Slashdot Mirror
Several Western Govts. Ban Lenovo Equipment From Sensitive Networks
renai42 writes "If you've been in the IT industry for a while, you'll know that Lenovo's ThinkPad brand has a strong reputation with large organisations for quality, dating back to the brand's pre-2005 ownership by IBM. However, all that may be set to change with the news that the defence agencies of key Western governments such as Australia, the US, Britain, Canada and New Zealand have banned Lenovo gear from being used in sensitive areas, because of concerns that the Chinese vendor has been leaving back doors in its devices for the Chinese Government. No evidence has yet been presented to back the claims, but Lenovo remains locked out of sensitive areas of these governments. Is it fearmongering? Or is there some legitimate basis for the ban?"
Thinkpads are very popular with people who need to do their own maintenance. They use them on the ISS for that very reason. Every part is replaceable and you can download a full service manual with excellent step-by-step illustrated instructions.
Sounds like fear of the boogyman and a bit of racism are really going to hurt the US in the long run.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
So I wonder which manufacturer that doesn't use Chinese components they'll use instead?
Windows can be very solid with some tweaking and only running trusted apps. It's when you open it up to third party software and drivers that haven't been thoroughly tested that you really run into issues. Sure, it's possible to get a BSoD regardless of what you do, but it's also possible for Linux or OSX installs to break too.
Costs are higher, but Americans are being employed and paid with tax money. Sounds like a better approach than shipping it directly to someone else's economy.
The problem is the credible fear of a lifecycle attack is sufficient to require that such hardware be avoided. There is a reasonable fear that the chinese might try something using Lenovo kit, therefore the classified networks need to avoid it. Its the same reason why Huawei networking hardware is avoided in some circles.
Of course, with the NSA now clearly off the leash, US IT equipment is now in the same position. Microsoft clearly backdoored Skype to enable easy wiretapping, the NSA is reportedly hacking foreign networks to introduce monitoring (who knows, perhaps it was the NSA responsible for the Athens Affair?), and with any US Cloud service provider subject to PRISM-style requirements, US IT infrastructure is now in the same boat that the Chinese have been struggling with for years now.
Test your net with Netalyzr
The new cold war will be electronic and China has already proven that they are willing to do whatever is necessary to stay ahead there.
This isn't racism, this is a forward looking policy that's saying when, not if but when, we start finding Chinese backdoors in our equipment, they won't be in our sensitive areas.
The down side is that even if our equipment says made in the USA, it means assembled. Most of the parts will have been manufactured in China.
Just because there's no evidence doesn't mean something isn't true. There's no evidence of life currently on Mars, but that doesn't mean there definitely isn't life on Mars. A lack of evidence just means a lack of ability to prove something one way or another.
They're only worried about back doors, not back windows. There's no way the Chinese could sneak fat American secrets out through a window.
Most of that 200MB has nothing to do with drivers. Do what anyone in IT does if that 200MB download is the only driver package available... download it, open the executable up with your favorite ZIP program and extract just the folder containing the actual print drivers. You don't need the rest of the software for printing.
Unlike most US companies, The Chinese government owns the largest share (38%) of Lenovo's parent company Legend which owns the largest share of Lenovo (34%).
FYI it was the British and Australian defense and intelligence communities that discovered malicious modifications to Lenovo's circuitry. Just in case you actually believe that the US intelligence was proactive for once, it was the British intelligence findings that encouraged congress to react.
The official statement is as follows:
[REDACTED]
The motherboard may be made in China but the components are not. The chips are largely American in manufacture (most of them are Intel). Now I suppose the company making the motherboards could add a chip, but, well, that would kinda be noticed during the QA process by the company that ordered them. It isn't like you get parts from a Chinese manufacturer and just slap them in a unit sight-unseen. Not because of worries about spying but because quality control with Chinese companies can be... problematic. You have to test the parts and send back the failed ones (1%ish usually, sometimes more).
In terms of BIOS/UEFI? That's all Phoenix Technologies and American Megatrends. They are in California and Georgia respectively.
There isn't a single US manufacturer of motherboards any more; that would be the most sturdy place to insert any nefariousness (at least, nefariousness by the PC manufacturer.) Who knows where BIOS code is written these days; but I doubt it's the US.
Not to mention the whole stack of drivers you need, like those for on-board peripherals. It'd be just as easy to put a back-door in a Windows I/O driver as it would the BIOS.
There are a number of reasons that this might not be the solution. The biggest of which is it is a lot cheaper for the DoD to say no Lenovo equipment in a sensitve system than to commission faraday cages for every sensitive experiment or environment.
Well now, it's been my keen observation over the years that people suspect of others the same nefarious behaviour that they indulge in themselves or would do given the opportunity. I am sure that there exist proposals to have Cisco/Juniper/Akami network gear do more than is advertised.
Knowing that the West intelligence services would do (are doing??) what Lenovo & Huawei are suspected of is enough to have those companies banned, at least in CIA/NSA thinking.
It's difficult enough to keep malware out of the network as it is without providing an easy doorway.
eg: stuxnet
However, if evaluation of the policy to ban Lenovo were up to me, I would do a serious risk evaluation and compare Lenovo to others such as Dell. Truth is that state sponsored malware could be introduced at many levels including embedded firmware in say, network or video chipsets.
I suspect that the multinational component sourcing makes banning Lenovo analogous to plugging a small hole in a screen door while leaving all the windows open.
We dispense of the messy and "expensive" tasks of manufacturing and delegate to the lowest cost labor force. Makes sense untill one needs to be able to defend oneself. Once war does not make financial sense, we might be OK. Not sure if we can count on that though.
when the front door is wide, wide open?
why should any company buy equipment from the US, Europe, or Australia these days? These governments have *repeatedly* proven themselves to snoop on all traffic and impose some significant back doors of their own.
Pot, Kettle.
However if the Chinese are ever coming for the USA, it will be through the courts with a small army of debt collectors.
Cute sound bite but the US has the Chinese over a barrel here. China has bought about $1.1 trillion dollars of US debt which is about 9% of total US debt. (Japan has a similar amount an total foreign debt obligations are around $5.8 tillion) Most of this debt was purchased to maintain the yuan's peg to the dollar in order to keep their exports cheap. (a weak currency helps exports) Exactly how do you propose the Chinese force the US to pay? The courts can't force the US government to do a thing. They can't sell the debt to someone else. No one else wants or could buy that much debt. If they let their currency get stronger (buys more dollars per yuan) then it hurts their exports by making them more expensive abroad. Since their economy is heavily export based, any action they could take carries a strong probability of badly damaging their economy. No the Chinese are in a tough spot. They have lent a lot of money to the US to keep their currency cheap and to ward off currency speculators. There is no way they could collect in a short time without a mushroom cloud appearing over their economy.
When you owe the bank a little money, you have a problem. When you owe the bank a lot of money, the bank has a problem.
I don't exactly work for a large organization, but we do have folks working all over the world so service and support is very important to us. We had been using Dell but switched to Lenovo for a year because we could get systems from them with less lead time. We couldn't switch back fast enough. We paid extra for 3 year onsite NBD warranties (vs return to depot warranties) but when we called Lenovo to get them to send someone out for a repair, it always turned into an argument about whether we were entitled to onsite service.
Dell has always had excellent service, over the past 10 years or so I can probably count the number of times they didn't have a hardware problem fixed the next business day on one hand. It also seemed like we had a higher incidence of problems with the Lenovo systems. We bought maybe 20 of them and of that 20 probably half had to have their system boards replaced because a USB connector snapped off.
This seems to be about politics and or irrational fear. Components for modern laptops are sourced from all over the world any number of which could be capable of any number of wicked things. If your goal is to mitigate risk from foreign governments then simply picking a new laptop vendor is not an effective solution.
Why not produce your own computers on the NSA fab? You know...put it to use use for something other than spying on your own people.
I'll make this one easy on you
Gee thanks. I'm really glad I have you to explain this to me since I merely have a master's degree in finance and am a certified accountant with 10 years experience in global sourcing. Good thing I have smart people like you to explain how currency trading works. [/sarcasm]
Defaulting on even a small amount of debt to China would collapse this system and US and world economy would not survive the fallout
The US doesn't have to default on the debt. That was the whole point. China will get paid in due time and they have very little leverage over the US regarding when and how. China bought that much US debt because they had to, not because they particularly wanted to. The notion that China now "owns" the US, or that they could take the US to some court over the matter is just nonsense. China (probably rightly) regards US debt as a safe investment but the China is in a much more precarious position than the US even without the exercise of some fiscal nuclear option.
Seriously people, take a little time to hop on over to the US Treasury site and learn a little about US debt instruments. It isn't hard, they'll explain it all, and even sell them to you directly if you want some.
So, this is not a loan shark situation, where the US goes to China and says "Please give us some money!" and China says "Ok you can have money, and at some point, you don't know when, I'll come and collect and you don't know how much for." Rather the US auctions off securities, bonds, notes, etc, and China chooses to buy some. They are sold to the highest bidder, which in this case means the entity that bids the interest rate down the lowest.
Now some things to note about them:
1) They pay out in US dollars. They are not denoted on foreign currency, they are in US dollars, meaning they have value only if the dollar does, and their value is dependant on the dollar.
2) They pay out only after a given period. There is no provision to call in the money early. They have a defined cycle depending on what you buy. Some t-bills have a maturity date as short as a couple weeks, some bonds a maturity date as long as 30 years. They pay out the principal only when they mature, not before (bonds pay out interest every 6 months). The only way to get money early is to sell them to someone else who wants them, for a price that group is willing to pay.
3) They aren't physical things you have, they are just entries in a computer at the treasury. They are completely under the control of the US government and if you did something that allowed them to seize your assets, there is fuck all you could do to stop it.
So no, China can't come "through the courts with a small army of debt collectors." Their case would be dismissed in summary judgement and they'd be charged court costs. You can't sue the government to try and get them to pay out their treasury securities early as it is EXPLICITLY stated that they pay out only at a given time. You can't demand they pay you in another currency, as they are sold in US dollars. You can't act as though they took your money without you knowing as you had to go and bid on them.
Seriously, none of this is a big secret or complex. Go look it up. Go participate in it, if you like. Treasurydirect is the government's site for individuals to buy securities. You can participate in the auctions and buy government debt for yourself, if you wish. Just don't think you can then run down to the court house and demand the government pay you. The terms of your payment are explicit up front. If you don't like it, don't buy.