2013年8月5日月曜日

Lenovo Computer Refuse

Lenovoのパソコンが採用を拒否された。
 英情報機関が、世界最大のパソコン企業である中国レノボ社製品の使用
を禁止していたことが分かった。

MI5、GCHQ調査
・外部からの操作でパソコン内のデータにアクセスできる工作が施されて
 いるのを発見した。
・通常のセキュリティー保護をバイパスする秘密の裏口がチップに最初か
 ら仕込まれているとの見解。

The Five Eyes
・Lenovo使用禁止通達
・2000年代半ば
 英国GCHQ、米国NSA、豪州DSD、カナダ、ニュージーランドの情報機関。

Lenovo
・2005年 IBMのPC部門を買収。
 Legend HoldingsはLenovoの34%株式を所有する筆頭株主。
 中国政府と中国科学院は、Legend Holdingsの38%株式を所有する筆頭株主。
・「製品の信頼性と安全性は顧客から常に保証されている」等とコメント。

豪州政府
・2012年 中国人民解放軍との関係が取り沙汰される華為技術の高速通信
 網事業への入札参加を拒否。

豪州防衛省
・Lenovoを使用禁止報道を否定。

IBMのPC部門がLenovoに買収されたと報道された後、少し経ってから、
現在も現役の経済評論家と称する人が、テレビ番組に出演し、Lenovoの
旧IBMPCの製造部門を訪問、部門責任者とインタビューをしていた記憶が
ある。
この時、経済評論家は、まとめとして、
「旧IBMPC製造部員を使い、中国本社の関与は見当たらない。
 言われているような問題(不正使用等)は考えにくい。
 多くの人は誤解しているようだ(意図略)。」
との言葉を思い出す。
経済評論家や番組関係者が知りながら報道したのか、Lenovoの広報活動が
うまかったのかは不明。当時、関与は無く次第に関与を強めた可能性も
ある。
治安関係の疑惑に対して、民間人が表面だけを見て、火の粉を払う行為の
良否もある。
最近では、ルーピーが良い例と思う。

LenovoとNECのPC部門と事業統合。
米NC州で製造されたPCに、不正操作ができる仕組みを組込んでいれば、
NECで製造されたPCへ組込まれた可能性も高い。

The Five Eyeへの批判をさけるために、Lenovoを利用したことも考えられ
る。

パソコン製造会社では、BIOSやアプリケーションレベルで、遠隔操作を
許可し、カスタマサービスを行うサービス(Remote Assistance、Constant
Secure Remote Disable等)があるようで、GCHQらの指摘はそれを指してい
るのかもしれない。

中国製エシュロンシステム
GCHQ Espionage
米国 秘密裁判所令状更新


NSA and GCHQ siphoning huge amount of data from undersea fiber optic cables


---英情報機関 ハッキング用工作 発見 中国レノボ社製 PC「使うな」---
2013年7月31日 夕刊
http://www.tokyo-np.co.jp/article/world/news/CK2013073102000223.html

 【ロンドン=石川保典】英情報機関が、世界最大のパソコン企業である中国レノボ社製品の使用を禁止していたことが分かった。三十日付の英紙インディペンデントが伝えた。
 情報局保安部(MI5)や政府通信本部(GCHQ)が製品を調べたところ、外部からの操作でパソコン内のデータにアクセスできる工作が施されているのを発見した。科学者は通常のセキュリティー保護をバイパスする秘密の裏口がチップに最初から仕込まれているとの見解を示したという。
 GCHQなどはコメントを拒否しているが、使用禁止の通達は二〇〇〇年代半ばに米国、カナダ、オーストラリア、ニュージーランドの情報機関でも出されたという。
 IBMのパソコン部門を〇五年に買収したレノボ社は、中国の国家機関・中国科学院が最大の株主。同紙には「製品の信頼性と安全性は顧客から常に保証されている」などとコメントしている。
 中国の情報技術(IT)企業をめぐっては、オーストラリア政府が昨年、中国人民解放軍との関係が取り沙汰される「華為技術」の高速通信網事業への入札参加を拒否し、中国政府が批判している。


---Lenovo security services PC ban denied by Australian Department of Defence---
31 Jul, 2013 Caroline Donnelly
http://www.itpro.co.uk/desktop-hardware/20301/lenovo-security-services-pc-ban-denied-australian-department-defence

Updated: After Chinese PC firm vowed to "look closely" into product ban claims, Australian Defence Department denies Lenovo veto.

The Australian Department of Defence has denied reports it banned Lenovo PCs from being used on its secret networks.

A recent report in the Australian Financial Review claimed there is a written order in place in Britain banning the likes MI5, MI6 and GCHQ from using the Chinese PC vendor’s products within classified networks.

The banning order was reportedly introduced during the “mid-2000s”, following the alleged discovery of modified circuitry, known as a “back door”, in its computers that would permit remote access without the user’s knowledge.

The article claims it is being adhered to by the “five eyes” of the Western intelligence alliance, which include GCHQ, the US National Security Agency, and Defence Signals Directorate in Australia, and their equivalents in Canada and New Zealand.

However, the Australian Department of Defence has now released a statement denying it has banned staff from using the Chinese PC vendor's products.

"Reports published on 27 and 29 July 2013 in the Australian Financial Review allege a Department of Defence ban on the use of Lenovo computer equipment on the Defence Secret and Top Secret Networks," the statement reads.

"This reporting is factually incorrect. There is no Department of Defence ban on the Lenovo company or their computer products; either for classified or unclassified systems," it concludes.

In a statement to IT Pro, Lenovo said its products have been found “time and time again” to be reliable and secure for its enterprise and public sector users.

“As a result of the IBM PC division in 2005, we have diverse global leadership and an excellent track record in selling into the public sector globally,” the statement read.

“We have not received word of any sort of a restriction on sales so we are not in a position to respond to that question...[but] Lenovo continues to have a strong relationship with government customers, so the claims being made are new to us.

“We are looking into this situation closely and we’ll be sure to share updates when available.”

A Home Office representative told IT Pro it was unable to confirm or deny claims that MI5 and MI6 are banned from using Lenovo PCs, adding that it does not comment on matters of this nature.

The company, which indirectly receives financial backing from the Chinese state, is not the first China-based tech vendor to have its public sector involvement called into question.

Last month, Chinese telecommunications vendor Huawei was the subject of a Government committee report into the role its technology plays in the UK’s critical national infrastructure.

The report focused on its alleged ties to the Chinese state, something the vendor has strenuously denied, and the potential this could have on the UK’s national security.

*This article was originally published on 30 July, and was updated on 31 July to include the Australian Department of Defence's statement.*


---NSA, GCHQ ban Lenovo PCs due to security concerns---
By Sooraj Shah
29 Jul 2013
http://www.computing.co.uk/ctg/news/2285455/nsa-gchq-ban-lenovo-pcs-due-to-security-concerns

Lenovo, the biggest PC supplier in the world, has seen its PCs banned from the secret networks of the intelligence and defence services of the UK, US, Australia, Canada and New Zealand - otherwise known as the Five Eyes.

Sources from intelligence and defence entities in the UK and Australia have confirmed the ban on PCs made by the Chinese company being used in "classified" networks, according to the Australian Financial Review (AFR).

A GCHQ spokesperson could not confirm or deny that a ban had been enforced.

"As a matter of policy we don't routinely discuss either the names or nature of suppliers to GCHQ on any aspect of our business," the spokesperson told Computing.

AFR claims that the ban was introduced half way through the 2000s after Lenovo chips were found to have "back-door" hardware and firmware (the interface between a PCs hardware and its operating system) vulnerabilities in Lenovo chips.

The sources said that malicious modifications to Lenovo's circuitry - more sophisticated than zero-day vulnerabilities - were discovered that could allow people to remotely access devices without the users' knowledge.

The report goes on to state that in 2006, the US decided not to use 16,000 new Lenovo PCs on classified networks because of security concerns. The change was thought to be due to anti-China trade sentiment.

It has been suggested that Lenovo has ties with the Chinese government as the Chinese Academy of Sciences, a Chinese government body, owns 38 per cent of Legend Holdings, which in turn is Lenovo's largest shareholder, owning 34 per cent of the PC maker.

More recently there have been high profile concerns about Chinese telecommunications firm Huawei's association with the Chinese government. The firm was set up by current president Ren Zhengfei, a former major in the Chinese People's Liberation Army.

Lenovo, which acquired IBM's PC business in 2005, still supplies PCs for "unclassified" government networks across Western nations including Australia and New Zealand, and it said it was unaware of a ban on "classified" government networks.

"Our products have been found time and time again to be reliable and secure by our enterprise and public sector customers and we always welcome their engagement to ensure we are meeting their security needs," the company said in a statement.

Update (30/07): The Australian Department of Defence has issued a statement denying that it has placed a ban on Lenovo products.

"This reporting is factually incorrect. There is no Department of Defence ban on the Lenovo Company or their products; either for classified or unclassified systems," it said.


---MI6 and MI5 'refuse to use Lenovo computers' over claims Chinese company makes them vulnerable to hacking---
Monday 29 July 2013
http://www.independent.co.uk/news/uk/home-news/mi6-and-mi5-refuse-to-use-lenovo-computers-over-claims-chinese-company-makes-them-vulnerable-to-hacking-8737072.html

Lenovo - the largest PC producer in the world - is indirectly backed by the Chinese state

Britain’s intelligence agencies, including MI6 and MI5, have allegedly banned the use of computers manufactured by Chinese company Lenovo due to concerns that the machines come hardwired with a vulnerability to hacking.

Machines produced by the state-backed technology company, which is the largest PC producer in the world, are claimed to have been found in tests by MI5 and GCHQ to have modifications in their circuitry which could allow remote access to the devices without the owners’ knowledge.

The discovery has led to a written banning order being issued among the “Five Eyes” alliance of British, American, Australian, Canadian and New Zealand eavesdropping agencies, including the US National Security Agency, according to the respected Australian Financial Review.

Lenovo, today voiced its “surprise” at the move and denied any fault in its machines. It is the latest company with links to the Chinese state to fall foul of concerns about its hardware following similar allegations against Huawei Technologies, the telecommunications producer earlier this year banned from competing for a L24 billion broadband contract in Australia.

GCHQ, the UK government’s vast listening station, and other UK intelligence agencies declined to comment on the reports concerning Lenovo, which it is claimed has been boycotted since the mid-2000s after laboratories in Britain and elsewhere revealed vulnerabilities in hardware and “firmware”- the link between a computer’s hard drive and its software.

Scientists are claimed to have identified highly-classified “back doors” in chips used in Lenovo machines which are extremely difficult to identify and could be activated remotely to either stop targeted computers working or access their contents.

As a result the agencies, ranging from the CIA to MI5, have declined to use the firm’s computers for secret and top secret networks, although Lenovo machines continue to be used by public bodies for non-sensitive work. The State Department announced in 2006 that it was not going to use a consignment of 16,000 Lenovo computers due to security concerns.

The alleged ban will re-open the debate about whether suspicions against Chinese technology companies, whose products are often cheaper than those of rivals, are justified or jingoistic. Huawei, which was earlier this month accused by a former head of the CIA of passing details of foreign telecommunications systems to the Chinese government, has repeatedly insisted its products are safe and challenged its detractors to provide proof for their claims.

A committee of MPs last month concluded urgent measures were necessary to ensure that equipment provided by Huawei to British companies such as BT could not be used as a conduit for a cyber attack.

Lenovo, which is based in Beijing, is indirectly backed by the Chinese state. The Chinese Academy of Sciences, a public body, owns more than a third of Legend Holdings, which in turn owns 34 per cent of the computer company and is its biggest shareholder.

Following the acquisition of IBM’s PC division in 2005, it has rapidly become a global player in the technology business with revenues last year of $29 billion (L19 billion)  and a market share of nearly 17 per cent.

In a statement, Lenovo said: “Our products have been found time and time again to be reliable and secure by our enterprise and public sector customers... We have not received word of any sort of a restriction of sales so we are not in a position to respond to this question. We are looking into this situation closely.”

The Home Office declined to comment on whether Lenovo machines were accredited on secret government networks. In a statement, GCHQ said: “As a matter of policy we don’t routinely discuss the names or nature of suppliers to GCHQ on any aspect of our business.”


---Chinese hackers 'steal blueprints for Australian spy HQ'---
Canberra
Tuesday 28 May 2013
http://www.independent.co.uk/news/world/australasia/chinese-hackers-steal-blueprints-for-australian-spy-hq-8633757.html

Hackers traced to China stole floorplans of the new A$630m base for the Australia Security Intelligence Organisation, according to ABC news
Rob Taylor

Chinese hackers have stolen the blueprints of a new multi-million-dollar Australian spy headquarters as part of a growing wave of cyber attacks against business and military targets in the close US ally, an Australian news report said.

The hackers also stole confidential information from the Department of Foreign Affairs and Trade, which houses the overseas spy agency the Australian Secret Intelligence Service, Australia's ABC Television said late yesterday.

The ABC report said Chinese hackers had targeted Australia-based companies more aggressively than previously thought, including steel-manufacturer Bluescope Steel, and military and civilian communications manufacturer Codan Ltd.

The influential Greens party said the reported hacking was a “security blunder of epic proportions” and called for an inquiry, but the government refused to confirm the security breach.

Foreign Minister Bob Carr said the report would not damage Canberra's ties with its biggest trade partner China.

“We have enormous areas of cooperation with China. I won't comment on whether the Chinese have done what is being alleged or not,” Carr told reporters today.

Hackers using a computer server traced to China had stolen floorplans of a new A$630 million headquarters for the Australia Security Intelligence Organisation, the country's domestic spy agency, said the ABC report.

The attack through the computers of a construction contractor exposed not only building layouts, but also the location of communication and computer networks, said ABC.

Australia security analyst Des Ball told ABC in the report that such information made the yet to be completed spy headquarters vulnerable to future cyber attacks.

“You can start constructing your own wiring diagrams, where the linkages are through telephone connections, through wi-fi connections, which rooms are likely to be the ones that are used for sensitive conversations, how to surreptitiously put devices into the walls of those rooms,” said Ball.

The ASIO building, being built near the location of Australia's top secret Defence Signals Directorate, is supposed to have some of the most sophisticated hacking defences in the country, which is part of a global electronic intelligence gathering network including the United States and the UK.

But its construction had been plagued by delays and cost blowouts, with some builders blaming late changes made to the internal design in response to cyber attacks.

Australian officials, like those in the United States and other Western nations, have made cyber attacks a security priority following a growing number of attacks of the resource rich country, mostly blamed on China.

Chinese telecommunications giant Huawei was last year barred from bidding for construction contracts on a new Australian high-speed broadband network amid fears of cyber espionage.

The Reserve Bank of Australia said in March that it had been targeted by cyber attacks, but no data had been lost or systems compromised amid reports the hackers had tried to access intelligence on Group of 20 wealthy nations negotiations.

In the United States, the Pentagon's latest annual report on Chinese military developments accused Beijing for the first time of trying to break into US defence networks, calling it “a serious concern”.

China has dismissed as groundless both the Pentagon report and a February report by the US computer security company Mandiant, which said a secretive Chinese military unit was probably behind a series of hacking attacks targeting the United States that had stolen data from 100 companies.

0 コメント: