UK between a rock and a Huawei place. Huawei's stolen data tech finally up for sale. Incoming threats from deepfakes and drones. These stories and more in this week's ISMG security report.
Hello, I'm Nick Holland. In the on-again, off-again saga reminiscent of the ongoing Brexit debacle, this week the UK government announced that it will indeed be allowing Huawei to play a limited role in the country's 5G rollout, a move that has sparked the ire of the White House. With the details, here's ISMG's executive editor, Databridged, in Europe, Matthew Schwartz. Huawei has scored a victory in the UK, where the government on Wednesday said that the Chinese manufacturing giant can play a limited role in Britain's national 5G rollout.
But will Huawei's victory come at a price for Britain's national security? That's the warning being sounded by the White House, which has been lobbying allies to not use any gear built by the likes of Huawei or ZTE and threatening to withhold sensitive intelligence if allies don't comply. The so-called Huawei question is whether Chinese manufacturers can be trusted or if their technology might be subverted by the Chinese government to spy via other nations' infrastructure. Of particular concern is China's national intelligence law of 2017, which Beijing could use to order a company to act in a manner that might harm the interests of, for example, the UK.
Another risk is that the technology could become a linchpin in future trade disputes. For example, the Chinese government might block security updates to fix known flaws in Chinese-built gear as a bargaining chip. So far, British Prime Minister Boris Johnson's decision to allow Huawei to be part of Britain's 5G rollout hasn't resulted in an outright condemnation by the White House. The UK government says its decision was made based on a comprehensive, evidence-based review of telecommunications supply chain risks by Britain's National Security Council, which Johnson chairs.
Politically speaking, the Prime Minister has been trying to balance multiple factors, especially as the EU prepares to Brexit the European Union, which is its largest trading partner, followed by the US and China. Of course, Johnson risks angering those last two and future trade deals if he mishandles the Huawei question. But US Secretary of State Mike Pompeo, who traveled to London this week, noted that the UK might re-examine its Huawei decision as its national implementation moves forward. Huawei's vice president, Victor Zhang, welcomed what he called the UK's evidence-based decision.
And he called on other countries, including Australia, to follow Britain's lead and allow the company to supply them with high-speed next-generation equipment. Australia has already responded by saying its ban on Huawei will remain in place. But the EU on Wednesday followed Britain's example by saying member states can decide if they want to block or restrict high-risk vendors such as Huawei. Telecommunications providers have been lobbying the UK government hard to use Huawei equipment.
And warning that excluding it could delay the UK's 5G rollout by two years or more. Products from competitors are available, including from Ericsson in Sweden and Nokia in Finland. But analysts say the selling point of equipment built by Huawei, which is heavily subsidized by the Chinese state, is that it is much less expensive than rival offerings. Critics of China, however, say that's by design because Beijing wants to dominate the world's next-generation mobile network equipment marketplace.
Johnson's decision, however, does impose some limits. He says high-risk vendors, including Huawei, will be excluded from sensitive core parts of 5G and gigabit-capable networks. Meaning its gear can only be used in the periphery of the network, known as the access network, which connects devices and equipment to mobile phone masts. That restriction has been put in place based on advice from Britain's National Cyber Security Center, which is part of British intelligence agency GCHQ.
The NCSC believes use of Huawei in non-core settings can be managed. But it says Huawei must not be used in core functions, including anything to do with security, virtualization, software-defined networking, authentication, network monitoring, or lawful intercept. In addition, for each of the country's big four mobile telephony providers, only 35% of their non-sensitive networks can be built using equipment from high-risk vendors. Huawei's equipment will also be excluded from all safety-related and safety-critical networks in the critical national infrastructure, as well as from a range of other sites, including nuclear installations and military bases.
Expect a new British law on telecom security requirements to be introduced by the government based on the NCSC's recommendations. It says those recommendations focus on creating a security framework, which, when followed by network operators, will be designed to mitigate a range of national risks to the telecommunications network and will significantly reduce the likelihood of a successful attack and the harm caused when one happens. Of course, there's no such thing as bulletproof security. But by including cybersecurity and resiliency as core components in Britain's 5G network, Britain hopes to build a stable and secure 5G network from the ground up.
Will it succeed? Only time will tell. For Information Security Media Group, I'm Matthew Schwartz. You're listening to the ISMG Security Report on ISMG Radio.
ISMG, your number one source for information security news. Wawa. Not only the name of a supermarket chain that's allowed the exposure of card data for eight months last year, but probably the sound coming from its senior management, as news broke this week that the trove of some 31 million credit and debit cards was now for sale on the dark web. With more is ISMG's Managing Editor, Security and Technology, Jeremy Cooke.
A long-running marketplace for buying stolen payment card data is advertising a large new batch. Experts say it's linked to the card breach at Wawa convenience stores revealed late last year. On Monday, the Joker Stash marketplace said it has 30 million stolen credit card details. Gemini Advisory is a New York-based consultancy that specializes in anti-fraud services.
It says the data likely comes from the attack against Wawa. Christopher J.S. Thomas is an intelligence product analyst with Gemini. He says the breach ranks with some of the largest card breaches of all time, including Target and Home Depot.
In December, Wawa revealed that point-of-sale devices and fuel dispensers across its 850 stores were infected with malware. Malware collected credit and debit card numbers, expiration dates, and cardholder names. The exposure lasted around eight months through December. The data may be of limited use to fraudsters.
Wawa said at the time of the breach that the CVV, which is the three-digit security code on the reverse of a card, was not leaked. That would make it harder for cybercriminals to make online card-not-present purchases, which usually require that code. Also, Wawa says PINs were not breached, nor other personal information. However, Thomas says that it still may be possible to leverage the data for fraud.
Christopher Thomas. It's certainly not going to be the most high-demand and the most desirable information out there, although it's often possible to make fraudulent gains off of little information. JokerStash says it also plans on posting geolocation data, which could include a cardholder's city and state of residence and zip code. That could allow fraudsters to seek out those people and trick them into divulging the CVV.
So far, however, only state has been listed. Thomas says JokerStash also tends to use extra-large breaches that it acquires to generate attention more than sales. The site has recently been trying to defend its reputation, citing media stories and taking credit for well-publicized breaches. Thomas again.
It's certainly like shooting a flare through the sky so everyone knows about the breach, everyone knows that it's been posted. So in terms of staying under the radar, this is certainly not the type of strategy you would enact for discretion. And that would make it more difficult to cash out the cards. Wawa issued a statement on Tuesday saying it is confident that the malware was contained by December 12th and that customers had not been at risk since then.
And as is customary, it is offering customers a year of fraud and credit monitoring. But Wawa's predicament shows once again the struggle retailers are facing with point-of-sale malware. For Information Security Media Group, I'm Jeremy Kirk. Finally, ISMG's SVP of editorial, Tom Field, had a fascinating conversation this week with Dave DeWalt, former CEO of FireEye and McAfee, and today appointed vice chair of the board of Inaxis, a vendor focused on securing business-critical applications such as ERP and CRM.
In this part of the interview, Tom asks Dave about incoming threats that keep him up at night. This is Dave's response. Yeah, I am on several cybersecurity companies, and I've been afforded an opportunity now in this sort of phase of my career to really look where the greatest gaps are between offense and defense. And that's really where I have my dragon invest, and that's where I like to focus.
So, you know, those big offensive gaps, what can the nation-state do? What can the criminal organizations do? What can the terrorist organizations do that there's very little commercial defense? And quite honestly, one of the reasons we're talking today is because business applications are one of those biggest gaps in these big applications, right?
But to give you a couple others, you know, I'm really focused in on social networks. It seems pretty obvious in light of things, deepfakes is a significant challenge for these network ties. We have over 3 billion users online on social networks today. These applications are massive, measured in billions.
They have very little security. They don't really care to have security, ironically. And when we look at the virality of information, the ability to influence people through that information, we have one of the biggest pandemics, in my opinion, in, you know, technology history. Because what you see oftentimes is what you believe.
And, of course, if the information is fake or the information has been altered, we tend to see a, you