Best Practice: Travel Light To China
Hugh Pickens writes "What may once have sounded like the behavior of a raving paranoid is now considered standard operating procedure for officials at American government agencies, research groups and companies as the NY Times reports how businesses sending representatives to China give them a loaner laptop and cellphone that they wipe clean before they leave and wipe again when they return. 'If a company has significant intellectual property that the Chinese and Russians are interested in, and you go over there with mobile devices, your devices will get penetrated,' says Joel F. Brenner, formerly the top counterintelligence official in the office of the director of national intelligence. The scope of the problem is illustrated by an incident at the United States Chamber of Commerce in 2010 when the chamber learned that servers in China were stealing information from four of its Asia policy experts who frequently visited China. After their trips, even the office printer and a thermostat in one of the chamber's corporate offices were communicating with an internet address in China. The chamber did not disclose how hackers had infiltrated its systems, but its first step after the attack was to bar employees from taking devices with them 'to certain countries,' notably China. 'Everybody knows that if you are doing business in China, in the 21st century, you don't bring anything with you,' says Jacob Olcott, a cybersecurity expert at Good Harbor Consulting. 'That's "Business 101" — at least it should be.'"
Read the subject line.
...if people traveling from Russia or China to here are told the same thing?
Good to see companies waking up to a very obvious threat. Next will be if they can figure out that sharing IP for a little bit of extra market share over there is NOT a good long term investment.
Since your laptop can be confiscated legally at the border.
DNA in your Linux: DNALinux
When there are risks of company devices being hacked and used to spy on corporate data, is it any wonder that many companies still refuse to allow personal devices to be connected to the company networks?
Still, you have to wonder how much of these issues are due to poor maintenance and management of the corporate infrastructure enabling the penetrations and attacks.
I've heard of ONE incident where a penetration was actually a zero-day exploit and did not happen because someone didn't upgrade a server or change passwords after employees left the company. 25 years. A quarter century. And only ONE incident that wasn't someone's failure to perform due diligence of maintenance?
That doesn't say much for North America's corporate security policies, does it?
I do not fail; I succeed at finding out what does not work.
This has been standard practice in many places for years. And not just when travelling to China. Even if you're not working with high value information, there's usually not any justification for taking equipment full of company information abroad.
My T510 Came from china in the first place...
This is done in every totalitarian country. For example, when David Smick was in Singapore, he called home and made a comment about being dissatisfied with the hotel room provided to him. When he was picked up the next day, the person "escorting" him apologized for his hotel room not being good.
Here in the States, we're monitored under the auspices of the "War on Drugs" or Terrorism or Child Porn or what have you. When folks say we live in a free country, I have to ask, "Is being monitored being Free?" The fact that I have to show id to buy suphedrine because a couple of addicts burnt their houses down is freedom? (As an aside, I live in white trash America and there has been maybe one meth lab in my area that has been raided in the last decade. One. But yet people and the police act like there's one on every block.)
In this day and age, the tin foil hat brigade are usually right
For this purpose notebook with ChromeOS (or ChromiumOS) seems like good solution.
839*929
Since your laptop can be confiscated legally at the border.
I'm not saying it's right for them to be able to do that but they do catch individuals engaged with corporate and even economic espionage that way. The key difference here is that it's intended to be an open action against you by US Customs whereas in China the intent is for you to never know anything happened and the key logger or stolen information being covertly used without your knowledge of who did it or even what's going on. I think one is much worse than the other but I guess that's just my opinion.
My work here is dung.
I read it as... laptop taken to China, infected with something which then wormed it's way into all the systems it could when reconnected to the corporate network, which happened to include some network controllable thermostats.
i.e. the Chinese aren't after the thermostat, it was just part of a system which got compromised.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
If you travel to China, this is old news.
Yes, some businesses are beginning to require wiped travel laptops for entering the US. I have to say that I do not know anyone personally who has had laptop issues at the US border (although I know that there are some people who are on some sort of list and have them frequently). The assumption is, if you go to China, you will probably be hacked, and it's not going to happen at Customs.
By the way, in my experience Chinese firms are incredibly paranoid about this, much more so than US firms. I suspect that paranoia has some justification.
Sigh.
Cue all the "BUT THE US IS WORSE THAN CHINA!" posts. You should log off WoW and read a little on Amnesty International about China. Could the USA do much better? Absofreakinglutely - But I can tell you as a Canadian business traveller that the USA is orders of magnitude less intrusive when it comes to visitors to their country. The next time you're in China go try to surf Tibet videos on Youtube and let me know how that goes for you.
Stop doing businees in and with China, entirely. /radical concept I know.
Bring manufacturing and jobs back to your home country/state and improve your own damn economy.
So rise up, all ye lost ones, as one, we'll claw the clouds.
So take a laptop filled with misinformation, science fiction, and totally bogus stuff. If enough people do this, your adversary will bankrupt himself trying to figure it all out. Extra points for the size of the server farms you can get trying to decrypt output from /dev/random.
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
China is 1.5 billion people. all of anglosphere and europe AND russia combined, cannot match that market. and its a growing market. not a saturated one.
Read radical news here
The lesson to take from this is: don't store valuable information on your thermostat.
China is 1.5 billion people. all of anglosphere and europe AND russia combined, cannot match that market. and its a growing market. not a saturated one.
China as a nation has a big GDP yes, but the per capita GDP is right down there with the Dominican Republic. There are a lot of people in China, but as a market western companies can only target the relatively small subset with relatively large disposable incomes. All of the migrant workers etc need their money to eat and clothe themselves and don't have much left over. Also you need to bear in mind that the rules aren't the same across China, some businesses are only possible in the Special Economic Zones. The other big problem is it is really hard to judge how big the market is, the only accurate figures are a state secret and that makes a lot of businesses nervous.
a fancy thermostat and a printer would both have a web interface panel, if the firewall did not isolate those devices from outside http requests both could have been being accessed from china without compromising anything, for that matter it could have been one of their own people tried to print something while they were in china, and that put the printers address in memory with the great firewall, and chinas security guys were following up (probably automated but sometimes china will do things manually that really need not be) to check if that address was some kind of proxy system.
Snowden and Manning are heroes.
Not only just another windows box, but a windows box that cannot be upgraded without violating the extremely expensive software support contract. ... the stereotype is if there is an expensive support contract, that machine is gonna get owned.
Seen this happen with numerically controlled machine tools, PBXs, some internet accessible "software as a service" type of apps, some weird embedded stuff I don't think I can talk about
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Okay. Erm...good for you? Would you like a cookie?
Nato has been an espionage networ that is called echelon for around 2-3 decades, and its now publicly acknowledged. i have a hard time believing that u.s. did not use the non-military information it intercepted through that or other means, for the benefit of its own corporations - the very corporations which back governments into power there by the way.
Its naive to think that way. abusive parties abuse power, public or private. the only difference in between the chinese and what goes on in the west, is probably chinese do not care much to put a storefront up.
Read radical news here
His phone probably doesn't accept cookies. ;-)
Lost at C:>. Found at C.
Those who RTTFA (read the third fine article) may have noted the discrepancy between what Mr. Mark Bregman of Symantec does when he travels to China, versus what he sells to the rest of us: he uses a dedicated laptop for China trips, and wipes the device before and after travel. On the other hand, he defends farming out coding to China based on 1) all the big s/w vendors do it, and 2) why worry about malicious code from China, when there have been terrorist attacks on the US committed by US citizens?
Rebuttals, off the cuff:
1) Evidently, capitalists don't just sell the rope that hangs them, they'll also teach you how to tie the noose.
2) Timothy McVeigh and 8 "pro-life" murders over the course of 20 years, vs. opportunity to open back doors into virtually every PC in the United States. I think we need to check whether Mr. Bregman has registered as a lobbyist for the China Central News Agency.
Luke, help me take this mask off