gives the USA gubmint and its 1% owners full access to your computer?
I could have got BKAV out of Vietnam.

[autonomous]

Handful of Chinese Hackers Responsible for Majority of Attacks

The Associated Press reports that analysis shows that the majority of attacks and intrusions emanating from China are conducted by as few as a dozen hacker groups, many in coordination with or under the direction of the Chinese government.

The report, titled Foreign Spies Stealing U.S. Economic Secrets in Cyberspace, states that many of the attacks carry tell-tale signatures of particular hacking groups being tracked by intelligence and cybersecurity teams in the U.S., contrary to many expert opinions which indicate that accurate attribution is nearly impossible if the attackers are savvy enough.

Nonetheless, the United States Office of the Counterintelligence Executive (ONCIX) recently released a report documenting the billions of dollars in intellectual property and classified information being lost every year to cyber espionage.

The report boldly suggested that state-sponsored entities in both China and Russia, among other offenders, are systematically targeting U.S. government and private sector networks in an effort to pilfer information that has tremendous economic value.

Foreign Spies Stealing U.S. Economic Secrets in Cyberspace

https://www.infosecisland.com/blogview/18683-Handful-of-Chinese-Hackers-Responsible-for-Majority-of-Attacks.html

Location of General Staff Department (GSD) in Beijing:
http://maps.google.com/maps?hl=en&ll=40.025072,116.237712&spn=0.002563,0.006539&sll=39.904214,116.407413&sspn=0.657366,1.674042&vpsrc=6&t=h&z=18

The GSD Third Department manages a vast communications intercept infrastructure and cyber surveillance system targeting foreign diplomatic communications, military activity, economic entities, public education institutions, and individuals of interest. The Third Department headquarters complex is clustered together with the GSD Operations Department, including its 24 hour watch center in Xishan Mountain, the Academy of Military Science (AMS), and National Defense University (NDU)

[Loki]

I shopped for an antivirus for a Windoze PC (not mine ) and settled on Panda.

Does software really matter when the problem may be hardware? I really have no clue, maybe one of the computer engineer geeks here knows? I reckon it's a combination of the two....

I've been running Linux (Ubuntu) for about a year now, haven't had any virus problems. But I ran Windows XP for years and only had a few minor viruses, mostly related to visiting "questionable" websites

[Keith_McClary]

We are babes in the woods. When the Chinese are ready, they will flip a switch and the whole country will be sitting in the dark.

Exactly right. It was reported in April 2009 that "hackers believed to be backed by the Chinese communist regime" had infiltrated computers critical to the functioning of the US electric power grid and deposited software that would allow them to "catastrophically disrupt service” when ordered.

You mean the USraelis stole the idea for the Stuxnet worm from China?

[Keith_McClary]

Does software really matter when the problem may be hardware? I really have no clue, maybe one of the computer engineer geeks here knows?

I'm sure companies are very careful what hardware and software goes into their products.

Today's Dilbert.

[autonomous]

China-based hacking of 760 companies an 'undeclared cyber cold war'

"They are stealing everything that isn't bolted down, and it's getting exponentially worse," said Representative Mike Rogers, a Michigan Republican who is chairman of the US Permanent Select Committee on Intelligence.

China has made industrial espionage an integral part of its economic policy, stealing company secrets to help it leapfrog over US and other foreign competitors to further its goal of becoming the world's largest economy, US intelligence officials have concluded in a report released last month.

"What has been happening over the course of the last five years is that China - let's call it for what it is - has been hacking its way into every corporation it can find listed in Dun & Bradstreet," said Richard Clarke, former special adviser on cybersecurity to US President George W. Bush, at an October conference on network security.

"Every corporation in the US, every corporation in Asia, every corporation in Germany. And using a vacuum cleaner to suck data out in terabytes and petabytes. I don't think you can overstate the damage to this country that has already been done."

http://www.smh.com.au/it-pro/security-it/chinabased-hacking-of-760-companies-an-undeclared-cyber-cold-war-20111215-1ovoq.html