Spies Are Going After US Supply Chains, Intel Agencies Say

This is an interesting article about foreign intel agencies infiltrating our IT systems. I am posting it primarily because they link CCleaner with China and hacking for industrial espionage and getting into government IT systems. CCLeaner is popular- I use to use it but replaced it with Malwarebytes.

If you have CCLeaner I would uninstall it. I did that with Opera (a great web browser) when a Chinese company bought it.

Evanina declined to slam Trump’s decision on ZTE, but said, “I will say that the intelligence community is on the record about the threat posed by Chinese telecom.” Asked whether he would use a ZTE phone, Evanina answered, “I would not.”

The government’s efforts to better manage security risks to the government and military supply chain go back a decade. They include a 2015 best-practices report from the National Institute of Standards and Technology, and a requirement in the 2018 defense authorization act that the Pentagon develop a better process for supply-chain security.

But the risk is growing and there’s no simple solution, according to Joyce Corell, the assistant director for supply chain at the National Counterintelligence and Security Center, or NCSC.

“The software supply chain is clearly being used as a threat vector,” Corell said.

She cited reports from cybersecurity company Crowdstrike, whose 2018 Threat Report identified out two software-based supply chain attacks with Chinese origins: Netsarang and CCleaner.

“Both of these back-door attacks on legitimate applications point to China-nexus threat actors, and used the technique of compiling malware directly into the compromised software,” the company notes. “Similarities between these attacks, such as command-and-control tactics and code overlaps, suggest they are connected to the same threat actor.”
Trump is using the wrong carrot in trying to save ZTE for trade concessions with China.