Russia requesting to review source code of Western companies’ security products
reuters.com
reuters.com
The US has shown time and time again that it has absolutely ZERO morals with regards to monitoring/spying/breaking security products at whim, when it suits us, and often even when it's a REALLY bad fucking idea and everybody knows it.
The problem at the moment is that 'we' can't necessarily trust 'ourselves'. Paradoxically, having the Russians audit may make our products more trustworthy for our own use. See also Open Source.
Anyone should be able to request the source code. It doesn't matter if it's someone we trust or not.
You can probably include his network and the oligarchy in there, but the average Russian citizen shouldn't really have a problem with the U.S.
Before Putin started working on actively fear mongering, our relationship was good and trending upward. They have slightly different cultural values than us, but its nothing like it was in the cold war. Our interests are aligned on most significant issues for the average citizen.
If both our countries could get rid of their current leader we could quickly become allies.
I doubt that as a people Russians are any more "proud" than any other nation; such a sentiment reminds me of the age of Romanticism, when such kind of analysis of nations, or of national spirit, was commonplace. It is so very human (and so very superficial, too) to want to feel superior to or at least no worse than others, that states exploit this via propaganda. If people are being systematically told that they belong to a great nation (which defeated the Germans in WWII, or was the first to send a man in space, or has a magnificent cultural legacy in XIXth century writers, or has the second largest nuclear arsenal, or other such stuff intended to boost nationalism), they get "proud". When this propaganda stops, they go back to normal again.
As a people, rather than as individual people, it's quite plausible that one nationality would be prouder than another; strength and centrality of national identity isn't a universal constant.
Being proud as a people means, essentially, that the individual people have (compared to other groups of the same kind, in this case nationalities) the group identity as a strong/central feature of individual identity.
People in Russia, like in the US, frequently criticize the country as well as people. What they don't like, like people in US, is "others" criticizing their country and the people.
Citation needed.
I do it quite often. Daily in fact.
But Russia as a state is pretty much synonymous with Putin as a person, right now. Until that changes, it's splitting hairs.
It's kind of disappointing this isn't widely understood, but I guess politics gets in the way. Anyway, feel free to share this:
2014 report into ATP-28: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a..., presenting pretty compelling (if circumstantial) evidence that group is Russian state backed.
(July) 2016 report into the DNC hacking, showing it was first breached by ATP-29 (The other Russian state backed hacking group), but the leaks almost certainly came from a second breach by ATP-28 later: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
One can of course argue that this is all a conspiracy. However, the fact that this first report was publicly available in 2014 gives some protection against the idea that it is motivated by US internal politics, and the second was also before the election actually occurred.
CIA, FBI and NSA all concur, they all put out unclassified statements with their conclusions, although they obviously kept much of their supporting evidence classified.
Was anything not classified? I have trust issues stemming from an unnecessary war based on false premises when I was a child.
Most of my hesitation stems from a lack of information about it. "Russians hacked Podesta's emails and released them to Wikileaks."
"Russians hacked voting machines."
Those are very targeted statements, and I'd feel better about the whole thing if more questions were answered.
Have the hackers successfully been linked to the Russian Government? How?
How long has this been going on? Since before this election cycle? If so, why is it only now an issue worthy of public attention?
Have other Government entities, China, North Korea, etc, done the same?
Have we seen similar attacks from inside the US?
When we had the march to war in Iraq, suspect intel was being selectively and deceitfully pulled out of context specifically to build a case for war in Iraq. By politicians, not by intel professionals. A bunch of former intel people went on record calling BS on it.
Right now, nobody's making a case for war with Russia. Retaliatory sanctions at best. They mostly just want to harden our election process and systems to prevent it from happening again, or worse.
Yet we see constantly moving goalposts from people who don't want that hardening to happen. What's their motivation?
I don't believe there are any claims Russia successfully hacked voting machines (I may have missed developments in the last week though). I believe there are claims they did successfully attack voter registration databases, but there are no real claims (except by left-wing conspiracy theory people) that they changed those databases - just stole data. I believe there is no non-classified evidence of this though (although I didn't read the document that Reality Winner sent to the Intercept, so that may document some evidence).
China has a well known hacking group (ATP-1) - see [1] for further information. There is no evidence or real claims they are involved in political interference within the US. OTOH they are quite good at industrial espionage and tracking Chinese dissidents.
I'm not very familiar with North Korea's group, but it is widely believed to be responsible for the Sony hack. I found that bizarre, but NK actions often are.
[1] https://www.fireeye.com/content/dam/fireeye-www/services/pdf...
The Russians foolishly trusted the west. Look up the astonishing policies initiated by 'harvard economists' in association with the usual suspects IMF and World Bank that directly led to the loot of hundreds of billions of dollars of Russian state assets and the rise of the oligarchy to understand how obsessive self interest and sabotage operate. Putin exists for a reason. 'Trust' is a naive to dangerous idea in this context.
No one is a doe eyed innocent upholding some moral high ground in international politics, people who affect that should be treated with extreme suspicion.
WHAT will it take to end this tiresome, counter-productive, primitive tribalism, really?
If you think "untrustworthiness" is part of our fundamental animal instincts, then just look at how most cultures have managed to repress one of the most basic animal instincts – sex – through indoctrination.
Why can't the same be done for violence and maliciousness?
Check out the Green Sky Trilogy (aka Below The Root) books, which depict a world where pacifism has been more or less achieved, through teaching children to abhor violence the same way our world does for sex and stuff.
Transparency is a dependency of trust.
They are requesting source code from products originating from any country not equal to Russia, essentially.
So apparently they only trust their own morals, if those.
There's not fantastic "go so" solutions in every product category though. :/ Though, if enough US companies do decide not to do business with Russian, it might kickstart the filling-in of some the holes.
Firstly, they provide customers with all internal documentation on every single device, component, and software. Secondly, if the customer is still sceptical, they invite a team to Cisco HQ. They provide the team with a closed-room environment containing all source code (including HDL) for inspection. The customer can also bring their own devices to test the outputs against that of the reference device they are inspecting.
So, in the case of Cisco, I'm not sure why this is news, since this system has been in place since the Snowden leak.
> Despite the clear slant in this article to associate this with more malicious goals... This is an ENTIRELY reasonable request.
So does Russia and China. And given the fact Russia launched a massive cyber attack against the voting system and the DNC, the purpose of the request is certainly offensive in nature regardless of the excuses made.
Sorry but this is pure speculation ( or fake news if you like the term ) by CNN, MSN and WaPo. Show the proof if you have any.
This is to say: Russia has a powerful incentive to do everything up to and including manipulating foreign elections, but in the eyes of Putin it is sufficient to be seen to be manipulating foreign elections. Arguably, this has a greater effect on the capacities of his adversaries, because democratic systems don't really work without a general consensus that elections are legitimate. Russia does not want an alliance with a strong US and EU, they want no alliance with a greatly weakened US and EU.
This is the kind of thing we might never get objective proof of, hacking is too easy to cover up or contract out. In cases like this where not acting could be detrimental and we already have an enemy we were acting against attributing malicious activities to them is reasonable. Trying to screw with your enemy's government's transitions of power is a common tactic at least since the early cold war.
If you had asked me 5 years ago when relations were better and before Putin got all Ukraine and Syria crazy, I would have said "I don't know, it is too premature to act". But right now Russia feels threatened by us and sees weakness in our elections this makes them hacking us fit too well. With that being as close to proof as we are likely to get it is the information we have to work with.
"There's no doubt that some bad actors have been poking around," FBI Director James Comey told lawmakers Wednesday, without offering any more specifics.
He acknowledged there have been “some attempted intrusions at voter registration databases” since August, when the FBI issued a bulletin to state governments warning that hackers had infiltrated the Illinois State Board of Elections and tried to breach election systems in Arizona.
Are you kidding me? This has been known for months and is in declassified DNI reports.
https://www.dni.gov/files/documents/ICA_2017_01.pdf
> Cyber Espionage Against US Political Organizations.
> The General Staff Main Intelligence Directorate (GRU)probably began cyber operations aimed at the US election by March 2016. We assess that the GRU operations resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.
> Russia’s effort to influence the 2016 US presidential election represented a significant escalation in directness, level of activity, and scope of effort compared to previous operations aimed at US elections. We assess the 2016 influence campaign reflected the Kremlin’s recognition of the worldwide effects that mass disclosures of US Government and other private data such as those conducted by WikiLeaks and others have achieved in recent years, and their understanding of the value of orchestrating such disclosures to maximize the impact of compromising information.
> We assess Moscow will apply lessons learned from its campaign aimed at the US presidential election to future influence efforts in the United States and worldwide, including against US allies and their election processes. We assess the Russian intelligence services would have seen their election influence campaign as at least a qualified success because of their perceived ability to impact public discussion.
> Russian Cyber Intrusions Into State and Local Electoral Boards.Russian intelligence accessed elements of multiple state or local electoral boards. Since early 2014, Russian intelligence has researched US electoral processes and related technology and equipment.
> Public Disclosures of Russian Collected Data. > We assess with high confidence that the GRU used > the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in > cyber operations publicly and in exclusives to media outlets.
> Content that we assess was taken from e-mail accounts targeted by the GRU in March 2016 appeared on DCLeaks.com starting in June
Btw this is the GRU:
As you are a Russian, please provide me access to the GRU's classified intelligence and I'll happily enlighten you on what you want to know.
No?
Well, how delightfully odd that you cannot provide that information. It is almost as if intelligence gathering and the related evidence is frequently kept secret to protect methodology/sources while the end result of that intelligence is all that is made public for decades.
I'm curious, can you say anything negative about Putin in relation to his human rights violations?
http://www.independent.co.uk/news/world/europe/russia-ukrain...
https://qz.com/336047/an-appalling-list-of-human-rights-abus...
http://thehill.com/blogs/pundits-blog/international-affairs/...
https://www.hrw.org/world-report/2017/country-chapters/russi...
This is wrong (I mean not morally wrong, but rhetorically, or logically wrong) on so many levels that I don't even know how to begin. I guess I'll just leave it at that.
I totally agree with your point about intelligence being kept secret. Sadly, this is indeed the case. I do not invite US secret services to reveal their sources. I am only saying that if they choose to keep evidence secret, it is not reasonable then to expect people to believe them. In absence of evidence, there is no way of knowing whether you are being told truth, or deliberate lie, or anything in between. Like someone else in the comment above said, this is essentially a matter of trust. And frankly, secret services do not deserve our blind trust (no-one does, but especially not them, because misinformation is, by definition, part of their trade).
Let me be clear: I am not here to defend Russia, or Putin (I am sick and tired of our ossified, unchangeable government, but I prefer not to think about them too much; they are disgusting, like many other politicians, perhaps much more so). I am only trying to defend reason, and critical thinking, and the importance of making valid arguments.
And yet, the only time you demand proof is related to Russia and your account was inactive for over a month before that. You protest and deflect far too much for me to believe you are genuine.
Sorry.
> I totally agree with your point about intelligence being kept secret. Sadly, this is indeed the case. I do not invite US secret services to reveal their sources. I am only saying that if they choose to keep evidence secret, it is not reasonable then to expect people to believe them. In absence of evidence, there is no way of knowing whether you are being told truth, or deliberate lie, or anything in between. Like someone else in the comment above said, this is essentially a matter of trust. And frankly, secret services do not deserve our blind trust (no-one does, but especially not them, because misinformation is, by definition, part of their trade).
It isn't blind trust. Russia has an established pattern of behavior of such meddling in countries like Georgia, Ukraine, etc. as well.
http://www.nbcnews.com/storyline/hacking-in-america/timeline...
> May 2014: Three days before Ukraine’s presidential election, a Russia-based hacking group, took down the country’s election commission in an overnight attack. Even a back-up system was taken down, but Ukrainian computer experts were able to restore the system before election day. Ukrainian police say they arrested hackers who were trying to rig the results. The attack was aimed at creating chaos and hurting the nationalist candidate while helping the pro-Russian candidate. Russia’s preferred candidate lost.
> May 2015: German investigators discovered hackers had penetrated the computer network of the German Bundestag, the most significant hack in German history. The BfV, German’s domestic intelligence service, later said Russia was behind the attack and that they were seeking information not just on the workings of the Bundestag, but German leaders and NATO, among others. Security experts said hackers were trying to penetrate the computers of Chancellor Angela Merkel’s Christian Democratic party.
> December 2016: Earlier this month, BfV head Hans-Georg Maasen warned "There is growing evidence of attempts to influence the federal election next year," referring to German parliamentary elections likely to take place in September 2017. Maasen specifically cited Russia as the source of the attacks, adding, "We expect a further increase in cyber attacks in the run-up to the elections." Experts believe the Russians are trying to damage incumbent Chancellor Merkel, who supported sanctions against Putin’s personal associates after Russia annexed Crimea.
Are you saying the entire Western world is engaged in a conspiracy to blame Russia for cyber attacks against multiple countries, some of which include elections?
Because, either this conspiracy exists or the fact that Ukraine, Germany, US, etc. all come to the same conclusion is based on actual evidence.
Taking the tinfoil off, Russia is probably behind the attacks but espionage is all about using misinformation; so who knows. Without the methodology behind how they've determined Russia was behind those attacks, we can never know.
> Taking the tinfoil off, Russia is probably behind the attacks but espionage is all about using misinformation; so who knows. Without the methodology behind how they've determined Russia was behind those attacks, we can never know.
What would be the purpose in launching a cyberattack against Ukraine followed by essentially an invasion by another nation?
Who would benefit from Trump's election with nation-state like capability? Russia.
Who wouldn't benefit? Literally everyone else.
But sure, give me an alternative narrative that makes any kind of sense under your theory. I suspect you'll go with the China/TPP angle since its anything else. The problem with that is Clinton was also willing to drop the TPP. There isn't any other nation state with anything resembling a motive AND the capability.
EDIT due to rate limits:
> Do you know what the Russian defense was? It was the "who would benefit" argument.
Whatboutism. Thank you.
I'm well aware of what their defense was.
That doesn't change the fact this isn't one incident but a 10+ year pattern of behavior.
EDIT again:
> I have no political leanings, I'm neither American or Russian. Your biases are showing, w.r.t your hatred of Trump and your unfounded claim/assumption that Russia would benefit from a Trump presidency.
> Why does it matter so much who leaked the emails, rather than the content of them? If the DNC has nothing to hide...
1) That wasn't the only thing I mentioned. A list of war-like acts by a foreign nation isn't a partisan issue. (i.e. interfering with domestic elections is a war-like act)
2) Rather than meeting a challenge you know is impossible to meet (because there isn't an alternative villain that meets the scenario you propose) you chose to focus on attacking me. Cute but ultimately irrelevant.
3) Thank you for admitting the best defense you could compose was "WELL YOU ARE A DEMONRAT!" which is odd for a "Canadian". Good day.
4) As for the benefits, Trump wants to be friendly with Putin, keep NATO at arm's length, drop sanctions, etc. Its absurd to argue you he isn't a pro-Russian president.
Remember the downing of Malaysia Airlines Flight MH17 over the Eastern Ukraine in 2014?
Do you know what the Russian defense was? It was the "who would benefit" argument. Who would benefit from shooting down that plane, they asked? Why, the Ukrainians, of course — they would show the rest of the world what vicious monsters the pro-Russian separatists and their Russian overlords are. Who wouldn't benefit? Why, Russia of course! Don't you see, they said, what an outrageous provocation that is?
Well, as the time went by, it became almost certain that the plane was shot down by a Buk missile launcher, probably manned by a Russian crew, that had crossed the Russian-Ukrainian border some time before.
Incidentally, for that particular case we have a pretty convincing body of evidence. I encourage everyone to look at that particular incident and at the investigation that followed as an example of arguing a case.
> Whatboutism. Thank you.
I am sorry, but this is not a whataboutism (a logical fallacy so widespread that it is treated at length in Wikipedia). It is an illustration of the weakness of the _cui bono_ argument.
The irony is that if a Chelsea Manning/Edward Snowden character leaked the DNC emails people would be praising them for exposing the shitshow that was going on behind the scenes.
It kind of takes the heat off of the Dems, it wasn't them who were tampering with the election (which they were); it was the Russians!
Why does it matter so much who leaked the emails, rather than the content of them? If the DNC has nothing to hide...
> Sorry.
It's funny. We don't know each other; yet you actually had enough interest in me as a person (not in my words related to this particular discussion) to examine my commenting history at Hacker News and to come to a conclusion. Which is based on circumstantial evidence (my commenting history). And which — whatever opinion you may have formed of me — is most likely wrong.
As a programmer (not a very experienced one), I've been reading Hacker News for quite some time. I have always found discussions here interesting and instructive, unlike on any other internet forum that I know of. I have never had a reason to jump in and leave a comment until I saw someone's criticism of someone else's example of functional programming, which sounded to me laughably wrong. This is when I decided to actually register and leave a comment to that person. I just couldn't resist.
And then, a day later, I saw a very similar discussion about Russia hacking the U.S. elections. I had been following the analysis of this story in the U.S. media since the story broke out. I have been annoyed by how easily this story got woven into the mainstream narrative; how easily the stories about DNC hacks, Podesta emails, and Wikileaks became to be regarded as acts of aggression of one country against another. I was dumbstruck by how easily political motivations of making Russia (which is not a lamb, by any standard) into a scapegoat get overlooked (believe you me, our media has a very similar tendency of blaming various events, including the Ukranian revolution of 2014, on the U.S.). That's why when I saw a comment of an intelligent human being that expressed an idea that so much irked me, I left mine. That people see it as evidence of my hidden motives, is both sad and amusing at the same time.
I am not qualified to talk about Georgia, or Ukraine, or Germany. I am not following their news. I do not follow Russian news, for that matter, either (they are depressing and sickening). I am not saying that Russia is innocent of anything, and that the whole world is in conspiracy against it. I simply do not know. I am only focusing here on the recent story regarding the U.S. elections, and on the quality of arguments surrounding it.
P.S.: > And yet, the only time you demand proof...
I was not even demanding proof :-) I was merely pointing out that the document you quoted cannot be regarded as such.
It's reasonable of us to be suspicious of ulterior motives.
Modern day mexican standoff.
The affairs of state are never moral.
Kaspersky comes to mind.
http://www.spiegel.de/international/germany/german-intellige...
So how do the Russians know that the code they see is the one generating the binaries sold in Russia? This is where reproducible builds would help, but without source code it's hopeless. They should at least build the product inthe lab, make sha1 of every file and check if they match with the ones on sale. But then there would be an inspection before every release and patch.
Maybe this is more about training and retaining Russian tech talent, creating friction for foreign vendors, and spreading a proto-fascist FUD and distrust of governments all over the world.
Because yes, I would think inspecting binaries (probably secretly) would be more productive in pursuit of the stated goal.
"But those inspections also provide the Russians an opportunity to find vulnerabilities in the products' source code - instructions that control the basic operations of computer equipment - current and former U.S. officials and security experts said."
Hell, most corporations require high scrutiny for _any_ software, let alone security software.
"Microsoft lets EU governments inspect source code for security issues" [2015]: http://www.pcworld.com/article/2931212/microsoft-lets-eu-gov...
https://www.microsoft.com/en-us/sharedsource/
I wonder how people think you get military clients without allowing deep inspection of the product? Oh, yeah, sure just hook your "super secure, rushed-to-market black box" on the same network as our cruise missile targeting systems. We trust you.
If your product contains bugs it is up to you to fix them. If some "Russian hackers" can find them by looking at the code in a clean lab but you can't, well, you aren't supposed to be in this business.
At some point you have to trust your toolchain.
https://dl.acm.org/citation.cfm?id=358210
The system needs to be bootstrapped in such a way that the compiler can be trusted. This may include compiling e.g. gcc through a multi-stage process starting from a simple, easily-audited compiler with a small set of features and working your way up to a full-featured C compiler. It might mean double-compilation---comparing output from multiple compilers.
Combining that with reproducible builds, you can (one day) trust your toolchain and your system. Hardware is another story.
https://reproducible-builds.org/events/athens2015/bootstrapp...
Hopefully this will be all sorted out and standard practice in the near future.
For those who don't recall, one of the concerns was the government trying to compel Apple to make changes to iOS to permit brute forcing the San Bernardino attacker's PIN. This is a violation of First Amendment rights (compelled speech), so this drew a lot of opposition, including from people that are part of free software and open source communities. The alternative was to have the FBI make changes to the software instead of compelling Apple to do so.
For those who agree with the free software philosophy, it's important to remove consideration of _who_ is trying to exercise the four freedoms. In the case of the FBI, from a free software perspective, of course they should be able to modify the software---we believe that all software should be free. (But that doesn't mean they should be able to install it on _someone else's_ device.)
In this case, Russia doesn't have to ask to examine free software. And if they did, it shouldn't be a concern. Restricting who can use and examine software is a slippery slope:
https://www.gnu.org/philosophy/programs-must-not-limit-freed...
But not all software is free/libre. But by extending that philosophy---there would be no _ethical_ concerns with a foreign power wanting to inspect proprietary source code. But proprietary software might have something of concern to hide: it might be something malicious like a backdoor, or it might be something like a lack of security or poor development practices.
The negative spin put on asking to know how our devices work, and what they do, is frankly disgusting.
Edit: Is posting identical comments in identical submissions, where one submission is upvoted and the other buried, not allowed? What should one do instead, if one's opinion on the story hasn't changed?
Do they not ask to review source code of the tools they buy and use?
The idea that they're doing it to develop backdoors is at least sort of silly, on the grounds that they are perfectly capable of dumping the firmware of these boxes once they import one and developing exploits against the actual image. In fact, that's not even a "nation-state" level of capability, there are plenty of individuals who can and do accomplish that for merely "bug bounty" money. Given the restrictions they have at looking at the source code it's not clear to me that it's going to be much easier for them than just doing it based on firmware dumps.
Some would fight it tooth and nail, but it would be better for society. It would be end the idea of selling prepackaged software, but it would end whole categories of viruses and malware.
I was heading the team overseeing these tests for a large western European company.
The reviews are done on the customer's company computers, with no access to network. After that the Russians only get a hash of the binary compiled with the reviewed code, that's all. They then compare this hash to the sw they get (on firmware for instance) to make sure that it comes from the code they reviewed.
I am paranoid but this is a very reasonable requirement we do not, unfortunately, normally have in Europe for "friendly" software coming from "friend" US companies (and probably vice versa but I do not care that way). Snowden proved that the BFF approach does not work.
this is the biggest part of the article. If the Russians are trying to hack US govt/corps/people its really helpful to have the US security companies show how they check.
Think of the index of a reference book. Where every pertinent word is listed along with a page number. Imagine you wanted to read a complicated and meaniful book like Tolstoy or Kafka and really understand it. Walk away with a sense of exactly what it meant. To gain that understanding you only have an index and you had to reconstruct the book's meaning from there. Technically you can, but it is massively more difficult.
Edit: A more accurate analogy would be that you aren't even given an index of words, but an index of phonetic sounds that you have to piece together to create words.
Sure - it won't be easy and will come with other pitfalls, but in some circumstances these may be easier hurdle than waiting months/years for some government to approve your product sale.