Slashdot Mirror
HP Enterprise Let Russia Scrutinize The Pentagon's Cyberdefense Software (reuters.com)
"A Russian defense agency was allowed to review the cyberdefense software used by the Pentagon to protect its computer networks," writes new submitter quonset. "This according to Russian regulatory records and interviews with people with direct knowledge of the issue." Reuters reports:
The Russian review of ArcSight's source code, the closely guarded internal instructions of the software, was part of Hewlett Packard Enterprise's effort to win the certification required to sell the product to Russia's public sector, according to the regulatory records seen by Reuters and confirmed by a company spokeswoman. Six former U.S. intelligence officials, as well as former ArcSight employees and independent security experts, said the source code review could help Moscow discover weaknesses in the software, potentially helping attackers to blind the U.S. military to a cyber attack. "It's a huge security vulnerability," said Greg Martin, a former security architect for ArcSight. "You are definitely giving inner access and potential exploits to an adversary."
It's another example of the problems security companies face when they try to do business internationally, according to Reuters. "One reason Russia requests the reviews before allowing sales to government agencies and state-run companies is to ensure that U.S. intelligence services have not placed spy tools in the software."
Long-time Slashdot reader bbsguru has his own worries. "So, opening your code for review because it is demanded by a potential customer? What could possibly go wrong? HPE may find out, and the U.S. Military is among the many clients depending on the answer."
It's another example of the problems security companies face when they try to do business internationally, according to Reuters. "One reason Russia requests the reviews before allowing sales to government agencies and state-run companies is to ensure that U.S. intelligence services have not placed spy tools in the software."
Long-time Slashdot reader bbsguru has his own worries. "So, opening your code for review because it is demanded by a potential customer? What could possibly go wrong? HPE may find out, and the U.S. Military is among the many clients depending on the answer."
Wait until they figure out who all Microsoft has shared the Windows source code with.
A good security product is secure even if attackers know how it works.
What treason? This story is utter garbage, HP weren't revealing US secrets, they were submitting their OWN software for review to win sales. Every large company does this for governments and sometimes private sector as well. Microsoft, IBM, Apple, Oracle etc etc all do this and if they didn't they would all be a fraction of the size they are now as none of them would get international government business.
You mean like the network connected smart HP photocopy/scanning machine that are almost everywhere in Fortune 500 companies, government agencies, and FedEx Offices (formerly Kinkos).
Russians having access to that would be some sweet revenge. After all, we used Xerox copiers and Xerox maintenance people to keep copies of all the documents Russian government officials photocopied for years.
They're going after people who read only headlines and who don't know what any of this stuff means.
Kind of like that utter nonsense Slashdot published months ago where someone spying on network requests found collusion between a 3rd party Trump company marketing site and a Russian bank. Except it was stray DNS queries caused by Russian spam. Few people bothered to question what the people spying on that network traffic were doing, exactly.
Citizenship vs capitalism.
HPE acts like it doesn't have the sense god gave a pissant, but, sadly, it does.
It little behooves the best of us to comment on the rest of us.
So you're in favor of "security through obscurity".
I can't say that that's in any way a good technical argument.
You share code with the Russians, their people look at it, and suggest changes before they are willing to buy it.
You share code with the U.S. government, their people look at it, and suggest changes before they are willing to buy it.
Everyone wins.
The original Hewlett-Packard split into HP Inc and HPE years ago. The old printer business is on the other side of the split.
You're serious?
How about: their people look at, come up with some changes they'd need before trusting their systems to it, then give one back to the vendor and keep some to themselves for later.
COTS is the devil when it comes to American defense procurement. Yeah you don't need to commission a new programming language and compiler for every single solitary project like they had to do back in the 70s and 80s, but then at the same time you don't really want to be buying an OS from a company where the single number one priority is to make sure the 'voice assistant' works instead of silly things like rendering menus correctly or recognizing unformatted disks.
And then the NSA wonders why they keep losing their shit.
"The capitalists will sell us the rope with which we will hang them."
V.I Lenin
Obscurity can be a perfectly valid defense layer for an attacker, so I'm not sure why you think there's no technical argument for it.
Tanks have armor, but they are often painted to match their terrain to obscure their location. Painting the vehicle does nothing to harm the armor, and it does help prevent targeting by the enemy -- through difficulty to see on reconnaissance. Invisible tanks would be even better.
By allowing an enemy to see government-run computer code, we're not only identifying what systems we're using, but also giving them an opportunity to look for flaws to exploit. You make a terrible assumption that the Russians would TELL the vendor of exploits they'd find as well as bother to use the software internally themselves.
Open source is great for day-to-day stuff, but for .. oh, I dunno... remote nuclear launch software, there had better be zero -- and I mean zero bugs. That had better be hand-written in assembly and checked by a few hundred master programmers while being overlooked by the designers of the cpu architecture it's being run on.
For other critical systems... yeah... best to keep those closed source so that WHEN bugs are found our national security isn't put on the line because of it.
The higher the standards of security, the more we need FOSS, because it's the superior security model. If you need it with zero bugs, you write it in something like Ada Spark.
This is my signature. There are many like it, but this one is mine.
Why not assure the software is secure and bullet proof to start with? If Russia finds a bug or opening to exploit the US, it only shows the US didn't do it's job in reviewing and securing the software / infrastructure.
At the end of the day they'll sit down with their fellow global citizens and hash it all out.
I doubt it. They'd never be able to agree upon who among them should rule the world. Human history is full of those able and willing to kill in pursuit of domination and despite all of our efforts the veneer of civilization remains thin indeed. The savage instinct is still alive and well in modern man and it doesn't take much to bring it clawing back to the surface.
Usually to the detriment of those of us still dependent on nation-states.
Power trumps wealth. Wealth can be stripped but real power is absolute and although the two are often found together they ought not to be confused. Vladimir Putin regularly strips and imprisons billionaires who displease him and kills those he cannot imprison. There's a lesson there on the limits of wealth and the utility of absolute power.
Sensationalist crap if I ever saw one.
Making a source-code review is standard operation procedure for high security settings. In fact, I recommend exactly this to some of my clients (I've worked in IS before the abbreviation had a second meaning about murderous religious idiots).
If this allowed them to discover weaknesses in the software, then maybe the US departments should've done a source-code review themselves and discovered those same weaknesses? What is wrong with the author of this crap to shout wolf because someone is doing proper security?
"omg, the Russians tested the same rifle that our army uses! Maybe they discovered at what temperature it explodes!"
Guys, you need to wake up over there before you find yourself plundged into a new Cold War by nonsense propaganda. Ask yourself who profits from such shit, who gets to sell more stuff thanks to articles like this, and who gets to gain more influence from the fear.
Assorted stuff I do sometimes: Lemuria.org
How about: their people look at, come up with some changes they'd need before trusting their systems to it, then give one back to the vendor and keep some to themselves for later.
Yes, the "threat model" is that they discover a bug and don't tell anyone.
Which means that the NSA (who is responsible for keeping US government infrastructure and systems safe) didn't find that bug when they did their source code review.
Additional information: There are many ways to find bugs in software aside from code reviews. So not showing them the code would have had two effects: a) they would've probably bought some other software and b) they would've given the binary to their binary testing team.
Assorted stuff I do sometimes: Lemuria.org
1. Use off-the-shelf product to save money, but another big customer might also audit the code (the current predicament)
2. Use custom product so it's unavailable to others, but ultimately relying on obscurity
3. Go open source and have politicians and media have a heart attack about how "now everyone can access the source code / Trump is giving our source code away for free"
4. Export ban on this software while you use it, again relying on obscurity
your thin skin doesn't make me a troll
Source code can contain information the binary doesn't. Like why mistakes are made and who made them, to give an example. So if there's an exploit in the binary, you find it either way. If the source code with the mistake contains comments from Sanjay at CompuGlobalHyperMegaNet in Mumbai, that tells you where else that mistake could be. If there's no mistakes in Sanjay's code, you still have a potential recruitment target. Paranoid? Yes. Unlikely? Can't say. Implausible? No.
Security through obscurity doesn't work. Fuzzing will eventually find holes.
It is time to change policies toward open source software. This approach puts security in everyone's best interest.
It is also time to switch to IPv6 only.
It is also time to get critical infrastructure completely off of the Internet.
It's not standard operational procedure to hand your code over to an attacking foreign power.
Are you especially dense or paid?
Ok, let's turn this around: Russian company wants to sell security product to US government.
Would you or would you not expect the US to ask for source code and review it?
No further questions.
Maybe the world should be perfect, but it isn't, live in the real world.
Every day. I actually to IS for a living, you know? This is standard operational procedure. If you don't believe when a professional firefighter tells you "ya, throwing large quantities of water on something that's burning really is quite normal" then I really can't help you.
You need to wake up to what Putin's up to.
You need to wake up to the fact that certain interested parties want to start a new Cold War, not for ideological reasons, but for $$$.
Should we be aware of other countries? Of course, they all have their own interests, it would be idiotic to blindly trust them.
Should we panic and see evil communists on every corner? Uh, sorry, I thought McCarthy died already?
Assorted stuff I do sometimes: Lemuria.org
It is possible to remove comments from source code before handing it in to code review.
It is also possible to establish sane comment guidelines, especially when you are a security company.
And it is quite trivial to figure out who actually writes the software for a software company, without comments in source code.
Sure you get additional information from code, especially if good documentation explains the thinking behind algorithms. However, to go into a panic because another country made a source code review is the most insane thing I've seen in a very long time.
These things are standard. Every large important piece of software has been through source code review many, many times. You think that the MS Windows source code is very much secret?
Assorted stuff I do sometimes: Lemuria.org
it shouldn't make any difference who looks at it. Linux and Unix are generally considered more secure than Windows but all the source code is available for anyone to look at.
Obscurity can be a perfectly valid defense layer for an attacker, so I'm not sure why you think there's no technical argument for it.
The real equivalent to camouflage paint on the Internet is to not show up on nmap and other port scans. That's not obscurity, that's not offering an unnecessary attack surface -- just as with tank visibility against backgrounds.
I guarantee you that the desert camouflage stands out like a sore thumb in Leningrad in the winter.
You make a terrible assumption that the Russians would TELL the vendor of exploits they'd find as well as bother to use the software internally themselves.
If the Russians get so far as to sign a letter of intent, in order to get access to audit the source code ...and then decline to purchase ...that's a pretty strong positive indicator of exploitable bugs.
At which point you schedule the NSA to audit the code, so that those bugs can be addressed.
What happens when you worship only money? Capitalism!
aaaaaaa
>> But with closed source software, the person that has access to the code has access to the vulnerability.
That's bullshit.
With closed source software, the person with access to the binary has access to the vuln.
aaaaaaa
I think code review is unlikely to discern mistakes at the scale of a large piece of software.
On the other hand, breaking up the chunks of the monolithic application into pieces to do unit testing can presumably make fuzzing easier. So the ability to re-build the project in a different way can be helpful.
XML is like violence. If it doesn't solve the problem, use more.
I'm not going into a panic because another country is doing source review. I'm saying the US government shouldn't be using code that's neither open source nor fully closed source. If it's fully open source, everything I said doesn't matter because it's got more eyeballs on it. If it's fully closed source and only domestic users review it, then that attenuates the risk. This here is a no-man's land in between where you don't get any of the benefits and have to assume that everyone's got their thinking hats on with regard to scrubbing anything embarrassing out of the comments that they originally thought were going to stay proprietary.
Security consultant here with experiences in SIEM's. ArcSight is a security information and event management (SIEM), which means all it does is collecting logs from other security devices together and deciding if sequence of events has higher priority compared to individual event.
For example, connection from unknown address, crashed antivirus service and unusually high disk activity is likely to be cryptolocker.
There is nothing valuable in source code of SIEM's, its a bunch of regex to parse incoming logs few basic rules (described in documentation) and interface. Nothing of value. What it could be doing though is leaking logs to US, therefor request code review is very reasonable.
PS. ArcSight is overcomplicated piece of crap, Splunk, Qradar and LogRythm are far superior. Search for Gartner report.
Move along, nothing to worry about. It's just arcsight. You're better off using owasp. We have the HP product, it's crap. False positives and they don't listen to customer feedback. Almost as bad as Tenable. They think they know better than the experts, such as the Crypto experts on a vulnerability that was patched almost a decade ago. They don't even follow their own rules and they don't listen to their customers either.
> Should we panic and see evil communists on every
> corner?
No, we shouldn't panic or indulge in paranoia. But we should be cognizant of who our enemies are, and be vigilant and wary of them. It's not like we're talking about HP giving up source code to the UK, Japan, Canada, or Germany here.
Vladimir Putin openly pines for his good old days in the KGB and Soviet Union; having called the dissolution of the latter the "greateast geopolitical catastrophe of the 20thcentury.". This is not paranoia or speculation or exaggeration or McCarthyism. Those are Putin's own words, spoken openly and publicly. And he's been invading neighboring countries like Georgia and Ukraine. He's not our friend and he's not someone we should be helping.
Imagine all the people...
I'm saying the US government shouldn't be using code that's neither open source nor fully closed source.
While there are theoretical advantages to Free Software in this context, they do not manifest to the degree that many Free Software advocates think. And I say that as a stern believer in Free Software (to the degree that I refuse to call it "Open Source").
OpenBSD is about the only project that actually does this right - by not relying on the assumption that Free Software actually gets read, but making sure it happens and running regular code reviews.
From a security perspective, I'd rather take a piece of close source software that I know has been through code reviews, than a piece of Free Software that may or may not have been looked at by anyone else besides the creator.
Assorted stuff I do sometimes: Lemuria.org
I think we're agreeing here.
But we should be cognizant of who our enemies are
That we should be.
So what, exactly, has Russia as a country, or the Russian government, done to make your life worse?
Compared to, say, the corporations that poison our water and air, the politicians who demolish our social security systems, the banks who stole unbelievable amount of tax payer money to cover up their gambling that lead to the financial crisis?
And he's been invading neighboring countries like Georgia and Ukraine. He's not our friend and he's not someone we should be helping.
The correct method for this is a trade embargo, i.e. don't sell them security software at all. But our leaders don't want that, because they are not interested in values or good. They are interested in geopolitical power games and their own personal profits and influence. All the fear-mongering is just a means to an end. Today it's Russia, last year it was muslim terrorists, before that it was this or that. What a load of bullshit.
Oh yeah, on invasions: If you are from the US, shut your stupid mouth and look up the list of countries that the USA has invaded in the past 50 years. Yes, always under the pretense of democracy and liberation and peace and bla bla bla. Now look at the effect that the invasion had on those countries, then name three where the invasion actually did have the effect that was claimed on TV.
Your own leaders sent more young Americans to their deaths in the past decade than Russia has killed in a century. What is the actual threat?
Assorted stuff I do sometimes: Lemuria.org