US suspects some foreign-made components threaten cybersecurity

from abcnews: Some foreign-made computer components are being manufactured to make it easier to launch cyber attacks on U.S. companies and consumers, a security official at the the Department of Homeland Security said. "I am aware of instances where that has happened," said Greg Schaffer, who is the Acting Deputy Undersecretary National Protection and Programs Director at the DHS. Schaffer did not say where specifically these components are coming from or elaborate on how they could be manufactured in such a way as to facilitate a cyber attack. But Schaffer's comment confirms that the U.S. government believes some electronics manufacturers have included parts in products that could make U.S. consumers and corporations more vulnerable to targeted cyber attacks. A device tampered with prior to distribution or sale could act as a "Trojan horse" in the opening wave of an international cyberwar. Contaminated products could be used to jeopardize the entire network. The admission by Schaffer came out Thursday after repeated questioning from Rep. Jason Chaffetz, R-Utah, at a House Oversight and Government Reform Committee hearing on cyber threats. ABC News previously reported that the FBI was investigating a case in which counterfeit Cisco routers were being sold to various government agencies but this is the first time that a government official has confirmed that the threat is real.

fbi tracking "suspects" online

A Freedom of Information Act(FOIA) request made in 2007 by the Electronic Frontier Foundation (EFF), reveals FBI using secret spyware. A recent article at Raw Story shows "...that software called the Computer and Internet Protocol Address Verifier (CIPAV) was used by the FBI since at least 2001. The software allows the FBI to collect a variety of information from a computer every time it connects to the Internet, including the IP address, Media Access Control (MAC) address, open communication ports, list of the programs running, URLs visited, and more. It is unclear how the FBI installs the software on a computer, but it is suspected that the spyware exploits a vulnerability in the user's browser, like other common Internet viruses."

However, the article notes a greater threat posed by a recent FBI proposal. "In February, the FBI urged members of the House Judiciary Subcommittee on Crime, Terrorism and Homeland Security to update the Communications Assistance to Law Enforcement Act (CALEA) and make it easier for authorities to eavesdrop on Internet." CALEA is the same 1994 law that the US administration was not observing just prior to the Iraq war!