No-IP? No idea. Why Microsoft faces an uphill battle to restore trust
Posted: July 4, 2014 Filed under: Uncategorized | Tags: anti-spam, bh consulting, botnet, botnet takedown, brian honan, canada, digital crimes unit, DNS, europol, microsoft, no-ip, outage, patch tuesday Leave a comment
To say this week was a bad news week for Microsoft would be putting it mildly.
First, its heavy handed decision to stop emailing security updates to users (in response to new Canadian anti-spam laws) was u-turned in a rather embarrassing manner.
Then came something much worse as Redmond’s Digital Crimes Unit (DCU) unilaterally sought a court injunction to seize control of 22 domains belonging to DNS firm No-IP.
It did this to arrest the spread of malicious activity on some of the domains, but with good reason commentators are already calling its strategy misjudged this time around:
- No-IP was not informed of the take-down, nor was it working in collusion with the cyber criminals. It also pleaded that it has always co-operated with the authorities when asked on such matters previously.
- Microsoft was unable to filter good traffic from bad, leading to millions of legitimate No-IP customers left without a service earlier this week.
Europol special advisor on internet security, Brian Honan, told me that the incident will further undermine the credibility of tech giants like Microsoft, which has already taking a pasting thanks to the NSA spying revelations from whistleblower Edward Snowden.
He raised a number of valid concerns with me by email:
• If No-IP were not contacted by Microsoft DCU regarding the abuse of their services what right have Microsoft DCU got to determine how good or bad the No-IP abuse mechanisms were? Indeed, what is the criteria and standards that Microsoft used to determine how responsive the No-IP abuse desk is? Are all service providers, including Microsoft, now expected to meet the requirements and expectations of Microsoft DCU? And if not can they expect similar interruptions to their business?
• Microsoft DCU also showed they do not have the technical capabilities in managing Dynamic DNS services and subsequently have impacted many innocent users and businesses, how will Microsoft DCU ensure
• There are also concerns over Microsoft infringing on the privacy of No-Ip’s legitimate customers. In effect Microsoft diverted all of these customers’ internet traffic via Microsoft’s systems. An action that could place No-Ip and Microsoft in breach of their own privacy policies and indeed various privacy laws and regulations.
This is probably the first major mis-step by the Digital Crimes Unit, and it will need to re-examine its procedures and processes very carefully to avoid a repeat. Its loss of face in this incident will only benefit the cybercriminals if it makes Redmond and others more hesitant to take action in future cases.
News of the World hackers, hacked ATMs and celeb snooping
Posted: July 3, 2014 Filed under: Uncategorized | Tags: ATM hacking, glenn mulcaire, infosecurity magazine, murdoch, news of the world, phone hacking, sophos, surveillance Leave a comment
News of the World private investigator Glenn Mulcaire was this week revealed to have gone to extraordinary lengths to hide his illegal tapping of celebrities’ voicemails: hacking an ATM to use its phone line.
I covered the story here for Infosecurity Magazine but thought it was worth including some extra comments.
Mulcaire’s cover was finally blow when BT sent a bill for the landline to the ATM owner, who forwarded it to the convenience store in which it was located, in a scruffy part of south London.
Sophos senior security advisor, Paul Ducklin, explained to me that Mulcaire probably chose an ATM line rather than tapping a copper phone line via other means, for several reasons.
“1. Unlike a fax machine the line never plays through a speaker for feedback purposes. Fax machines usually play their modem noises for a few seconds as part of the ‘user interface’.
2. If you interrupt a data transmission, the system will probably sort itself out automatically later on and no-one will realise that it was deliberate, rather than just a glitch. And you’ll hear the modem trying to come on-line, so you can hang up temporarily to get out of the way.
3. It’s likely to be a rented service that bundles in the phone line, so the bills probably go through a convoluted route to the person where the line is actually installed, making detection more complex – as happened here.”
He stressed the important of business owners checking their phone statements, just as one should bank statements or those belonging to online accounts, for any signs of suspicious activity.
“Cybercriminality usually leaves traces, and the one thing you can be sure of if you don’t make a habit of looking for those traces is that you won’t find them,” Ducklin told me.
“In various recent high-profile credit card breach cases, the afflicted retailer found out because someone outside the organisation noticed suspicious patterns of fraud. Best not to wait until someone else finds out before you do.”
Is Taiwan’s last chance at tech survival the connected home?
Posted: June 25, 2014 Filed under: Uncategorized | Tags: acer, Asus, compal, computex, foxconn, idg connect, ODM, OEM, PC manuacturing, quanta, Taiwan, taiwan technology, wistron Leave a comment
I’ve just finished another piece for IDG Connect taking apart the Taiwanese technology industry – it seemed like as good a time as any on the back of Computex 2014.
If you haven’t heard of the show it’s the second largest IT event in the world and is held every year in Taipei as it has been for 34 years.
Well, the island formerly known as Formosa has been punching well above its weight on the tech scene for decades now, thanks to lots of government investment, a booming chip industry and a steady stream of bright young engineers and designers pouring from its universities.
But as I found out, many of its major firms are facing an unprecedented set of challenges which could threaten its long term future.
Firstly the PC market is in decline – which is bad news for 4th and 5th placed global brands Acer and Asus. Whether terminal decline we still don’t know but it has certainly meant Taiwan’s major ODM/OEM firms have had to adapt to a new mobile-centric output.
The two big brands mentioned above, however, haven’t done a very convincing job so far.
“The whole shift to mobility including smartphones and tablets is the new growth curve for the whole industry,” Forrester analyst Bryan Wang told me from Computex. “What I have seen is that Taiwanese companies are losing in this space.”
Gartner’s Amy Teng was not much more optimistic.
“These manufacturers have to rely on brand vendors to consume their production outcome. This business relationship is weak because today’s PC supply chain is advanced and standardised enough to transplant from vendor to vendor easily,” she argued.
Teng added that the move from high volume, low customisation products to low volume, highly customised products is a big challenge – especially when these manufacturers are being asked to be more cost effective and quicker to market.
All is not lost, though. The country’s semiconductor firms are still well placed and there are opportunities in other areas for those ODM/OEM giants like Wistron, Foxconn, Quanta and Pegatron.
“Regarding how to overcome, or thrive in the coming decade, I do not see any opportunity in the smartphone/tablet space now. However, Taiwanese companies still stand a chance in the connected home space, which is set to evolve in the next couple of years,” said Wang.
“Home/smart gateways, set-top-boxes and smart routers – these could be the angles. At Computex here, I do see home grid, smart plugs, smart home solutions are evolving as an interesting area.”
Can Hong Kong build a ‘Silicon Harbour’? Nah, probably not
Posted: June 10, 2014 Filed under: Uncategorized | Tags: china, datacentre, datacentre hong kong, google hong kong, hong kong, hong kong start up, idg connect, shanghai, shenzhen, silicon harbour, singapore, start-ups, tokyo 1 Comment
I might be back in London now but I’m still keeping one eye on the East. My latest for IDG Connect is a piece on whether Hong Kong can really lay claim to the title “Silicon Harbour”, given its dubious track record of under-investment and the increasing strength of rival Asian cities including Tokyo, Shenzhen, Shanghai and Singapore.
Well, as always, the jury’s still out. There are a lot of good things going on in Hong Kong, as this upbeat infographic shows. It’s politically stable, safe from most natural disaster and you can use the internet freely (unlike in mainland China). It’s also well connected internet-wise and relatively cheap, as Frost & Sullivan analyst Danni Xu told me: “enterprises in Hong Kong using 100 Mbps Ethernet Point-to-Point (P2P) per month are paying only one third the price of a similar set up in Singapore”.
“However, despite these advantages/benefits, Singapore remains popular in certain cases over Hong Kong when it comes to selecting a destination to set up a data centre,” she added. “Google was a prime example of this when its plan to establish a data centre in Hong Kong did not materialise. The cost and difficulty of acquiring suitable land were cited as the key reasons for this.”
It also seems like HK’s key strengths, its value as a financial centre and proximity to China, are also its biggest drawbacks. This means Singapore and other cities are usually preferred as regional hubs while HK is the choice as a base for firms looking to expand into China. It also means investors can be reluctant to plough their money into untried or tested tech start-ups as the culture is mainly about finance and property.
Forrester analyst Clement Teo had this:
“There are some structural factors may constrain ICT development in HK e.g. its relatively small domestic market and shrinking manufacturing and industrial sector do not provide sufficient incentives to spur technological developments. Moreover, HK needs to divvy up scarce resources – like land, office space and investment funding and talent – among established economic pillars such as financial services, real estates and retail.”
The HK government this year released an ambitious Digital 21 Strategy – the latest in a long line of such policy documents from the SAR – and certainly talks a good game. But I’m still hugely sceptical whether the political will is there to help smaller tech firms – the start-ups and similar which could genuinely turn the city state into a ‘Silicon Harbour’.
South China Sea: another cyber skirmish to worry about
Posted: May 29, 2014 Filed under: Uncategorized | Tags: china, china cyber espionage, cold war, cybersquard, hacking, information security magazine, philippines, PLA, South china sea, threatconnect, vietnam, washington 1 Comment
I seem to have chosen the wrong time to come back from Hong Kong. Just a fortnight after landing back in Blighty, the US raised the stakes between the two superpowers, and mortally offended China’s honour, by indicting five PLA soldiers on charges of hacking US firms for economic gain.
I’ve written enough about it here and here already, so I won’t go into the pros and cons of this high risk strategy again. Safe to say that Beijing already appears to be retaliating in the most effective way possible; by making things decidedly difficult for US tech firms in the Middle Kingdom. Already reports have emerged that Cisco and IBM could be in trouble.
Is a new Cold War about to begin?
Well, if it does, one company it might be worth keeping an eye on is threat intelligence firm Cyber Squared. The firm’s ThreatConnect Intelligence Research Team has an interesting and very thorough analysis of new APT-style cyber attack campaigns in the disputed South China Sea (SCS) region, as I wrote about here.
“What’s that got to do with us?” you might ask. Well, potentially quite a lot, according to Cyber Squared chief intelligence officer, Rich Barger.
“There is a risk of increased data loss for Western firms that routinely work with Vietnamese, Filipino, and other SCS region companies,” he told me. “Unit 61398/APT1 operates on the whim of the PRC, and cyber espionage has been adopted as the preeminent ‘low risk – high payoff’ medium for strategic intelligence collection.
“We typically see companies that are infrastructure related being targeted. Industries such as energy, oil & gas, mining, and transportation may find themselves directly or indirectly impacted.”
The message is loud and clear; if you have any military, economic or geopolitical stake in the SCS region, be aware that Chinese cyber operatives are increasing their activity.
“China has had a long standing national and regional interest within the South China Seas region,” explained Barger.
“It offers them a strategic economic advantage in terms of regional and global energy development and trade. From a military perspective, a strong Chinese presence within the SCS also counters the US pivot to South East Asia where China’s military modernisation, especially its navy, and regional assertiveness have come to an intersection.”
Barger argued that the various disparate groups at risk in the SCS need to start sharing information on attacks and “observing both the technical picture and the geo-political context”.
“It is important for those within these targeted industries to actively invest in threat intelligence processes as a standard business practice that supports internal information security operations,” he concluded.
“It is equally important that technical leaders effectively interpret and articulate regional threats and the context surrounding them to corporate business leaders.”
Cyber crime boss offers Ferrari to ’employee of the month’: truth or hoax?
Posted: May 13, 2014 Filed under: Uncategorized | Tags: amichai shulman, cyber crime, cyber crime boss ferrari, employee of the month, imperva, independent, inforsecurity magazine, rapid7, trey ford, underground economy Leave a comment
I’m back in the UK for the time being and writing regular news for Infosecurity Magazine now so expect a fair spattering of off-cuts from this side of the globe for the coming year.
One of the first stories of note I covered was news, broken first by The Indy, that a cyber crime boss had released a video to the darknet offering up a Porsche or Ferrari to the cyber goon-for-hire who could come up with the most lucrative scam.
Now, if it’s true, the story is an interesting one in what it tells us, or confirms to us, about the economics of cyber crime.
Namely, that if the bad guys have this kind of money knocking about – to blow on a kind of bizarre “employee of the month” competition – then how can the police, government and even security vendors hope to attract and retain the best talent?
If nothing else, Rapid7 global security strategist Trey Ford told me by email, it shows the sheer professionalism of cyber gangs today and the vast scale of the underground economy.
“With every part of our lives revolving around increasingly connected technologies, the line between physical and virtual is gone, and the opportunities for attackers are immense,” he added.
“The general public needs to understand this is no longer a world of script kiddies and evil foreign governments, where the average person is unlikely to be a victim. Cyber crime is big business, and everyone is a potential target.”
It sounds obvious but it’s worth saying again, and stories like this at least raise these raise these problems in the public eye.
The other alternative, of course, is that it’s a hoax. Amichai Shulman, co-founder and CTO of Imperva, was not convinced by the story.
“I find it odd that criminal organisations resort to ‘advertising’ an ‘employee of the month’ program. I don’t think that we’ve seen this with recruiting skilled chemists for drug making and drug design or astute economists for money laundering schemes,” he argued. “This leads me to speculate that this is a hoax.”
LinkedIn and the cost of doing business in China
Posted: April 28, 2014 Filed under: Uncategorized | Tags: ai weiei, censorship, china, chinese censorship, facebook, facebook ban china, great firewall, greatfire.org, human rights watch, IHRB, linkedin, social neworking, twitter, twitter ban china Leave a comment
A few weeks ago I covered the launch of LinkedIn in China. It’s been available in English there for a while now and has even managed to amass around 4 million users, I’m told, but this was a big deal because it could give the firm access to up to 140 million Chinese professionals.
That said, many questions remain unanswered about the move, and I’ve been doing a bit of digging to explore them.
The most important centre around exactly what LinkedIn will have to sacrifice to remain unblocked by the Great Firewall. We all know the likes of Facebook, Twitter and YouTube have been forbidden for years by China’s censorship apparatus, but is the cost of doing business there actually worth the potential damage to reputation and bottom line?
Well, CEO Jeff Weiner had this to say about the compromises it has had to make:
As a condition for operating in the country, the government of China imposes censorship requirements on internet platforms. LinkedIn strongly supports freedom of expression and fundamentally disagrees with government censorship. At the same time, we also believe that LinkedIn’s absence in China would deny Chinese professionals a means to connect with others on our global platform, thereby limiting the ability of individual Chinese citizens to pursue and realise the economic opportunities, dreams and rights most important to them.
To me this seems a little disingenuous. Would Chinese citizens’ lives really benefit so much from a local language version of LinkedIn, or is this all about the money?
“I think the CEO should be more upfront about what exactly he is talking about in this situation,” Charlie Smith, co-founder of anti-censorship body Greatfire.org, told me. “What he means to say is that in order for them to get a business license to operate in China so that they can start to sell advertising and recruitment notices, the Chinese authorities insisted that they self-censor.”
The problem is we still don’t know exactly what LinkedIn has agreed to censor. Surely a pre-requisite for getting the green light from Beijing’s censors is having a plan on exactly what will be monitored, and how many resources will be spent on human censors, filtering technologies, etc? Well, LinkedIn told me the license is still pending, and so it can’t be more specific on the details.
But it gets more complicated. Will, as Smith asked me, the profiles of certain rights groups or individuals be removed by LinkedIn, if requested? What if a Chinese user wants to connect with a rights group or dissident outside China? One presumes the firm will have to create some kind of internal firewall between Chinese users and those outside the Chinternet. Aside from the cost to the bottom line, this has all the ingredients for a potential PR disaster.
“How are they going to ‘protect’ Chinese users from seeing content that is being posted by people outside of China that they are connected with? When this kind of censorship comes to light, many people will start testing the LinkedIn platform to see how far this censorship will go,” Smith argued.
“Most people only use LI when they are looking for a job, so I would imagine that many professionals, upon hearing about this complicit censorship, will simply leave the platform and use traditional job boards for their employment search.”
I also spoke to Lucy Purdon at rights group the Institute for Human Rights and Business, which urged more transparency from LinkedIn and encouraged the firm to reach out to the ICT industry and civil society as a member of the Global Network Initiative.
Purdon added:
LinkedIn should learn from the experience of other ICT companies operating in China, especially where government requests for user details present particular risks to users and conflict with the company’s commitment to respect internationally recognised human rights.
In the post-Snowden fallout, LinkedIn has filed legal challenges in the US, seeking permission to provide greater transparency of the number of national security requests they receive from the US government. Given that, at the very least we would expect LinkedIn to push for the greatest transparency in China and include requests from the Chinese government in their transparency reports, which provides a country by country breakdown. In addition, LinkedIn should consider expanding the categories to include censorship requests.
Now this is just the opinions of two organisations. But they’re valid ones and highlight the problems facing any social media or user-generated content-heavy company trying to do business inside China. It’ll be very interesting to see just how LinkedIn handles these issues as it expands its beta service behind the Great Firewall.
East Asia top source of cyber espionage, but with major caveats
Posted: April 25, 2014 Filed under: Uncategorized | Tags: APT, china, cyber attacks, cyber espionage, data breach investigations report, Eastern asia, hacking, north america cyber attacks, state sponsored cyber espionage, targeted attacks, Verizon business Leave a comment
Verizon’s annual Data Breach Investigations Report is out and several headlines have pointed to it highlighting China once again as the biggest source of global cyber espionage threats, however we need to be careful drawing such conclusions.
The report revealed that when it comes to cyber espionage, the majority (87%) is state affiliated rather than committed by organised crime (11%) and is targeted at victim organisations outside of the country of origin.
When it comes to “victim countries”, the US (54%) accounts for by far the majority, followed by South Korea (6%) and Japan (3%), although this is more of a reflection of the intelligence sources that inform the report than anything else.
More interestingly, it pegged “external actors” operating from Eastern Asia – mainly China and North Korea – as the most prolific worldwide, accounting for 49%.
Eastern Europe was next (21%), followed by Western Asia (4%), while North America and Europe were way down with just 1% each.
So what does this tell us? Well, those looking to prove that China is once again the arch bogeyman when it comes to global state-sponsored attacks should think twice, according to Verizon.
Report co-author and senior analyst, Kevin Thompson, told me that the results reflect the fact that large numbers of North American companies participate in the study and relatively few hail from East Asia – with none from China and Japan.
“We have been trying to recruit a partner organisation from China, Japan, or South Korea to increase our visibility into that part of the world,” he added. “Since many of our partners that investigate cyber espionage are based in North America they tend to only see attacks that are aimed at North American companies.”
Also, out of 511 total cyber espionage incidents recorded, more than half (281) were removed because no country could be attributed as the source of an attack.
“East Asia is the most commonly seen espionage actor when our partners are able to identify the country at all, which is not even half of the time,” Thompson explained.
“There tends to be more research around East Asian espionage than other countries, especially among North American partner organisations. Since there is more research in that area, it is easier for a partner to identify espionage from those regions while espionage from North America or Europe might be labelled ‘Unknown’ and would not be included in figure 59 of the report.”
If the NSA revelations have taught us anything it’s that the 1% figure for North America-based attacks is likely to be way smaller than in reality.
Verizon also claimed in the report that “the percentage of incidents attributed to East Asia is much less predominant in this year’s dataset”.
The real growth in activity is actually coming from Eastern European attackers, it said, adding the following:
At a high level, there doesn’t seem to be much difference in the industries targeted by East Asian and Eastern European groups. Chinese actors appeared to target a greater breadth of industries, but that’s because there were more campaigns attributed to them.
Malicious email attachment (78%) and web drive-by (20%) are still the most popular method of gaining access to a victim’s environment.
As for advice on how to lower the risk of a compromise, Verizon reiterated the basics.
These include: patch all systems and software so they’re fully up-to-date; use and keep an updated anti-malware solution; maintain user training and awareness programs; segment your network; log system, network, and application activity; monitor outbound traffic for data exfiltration; and use 2FA to stop lateral movement inside the network.
Indonesia’s 20 per cent smartphone tax likely to backfire
Posted: April 11, 2014 Filed under: Uncategorized | Tags: apple, blackaberry, canalys, foxconn, foxconn indonesia, import tax, indonesia, iphone 4, jakarta post, mobile phones, smartphones, the register Leave a comment
This week news emerged that the Indonesian government is planning to levy a 20 per cent luxury goods sales tax on all smartphones made outside the country. It’s an old fashioned piece of protectionism which could hit mobile phone makers in the region pretty hard and is unlikely to have the desired outcome.
As I mentioned in my story for The Register, Indonesia is a growing smartphone market with massive potential – as the world’s fourth most populous nation.
Firms that might be particularly dismayed by the tax include BlackBerry, which counts Indonesia as one of its few remaining strongholds, and Apple, which only recently restarted iPhone 4 production to target budget conscious locals.
If the rumours are true it can be seen less as an attempt to spur local handset makers, of which there are few, and more as a means to persuade more global manufacturers to locate facilities in the country.
Foxconn has already stolen a march on its rivals here by announcing a $1bn investment in facilities there.
Canalys analyst Jessica Kwee told me that, seeing as most domestic smartphone makers are focused on cheap, low-end handsets it’s unlikely that high-end users will be persuaded by the tax to buy local.
“What I think is more likely to happen is that the extremely wealthy would continue to buy their premium phones as is,” she said.
“Then other users will resort to the grey market to source their high-end phones – either via grey importers, by buying when they travel to nearby countries like Singapore or Malaysia, or by requesting from their friends etc. The latter would certainly not benefit the government.”
It’ll be interesting to see whether the government follows through with its plans. After all, at one stage it was mooting the tax only on handsets over Rp 5 million (£260), which I still reckon is the most likely outcome.
“Don’t get bitten by Asia’s offshore tigers,” says Gartner
Posted: April 3, 2014 Filed under: Uncategorized | Tags: APAC outsourcing, asia offshoring, china, gartner, india, it manufacturing, IT offshoring, IT services, nearshoring, outsourcing Leave a comment
IT offshoring; not the most exciting topic in the world but a vital contributor to the global IT economy. Last week Gartner released a new report detailing the challenges and opportunities facing Asian locations and warned that while emerging stars such as Indonesia and Vietnam offer great cost savings, there are risks.
Primary among these, as I noted for The Reg, is that none are doing well when it comes to their Data/IP Security and Privacy rating.
Indonesia, Thailand, Sri Lanka, Bangladesh and Vietnam all ranked “poor”, while more mature markets China, Philippines, India and Malaysia only did one better at “fair”.
Report author Jim Longwood also told me that despite ostensibly low costs, some emerging destinations may incur hidden “soft costs”.
“In some countries, for example, you might have to use a local joint venture; or for manufacturing pay additional fees to ensure a higher level of continuity of power supply than local businesses and homes might receive to avoid ‘brown outs’,” he said.
“Another soft cost is building a local brand, to enable the captive to attract a better quality of resources, e.g. when competing against the well-known global brands like of IBM, HP, Microsoft, SAP & Oracle for local talent. Part of this may well be investing building campus type facilities as the Indian providers have done.”
So, which will emerge as the favourite place to offshore IT services in the future?
Well, there are a number of locations vying for the business of MNCs, the analyst told me. Vietnam Bangladesh and Indonesia are leading the pack of emerging Asian countries thanks to strong government support for the first two and “more adhoc local entrepreneurial means” in the latter.
As for China, well it is certainly creeping up fast on India, and was rated by Gartner as the sub-continent’s number one challenger in terms of scale.
However, India has won the “current battle” in terms of horizontal IT services for apps and business processes and will not be overtaken by the Middle Kingdom anytime soon.
“However, versus India, China has certainly won the ‘battle’ to be a leading global site for manufacturing technology whether for TVs, telecommunications or IT hardware componentry,” he added.
phil muncaster 