Slashdot Mirror

← Back to Stories (view on slashdot.org)

Under Pressure, Western Tech Firms Including Cisco and IBM Bow To Russian Demands To Share Cyber Secrets (reuters.com)

Posted by msmash on from the folding-up dept.

An anonymous reader shares a Reuters report: Western technology companies, including Cisco, IBM and SAP, are acceding to demands by Moscow for access to closely guarded product security secrets, at a time when Russia has been accused of a growing number of cyber attacks on the West, a Reuters investigation has found. Russian authorities are asking Western tech companies to allow them to review source code for security products such as firewalls, anti-virus applications and software containing encryption before permitting the products to be imported and sold in the country. The requests, which have increased since 2014, are ostensibly done to ensure foreign spy agencies have not hidden any "backdoors" that would allow them to burrow into Russian systems. But those inspections also provide the Russians an opportunity to find vulnerabilities in the products' source code -- instructions that control the basic operations of computer equipment -- current and former U.S. officials and security experts said. [...] In addition to IBM, Cisco and Germany's SAP, Hewlett Packard Enterprise Co and McAfee have also allowed Russia to conduct source code reviews of their products, according to people familiar with the companies' interactions with Moscow and Russian regulatory records.

5 of 111 comments (clear)

  1. I'd want to know, too. by Frosty+Piss · · Score: 5, Insightful

    These are reasonable requests and fit perfictly within the Open Source paradigm. So what's the issue?

    Oh, yeah it's Russia...

    --
    If you want news from today, you have to come back tomorrow.
    1. Re:I'd want to know, too. by rmandevi · · Score: 5, Insightful

      If they're sharing the code with everybody, that's good engineering practice. This raises the possibility that a White Hat will discover a bug and report it to the vendor, who can then close the hole.

      If they're sharing it with only Russia, this puts them in a privileged position to exploit those bugs without reporting them. Clearly, this increases the odds of a breach. This isn't because it's Russia, either; sharing with any one entity, unless you absolutely trust them to report all the flaws they find, causes the same problem.

      --
      People who live in glass houses shouldn't walk and text.
    2. Re:I'd want to know, too. by ShanghaiBill · · Score: 4, Insightful

      These are reasonable requests and fit perfectly within the Open Source paradigm. So what's the issue?

      The Open Source paradigm is that with many eyes all bugs are shallow. But in this case, there are not many eyes, only a few Russian eyes, and those eyes are at least potentially hostile.

      If they want to give the Russians access, it would be wise to also give more source access to friendly eyes, such as Western security experts, along with some bug bounties to incentivise them.

    3. Re:I'd want to know, too. by Frosty+Piss · · Score: 5, Insightful

      If they want to give the Russians access, it would be wise to also give more source access to friendly eyes, such as Western security experts, along with some bug bounties to incentivise them.

      Who says they haven't? My guess is the NSA has looked at the code...

      --
      If you want news from today, you have to come back tomorrow.
  2. Re:This is the absolute best effect of Trump elect by nnet · · Score: 4, Insightful

    McCarthy wasn't always wrong. What goes around comes around. Welcome to the New Cold War, same as the Old Cold War.