Slashdot Mirror
Lenovo Under U.S. Probe for Spying
BigControversy writes "The DailyTech has a report indicating that Lenovo, the giant Chinese PC manufacturer, is under a probe by the U.S.-China Economic Security Review Commission (USCC) for possible bugging. Apparently, the government has ordered 16,000 PCs from Lenovo but is now requesting that Lenovo be investigated by intelligence agencies. The fear is of foreign intelligence applying pressure to Lenovo to equip its PCs so that the U.S. can be spied on." From the article: "Despite the probe, Lenovo says that its international business, especially those that deal with the US, follow strictly laid out government regulations and rules. Lenovo also claims that even after purchasing IBM's PC division, its international business has not been affected negatively. Interestingly, in an interview with the BBC, Lenovo mentioned that an open investigation or probe may negatively affect the way that the company deals with future government contracts or bids." There just has to be better uses of our intelligence community's time.
Isn't this the perfect use of our intelligence community? I think this is a very valid threat from a community like China who has been known to have spies in the US at all times. (Not saying we don't spy back, but that's the game!).
A lot of federal agencies have policies about using foreign hardware/software for reasons just like this. Go USA!
This isn't much different than the Chineese Governments fear of backdoors placed in M.S. Windows by U.S intellegence. The shoe is on the other foot now.
Any built-in addition features in the hardware, the bios or
even the preinstalled operating system would be immediately
detected and destroy the entire PC business of Lenovo abroad.
Dell, HP, IBM, Apple, and many, many others are most of the time built right next to each other in China. I'd be willing to bet there isn't a single computer where every piece in it is made in the USA, or a US Friendly country (friendly by my definition = NATO)
As a rock-in-roll Physicist once said, No matter where you go, there you are.
Xenophobia.
I have nothing further to add, because that word sums it all up. While there are valid threats against the USA and in the intelligence community there are measures to tap into restricted data, they are NOT going to mess with PCs for fuck's sake! If someone has high security requirements that entity is not going to buy from a consumer level shop ANYWAY.
Geez.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
First off, they aren't under a "probe" for possible spying, despite what the article says. A "probe" would imply that somebody has reason to believe there is actually spying going on. Instead, this is a stupid "investigation" to ensure that there isn't, despite a complete lack of evidence saying there is. This is simple xenophobia, nothing more.
Do the geniuses that ordered this "probe" realize that the vast majority of components in a modern computer come from the orient? That it is VERY difficult to find a keyboard, mouse, case, or power supply that is NOT made in China? Do they know that many laptops (not Lenovo) are manufactured by Chinese-owned companies, and/or made directly in China itself?
The only thing that could be worrisome is if they had Lenovo handle the builds on the hard drives, but NO classified shop should be relying on "outside" builds anyway.
Do these folks ALSO realize that by law, no computer containing classified data may be connected to a public network of any kind? How is any "bugged" machine supposed to export the data? Osmosis? Telepathy?
SirWired
And you didn't install the OS yourself from something "known good" (or at least believed good, like a generic windows install CD bought at best buy or your other favorite local rip-off shop) you're an idiot.
Irrelevant.
BIOS has gotten to the point that it can "phone home" before you even get to the OS. A small modification to hardware or firmware can make it so the system inserts key packets into the network stream, sending covert messages out to the equivalent of electronic "dead drops".
We aren't talking about always-on-a-secure-network PCs, but laptops that'll be jacked into hotels, Starbucks and other insecure networks at some point.
Unless you jack those machines in behind a traffic analyzer/router that captures every packet, then analyze *each* packet that goes out of the machine, you'll never be 100% sure the hardware isn't trojaned.
Ping is nice and innocuous. Are you sure you know what that 56-byte payload contains? Have you ever looked? What about DNS requests? They happen ALL the time. Did you analyze each one to make sure they aren't requesting TXT-records that get forwarded over to a Chinese-owned server in the U.S.?
-Charles
Learning HOW to think is more important than learning WHAT to think.
Like it or not, we totally depend on other countries. I used to work on a military system that used tubes (valves for you brits). The tubes were no longer made in the west. The only source of the tubes was the USSR (with whom we would have been at war, if there was a war). If the third world war had lasted more than a month, we would have had to order spare parts from the Russians.
Mil Spec used to require second source suppliers for everything. That means every chip, resistor and capacitor. To do that now would require that several companies have the complete design of everything down to the last square mm of silicon. Such a policy would effectively prevent spying devices because many people would be able to examine the design. The same reason that open source is safer than Windows is the same reason that hardware designs should be open sourced (or at least second sourced).
BTW. You are absolutely right. Even friendly countries spy on each other. There was a story going around a while ago about an embassy had to be totally torn down because the local workers who built it had planted many microphones in it.
...are you going to find a collection of article summaries that:
1) criticize the United States for using it's intelligence resources to protect itself from a corporation operating out of Communist China.
2) criticize the US for not using intelligence resources "_enough_" to protect its ports/borders/etc.
3) criticize the US for using intelligence resource "_too_much_" by wire-tapping potential terrorists.
Go figure.
I read