Welcome to Codebook, the only cybersecurity newsletter officially informed that the president's Twitter account can't grant reporters a federal holiday.
Tips? Ideas? Feel free to respond to this email.
Welcome to Codebook, the only cybersecurity newsletter officially informed that the president's Twitter account can't grant reporters a federal holiday.
Tips? Ideas? Feel free to respond to this email.
Illustration: Rebecca Zisser/Axios
Now that the U.S. and other countries are barring the use of Chinese-built 5G equipment — thanks to allegations that China's government sabotages those products for espionage purposes — we're beginning to see more suspicious treatment of other infrastructure built in China, too.
The big picture: Following the U.S. ban on Chinese-made telecom equipment from Huawei and ZTE, we'll have to decide whether that means other parts of other supply chains are also guilty by association.
Regulators often deal with these kinds of supply chain issues product by product only after a problem is discovered. That leaves much of the burden on the customers, who are often left hoping that the product they bought won't eventually run afoul of the government.
Take solar equipment as an example:
With mass transit, there are not a lot of other options beside Chinese components. And as in many other industries, Chinese components are typically cheaper.
The big question: How do you maintain global supply chains without getting involved in the geopolitics of smart devices?
The risk management proposition for companies should be "holistic" and case by case, said Edna Conway, chief security officer of the global value chain at Cisco and a member of the Department of Homeland Security's supply chain task force.
The bottom line: Policies driven by economic nationalism are likely to be overly broad and potentially destructive. "The global value chain is a benefit to all. We can and should continue to avail ourselves of it," said Conway.
Listings on the hacker forum. Photos: Sixgill
Separate hackers on a Russian-language hacker forum have offered to sell access to the content management systems of bundles of news sites since October, notes Israeli threat intelligence firm Sixgill, which would give buyers the ability to edit or upload their own news stories. One offered access to 1,425 U.S. sites.
Why it matters: "We get a sense of urgency from looking at this stuff," said Alex Karlinsky, a intelligence expert at Sixgill. "It may seem like a small thing, but in this era of political bots and trying to influence opinion, this is another way to do that."
Details: The posts appeared on a predominantly Russian-language hacker forum where hackers frequently auction access to websites of all types.
The hackers in both cases were well-established enough on the forum that the listings appear credible, said Karlinsky.
There does not appear to be a specific spike in sales of access to news agencies, said Karlinsky. Rather, the two listings covering the same ground were a coincidence brought about by the rise in listings of pre-hacked sites overall.
More than 80 certificates from federal websites have expired during the shutdown, notes Marc Rogers, director of cybersecurity for Okta.
Certificates? One major protection for web users is a trusted third party that ensures your web browser is connecting directly to a web site. They call that a certificate.
Why it matters: "Consumers will either not be able to access certain sites or view them via a trusted browser," said Rogers.
After Poland arrested a Huawei executive for espionage last week, the Wall Street Journal reports that Poland will join the U.S. in lobbying NATO nations to avoid Chinese telecommunications tech many nations link to espionage.
Meanwhile: Ren Zhengfei, the typically reclusive founder of Huawei, emerged Tuesday to tell reporters the company does not spy on behalf of China.
Codebook will see you Thursday.