Security News
The Chinese surveillance balloon that drifted across the US last week looks set to spark a new round of sanctions against Middle Kingdom tech firms. Ned Price, the State Department spokesperson said on Thursday, "We're exploring taking action against PRC entities linked to the PLA that supported the balloon's incursion into US airspace."
Australia's Defence Department removed all Chinese manufactured surveillance cameras after an audit detailed the number of Hikvision and Dahua devices installed in various government facilities. In an impromptu interview on Friday, deputy prime minister and minister of defence Richard Marles revealed that all the relevant Chinese-manufactured Defence department cameras had been removed.
Tensions between two of the biggest producers of connected devices are coming to a head, and will be changing the IoT landscape in 2023. In recent months, India and China have faced off over their disputed border in the Himalayas.
Google's Threat Analysis Group has burned more than 50,000 spammy fake news stories and other content posted by the pro-China 'Dragonbridge' gang. Meta and Twitter have also removed fake content from China that looks and sounds very similar to Dragonbridge's efforts.
China's government has declared the nation's information security industry needs to grow - fast. A document with the catchy title of "Guiding Opinions of Sixteen Departments Including the Ministry of Industry and Information Technology on Promoting the Development of the Data Security Industry" was issued last week, setting out an ambitious program to scale the industry at 30 percent compound annual growth rate, so it reaches ¥15 billion of annual revenue by 2025.
Three years from now, hypothetically, China launches an amphibious invasion of Taiwan. There's no overland route to deliver supplies to Taiwan's military - whatever it has when China invades is what it'll have until friendly forces can resupply it over the Pacific.
An ex-General Electric engineer has been sentenced to two years in prison after being convicted of stealing the US giant's turbine technology for China. New York resident Xiaoqing Zheng, 59, who used to be employed at GE Power and specialized in turbine sealing technology, was convicted of conspiracy to commit economic espionage at the end of March after a jury trial in the Northern District of New York courthouse.
The social media conglomerate also took steps to disable accounts and block infrastructure operated by spyware vendors, including in China, Russia, Israel, the U.S. and India, that targeted individuals in about 200 countries. A second set of 250 accounts on Facebook and Instagram linked to another Israeli company called QuaDream was found "Engaged in a similar testing activity between their own fake accounts, targeting Android and iOS devices in what we assess to be an attempt to test capabilities to exfiltrate various types of data including messages, images, video and audio files, and geolocation."
The China-linked crime gang APT5 is already attacking a flaw in Citrix's Application Delivery Controller and Gateway products that the vendor patched today. Citrix says the flaw, CVE-2022-27518, "Could allow an unauthenticated remote attacker to perform arbitrary code execution on the appliance" if it is configured as a SAML service provider or identity provider.
Today I have some squid geopolitical news. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here.