STE WILLIAMS

Magic Quadrant for Enterprise Backup/Recovery

A military judge will deliver her verdict on Private Bradley Manning’s disclosure of secret Army documents to whistleblowing site Wikileaks later today.

Colonel Denise Lind will issue the verdict of the court martial at 1pm EDT (6pm BST) today, following two months of hearing evidence.

Manning has already pleaded guilty to ten lesser charges out of the 22 he faces, but could still go to prison for life on the remaining charges, which include aiding the enemy, transmitting defence information and violations of computer regulations.

The army analyst’s defence lawyer, David Coombs, has argued that Manning was “young, naive and good-intentioned” and leaked over 250,000 classified documents to spark public debate about US military and foreign policy, after disillusionment during his deployment in Iraq in 2009.

“I believe that if the general public… had access to the information… this could spark a domestic debate as to the role of the military and foreign policy in general,” Manning said in a long statement at the start of his court martial.

“I felt I accomplished something that would allow me to have a clear conscience,” he added.

But the prosecution team, headed by Major Ashden Fein, has said that Manning should have known, as an intelligence analyst, that the leaked files could be used by enemy organisations like Al Qaeda, and has accused him of harming national security and endangering people’s lives.

“This is a case about a soldier who systematically harvested hundreds of thousands of documents from classified databases and then dumped that information onto the internet into the hands of the enemy,” Captain Joe Morrow, one of the prosecuting officers, said at the start of the court martial.

Manning’s court martial and treatment since he was arrested have sparked controversy and his actions have divided opinion. While nearly 100,000 people have signed a petition calling for him to be awarded the Nobel Peace Prize, the US government insists that releasing the classified documents could have put the lives of Americans, foreign intelligence and diplomatic sources at risk. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/30/manning_verdict_expected/

Magic Quadrant for Enterprise Backup/Recovery

A cyber-jihad has erupted between groups of rival Islamic hackers in Bangladesh and Indonesia, resulting in attacks on hundreds of sites.

The rival hackers have abandoned their normal pursuit of Israeli targets and have instead turned on each other. It is unclear which side started the war, although the Bangladeshi group have accused Indonesia of supporting Israel, even though relations between the two countries are frosty at best.

A group called Bangladesh Grey Hat Hackers claimed to have hacked around 900 Indonesian sites and threatened to expand their assault to include ecommerce and financial sites. The full list also includes pet food sites, foreign embassies, and government websites. At the time of writing, loading up many of the sites resulted in a 404 error.

On the group’s Facebook page, a hacker called Rotating Rotor wrote an open letter to Indonesia, which we’ve rewritten slightly for the sake of clarity.

Earlier today, Rotor wrote: “Assalamu Alaikum. First of all take my greetings of Ramadan. As you all know we are in a cyber war with the hackers of your country. You guys only knew that we are defacing your countries sites.

“Now you can ask if we don’t deface Muslim’s sites then why we are attacking Indonesian sites? Believe me. We are forced to do so with your hacking teams, who wanted war with us several times before.”

The group have some “simple demands” which they have not yet announced. If these are not met, the hacking will continue for another six months, the group threatened. It claimed that five groups of Indonesians had carried out small-scale cyber attacks in recent months, eventually provoking a full-scale retaliation, despite repeated calls for peace.

Rotor added: “We are getting thousands of requests from many Indonesian’s to stop the attack. We feel hurt after seeing this. We decided to stop. But Indo Hackers defaced our sites again. Then we changed our mind and continue to attack.

“Right now we are just only defacing. If your Hackers don’t stop we are going to inject malware and viruses to all of your e-commerce sites and destroy your e-commerce system.

“We already gain access to many of your servers, We just observing your Hackers activities.

“Believe me, I swear. We have the capabilities to continue this war for minimum 6 months. We got access to your unlimited servers.”

On the page, there are also dozens of comments from people using the famous Anonymous Guy Fawkes mask as their profile picture.

One wrote: “The Zionists are laughing at us. Muslim vs Muslim. Better we all unite, not fight each other.”

Indonesian hackers also released a list of the Bangladeshi sites they have attacked in turn, which include religious courts and government websites, including the Presidential page.

We visited some of the sites on the list, which show a message that said: “Stop attack my country. Don’t touch my country Bangladesh. Fuck BD Gay Hay UR lamer. A little dog Murkho Manob was using message slander. Bitch dog really. YOUR MOTHER FUCKER!”

Murkho Manob is a Bangladeshi hacker who targets websites he claims support Israel. A quick Google search shows he has attacked the website of a British Thai boxing club and also a rather quaint-looking hotel, as well as Israeli websites.

We have written to both sides for comment, but they have not yet replied. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/30/cyber_war_erupts_between_india_and_bangladesh/

Magic Quadrant for Enterprise Backup/Recovery

+Comment The UK is failing to win the war on “e-crime”, according to MPs on the Home Affairs committee in its first ever report on online crime.

The committee published its “Report on e-crime” on Tuesday following hearings over 10 months, where the MPs heard from senior police officers as well as experts from academia, banks and the IT security business.

The committee appeared keen for banks, ISPs, search engines, social media sites and many other web-based businesses to start taking action against criminals operating online. The committee has advised that these companies apply filters, sort through content and report online crime to the police, among other things.

The comittee has also revived calls for a dedicated child exploitation prevention unit, an ISP code of conduct and an “IWF for terrorism”.

In the report, the MPs criticised banks for “simply reimbursing the victims with no pursuit of the perpetrators” for cases involving low-level credit card or electronic banking fraud. “Banks must be required to report all e-crime fraud to law enforcement,” it said.

Treat e-criminals like, er, criminals

The Committee called for the establishments of a “dedicated state of the art espionage response team” (the Mission Impossible squad, perhaps) to handle reports of suspected cyber-espionage from British companies, media, and institutions.

The Director of Public Prosecutions should review sentencing guidance to “ensure e-criminals receive the same sentences as if they had stolen the same amount of money or data offline.”

The elected representatives on the committee also want to see a much tighter internet filtering regime. “It is still too easy for people to access inappropriate online content, particularly indecent images of children, terrorism incitement and sites informing people how to commit online crime,” a statement by the Home Affairs Committee explains.

“There is no excuse for complacency. The Committee urges those responsible to take stronger action to remove such content. The Government should draw up a mandatory code of conduct with them to remove material which breaches acceptable standards.”

The government should look at setting up a similar organisation to the Internet Watch Foundation focused on reporting and removing online terrorist content, according to the 11 MPs who make up the committee.

The MPs also criticised a reduction in funding to the ‪Child Exploitation and Online Protection Centre‬ (CEOP) of 10 per cent over four years, as well as plans to merge the operation with the ‪National Crime Agency‬ (NCA), which is due to begin work in October. Plans to establish the NCA were first announced three years ago and cleared after the passage of the Crime and Courts Act earlier this year.

The ‘victims are hidden in cyberspace’

Committee Chair, Keith Vaz MP said: “We are not winning the war on online criminal activity. We are being too complacent about these e-wars because the victims are hidden in cyberspace.”

He went on to say: “The threat of a cyber attack to the UK is so serious it is marked as a higher threat than a nuclear attack.”

He added: “You can steal more on the internet than you can by robbing a bank and online criminals in 25 countries have chosen the UK as their number one target. Astonishingly, some are operating from EU countries.

“If we don’t have a 21st century response to this 21st century crime, we will be letting those involved in these gangs off the hook. We need to establish a state of the art espionage response centre. At the moment the law enforcement response to e-criminals is fractured and half of it is not even being put into the new National Crime Agency,” he continued.

Vaz, a supporter of homeopathy who previously ran a campaign against video game violence, wants to see tighter takedown laws in the hopes this will remove what he views as objectionable content from the web.

The tragic murders of April Jones and Tia Sharp have shown the terrible consequences of access to indecent images on the web. Young people are increasingly radicalised online by the words of radical clerics such as Anwar al-Awlaki on YouTube or internet magazine Inspire. What starts on the web, ends up on the streets of Woolwich. The Prime Minister was right this week to highlight the responsibility of the Internet Service Providers, search engines and social media sites. They are far too laid back about what takes place on their watch and they need to do more to take inappropriate content down. If they do not act, the Government should legislate.

Filters? No, it’s education that’s needed

Adrian Culley, global technical consultant at Damballa, who previously served with the Computer Crime Unit at Scotland Yard, said the report highlights the need for greater awareness of online threats. “Today’s report suggests we need a new approach to tackling the threats of e-crime. I’d argue that this means re-examining how we educate citizens to function safely, and with vigilance, in the digital society,” Culley explained.

“The fact is that our society – and a large part of the economy – is now digital.” Echoing the frustration of security consultants everywhere, he added: “Ultimately, there is no e-crime, there is just crime. There is no cyber Terrorism, there is just terrorism. There is no Cyber Warfare, there is just warfare.

“We all need to know how to be safe in our digital lives and a ‘cyber proficiency’ programme is now required to help empower people of all ages. The skill level must be raised across society, including for those officials tasked with responsibilities in these areas,” he added.

Comment

Arguing that the UK should roll back the clock and separate CEOP from the National Crime Agency is unlikely to go anywhere. Other recommendations such as mandating banks to report cybercrime are unlikely to be effective either, unless police are given the resources and training to investigate online crime.

Perhaps banks could do more to collate reports of small-scale fraud to help police gain a broader picture of trends and larger fraudulent campaigns that might otherwise go unnoticed.

The report also lacks a detailed critique of Action Fraud, the UK Computer emergency Response Team, GCHQ’s CESG or other relevant bodies in the fight against cybercrime and cyber-espionage.

Parliament’s Intelligence and Security Committee, by contrast, came up with a far more sophisticated review of the security threat landscape earlier this month.

In El Reg security desk’s opinion, statements by the Home Affairs Committee chairman fail to convince that the MPs have a clear take on what institutions are already in place and what the priorities ought to be in fighting cybercrime. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/30/ecrime_report_home_affairs_cmte/

Magic Quadrant for Enterprise Backup/Recovery

Back on 12 July, world media uncovered a minor sensation: Russia’s Federal Protective Service (aka Federalnaya Sluzhba Okhrany, Федеральная служба охраны or FSO in English) had issued a tender for typewriters to help keep its secrets, presumably since a typewriter can’t be hacked. As the tender came to light not long after Edward Snowden started divulging secrets, dots were joined to suggest Russia’s intelligence services were moving to a pre-PC world to enhance security.

A little delving into the tender, however, suggests to The Register that typewriters never went away at the FSO.

Here’s one example of the story, from The Guardian, which put it this way:

“In the wake of the US surveillance scandal revealed by the US whistleblower Edward Snowden, Russia is planning to adopt a foolproof means of avoiding global electronic snooping: by reverting to paper.

“The Federal Guard Service (FSO), a powerful body tasked with protecting Russia’s highest-ranking officials, has recently put in an order for 20 Triumph Adler typewriters, the Izvestiya newspaper reported.

“Each typewriter creates a unique “handwriting”, allowing its source to be traced, the report said.”

That story is still circulating, picking up various embellishments along the way, but something occurred to Vulture South: as far as we could tell, none of the stories in the Western media directly referenced any primary source.

The story referenced by The Guardian is here at Izvestia, or if you don’t read Russian, here.

(Either the original or the translation carries a howler, by the way, setting the value of the contract at 486 million roubles, rather than 486 thousand roubles.)

That, however, is merely a story about a tender that appeared on the government’s official tender site. Finding the tender took more work, but thanks to a Russian-speaking friend of The Reg it eventually turned up here (Google translation).

So what is The Register able to report, having found the original tender?

We can confirm that the FSO tendered for typewriters. The tender asks for 20 of them, as reported.

We can also confirm that the tender was issued after Ed Snowden’s revelations. But the tender documents, so far as we can tell after relying on web-based translation services, don’t mention typewriters as being acquired to enhance security. Reports suggesting this is the case only come from Izvestia, which says it has sources for the allegation.

There is no such discussion in the tender documents, which do contain remarks saying the FSO won’t accept electronic tenders. Might that have been conflated into the security angle?

We also know the tender has been won, by one “Marina V Zaika, solo entrepreneur”. Sshe’s done very nicely out of it: at 486,000 roubles for the whole contract, she’ll reap a cool 24,300 roubles for each machine. From our quick perusal of European office equipment sites, the Twain T180’s street price is currently around 125 Euros apiece, or about 5,500 roubles.

Perhaps the inflated price recognises that new Twain T180s might be hard to come by, a suggestion we make because the tender demands that they not have been manufactured prior to 2012.

Consumable clues

Another reason for the amount of cash on offer is that the tender also suggests, contrary to the widespread impression that the FSO is “reintroducing” typewriters, that they never completely went away.

How can The Register say this with certainty? Because the tender also seeks ribbons and correcting tape for a completely different model of typewriter from another manufacturer.

That model for which the ribbons are sought is the Olympia “Comfort”. Over at Olympia’s site, the “Comfort” isn’t mentioned as a product still on sale (but we are willing to concede the “Carera De Luxe might translate as “Comfort”.

Since the tender isn’t trying to buy Olympia machines but does seek consumables, we conclude the Comfort is already used within the FSO.

Perhaps the agency has used typewriters for years as a secure means of communications and, in a post-Snowden panic, has decided it needs more?

Whatever the reason, the amount of consumables ordered isn’t huge, and certainly not enough to see the FSO paying street price for the typewriters it wants.

For now, all we have conclusive evidence for is that the FSO is willing to pay a premium for some new Triumphs. That seems, to The Register, to warrant investigation on grounds of wasteful procurement alone, but regrettably The Reg lacks a Moscow bureau … ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/30/russian_spooks_never_stopped_using_typewriters/

Magic Quadrant for Enterprise Backup/Recovery

The official Twitter account of the Reuters news agency became a conduit for pro-Assad propaganda on Monday after the account was taken over by hacktivists from the infamous Syrian Electronic Army.

Updates supportive of Syrian president Bashar Al-Assad spewed from @thomsonreuters before normality was restored and the news agency regained control of the hacked account, the Wall Street Journal reports.

The compromised account was used to put out a series of propaganda messages and cartoons (captured in screenshots in a story by the Atlantic Wire here) in support of President Assad’s government.

Since March 2011, Syria has been embroiled in civil war. Uprisings against the Assad government have resulted in numerous clashes between rebels and the regime’s forces, which are supported by Hezbollah.

According to some security and human rights researchers, including InfoWar Monitor, the SEA has also been tasked with hacking and otherwise disrupting opposition websites within Syria itself.

Syrian citizens’ access to the internet has been cut off twice in the past two years: once in the second month of the civil war, and most recently as rebel forces fought their way into the capital city of Damascus at the end of last year.

Reuters is the latest in a long line of media organisations perceived to be pro-rebel or against the Assad regime to be pwned by the SEA. Previous victims include The Guardian, The Daily Telegraph, Al Jazeera and The Onion. An attack on the Associated Press in April was used to falsely claim the White House had been bombed and President Barack Obama injured, leading to a temporary dip in stock exchanges.

The group’s main stock-in-trade involves multi-stage phishing attacks ultimately aimed at taking over email accounts associated with social media profiles of targeted organisations.

Separately, unconfirmed reports suggest the SEA managed to take over three personal email accounts of White House employees. These compromised accounts were used to send secondary phishing emails, disguised as BBC or CNN articles, to other workers. Prospective marks who clicked on these links were directed towards fake Gmail or Twitter login screens in a ruse aimed at harvesting login credentials.

The hacktivists told E Hacking News that although their ultimate aim to compromise the White House website had failed, they have managed to compromise Twitter account passwords and Hootsuite accounts.

Twitter has suspended the group’s official account — @Official_SEA12 — following the SEA’s latest run of attacks on websites associated with VoIP apps Viber and Tango earlier this month. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/30/reuters_twitter_pwned/

Cloud storage: Lower cost and increase uptime

Microsoft is bringing more companies its threat sharing program and loading potentially dangeous items into its Azure cloud, despite past problems with security leaks.

The changes to the Microsoft Active Protections Program were announced by Redmond on Monday, and will see the company share critical security information with a wider pool of firms than before, while also spinning up a cloud service for profiling threats as they appear.

MAPP was created in 2008 as a way for Microsoft to share vulnerability information with security vendors in advance of patches.

With Monday’s announcement, the program has been split into three tranches: MAPP for Security Vendors, which is the traditional MAPP service, MAPP for Responders, which sees Microsoft foster communication between itself and incident response and intrusion prevention organizations, and MAPP Scanner, which sees Redmond use its Azure cloud to evaluate potentially harmful files.

Though MAPP has helped Microsoft share threat information with the wider technology industry, the program has had problems. Microsoft kicked Chinese MAPP partner firewall company Hangzhou DPTech out of the program in March 2012 after it was found to have been behind the leaks of a critical bug in Microsoft’s Remote Desktop Protocol.

MAPP for Responders will see Microsoft share threat intelligence rather than specific vulnerability information with security organizations such as response companies, CSIRTS, ISACS, and security vendors. The program will use the Structured Threat Information Expression (STIX) and Trusted Automated eXchange of Indicator Information (TAXII) specifications to share threat information.

Along with broadening information sharing, Microsoft is also putting Azure cloud to work via the MAPP Scanner program, which uses Redmond’s servers to scan Office documents, PDF files, flash movies, and URLS for potential malicious content. The tool is already used internally by Microsoft to identity new attacks and methods.

The scanner works by spinning up VMs for every supported version of Windows, and opens the content in all supported versions of the appropriate application, then looks for signs of a threat.

“MAPP Scanner can help find a known vulnerability and return the CVEs and affected platforms for that issue, while also flagging suspicious activity not associated with a known vulnerability for deeper analysis,” Jerry Bryant a Microsoft senior security strategist, writes in a blog post explaining the technology.

Redmond already has another Azure-based security service, via its Cyber-Threat Intelligence Program (C-TIP), which ingests and transmits data on infected Windows computers. Though the two systems share various characteristics, a Microsoft spokesman confirmed that they are run separately and indicated information is not shared between them.

Microsoft’s group manager for Response Communications, Dustin Childs, writes that the broadened MAPP schemes have been created to help Microsoft “eliminate entire classes of attacks by working closely with partners to build up defenses, making it increasingly difficult to target Microsoft’s platform.”

No mention was made in the report about whether MAPP information will or will not be shared with government organizations, such as the NSA. At the time of writing, Microsoft had not responded to multiple queries for further information about the number of MAPP partners and how threat information is being stored and transmitted within Azure. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/29/microsoft_mapp_security_program_expansion/

Cloud storage: Lower cost and increase uptime

Students from the University of Texas successfully piloted an $80m superyacht sailing 30 miles offshore in the Mediterranean Sea by overriding the ship’s GPS signals without any alarms being raised.

The team, led by assistant professor Todd Humphreys from UT Austin’s department of aerospace engineering and engineering mechanics, took a GPS spoofing device the size of a briefcase up to the upper deck of the White Rose of Drachs, a 65 meter luxury yacht owned by British property magnate Michael Evans, while it was in international waters en route from Monaco to Rhodes, Greece.

Having previously identified the location of the ship’s two GPS receivers, the team then oriented the briefcase towards them and began broadcasting false GPS data at low power. By gradually increasing the strength of their signals they were able to overpower the aerials and spoof the on-board navigation systems.

To turn the ship they then input a new signal indicating the ship was going off its logged-in course, which set off an alarm from the navigation computer telling the crew to change course. As far as the crew was concerned things were back on track, but the vessel was now heading off its original course.

“With 90 percent of the world’s freight moving across the seas and a great deal of the world’s human transportation going across the skies, we have to gain a better understanding of the broader implications of GPS spoofing,” Humphreys said.

“I didn’t know, until we performed this experiment, just how possible it is to spoof a marine vessel and how difficult it is to detect this attack. This experiment is applicable to other semi-autonomous vehicles, such as aircraft, which are now operated, in part, by autopilot systems.”

The experiment, which took place with the ship-owner’s permission, is part of continuing research by the team into GPS spoofing. Last year Humphreys demonstrated how the same spoofing technique could be used from 1km away against a GPS-guided drone to an audience from the US Department of Homeland Security at White Sands, New Mexico.

The demonstration got a lot of attention, coming after the Iranians showed off a seemingly intact US bat-wing RQ-170 Sentinel drone, which it claimed it had been hacked and hijacked by an army electronic warfare unit. These claims have been dismissed by experts, but fears of military hardware getting redirected or stolen are on the agenda, as well as being much-loved by screenwriters.

Before the panic starts, it should be pointed out that the Texans are spoofing civilian GPS systems. Cracking encrypted military signals has never been demonstrated, although jamming them is possible, and redirecting cruise missiles in flight will remain in the fictional realm for the time being.

In the case of the White Rose of Drachs hijacking, there’s also little need for concern. The ship carries a crew of 18 and no captain relies solely on GPS. Any significant course deviation would most likely be noticed by those on watch during regular position checks.

Nevertheless, the research by Humphreys and the US Austin team is interesting. Spoofing equipment is increasingly easy to get hold of and while Humphries claims to “owns the world’s most powerful civil GPS spoofer,” that should come with a caveat “that I know about.” ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/29/texas_students_hijack_superyacht_with_gpsspoofing_luggage/

Cloud storage: Lower cost and increase uptime

Symantec has plugged a series of critical flaws in its Web Gateway appliances which included a backdoor permitting remote code execution on targeted systems.

The flaws, discovered during a short crash test by security researchers at Austrian firm SEC Consult, created a means to execute code with root privileges – or the ability to take over a vulnerable appliance.

In an advisory note, SEC Consult Vulnerability Lab warns the flaws posed a huge spying risk to corporate users of Symantec’s technology, which is designed to prevent malware and other threats from getting inside corporate networks.

Several of the discovered vulnerabilities below can be chained together in order to run arbitrary commands with the privileges of the “root” user on the appliance.

An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (eg. Active Directory/LDAP credentials) which can be used in further attacks. Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if SSL Deep Inspection feature in use), including sensitive information like passwords and session cookies is possible.

If SSL Deep Inspection is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed/trusted on all workstations in the company. If this private key is compromised by an attacker, arbitrary certificates can be signed.

SEC Consult identified six vulnerabilities with the technology in total, including: cross-site scripting; OS command injection; security misconfiguration; SQL Injection; and cross-site request forgery flaws.

Symantec was notified about the flaw on 22 February but only published a security bulletin last week, on 25 July. Sysadmins should update their technology to Symantec Web Gateway version 5.1.1.

A vanilla statement from Symantec explained that the update was available to customers either directly or through its channel partners.

Symantec learned of potential security issues impacting the Symantec Web Gateway security appliance and has released an update to address them. Symantec Web Gateway 5.1.1, which fully addresses these issues, is currently available to customers through normal support locations. We encourage customers to ensure they are on the latest release of Symantec Web Gateway.

®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/29/symantec_web_gateway_vulns_fixed/

Cloud storage: Lower cost and increase uptime

Chinese PC giant Lenovo has been banned from supplying kit for the top secret networks of western intelligence agencies after security concerns emerged when backdoor vulnerabilities were detected, according to a new report.

Unnamed intelligence and defence “sources” in the UK and Australia confirmed to the Australian Financial Review that a written ban was slapped on the firm almost a decade ago in the mid-2000s. The timeframe offered matches Lenovo’s 2005 acquisition of IBM’s PC business.

Serious backdoor vulnerabilities in hardware and firmware were apparently discovered during the tests which could allow attackers to remotely access devices without the knowledge of the owner.

The ban applies to various agencies in the Five Eyes alliance (UK, US, Canada, New Zealand and Australia) where such rules are normally implemented across the board given the interconnected nature of some of their classified networks, AFR said.

GCHQ, MI5, MI6, the Australian Security Intelligence Organisation, the Australian Secret Intelligence Service, and the NSA were all named as participating in the Lenovo ban. However, it only applies to the most highly restricted networks and the Chinese firm remains a significant government IT provider to other government agencies in these countries.

The revelations will be a concern for private businesses just as the US Congressional report on Huawei and ZTE last year which branded these Chinese firms a national security risk.

It’s unclear whether the results of the government testing of Lenovo kit were ever shared with the private sector, although Lenovo’s position as the leader of the global PC market would seem to suggest not.

While the company is a global publicly traded business with headquarters in North Carolina as well as Beijing, its biggest shareholder is Legend Holdings, a firm which itself is part-owned by government body the Chinese Academy of Sciences.

There is also widespread suspicion in the West that even non-state owned businesses have close ties with Beijing through the ubiquitous Communist Party committees which operate within them.

Lenovo has sent The Reg a statement in response to the report that does not deny its accuracy, but offers the following:

“We have not received word of any sort of a restriction of sales so we are not in a position to respond to this question. As a result of the purchase of the IBM PC division in 2005, we have an excellent track record in selling into the public sector globally. Our products have been found time and time again to be reliable and secure by our enterprise and public sector customers and we always welcome their engagement to ensure we are meeting their security needs. We manufacture our products around the world including facilities in the US, Europe, Japan, Mexico, India, Brazil, Argentina and China and RD centres in Japan, US and China. We are a publicly listed, Fortune 500 company with significant leadership and operational resources in the US, as well as other markets around the world. We are very open, transparent and accountable to our public shareholders and a wide range of other stakeholders globally and have always met and exceeded government regulations in the 100+ countries in which we do business. We’re surprised by this development as Lenovo continues to have a strong relationship with all Australian government departments. Customer data privacy is a top priority for Lenovo across all customers groups. We are confident not only in our products, but also in the relationships we have with major customers in the public and private sectors around the world.”

The news comes a week after former NSA and CIA chief Michael Hayden argued in an interview with the AFR that Huawei represents an “unambiguous national security threat to the US and Australia”. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/29/lenovo_accused_backdoors_intel_ban/

Cloud storage: Lower cost and increase uptime

Apple’s developer portal came back to life over the weekend, eight days after it was allegedly taken down by a Turkish bloke.

The high-fructose computer company delivered its usual non-deluge of information about just what caused it to pull the site down last week. It’s being just as verbose with its news of how it was coaxed back into health and when full service will be restored.

An update page , says the company is working “to bring our developer services back online” and thanks developers “for bearing with us while we bring these important systems back online. We will continue to update you with our progress.”

Whatever the cause of the outage, it’s sever enough to mean not all Developer services can be restored at once. Apple’s Status page reports, at the time of writing, that only seven of fifteen services are live. That some of those listed as offline, such as “Technical Support”, can easily be explained by the fact this story is being written on Sunday night, Cupertino time. Not even fanboi developers want help at that time of week.

That the service’s forums are also down perhaps speaks of more serious problems. ®

Cloud storage: Lower cost and increase uptime

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/07/29/apple_developer_portal_partially_resurrected/