Malware Comes with gadgets

[Lewis]

Malware Comes with Many Gadgets, Homeland Security Admits

Jul 9, 2011 1:00 PM

A top Homeland Security Official admitted to Congress that electronics and software sold in the United States are sometimes preloaded with spyware, malware, and other nasty security-compromising components by unknown foreign parties.
[video=youtube;xFlgaJa4UVk]http://www.youtube.com/watch?feature=player_embedded&v=xFlgaJa4UVk[/video]
Greg Schaffer, DHS assistant secretary for cybersecurity and communications, testified to the House Oversight and Government Reform Committee last week saying that Homeland Security and the White House have been aware of the threat for quite so

me time.
Schaffer admitted he is aware of instances when foreign-made technology was built with embedded security risks but did not elaborate on what kind of equipment DHS has encountered. He also pointed out that overseas components are found in many domestically manufactured electronics.
Fast Company's Neal Ungerleider, who first reported the news, uncovered a few paragraphs in the White House's Cyberspace Policy Review (PDF) that he thinks shows the administration is aware of problems with imported technology:
"The emergence of new centers for manufacturing, design, and research across the globe raises concerns about the potential for easier subversion of computers and networks through subtle hardware or software manipulations. Counterfeit products have created the most visible supply problems, but few documented examples exist of unambiguous, deliberate subversions.
A broad, holistic approach to risk management is required rather than a wholesale condemnation of foreign products and services. The challenge with supply chain attacks is that a sophisticated adversary might narrowly focus on particular systems and make manipulation virtually impossible to discover. Foreign manufacturing does present easier opportunities for nation-state adversaries to subvert products; however, the same goals could be achieved through the recruitment of key insiders or other espionage activities."
Based on the review, which was written several months ago, the most compromised technology is counterfeit devices but it's possible mainstream products could be infected. This is particularly troubling since DHS declined to specify what kind of technology it found with embedded malware.
MSNBC's Alex Johnson found a YouTube video of the hearing; you can watch the exchange starting at 51:47.
PC World

 

[tim-from-pa]

When I read the article, it is unclear to me what type of "gadgets" these are, but I'm assuming portable electronic devices. The Operating Systems in such devices that use Android or from Apple, etc. don't get malware, at least not in the sense that Microsoft does. What they do get are Trojans which are simply applications that are malicious, but unlike Microsoft where a Trojan makes the behavior of the whole device or computer go bonkers, on Apple, Android or similar they do not do that ---- rather it may do something like sending out information in a stealth manner while your iphone otherwise works perfectly well. Already Steve Jobs had to answer for similar applications from themselves sending back private data such as the user's location.

In addition, the tone of the article was such that these devices already had such malware on them--- not something a user innocently picks up while browsing the way Microsoft does.

I get a little annoyed at the malware scares for portable devices and I have yet to know someone personally that ever had one. But ask anyone who has or had a Microsoft device or computer and they'll tell you horror stories about malware. Just because Microsoft is sickly doesn't mean they have to project their inadequacies on other OS's and scare the people. Portable devices won't have much trouble until windows 8 gets put onto them, then "all of a sudden" we will see that happening, but only to Microsoft devices which is why I don't think they are going anywhere in that market unless they clean up their act major-time.