Slashdot Mirror

← Back to Stories (view on slashdot.org)

Under Pressure, Western Tech Firms Including Cisco and IBM Bow To Russian Demands To Share Cyber Secrets (reuters.com)

Posted by msmash on from the folding-up dept.

An anonymous reader shares a Reuters report: Western technology companies, including Cisco, IBM and SAP, are acceding to demands by Moscow for access to closely guarded product security secrets, at a time when Russia has been accused of a growing number of cyber attacks on the West, a Reuters investigation has found. Russian authorities are asking Western tech companies to allow them to review source code for security products such as firewalls, anti-virus applications and software containing encryption before permitting the products to be imported and sold in the country. The requests, which have increased since 2014, are ostensibly done to ensure foreign spy agencies have not hidden any "backdoors" that would allow them to burrow into Russian systems. But those inspections also provide the Russians an opportunity to find vulnerabilities in the products' source code -- instructions that control the basic operations of computer equipment -- current and former U.S. officials and security experts said. [...] In addition to IBM, Cisco and Germany's SAP, Hewlett Packard Enterprise Co and McAfee have also allowed Russia to conduct source code reviews of their products, according to people familiar with the companies' interactions with Moscow and Russian regulatory records.

11 of 111 comments (clear)

  1. I'd want to know, too. by Frosty+Piss · · Score: 5, Insightful

    These are reasonable requests and fit perfictly within the Open Source paradigm. So what's the issue?

    Oh, yeah it's Russia...

    --
    If you want news from today, you have to come back tomorrow.
    1. Re:I'd want to know, too. by rmandevi · · Score: 5, Insightful

      If they're sharing the code with everybody, that's good engineering practice. This raises the possibility that a White Hat will discover a bug and report it to the vendor, who can then close the hole.

      If they're sharing it with only Russia, this puts them in a privileged position to exploit those bugs without reporting them. Clearly, this increases the odds of a breach. This isn't because it's Russia, either; sharing with any one entity, unless you absolutely trust them to report all the flaws they find, causes the same problem.

      --
      People who live in glass houses shouldn't walk and text.
    2. Re:I'd want to know, too. by ShanghaiBill · · Score: 4, Insightful

      These are reasonable requests and fit perfectly within the Open Source paradigm. So what's the issue?

      The Open Source paradigm is that with many eyes all bugs are shallow. But in this case, there are not many eyes, only a few Russian eyes, and those eyes are at least potentially hostile.

      If they want to give the Russians access, it would be wise to also give more source access to friendly eyes, such as Western security experts, along with some bug bounties to incentivise them.

    3. Re:I'd want to know, too. by Frosty+Piss · · Score: 5, Insightful

      If they want to give the Russians access, it would be wise to also give more source access to friendly eyes, such as Western security experts, along with some bug bounties to incentivise them.

      Who says they haven't? My guess is the NSA has looked at the code...

      --
      If you want news from today, you have to come back tomorrow.
    4. Re: I'd want to know, too. by Anonymous Coward · · Score: 3, Insightful

      Do you honestly think that US agencies don't have access to the source code of US products? I can't imagine the department of defense running Cisco routers without inspecting the source code at first. Can you imagine US agencies running Chinese products and wouldn't it be reasonable to ask them to disclose their source code before you buy from them ?

      I mean Cisco don't HAVE to sell to Russia and Russia doesn't have to buy their stuff. They can go for Huwaweii instead and I am pretty sure they will get the source for that,

    5. Re:I'd want to know, too. by Anonymous Coward · · Score: 0, Insightful

      So anyway, how's the pay for being a russian shill ?

    6. Re:I'd want to know, too. by WheezyJoe · · Score: 1, Insightful

      Truly. If they're sharing them with Russia, they should share with EVERYONE - draw an open-source license.

      IBM et al. are biting the bullet because they want to sell to the Russian market... perhaps because if they don't, someone else will and make lots of oil-soaked rubles and countless Russian intangibles. But if they give away these "secrets" to the Russians, we can pretty much assume such secrets are in the wild, perhaps immediately handed to the teams of patriotic but not-at-all-affiliated with the government Russians (wink, wink) who are taking down Ukrane's power grid. The point of keeping them secret is so that other people won't copy what you've done and sell it and compete with you. But for sure that's exactly what the Russians will do with this... build their own so they don't have to give up their oil rubles to Western companies. And there's no guarantee the Russians won't sell what they've learned to the Chinese (or any other highest bidder), who will be happy to pass it on to some half-state-owned conglomerate to build their own equipment for 1/1000 of what the Western companies would sell for.

      The only people NOT getting in on the source code is the open-source community who might do something good with it, like find bugs.

      Put short, if you're going to have to open your code to Russia to sell to Russia, draw an open-source license first. If you can't afford the open-source community to see and copy your code, you damn well can't afford the Russians to do it.

      Me, if I want to purchase "secure" equipment from these companies, I damn-well want to make they're products that have NOT been sold and opened-up to the Russians, or for my money such equipment is de-facto NON-secure. Should have some kind of NOT OPENED TO RUSSIANS certification or something.

      --
      Take it easy, Charlie, I've got an Angle...
    7. Re:I'd want to know, too. by WheezyJoe · · Score: 1, Insightful

      The NSA doesn't report bugs and vulnerabilities back to the tech company.

      If I had a choice of disclosing my source code to either the Russians or the NSA, I would pick the Russians.

      Be careful what you wish for. The NSA may bust your neighbor for hoarding bomb-making material, or fink you to the FBI for your 15-year collection of kiddy-pr0n. The Russians, OTOH, will cut the power to your town on the hottest day of the year, brick the machine in the hospital that's keeping you alive, make your bank account disappear, make ships, drones and planes crash into each other, and turn your home router into a trove of kiddy-pr0n while finking you out to the FBI, and even rig media and election machines to put a failing businessman turned reality-TV show host into the White House. Why? For a laugh at our expense (what else is there to do fun in Russia?), and to show Big Boss Putin what they can do in hopes of catching a few scraps from his table.

      It ain't a great choice, nor do I have it, but I'll take the NSA, thank you.

      --
      Take it easy, Charlie, I've got an Angle...
    8. Re:I'd want to know, too. by Anonymous Coward · · Score: 0, Insightful

      Yeah, sure thing. Until 'white hats' start dying mysteriously of polonium poisoning.

  2. Re:This is the absolute best effect of Trump elect by nnet · · Score: 4, Insightful

    McCarthy wasn't always wrong. What goes around comes around. Welcome to the New Cold War, same as the Old Cold War.

  3. This is why it is so stupid ... by Alain+Williams · · Score: 3, Insightful

    of the likes of GCHQ and the NSA to hoard vulnerabilities that they find. The Russians, and likely other ''bad guys'', are probably going to find the same set of vulnerabilities.

    If they really wanted to do their job of protecting us they would tell the vendor and we would all be a lot safer.