US and Russia Open Talks On Limits To Cyberwar

andy1307 passes on this from the NY Times: "The United States has begun talks with Russia and a United Nations arms control committee about strengthening Internet security and limiting military use of cyberspace. American and Russian officials have different interpretations of the talks so far, but the mere fact that the United States is participating represents a significant policy shift after years of rejecting Russia's overtures. Officials familiar with the talks said the Obama administration realized that more nations were developing cyberweapons and that a new approach was needed to blunt an international arms race ... While the Russians have continued to focus on treaties that may restrict weapons development, the United States is hoping to use the talks to increase international cooperation in opposing Internet crime. Strengthening defenses against Internet criminals would also strengthen defenses against any military-directed cyberattacks, the United States maintains."

Comments

Here's a good first step ...

[ScrewMaster]

Stop buying networking hardware from China, and build (or re-build) domestic suppliers of such equipment. That applies to any nation that wants to maintain security: China has been abusing its position as a dominant hardware supplier for some time now. You can have all the network security in place that money can buy, but if the Internet-facing defenses have been compromised from the manufacturer you're pretty much screwed. Too much untrustworthy modified firmware has been coming out of China lately for me to place any faith in it. Well, all right ... I suppose that if the boards are made in China but a domestic vendor supplies the firmware locally it would be okay ... but that's not how it usually works.

Now, some of you may think that I'm picking on Chinese vendors ... and I am, but the criticism is well-deserved in this case. Not that I believe the individual manufacturers are doing this of their own accord, necessarily. But there's a lot of intrusion attempts coming out of that country, and you can bet the people behind it look at selling compromised hardware to other countries as a legitimate tool. How many of those attempts are successful because a firewall or router has hidden code in it I suppose we'll never know.

Re:Here's a good first step ...

[icebike]

Too much untrustworthy modified firmware has been coming out of China lately for me to place any faith in it.

Citation needed.

I don't doubt this is possible, but a network component manufacturer having product built in China is probably able to tell if the unit is not to spec.

China uses commodity chips, (some of which is also manufactured in China) but the finished product has to run the home manufacturer's software.

The assumption that the engineers that designed it couldn't tell if the the design has been altered and back doors inserted seems a bit of a hyperventilation to me.

Re:Here's a good first step ...

[easyTree]

If a 100k botnet attacks your site, how do you determine if they're the Russian military or a bored teenager?

var attacker = (benefitToForeignPolicyAgenda (russianMilitary) >= benefitToForeignPolicyAgenda (boredTeenager)) ? russianMilitary : boredTeenager;

Re:"In Soviet Russia..."

[lul_wat]

In Soviet Russia Government Cybers You ..wait that's a different kind of cybering

Re:"In Soviet Russia..."

[Shakrai]

Ah, I just can't do it. Can somebody else say it?

In Soviet Russia, meme fails you?

Corroboration?

[Anonymous Coward]

How the heck are you going to limit military use? This isn't like nukes where there are facilities to visit. I can't help but think that language is just smokescreen for the public, and this is really about cooperation on policing the internet. (Cue more secret talks ala ACTA.)

Re:"In Soviet Russia..."

[ZeroExistenZ]

In Soviet Russia Government Cybers You .

Putin: So.. then... I open my secret caves..
Obama: I didn't know you had a cave right there..
Putin: It's a wet one... for our underwater missile carriers..
Obama: Mmmmm my missile carrier is pretty long. My engineers are making it longer as I speak.
Putin: Once we reach the open ocean, all under water.. I launch my missile...
Obama: Make it glow, show me the money shot baby...
Putin: And it explodes, all over Norway... in mesmorizing blue light...
Obama: Oh baby... you almost really tore a new hole there, up in the atmosphere
Putin: The explosion was, sadly, premature
Obama: That's ok, I understand.