STE WILLIAMS

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Black Hat 2013 Researchers from Georgia Tech’s Information Security Center (GTISC) claim to have found a way to sneak a malware-ridden app through Apple’s inspection regime, and have also raised concerns about “malicious chargers” for iPhones.

The GTISC team explains its research here and claim to have created an app “which rearranges its own code to create new functionality that is not exhibited during Apple’s approval process. This allows the malicious aspects of the app to remain undetected when reviewed and therefore obtain Apple’s approval.”

The researchers claim to have published the app and that it “can successfully perform many malicious tasks, such as posting tweets, taking photos, sending email and SMS, and even attacking other apps – all without the user’s knowledge.”

The researchers also “decided to investigate the extent to which security threats were considered when performing everyday activities such as charging a device” and have created a “malicious charger” called “Mactans” to explore the issue.

The term is problematic on two fronts, the first of which is that the “charger” is not a charger but a single-board computer concealed within the carapace of a charger and packing software that allows it to rummage about in iOS’ innards and do nasty things to them. The team found users who connect to this device can have lots of nasty damage done to their phones, which is hardly surprising.

That such an outcome is possible is not welcome: whatever iOS flaws make it possible for a single board machine to do naughty things clearly need to be addressed. Whether it is useful for world+dog to have the term “malicious charger” enter the lexicon is a different matter.

Happily, the second problem with “malicious chargers” has already been addressed by Apple, which has been noted by those who saw the Georgia Tech team speech at Black Hat.

Just saw in press conference that Apple has neutered the Mactans rogue/malicious charger issue in iOS7… #BlackHat pic.twitter.com/V0dWSbDwZn

— riskybusiness (@riskybusiness) July 31, 2013

Apple’s pre-fix is a new iOS 7 feature that asks users if they trust the computer into which they have plugged their iThing. The Reg imagines that anyone plugging their high-fructose phone into a charger and finding that message would take a second, and far closer, look at their source of electrons before proceeding. ®

Magic Quadrant for Enterprise Backup/Recovery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/01/boffins_say_theyve_fooled_apple_with_malware_app/

Cloud storage: Lower cost and increase uptime

Black Hat 2013 Security researchers have developed a trick to take over Gmail and Outlook.com email accounts by shooting down victims’ logout requests – even over a supposedly encrypted connection.

And their classic man-in-the-middle attack could be used to compromise electronic ballot boxes to rig elections, we’re told.

Ben Smyth and Alfredo Pironti of the French National Institute for Research in Computer Science and Control (INRIA) found a way to exploit flaws in Google and Microsoft’s web email services using an issue in the TLS (Transport Layer Security) technology, which encrypts and secures website connections.

Full details of the attack are yet to be widely published – but it was outlined for the first time in a presentation at this year’s Black Hat hacking convention in Las Vegas on Wednesday.

In short, it uses a TLS truncation attack to block victims’ account log-out requests so that they unknowingly remain logged in at their PC: when the request to sign out is sent, the attacker injects an unencrypted TCP FIN message to close the connection. The server-side therefore doesn’t get the request and is unaware of the abnormal termination.

The pair explained:

In essence, we block encrypted messages that are sent over the network to de-synchronize authorisation: we force Gmail and Hotmail [Outlook.com] to display on your browser the page that announces that you have successfully signed-out, whilst ensuring that your browser maintains authorisation with Gmail and Hotmail [Outlook.com].

Given such an announcement, you should be assured that you are secure, in particular, a hacker should not be able to access your email, even if you [log out and] leave your computer unattended. However, we can violate this basic security premise and access your Gmail and Hotmail [Outlook.com] accounts just by reloading the web page.

The attack does not rely on installing malware or similar shenanigans: the miscreant pulling off the trick must simply put herself between the victim and the network. That could be achieved, for example, by setting up a naughty wireless hotspot, or plugging a hacker-controlled router or other little box between the PC and the network.

The researchers warned that shared machines – even un-compromised computers – cannot guarantee secure access to systems operated by Helios (an electronic voting system), Microsoft (including Account, Hotmail, and MSN), nor Google (including Gmail, YouTube, and Search).

“This blocking can be accomplished by a so-called ‘man in the middle’,” Pironti told El Reg.

“Technically, whatever piece of hardware is relaying data between you and Google could decide to stop relaying at some point, and do the [logout] blocking.

“In practice, this is very easy to do: with wireless networks (e.g. setting up a rogue access point) or with wired networks (e.g. by adding a router between your cable and the wall plug – alternatively this could be done with custom-built hardware, which could be very small).”

Block and tackle

Several attacks might be possible as a result of the vulnerability, according to Pironti.

“In the context of voting, a single malicious poll station worker could do the attack, voting at his pleasure for any voter. He sets up his man-in-the-middle, then waits for a designated victim to enter the voting booth. The man-in-the-middle device blocks the relevant messages. Then the malicious worker enters the voting booth (e.g. with the excuse to check that the machine is operational) and votes on the victim’s behalf.”

Webmail attacks on shared computers in settings such as libraries are also possible. An attacker simply needs to access a computer after a mark incorrectly believes she has signed out.

Unbeknown to the user, the hacker’s hardware will have blocked the relevant messages, yet the user must be shown what appears to be a “you’ve signed out” page – the core element of the con. After that, it’s easy for an adversary to use the computer to access the user’s email.

“We believe this [problem] is due to a poor understanding of the security guarantees that can be derived from TLS and the absence of robust web application design guidelines. In publishing our results, we hope to raise awareness of these issues before more advanced exploits, based upon our attack vector, are developed,” the researchers concluded.

The attack developed by INRIA is possible thanks to a de-synchronisation between the user’s and server’s perspective of the application state: the user receives feedback that her sign-out request has been successfully executed, whereas, the server is unaware of the user’s request.

“It follows intuitively that our attack vector could be exploited in other client-server state transitions,” Smyth and Pironti explained.

Mitigating the attack could be achieved by reliably notifying the user of server-side state changes. “Unfortunately, the HTTP protocol is unsuited to this kind of notification”, we’re told, so the researchers advocate the use of technologies such as the SPDY networking protocol and AJAX (asynchronous JavaScript and XML, a web development framework).

The two researchers shared their findings with Google and Microsoft; the web advertising giant acknowledged the discovery in its application security hall of fame.

Smyth and Pironti’s presentation of their research was titled Truncating TLS connections to violate beliefs in web applications. The researchers were able to exploit the Helios electronic voting system to cast ballots on behalf of voters, take full control of Microsoft Live accounts, and gain temporary access to Google accounts.

Subtle reasons make Microsoft’s webmail service more exposed than its Google equivalent, Pironti explained.

“Google happens to be less exposed for two reasons,” Pironti told El Reg. “First, our attack relies on a de-synchronisation at the server side: it happens that Google ensures synchronisation every five minutes, which makes our attack [only] work within this five minutes window. Second, Microsoft allows you to change your password without re-typing the old one, so once we access the user account, we can change its password and get full control.”

Pironti said the research didn’t look at other popular webmail systems, such as Yahoo!’s, so he can’t say for sure whether they are vulnerable or not.

“We suspect many other services are broken, but we didn’t look into details,” he said. ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/01/gmail_hotmail_hijacking/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Edward Snowden’s latest revelations about NSA snooping, the Xkeyscore program, have quickly been called into question.

While The Guardian correctly identifies XKeyscore as being a search tool for NSA databases (providing what the outlet’s Glenn Greenwald writes is an “ability to query the databases at any time”, which is pretty much what a database is for), Greenwald also conveys the impression that XKeyscore trawls all of America’s communications in real time.

That interpretation of XKeyscore is now being disputed by American journalist Marc Ambinder. Writing for The Week, he professes the opinion that Greenwald has misunderstood the function and the power of the tool.

Ambinder, co-author with DB Grady (nom-de-plume of David Brown) of the January 2013 book Deep State: Inside the Government Secrecy Industry, says he and Grady had already documented XKeyscore. From their research, he says, it’s clear that the program exists, is not as deep a secret as Greenwald believes – and that it’s an organisational and search tool rather than a collection tool.

“XKeyscore is not a thing that DOES collecting; it’s a series of user interfaces, backend databases, servers and software that selects certain types of metadata that the NSA has ALREADY collected using other methods. XKeyscore, as D.B. Grady and I reported in our book, is the worldwide base level database for such metadata”, Ambinder writes.

Ambinder also writes: “I quibble with the Guardian’s description of the program as ‘TOP SECRET.’ The word is not secret; its association with the NSA is not secret; that the NSA collects bulk data on foreign targets is, well, probably classified, but at the SECRET level.”

The Register notes that XKeyscore’s existence and some of its nature was described in 2010 in recruitment advertising on the K-Bar List, which describes itself as “a free veterans’ employment network”.

Those advertisements describe XKeyscore as being “deployed worldwide” and “incorporated into production architecture and used by analysts on a 24/7/365 basis”. Signal intelligence experience was on the “preferred list”, since applicants had to have “experience working with DNI [digital network information – Ed] SIGINT systems and an understanding of SIGINT data flow”. Applicants needed TS/SCI (top secret / sensitive compartmented information) clearance. ®

Magic Quadrant for Enterprise Backup/Recovery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/01/xkeyscore_leak_challenged/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Black Hat 2013 Security researchers have warned against the industry’s use of femtocells after successfully hacking into two popular models of femtocell, allowing them to intercept voice and SMS information from nearby mobile devices.

The exploit was detailed by iSEC Partners at the Black Hat conference in Vegas after being revealed earlier in July, and affects two femtocells used by Verizon and one repackaged Verizon box put out by Sprint which have already been remotely patched.

Femtocells are used to extend the range of broadcast signals in hard to reach places, and work by creating a secure IP-SEC tunnel between themselves and their carriers larger network. If signal is lacking or poor, then phones will automatically hop onto a nearby femtocell.

The researchers believe it is the first time an exploit has been disclosed against femtocells produced by US carriers. The exploit has been verified to work on 2009 SCS-26UC4 and a 2010 SCS-2U01 femtocell from Verizon.

The exploit saw the researchers gain access to the femtocells via interfacing with an HDMI port on the base of the device, then gaining root access to the stripped-down Linux system inside.

Once inside the system, they were able to implement methods for intercepting and decoding both voice and SMS track – data proved too difficult. They also developed a technique for cloning the phone, allowing people to surreptitiously listen in to calls.

Though these vulnerabilities have been subsequently patched, the researchers are not confident in the continuing integrity of the femtocell as an architecture. This is because the hardware can never be totally locked down by the vendor, and so there will always be some kind of exploit, they reckon.

“There are over 30 carriers worldwide who have femtocells,” Tom Ritter, a security consultant at iSEC Partners explained. “Clearly there are issues here. You could of course harden the actual device [but] there’s nothing you can do on the platform to prevent physical attackers getting in. There are lots of ways to break onto a physical device.”

Another route would be to have carriers mandate that femtocell users register expected numbers with the operator in advance, “but we don’t think it is enough,” they said.

They instead recommend the use of secured VoIP on WiFI, when out of tower range, or the use of secure end-to-end encryption via apps, of which ones made by Whisper Systems and Silent Circle would be examples.

“Really, you should be ditching them altogether. We’re just pretty nervous about giving random people like yourselves cellphone towers and [you] breaking into them.” ®

Magic Quadrant for Enterprise Backup/Recovery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/01/femtocell_exploit/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

D-Link has issued patches for a pair of its network video recorders after a Qualys analysis identified remote authentication bypass vulnerabilities.

The DNR-322L and DNR-326 recorders are midrange 4TB recorders which among other things can be used as recorders for the company’s IP cameras. As reported by PC World, Qualys also identified information disclosure and denial-of-service vulnerabilities.

An attacker could also perform a remote admin password reset on vulnerable systems, and push firmware into the machines without authentication.

The patches were issued by D-Link mid-July after Qualys notified the company of the vulnerabilities. The DNR-322L firmware patch is here, and the DNR-326 patch is here.

Qualys’ Bharat Jogi presented the vulnerabilities to the BSides Las Vegas conference. He told PC World that the Shodan search engine can locate “16,000 D-Link NAS and NVR devices connected to the Internet.”

The number of DNR-322L and DNR-326 devices (the units subject to the Qualys-discovered vuln) El Reg was able to find on Shodan is far more modest: fewer than 200. However, it comes as no surprise that other NVRs might also have vulnerabilities, or that there may be units exposed to the Internet but still carrying their out-of-the-box passwords. ®

Magic Quadrant for Enterprise Backup/Recovery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/01/dlink_patches_vid_storage_units/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Black Hat 2013 Security researchers have shown how hackers can use ad networks to create ephemeral, hard-to-trace botnets that can perform distributed-denial-of-service attacks at the click of a button.

In a presentation at the Black Hat conference in Las Vegas on Wednesday, researchers from WhiteHat Security showed off their technique, which uses iframes in web ads to call a JavaScript file that hammers a site with requests.

The exploit “forces JavaScript to use cross-origin requests to force as many requests as possible out of a single browser or a lot of browsers to a single website,” WhiteHat Security’s threat research center chief Matt Johansen said.

The company embedded JavaScript code in an advert that they ran on an unnamed ad network. This code pointed to an Amazon Web Services server on which they hosted the core JavaScript file, which they could then modify after the ad was deployed.

WhiteHat confirmed that the ad network did evaluate the code, but seeing nothing overtly malicious, permitted it to go ahead.

“We had kind of benign JavaScript here, but if you started using the evil ideas the code might start to look a bit suspicious,” Johansen said. “We didn’t dip our toe into the [ad] porn networks.”

The researchers’ code asked the browser to throttle up to its maximum amount of connections (six in Firefox, for example) and access the website via HTTP. They also demonstrated a workaround that can go above the browsers’ permitted number of concurrent connections by using an FTP request format, potentially allowing one browser to flood a site with concurrent connections.

This approach let the researchers deploy an ad that could automatically execute when served on a page and force viewers’ browsers to hammer a site of WhiteHat’s choice with requests.

“What’s the benefit of hacking this way – why not do a traditional DDoS attack?” asked WhiteHat’s threat research center manager Matt Johansen, who then answered his own question. “There is no trace of these. The JS gets served up, it goes away. It’s very, very easy.”

The only real way to trace this back to WhiteHat would be to go to the ad network and get the credit card used to buy the malicious adverts, Johansen said. As Reg readers will know, it’s not too difficult for hackers to illicitly and anonymously gain access to credit cards.

In a live demonstration, the researchers showed 256 concurrent connections to a single Apache Web Server, with over a million connections tracked in an hour. The total cost of the ads was lower than the cost of the Amazon instance used to serve the illicit JavaScript, and both only cost tens of dollars.

Next, WhiteHat plans to work with partners to deploy a version of the exploit that explicitly targets a site protected by a DDoS-protection service. They also plan to try and use the technique to run distributed MD5 hash cracking via a software tool such as Ravan. Previously, the same researchers have cracked open Google’s Chrome OS.

Much to the dismay of this ad-funded publication, the researchers plugged the use of ad blockers as one of the only easy ways to remediate this problem. ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/31/whitehat_security_ad_networks_botnet/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Black Hat 2013 NSA head General Keith Alexander believes the NSA’s data-slurping programs should “be something we put forward as an example to the rest of the world,” due to the oversight afforded by the courts, Congress, and the administration.

The spy chief made his remarks at the Black Hat security conference in Las Vegas on Wednesday, after a tough couple of months for the secretive organization during which mega-leaker Edward Snowden spilled the beans on telephony metadata collection programs in the US, content interception abroad via PRISM, and other schemes abroad.

At Black Hat, Alexander vigorously defended both the metadata interception via the authority provided by the Patriot Act (Section 215), and the Foreign Intelligence Surveillance Act (FISA, Section 702). He argued that the oversight afforded to the government, court, and administration concerning the schemes more than compensates for any potentially uncomfortable feelings people may have about privacy invasion.

Alexander’s disclosures came about due to the unprecedented intelligence leaks from Edward Snowden, a former Booz Allen contractor who had worked in the NSA. Last week Alexander said the Snowden leaks represented a “huge break in trust and confidence” between the NSA and its contractors.

“The tools and things we use are very much the same as the tools you use in securing networks,” Alexander said. “The difference in part is the oversight and compliance we have in these programs – that part is missing in much of the discussion.”

The general went on to discuss at length the immense oversight that NSA analysts are under, and stressed that very few within the organization have the ability to query the information slurped up by these programs.

He attempted to reassure a skeptical audience by saying “our people have to take courses and pass exams to use this data.” Data from the interception programs has “provided value” across some 53 “terror-related activities” detected by the NSA.

“Remember,” Alexander said. “Their intent is not to go after our communications, their intent is to find the terrorist that walks among us.”

Keith “break in trust and confidence” Alexander also tried to reassure people that the data being shared by Silicon Valley tech companies was not as great as that feared by the press.

“Industry just doesn’t dump stuff to us and say ‘Hey, here are some interesting facts.’ They are compelled by court order to comply where all three branches of our government have come together,” he said. Only 35 analysts within the NSA are authorised to run queries on user metadata, Alexander said, and there are 22 people within the NSA that can approve this.

“In 2012 there were less than 300 numbers approved for queries,” he said. “These queries resulted in 12 reports to the FBI. Those reports contained less than 500 numbers – not millions, not hundreds of thousands, not tends of thousands: less than 500.”

As for the mass interception of foreign national data such as emails and other content via the 702 program, Alexander said that Congress had reviewed this program over a four-year period and “found no willful or knowledgable violations of the law or intent of the law in this program.”

He also bridles at the way the FISA court has been portrayed as being a “rubber stamp” organization. “I’m on the other end of that table with federal judges, and anyone here who has been up against a federal judge knows these are people with tremendous legal experience that don’t take any – I’m tying to think of a word here – from even a four star general, he said. “They are not a rubber stamp.”

The immense oversight under which NSA analysts labor when investigating telephony or email data jars rather heavily with the “XKeyscore” program that was revealed by The Guardian on Wednesday. XKeyscore apparently lets analysts trawl an individual’s emails, social media activity, and internet queries, without the need for review by either a court or senior NSA personnel.

The XKeyscore system can be queried by name, telephone number, IP address, and keywords, and email address.

“Allegations of widespread, unchecked analyst access to NSA collection data are simply not true,” the NSA said in a statement to The Guardian. “Access to XKeyscore, as well as all of NSA’s analytic tools, is limited to only those personnel who require access for their assigned tasks. … In addition, there are multiple technical, manual and supervisory checks and balances within the system to prevent deliberate misuse from occurring

Near the close of his speech Alexander said “We stand for freedom.” A member of the black-clad, security-aware audience, however, took issue with that assertion.

“Bullshit!” he shouted ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/31/nsa_data_interception_black_hat/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

The cover has been blown on an NSA program which collects data on “nearly everything a user does on the internet” even as the debate rages over the secretive US agency’s mass surveillance of innocent people.

The XKeyscore program covers emails, social media activity and browsing history and is accessible to NSA analysts with little or no prior authorisation, according to a leaked presentation published by The Guardian today.

The slide deck, disclosed by NSA whistleblower Edward Snowden and published by alongside an accompanying story, was released just hours before NSA director General Keith Alexander was due to deliver an eagerly anticipated keynote presentation at the Black Hat security conference in Las Vegas.

The Guardian reports that the top secret National Security Agency program allows analysts to search through a database “containing emails, online chats and the browsing histories of millions of individuals”. In the leaked documents, the NSA describes XKeyscore as its “widest-reaching” internet intelligence system.

Targets data in transit

The release is arguably the most significant disclosure about the NSA’s web surveillance operations since the first revelations about the spy agency’s controversial PRISM web data mining program, which collected data from email, chat and VoIP. That program harvested information from users of services provided by Google, Facebook, Apple, Yahoo! and AOL, and was said to have been carried out with the indirect assistance of those companies.

While PRISM involves stored data, XKeyscore appears to involve mining through data in transit, either from the premises of a telco or through a fibre-optic tap. Leaked training materials explain how analysts fill in a simple online form before gaining access to data sorted by identifiers, such as target email addresses. Only a broad justification of the reason for a request, which is reportedly not subject to a review by any court or senior NSA personnel, is needed.

The Guardian reports that the leaked files provide substance to Snowden’s claims that while working as an NSA contractor he “could “wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email”.

He made those claims in a video interview in early June soon after he outed himself as the source of leaks about the NSA’s secret surveillance programmes.

Analysts can combine XKeyscore with data from other NSA systems to obtain “real-time” interception of a target’s internet activity, said the paper.

“XKeyscore provides the technological capability, if not the legal authority, to target even US persons for extensive electronic surveillance without a warrant,” said The Guardian‘s Glenn Greenwald.

They don’t even need to know who you are to track you down

According to the slides, spooks can query the system by name, telephone number, IP address and keywords as well as email address. Just searching by email address alone will not give a target’s full range of activities on the net, but a range of carefully selected queries are needed to prevent analysts being swamped with an unmanageable dump of information to sort through.

Spooks are advised to use metadata also stored in XKeyscore in order to narrow down their queries. Queries can be mixed and matched in order to try to pin down a group of suspects without even knowing targeting information, such as email addresses.

One example cited in the training document says that XKeyscore can be used to search for someone whose language is out of place in a region, or who is using encryption and “searching the web for suspicious stuff”. Another example states that XKeyscore is the only system that allows analysts to directly target traffic from “VPN startups in country X” to “give me the data so I can decrypt and discover the users”.

“No other system performs this on raw unselected bulk traffic,” the 2008 vintage training manual (marked “Top Secret” and apparently shared only with the NSA’s peers in the UK, Australia, Canada and New Zealand) explains.

XKeyscore also provides a means to index exploitable computers in a specified country, as well as a way of obtaining the email address of persons of interest using Google Earth.

One leaked document describes how the program “searches within bodies of emails, webpages and documents”, including the “To, From, CC, BCC lines” and the ‘Contact Us’ pages on websites”. XKeyscore also also allows analysts to pull together logs of the IP addresses of visitors to specified websites.

An NSA tool called DNI Presenter is used to read the content of harvested emails. The same tool enables analysts to read the content of Facebook private messages.

Content remains on the system for only three to five days, while metadata is stored for 30 days. One leaked document states: “At some sites, the amount of data we receive per day (20+ terabytes) can only be stored for as little as 24 hours.”

However, NSA systems allow flagged data on Xkeyscore to be moved onto other databases such as Pinwale, where material can be stored for for up to five years.

Despite the short shelf life of data stored on XKeyscore in one month last year, the system collected at least 41 billion total records.

NSA training manuals state that 300 terrorists have been captured using intelligence from XKeyscore before 2008, a factor that will doubtless be used to justify the program and criticise its exposure.

In a statement to The Guardian, the NSA said: “NSA’s activities are focused and specifically deployed against – and only against – legitimate foreign intelligence targets in response to requirements that our leaders need for information necessary to protect our nation and its interests.

“XKeyscore is used as a part of NSA’s lawful foreign signals intelligence collection system.

“Allegations of widespread, unchecked analyst access to NSA collection data are simply not true. Access to XKeyscore, as well as all of NSA’s analytic tools, is limited to only those personnel who require access for their assigned tasks … In addition, there are multiple technical, manual and supervisory checks and balances within the system to prevent deliberate misuse from occurring.”

The NSA statement continues: “Every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law.

“These types of programs allow us to collect the information that enables us to perform our missions successfully – to defend the nation and to protect US and allied troops abroad.” ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/31/prism_put_in_the_shade_by_leak_about_even_more_powerful_snoop_tool/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Update The Australian Department of Defence has issued an official statement denying it banned the use of Lenovo computers over concerns they contained backdoor vulnerabilities.

A report from the Australian Financial Review last weekend claimed that the ban applied to top secret networks run by the intelligence and defence services of the “Five Eyes” allies – US, UK, Australia, New Zealand and Canada.

the report claimed to have obtained confirmation of a written ban by “multiple intelligence and defences sources” in the UK and Oz, and further added that an Australian Department of Defence spokesman confirmed that Lenovo kit had “never been accredited” for such networks.

However, the DoD released the following short statement on its site today:

Reports published on 27 and 29 July 2013 in the Australian Financial Review allege a Department of Defence ban on the use of Lenovo computer equipment on the Defence Secret and Top Secret Networks.‪ ‪

This reporting is factually incorrect. There is no Department of Defence ban on the Lenovo Company or their computer products; either for classified or unclassified systems. ‪

That statement calls into question whether the other Five Eyes members ever had similar bans in place. GCHQ, MI5, MI6, the Australian Security Intelligence Organisation, the Australian Secret Intelligence Service, and the NSA were all named as observing the now-discredited ban.

The original report had claimed that serious backdoor vulnerabilities in Lenovo hardware and firmware had been discovered in testing in the mid-2000s – vulnerabilities which could allow attackers to remotely access a device without the owner’s knowledge.

For its part, Lenovo on Monday said it was surprised by the news as it has good working relationships with public and private sector clients around the world.

“We have not received word of any sort of a restriction of sales so we are not in a position to respond to this question,” it added. ®

Updated to Add

Of course the original report never said there was an Australian defence-department-wide ban on Lenovo kit, just that the secret intelligence and security agencies of the five Anglophone nations – many of which do not belong to their parent countries’ defence departments, in any case, but to other arms of government – do not use Lenovo equipment to handle highly classified data.

That fact is not denied by the Australian defence-department statement mentioned above, which contradicts an assertion that nobody actually made. The Register has since received confirmation that what was actually reported – that the allied security/intelligence community doesn’t use Lenovo gear to handle sensitive data – is correct.

As usual, the use of the term “factually incorrect” by a press officer has turned out to mean that the story was true. -Ed

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/31/department_defence_no_lenovo_ban/

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

The Australian Department of Defence has issued an official statement denying it banned the use of Lenovo computers over concerns they contained backdoor vulnerabilities.

A report from the Australian Financial Review last weekend claimed that the ban applied to top secret networks run by the intelligence and defence services of the “Five Eyes” allies – US, UK, Australia, New Zealand and Canada.

the report claimed to have obtained confirmation of a written ban by “multiple intelligence and defences sources” in the UK and Oz, and further added that an Australian Department of Defence spokesman confirmed that Lenovo kit had “never been accredited” for such networks.

However, the DoD released the following short statement on its site today:

Reports published on 27 and 29 July 2013 in the Australian Financial Review allege a Department of Defence ban on the use of Lenovo computer equipment on the Defence Secret and Top Secret Networks.‪ ‪

This reporting is factually incorrect. There is no Department of Defence ban on the Lenovo Company or their computer products; either for classified or unclassified systems. ‪

That statement calls into question whether the other Five Eyes members ever had similar bans in place. GCHQ, MI5, MI6, the Australian Security Intelligence Organisation, the Australian Secret Intelligence Service, and the NSA were all named as observing the now-discredited ban.

The original report had claimed that serious backdoor vulnerabilities in Lenovo hardware and firmware had been discovered in testing in the mid-2000s – vulnerabilities which could allow attackers to remotely access a device without the owner’s knowledge.

For its part, Lenovo on Monday said it was surprised by the news as it has good working relationships with public and private sector clients around the world.

“We have not received word of any sort of a restriction of sales so we are not in a position to respond to this question,” it added. ®

Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/31/department_defence_no_lenovo_ban/