Posts Tagged

Risk

Don’t let the coronavirus make you a home office security risk

Welcome to life working at home, where the only one standing between you and all kinds of malware, ransomware and other security foul ups is, well, you.

Sure, the tech support desk will try to help you, but it’s not like they can stop by your desk and install a patch for you anymore. It’s a brave new scary world and we’re all trying to do the best we can. So, here, are six tips on how to keep your computer safe.

We hate to say it but all too many computer problems are, as they say in tech support land,  “Problem exists between chair and keyboard (or PEBCAK).” That is, little old you. No one’s asking you to become a security guru and win the next Pwn2Own competition. But you must learn a little bit about how to keep your computer safe and you must be warier of potential threats.

You see, there really are people out there who want to grab your password, steal your data and your company’s data, and infect your computer with ransomware while they’re at it. Or, to be more precise, there are automatic botnet systems out there spending every second of the day pounding on your virtual door.

It’s nothing personal. Just like the coronavirus, though, these really are out to get you. So, you need to act accordingly.

Enable automatic updates (usually)

If you, or your corporate IT staff, haven’t done it before, turn on automatic software updates for your operating system and programs.

Everyone says that, but let me add a caveat: If you use Windows for your desktop operating system, learn what your business’s recommendations are for Windows update. You may not want to update Windows at all.

You see lately Windows 10 has a truly lousy patching record.  This included machines not booting properly; your desktop vanishing into the ether; and the File Explorer Search box went haywire for a while. Microsoft has even delayed retiring Windows 10 1709, known to you as the 2017 Fall Creators Update by six months. That’s just so people don’t have to update their older Windows 10 systems and possibly run into problems.

Given all this, do you really want to update, run into a problem, and then try to troubleshoot it on your own? No, I didn’t think so.

Instead, I suggest you pause Windows 10 updates for now. To do that with a business edition of Windows 10, you do this by going to Settings > Update & Security > Windows Update > Advanced Options. Once there, under the “Choose when updates are installed” heading, select Semi-Annual Channel. This delays major feature updates by about four months, when all the bugs should be worked out. Under the quality update heading, change the deferral period to 30 days from its default of zero. These are the Patch Tuesday patches.

If you’re running a Windows 10 Home and it’s Windows 10 1903 (aka the May 2019 Update, or newer) you can also delay patches. To do this go to Settings > Update & Security > Windows Update, and look for the “Pause updates for 7 days” button. With this, you can keep delaying it in 7 day chunks for up to 35 days.

Everything else, just go ahead and update. There may even be programs you rely on hiding in your system that need patching but do a poor job of alerting you. For these, you can use SUMo or  PatchMyPC or to track other programs software on your PC that may need an update..

Finally, if you go to a random website and it tells you must update Adobe Flash or some other program before you can use it and you can download it from a link they provide, DON’T DO IT. Often this is a corrupted website trying to put malware on your computer.

Anti-viral software: Who needs it?

You wouldn’t know if from all the ads, but viruses are among the least of your security worries these days. There are all kinds of malware out there, but the traditional virus or worm? Not so much.

That said, while you can use one of the latest and best antivirus programs for most of us Microsoft’s own free Windows Defender Security Center is all you’ll need. If you want more check out, Norton Security Premium or AVG Internet Security,

If you use a Mac, you may think you’re safe. Nope. While you’re far less likely to run into malware than your Windows-using colleagues, there are viruses out there with your Mac’s name on them. For overall protection, we recommend Sophos Home Premium. If you just want good free antivirus protection give AVG Antivirus for Mac‘s free tier a try.

Desktop Linux user? You don’t really need an antivirus program. It’s not that Linux’s security is perfect — nothing is in this world — but it’s better than the rest. There’s never really been an effective Linux desktop virus.

Password management

We all hate passwords and want to move on. Well, maybe someday two-factor authentication (2FA) will be perfected. But, we’re not there yet. In the meantime, here are some simple suggestions on how to use passwords safely and efficiently.

First, use passphrases, like “I-Hate-Coronavirus!!,” which you can remember instead of easy to guess passwords like “abcdef,” the ever popular “password,” or your birthday. Nor, should you use memory unfriendly passwords such as “Gog$^Yack4.” Your memory and your security will thank you.

You should also use a password manager. With most of us having to deal with dozens of sites and services requiring passwords, no one can remember all of them. The answer’s a password management program.

Password managers enable you to manage your login credentials across all your devices while keeping your passwords secure. They can also automatically fill in web forms for you. Many web browsers, such as Edge, Firefox, and Google Chrome include this functionality

If you don’t trust Microsoft, Mozilla or Google with your data, or you want non-internet password management, you need a standalone password manager. The best of these are LastPass and 1Password.

Of course, if 2FA is available on services you use all the time. Use It. Yes, it can be a nuisance entering in a PIN from a text message or the like, but it makes them orders of magnitude more secure.

Bad guys gone phishing

The single biggest security problem you’re most likely to run into is phishing. There are two kinds of phishing. In the older type, scammers use email or text messages to trick you into giving them your personal information. Once they have your passwords, account numbers, or Social Security number, you can kiss your privacy, credit score and possibly your job good-bye. In the other, you’re encouraged to download or open a file or click on a link, which will infect your computer with malware.

In either case, they often look like they’re from someone or a company you trust.  They often tell you a story to trick you into making a fatal mistake. This can include the following: Saying they’ve noticed some suspicious activity or problem, there’s a problem with your account, you’re eligible for a refund or you need to pay a (fake) invoice. 

There’s already been a significant rise in coronavirus phishing messages. You can be sure they’ll be many more proclaiming a cure, an urgent message from the CDC, and the like.

Phishing messages also disguise themselves with personal information. They’ll include your home address, your pets’ names and so on. Don’t buy it. It’s easy to find your personal information on the internet. Just consider for a moment how much to tell people about yourself on Facebook and the other social networks.

You can spot phishing messages with several tell-tale signs. If you look closely at the address instead of being from a real address, say [email protected] it will be from [email protected]. They also often open with a generic solution such as “Hi Dear” instead of your real name.

When you get a phishing message, delete it. Never reply to it or open any link or attachment within it.

Finally, another phishing variant is the Microsoft support call scam.  In this one, you’ll get a call from someone claiming to be from Microsoft or a partner and that an automatic scan of your PC has shown a problem and they’re here to help all for one low price No, no they’re not. Microsoft will never call you out of the blue. At the very least, you’ll lose a few bucks and the worst you may find your computer and all your company’s files locked up with ransomware,

Virtual private networks: VPNs still a necessity

These days a lot of our front-line business programs, such as Office 365, Google Docs, and QuickBooks Online use a software-as-a-service (SaaS) cloud model. For these, you don’t need a VPN. But, a lot of our in-house applications still are humming away in our data centers and server rooms. That means, you’ll need a VPN to safely get to them.

If your company hasn’t set up a VPN for you, tell them to set one up right now. Otherwise anything you send between your home and your office is vulnerable to be spied on.

Picking a VPN isn’t your job — you may be acting as a chief security officer, but you aren’t paid like one nor do you have the technical expertise.

If you’re running a small business, you need to pick a small-office/home-office (SOHO) VPN now, Some of the best, easy-to-deploy choices are ExpressVPN, StrongVPN, or TunnelBear

Backups: Your last chance for survival

Last, but never least, you may not think of backups as part of security, but they are. They’re the last safety belt to save you from disaster when everything else has gone wrong. As long as you have a good backup, even if your files are frozen by ransomware and your machines are working more for a botnet than they are for you, you can still wipe everything and start fresh.

Again, this is something your IT department should be handling for you. But, in the rush to get you out the door and working from home. it may have been neglected.

The quickest, easiest way to back up your business PC from home is to use a cloud backup service. Once your company’s sysadmins catches up they’ll also find it easier to get at your backups if they’re on the cloud rather than if you’re using an old-style DVD or even tape backup system. Ones to consider are Acronis, Carbonite, and IDrive. A more home Mac and Windows friendly solution is Google’s Backup and Sync.

Secure at home

Keeping your work safe from home isn’t easy. Butit’s not rocket science either. Just follow these tips and you should be OK.

After all, I’ve been following them for more than 30 years of working from home without a single security incident. If I can do it, you can, too.

Welcome to life working at home, where the only one standing between you and all kinds of malware, ransomware and other security foul ups is, well, you.

Sure, the tech support desk will try to help you, but it’s not like they can stop by your desk and install a patch for you anymore. It’s a brave new scary world and we’re all trying to do the best we can. So, here, are six tips on how to keep your computer safe.

We hate to say it but all too many computer problems are, as they say in tech support land,  “Problem exists between chair and keyboard (or PEBCAK).” That is, little old you. No one’s asking you to become a security guru and win the next Pwn2Own competition. But you must learn a little bit about how to keep your computer safe and you must be warier of potential threats.

You see, there really are people out there who want to grab your password, steal your data and your company’s data, and infect your computer with ransomware while they’re at it. Or, to be more precise, there are automatic botnet systems out there spending every second of the day pounding on your virtual door.

It’s nothing personal. Just like the coronavirus, though, these really are out to get you. So, you need to act accordingly.

Enable automatic updates (usually)

If you, or your corporate IT staff, haven’t done it before, turn on automatic software updates for your operating system and programs.

Everyone says that, but let me add a caveat: If you use Windows for your desktop operating system, learn what your business’s recommendations are for Windows update. You may not want to update Windows at all.

You see lately Windows 10 has a truly lousy patching record.  This included machines not booting properly; your desktop vanishing into the ether; and the File Explorer Search box went haywire for a while. Microsoft has even delayed retiring Windows 10 1709, known to you as the 2017 Fall Creators Update by six months. That’s just so people don’t have to update their older Windows 10 systems and possibly run into problems.

Given all this, do you really want to update, run into a problem, and then try to troubleshoot it on your own? No, I didn’t think so.

Instead, I suggest you pause Windows 10 updates for now. To do that with a business edition of Windows 10, you do this by going to Settings > Update & Security > Windows Update > Advanced Options. Once there, under the “Choose when updates are installed” heading, select Semi-Annual Channel. This delays major feature updates by about four months, when all the bugs should be worked out. Under the quality update heading, change the deferral period to 30 days from its default of zero. These are the Patch Tuesday patches.

If you’re running a Windows 10 Home and it’s Windows 10 1903 (aka the May 2019 Update, or newer) you can also delay patches. To do this go to Settings > Update & Security > Windows Update, and look for the “Pause updates for 7 days” button. With this, you can keep delaying it in 7 day chunks for up to 35 days.

Everything else, just go ahead and update. There may even be programs you rely on hiding in your system that need patching but do a poor job of alerting you. For these, you can use SUMo or  PatchMyPC or to track other programs software on your PC that may need an update..

Finally, if you go to a random website and it tells you must update Adobe Flash or some other program before you can use it and you can download it from a link they provide, DON’T DO IT. Often this is a corrupted website trying to put malware on your computer.

Anti-viral software: Who needs it?

You wouldn’t know if from all the ads, but viruses are among the least of your security worries these days. There are all kinds of malware out there, but the traditional virus or worm? Not so much.

That said, while you can use one of the latest and best antivirus programs for most of us Microsoft’s own free Windows Defender Security Center is all you’ll need. If you want more check out, Norton Security Premium or AVG Internet Security,

If you use a Mac, you may think you’re safe. Nope. While you’re far less likely to run into malware than your Windows-using colleagues, there are viruses out there with your Mac’s name on them. For overall protection, we recommend Sophos Home Premium. If you just want good free antivirus protection give AVG Antivirus for Mac‘s free tier a try.

Desktop Linux user? You don’t really need an antivirus program. It’s not that Linux’s security is perfect — nothing is in this world — but it’s better than the rest. There’s never really been an effective Linux desktop virus.

Password management

We all hate passwords and want to move on. Well, maybe someday two-factor authentication (2FA) will be perfected. But, we’re not there yet. In the meantime, here are some simple suggestions on how to use passwords safely and efficiently.

First, use passphrases, like “I-Hate-Coronavirus!!,” which you can remember instead of easy to guess passwords like “abcdef,” the ever popular “password,” or your birthday. Nor, should you use memory unfriendly passwords such as “Gog$^Yack4.” Your memory and your security will thank you.

You should also use a password manager. With most of us having to deal with dozens of sites and services requiring passwords, no one can remember all of them. The answer’s a password management program.

Password managers enable you to manage your login credentials across all your devices while keeping your passwords secure. They can also automatically fill in web forms for you. Many web browsers, such as Edge, Firefox, and Google Chrome include this functionality

If you don’t trust Microsoft, Mozilla or Google with your data, or you want non-internet password management, you need a standalone password manager. The best of these are LastPass and 1Password.

Of course, if 2FA is available on services you use all the time. Use It. Yes, it can be a nuisance entering in a PIN from a text message or the like, but it makes them orders of magnitude more secure.

Bad guys gone phishing

The single biggest security problem you’re most likely to run into is phishing. There are two kinds of phishing. In the older type, scammers use email or text messages to trick you into giving them your personal information. Once they have your passwords, account numbers, or Social Security number, you can kiss your privacy, credit score and possibly your job good-bye. In the other, you’re encouraged to download or open a file or click on a link, which will infect your computer with malware.

In either case, they often look like they’re from someone or a company you trust.  They often tell you a story to trick you into making a fatal mistake. This can include the following: Saying they’ve noticed some suspicious activity or problem, there’s a problem with your account, you’re eligible for a refund or you need to pay a (fake) invoice. 

There’s already been a significant rise in coronavirus phishing messages. You can be sure they’ll be many more proclaiming a cure, an urgent message from the CDC, and the like.

Phishing messages also disguise themselves with personal information. They’ll include your home address, your pets’ names and so on. Don’t buy it. It’s easy to find your personal information on the internet. Just consider for a moment how much to tell people about yourself on Facebook and the other social networks.

You can spot phishing messages with several tell-tale signs. If you look closely at the address instead of being from a real address, say [email protected] it will be from [email protected]. They also often open with a generic solution such as “Hi Dear” instead of your real name.

When you get a phishing message, delete it. Never reply to it or open any link or attachment within it.

Finally, another phishing variant is the Microsoft support call scam.  In this one, you’ll get a call from someone claiming to be from Microsoft or a partner and that an automatic scan of your PC has shown a problem and they’re here to help all for one low price No, no they’re not. Microsoft will never call you out of the blue. At the very least, you’ll lose a few bucks and the worst you may find your computer and all your company’s files locked up with ransomware,

Virtual private networks: VPNs still a necessity

These days a lot of our front-line business programs, such as Office 365, Google Docs, and QuickBooks Online use a software-as-a-service (SaaS) cloud model. For these, you don’t need a VPN. But, a lot of our in-house applications still are humming away in our data centers and server rooms. That means, you’ll need a VPN to safely get to them.

If your company hasn’t set up a VPN for you, tell them to set one up right now. Otherwise anything you send between your home and your office is vulnerable to be spied on.

Picking a VPN isn’t your job — you may be acting as a chief security officer, but you aren’t paid like one nor do you have the technical expertise.

If you’re running a small business, you need to pick a small-office/home-office (SOHO) VPN now, Some of the best, easy-to-deploy choices are ExpressVPN, StrongVPN, or TunnelBear

Backups: Your last chance for survival

Last, but never least, you may not think of backups as part of security, but they are. They’re the last safety belt to save you from disaster when everything else has gone wrong. As long as you have a good backup, even if your files are frozen by ransomware and your machines are working more for a botnet than they are for you, you can still wipe everything and start fresh.

Again, this is something your IT department should be handling for you. But, in the rush to get you out the door and working from home. it may have been neglected.

The quickest, easiest way to back up your business PC from home is to use a cloud backup service. Once your company’s sysadmins catches up they’ll also find it easier to get at your backups if they’re on the cloud rather than if you’re using an old-style DVD or even tape backup system. Ones to consider are Acronis, Carbonite, and IDrive. A more home Mac and Windows friendly solution is Google’s Backup and Sync.

Secure at home

Keeping your work safe from home isn’t easy. Butit’s not rocket science either. Just follow these tips and you should be OK.

After all, I’ve been following them for more than 30 years of working from home without a single security incident. If I can do it, you can, too.



Source link

Mitigate your risk of getting hacked with help from with this online academy

Cyber crime rates are on the rise. In fact, according to this 2019 Juniper Research paper, the financial burden of this global nuisance is expected to surpass $2 trillion in 2020 alone. But don’t panic. It turns out that education plays a major role in mitigating the risks, which is why grabbing a lifetime subscription to the CyberTraining 365 Online Academy is money well spent.

The CyberTraining 365 Online Academy is a multi-award winning e-training platform. It offers students access to over 660 hours worth of cutting-edge security skills training, facilitated by industry experts, that’ll bring them in line with the National Cybersecurity Workforce Framework. If you own a business and worry that it might be vulnerable, do yourself a favor and find out whether you or your employees could benefit from enrollment.

What makes the CyberTraining 365 Online Academy so different is the fact that students are actually able to earn real certifications while they learn. Few web-based skills training programs boast such a profound advantage. And, since the content is delivered via the web, there are literally no classes to attend. That makes it really convenient, especially for professionals already working in the field who probably don’t have time for a regular full class schedule.

The way we see it, you basically have two choices. Keep doing things the way you are now and pray you don’t become another cyber crime statistic, or put the power of knowledge on your side with the CyberTraining 365 Online Academy. Since the cost of a lifetime subscription is discounted to just $79.99 (from the regular cost of $2,495), this choice should be one of the easiest ones you’ll ever have to make.

 

CyberTraining 365 Online Academy: Lifetime Subscription – $79.99

See Deal

Prices are subject to change.

Copyright © 2020 IDG Communications, Inc.



Source link

Smart lighting security flaw illuminates risk of IoT

The latest smart home security nightmare sheds light on the risk you take each time you add another connected item to your home, office or industrial network – and even market leading brands make mistakes.

The story of Hue

Philips Hue smart lighting systems are probably among the most widely installed smart home solutions in the world, so plenty of people deserve to learn about the latest Check Point research which warns of a major security flaw in them.

It seems it is possible to infiltrate home/office networks using a remote exploit in the ZigBee low-power wireless protocol and Philips Hue smart bulbs and bridge as the access point.

The report claims it was possible to subvert smart home security to the extent that hackers took control of the bulb and then tricked users into a series of actions that let hackers infiltrate the network itself.

Check Point alerted Philips to the problem and the manufacturer very quickly released a software patch to protect against it.

You can get that patch here, and if you happen to have a Hue system installed somewhere in your life you should install it as soon as you can.

Particularly in view of Kaspersky research that tells us attacks against smart home devices climbed by around 700% in the last 12 months.

Why is this still happening?

This strongly reminds me of the highly publicized 2014 attack when criminals used a vulnerability in a connected HVAC system to exfiltrate the details of millions of credit and debit cards from Target.

This is what can happen when attackers succeed in penetrating networks – a little packet-sniffing and your bank details could be purloined – as too might be the access codes for the power plant you work at.

What’s remarkable about this is that it has been six years since the Target hack, and yet it’s still possible to isolate connected items in order to subvert them.

This is a problem Apple has been working to try to solve ever since it created its Made for HomeKit system

Manufacturers have a responsibility

Now, I’m not about to focus my ire on Philips in this – the company took steps to remediate the situation once it heard about it.

Nor is it exactly Zigbee that is at fault — the truth is that every operating system holds its own set of vulnerabilities and identifying them is a big business.

But I will focus some anger at those manufacturers in the smart home space who don’t see security and privacy as important in an increasingly connected age.

Because the risk to your home and business represented by poorly secured devices on your connected networks reflects the weakest devices you have installed far more than the better ones.

You can have ten thousand well secured smart devices, but that ancient connected thermostat in the storeroom may be all the vulnerability a hacker needs to penetrate your entire network.

That’s also why you should diligently check how committed manufacturers are to regular software and security updates for the smart devices they want to sell you. It doesn’t matter if those systems are aimed at business or consumer users, if they don’t commit to regular security protection, you shouldn’t buy them. 

What can you do?

I recommend consumer and enterprise users take inventory of their existing connected device deployments.

When they do, they should ask the following questions:

  • Has this device shown any unexpected instability recently?
  • Is it possible to update the firmware on this device?
  • Is the latest software patch installed?
  • How regularly do software patches ship?
  • Is it possible to change any default password/code on the device and has it been changed?
  • Is it possible to use an alphanumeric code?
  • Does the system support the latest edition of its operating system?
  • What is the device’s networking protocol? Is it still current?
  • Is it possible to identify the device from beyond the network using standard network monitoring tools?
  • If you can’t update the device, or change its password, or it uses an ancient networking protocol, stop using it.
  • If the device is visible to people outside your network, either secure it, or switch it off and send it to be recycled.

In some cases, I’ve heard of deployments in which connected devices are placed on a separate wireless network from any computers or data storage systems.

Apple, has its own solution which may go some way toward securing HomeKit-based smarthomes, Homekit-enabled routers. These let you protect smart devices across your office or home, but only a few routers supporting this are available right now.

Personally, I think every router should have smart device protection baked inside. Perhaps this is what Apple, Google, Amazon, the Zigbee Alliance and others hope to achieve with the Connected Homes over IP project.

But the security vulnerabilities illuminated by this latest Hue problem should be proof positive that better security is mandatory, for your home, your office, factory or any other connected system.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.





Source link

Which Of These Common Candies Puts You At Risk For Heart Problems?

Close up of a pile of licorice candies
FDA

Answer: Licorice

We all know too many sweets are bad for you since excess sugar consumption leads to weight gain, is hard on your pancreas, and can even lead to diabetes in the long run, but some sweets may do you in much, much sooner than others.

If you find yourself eating huge amounts of licorice, you won’t have to wait decades to develop a metabolic disease, as it will do you in long before retirement age is upon you. Black licorice contains glycyrrhizin, a sweet compound found in the licorice root that is preserved during the candy creation process. In addition to its sweet flavor, glycyrrhizin can also cause potassium levels in the body to fall and prolonged licorice consumption—two ounces of real licorice a day for two weeks—is enough to cause some people to experience abnormal heart rhythms, elevated blood pressure, edema (swelling), lethargy, and even congestive heart failure.

If you’re a licorice fan, don’t panic quite yet. Not only is two ounces a day for weeks on end a high amount, but many “licorice” treats don’t actually contain real licorice, but are instead flavored with anise oil, which has the same smell and flavor profile. If you are purchasing real, honest-to-goodness licorice, you can either limit your consumption or shop carefully and purchase deglycyrrhizinated licorice (DGL), which has the heart-troubling compound removed.





Source link

Huawei 5G Hardware as a National Security Risk, Explained

Huawei is a constant headline maker. In the UK, the Defence Secretary was sacked for allegedly leaking details of Huawei’s involvement with the rollout of 5G. In the United States, government officials are cracking down on Huawei over the same technology; federal agencies and subcontractors must not use Huawei products and services.

It raises the question: Is Huawei truly a security threat?

Is Huawei a National Security Threat?

There are no easy answers to a question that has a long recent history. If you ask Huawei, of course, they will tell you that their services and products are clear of malicious intent. Ask a Five Eyes government official and you will receive a very different answer.

Unfortunately, for the public, finding out the truth of the matter is difficult. For the most part, we must rely on what appears in the media.

Another way to look at the problem is to consider the objections of governments, politicians, and agencies that oppose Huawei.

As one of the world leaders on 5G network technology, governments and telecom firms alike want to work with Huawei. However, the primary concern is that Huawei telecoms equipment is a conduit for Chinese government spying.

Installing Huawei developed technology and hardware will open a direct line into the heart of a nation’s critical infrastructure, including wireless communication and emergency service networks. (What is 5G wireless technology?


What Is 5G? Here’s How It’ll Make Mobile Internet Faster and Better




What Is 5G? Here’s How It’ll Make Mobile Internet Faster and Better

Feel your mobile internet is too slow? 5G is the next generation of mobile internet, and will make mobile data faster than ever.
Read More

)

So, what’s the evidence? Can any country or organization categorically prove that the Chinese government is using Huawei as a front for espionage?

The Evidence Against Huawei

The concerns surrounding Huawei center on the Chinese tech giant’s links to the Chinese military. Huawei’s founder, Ren Zhengfei, has strong ties to the Chinese military, where he served as an engineer. He also has links to the ruling Communist Party.

A telecoms company founded by a former military tech expert that provides telecoms equipment to the world, whose company has a strong say in the development of the next generation of mobile wireless technology, 5G.

In addition, in 2018, a new Chinese national intelligence law that came into force contained concerning language. For instance, Article 7 of the law states “All organizations and citizens shall, in accordance with the law, support, cooperate with, and collaborate in national intelligence work, and guard the secrecy of national intelligence work they are aware of . . . The state will protect individuals and organizations that support, cooperate with, and collaborate in national intelligence work.”

Most recently, the Times reported that the CIA holds evidence of collusion between the Chinese government and Huawei, but it hasn’t been openly published. According to the newspaper’s source, Huawei has “received funding from the branches of Beijing’s state security apparatus… American intelligence shown to Britain says that Huawei has taken money from the People’s Liberation Army, China’s National Security Commission, and a third branch of the Chinese state intelligence network.”

Of course, no one has seen the evidence to corroborate the allegations. It is unlikely anyone will, at least not without a significant security clearance.

Inconclusive Evidence of Hardware Spying

The issue remains that, despite numerous congressional hearings, despite the UK Defence Secretary, Gavin Williamson losing his ministerial role over a leak regarding Huawei, and despite the links between the Chinese government and Huawei, there isn’t any physical evidence of spying. (Still, should you trust a Huawei phone?)

Outside of Huawei, there was the alleged link between hardware manufacturer, SuperMicro, and the Chinese government. Bloomberg printed an expose claiming that SuperMicro was selling servers and other hardware with motherboards containing minute chips designed to spy on US companies, like Apple and Amazon.

Unfortunately, Bloomberg didn’t provide any evidence to the US tech companies allegedly infiltrated. Nor did it elaborate on any evidence in any of the articles published regarding SuperMicro. The lack of evidence saw Apple, Amazon, and other major US tech companies categorically deny the claims. Next up, the UK’s National Cyber Security Centre (NCSC), part of GCHQ, said it had no reason to doubt Apple or Amazon.

And then, the US Department of Homeland Security (DHS) said almost the same.

Turning the tables, the US authorities accused Huawei and its chief financial officer, Meng Wanzhou, of conspiring to defraud HSBC and other banks by twisting Huawei’s operating relationship with Skycom Tech Co Ltd—a suspected front company operating in Iran that broke US sanctions.

How did the US find out about this? By spying on Huawei.

The Hypocrisy in Calling Out Huawei

When so much time is devoted to calling out one company, it is easy to forget the masters are constantly at work. The NSA, CIA, MI6, and other agencies from the Five Eyes countries continue to operate similar programs throughout the world.

Indeed, Edward Snowden describes the Five Eyes intelligence gathering as a “supra-national intelligence organization that does not answer to the known laws of its own countries”—let alone the laws of other countries where intelligence operations take place.

“Huawei has not and will never plant backdoors. And we will never allow anyone else to do so in our equipment.”

Huawei’s rotating chairman, Guo Ping, attacked those efforts at the 2019 World Mobile Congress, specifically noting that the NSA was shown to have been operating a covert program against Huawei since at least 2007.

Guo finished strongly, claiming that “The fusillade being directed at Huawei is the direct result of Washington’s realization that it has fallen behind in developing strategically important technology . . . The global campaign against Huawei has little do with security, and everything do with America’s desire to suppress a rising technological competitor.”

Again, Is Huawei Actually a Security Threat?

The flipside looks like, at least to me, that the US government (and other Five Eyes governments) are saying “it takes one to know one.” Huawei may not directly hack US telecoms networks or other wireless technologies. But, they know what the NSA is doing and has done, and realize that the Chinese government is absolutely practicing similar techniques in counter-espionage.

In that, while there is no current physical evidence that Huawei is hacking the US wireless network or attempting to backdoor the upcoming 5G rollout, who is to say they won’t at a later date. At the end of the day, it isn’t Huawei that is really the security risk. It is the agencies that use them as a conduit that are; Huawei must suffer in the middle to keep its position as a darling of Chinese tech.

One more thing: US tech companies are far from free of the grasp of the government, providing backdoors, by law, into databases and other data collection programs. The Chinese government gives many of those companies a wide berth. Why shouldn’t the US, UK, and other Western countries do exactly the same to Chinese tech companies?

Five Eyes countries have previous with barring certain foreign companies working in areas with exposure to sensitive information. Kaspersky was in the firing line throughout much of 2017 and into 2018. Learn more about Kaspersky as a reliable antivirus suite


Is Kaspersky Still Reliable Antivirus Software?




Is Kaspersky Still Reliable Antivirus Software?

Security news is currently awash with a series of accusations against one of the world’s leading antivirus developers, Kaspersky Lab. So, can you trust Kaspersky antivirus, or does it let Putin into your PC?
Read More

.

Explore more about: Computer Security, Huawei.





Source link