Slashdot Mirror
HP Enterprise Let Russia Scrutinize The Pentagon's Cyberdefense Software (reuters.com)
"A Russian defense agency was allowed to review the cyberdefense software used by the Pentagon to protect its computer networks," writes new submitter quonset. "This according to Russian regulatory records and interviews with people with direct knowledge of the issue." Reuters reports:
The Russian review of ArcSight's source code, the closely guarded internal instructions of the software, was part of Hewlett Packard Enterprise's effort to win the certification required to sell the product to Russia's public sector, according to the regulatory records seen by Reuters and confirmed by a company spokeswoman. Six former U.S. intelligence officials, as well as former ArcSight employees and independent security experts, said the source code review could help Moscow discover weaknesses in the software, potentially helping attackers to blind the U.S. military to a cyber attack. "It's a huge security vulnerability," said Greg Martin, a former security architect for ArcSight. "You are definitely giving inner access and potential exploits to an adversary."
It's another example of the problems security companies face when they try to do business internationally, according to Reuters. "One reason Russia requests the reviews before allowing sales to government agencies and state-run companies is to ensure that U.S. intelligence services have not placed spy tools in the software."
Long-time Slashdot reader bbsguru has his own worries. "So, opening your code for review because it is demanded by a potential customer? What could possibly go wrong? HPE may find out, and the U.S. Military is among the many clients depending on the answer."
It's another example of the problems security companies face when they try to do business internationally, according to Reuters. "One reason Russia requests the reviews before allowing sales to government agencies and state-run companies is to ensure that U.S. intelligence services have not placed spy tools in the software."
Long-time Slashdot reader bbsguru has his own worries. "So, opening your code for review because it is demanded by a potential customer? What could possibly go wrong? HPE may find out, and the U.S. Military is among the many clients depending on the answer."
A good security product is secure even if attackers know how it works.
You're a Trumpy, go figure. It's funny how you run distraction on a tiny non-issue and pretend that sums up the entire case for collusion or it's debunking. It's neither.
When Trump claims he has no business interests in Russia, he is lying. When Trump says he has no contacts in Russia and neither has his administration, it's a massive lie.
When Trump claims there was no hacking attempt or disinformation campaign to promote his presidency, he is lying. He's been briefed on it and decides he knows better than the NSA+17.
But you're right, a single DNS query by itself proves nothing and neither does your comment in defense of a traitor who is going down in mere months from now.
Popcorn, bitch denialist? Or are you going to pretend none of this is real next?
"The capitalists will sell us the rope with which we will hang them."
V.I Lenin
At the end of the day they'll sit down with their fellow global citizens and hash it all out.
I doubt it. They'd never be able to agree upon who among them should rule the world. Human history is full of those able and willing to kill in pursuit of domination and despite all of our efforts the veneer of civilization remains thin indeed. The savage instinct is still alive and well in modern man and it doesn't take much to bring it clawing back to the surface.
Usually to the detriment of those of us still dependent on nation-states.
Power trumps wealth. Wealth can be stripped but real power is absolute and although the two are often found together they ought not to be confused. Vladimir Putin regularly strips and imprisons billionaires who displease him and kills those he cannot imprison. There's a lesson there on the limits of wealth and the utility of absolute power.
Sensationalist crap if I ever saw one.
Making a source-code review is standard operation procedure for high security settings. In fact, I recommend exactly this to some of my clients (I've worked in IS before the abbreviation had a second meaning about murderous religious idiots).
If this allowed them to discover weaknesses in the software, then maybe the US departments should've done a source-code review themselves and discovered those same weaknesses? What is wrong with the author of this crap to shout wolf because someone is doing proper security?
"omg, the Russians tested the same rifle that our army uses! Maybe they discovered at what temperature it explodes!"
Guys, you need to wake up over there before you find yourself plundged into a new Cold War by nonsense propaganda. Ask yourself who profits from such shit, who gets to sell more stuff thanks to articles like this, and who gets to gain more influence from the fear.
Assorted stuff I do sometimes: Lemuria.org
Security through obscurity doesn't work. Fuzzing will eventually find holes.
It is time to change policies toward open source software. This approach puts security in everyone's best interest.
It is also time to switch to IPv6 only.
It is also time to get critical infrastructure completely off of the Internet.