Feb 16 2009

DNS redirection — do antivirus firms have the right to do it en masse?

No Gravatar

TechRepublic pundit Michael Kassner dares to ask a philosophical question. Do antivirus firms have the right to manipulate DNS queries en masse to protect society from a rampant worm or virus? “I’m concerned that precautionary actions being taken may be setting dangerous precedence,” Kassner notes.

Believe me: I envy him for asking this philosophical question. Kudos!

Kassner asks if anti­virus firms have the right to mani­pu­late DNS queries en masse to pro­tect society from the Downadup worm. This forces us to ask “Who watches the Watchmen?”

Obviously, we can respond to Kassner with a tagline from an upcoming movie: “Who watches the Watchmen?” It’s a corollary philosophical question that brings out the debate in all of us.

On the one hand, I don’t think Joe SixPack will care if a reputable DNS provider (e.g. OpenDNS) wants to protect him from a well-documented worm. Joe will almost certainly say “more power to ‘em” and go about his business. If the root servers themselves get involved in this, I think Joe will say the same thing. “They’re protecting me from harm, what’s wrong with that?”

On the other hand, I doubt the U.S. government wants a Russian or Chinese antivirus firm to control the direction & path its military computers take. If any nation could offer protection like this to the root servers themselves, they could very easily weaponize it for a cyber-war. “Greetings, Comrade! Your battalion need directions to g2.army.mil? March your Internet connection to 162.105.161.214…”

Then again, I could very well be wrong here. The Pentagon and the Beltway actually might not care at all who ultimately controls the root DNS servers that their DNS servers rely on.

Things willmight change if/when a reputable civilian firm takes up arms in a cyber-war, making enemies of some of their own customers. But I guess we’ll need to wait for OpenDNS to declare war against the U.S. Air Force.

“Waitaminit, Rob! Didn’t we already debate this in 2001 when The China Syndrome first came to light?” Sure we did — and Joe SixPack told us by his inaction that he doesn’t care one iota if his antivirus firm arms a hostile country with offensive cyber-smallpox technology. Likewise, the U.S. government told us by their inaction that they don’t care, either.

That’s why I might be wrong in thinking the U.S. government actually cares who controls the root DNS servers that their DNS servers rely on. And this only makes sense if you think about it. You just know some members of the U.S. Air Force information assurance community have configured OpenDNS on their home PCs and personal laptops. That means they trust a Russian antivirus firm to protect all of those sensitive-but-unclassified EPRs & OPRs they love to work on after duty hours…

Jan 28 2009

Why Symantec’s CEO shouldn’t be Obama’s Commerce Secretary

No Gravatar

A Fox News report claims President Obama has his eye on Symantec CEO John Thompson as his “leading candidate for Commerce Secretary.”

I think the president should reject Thompson — because Symantec secretly turned over computer viruses to China for at least two years during Thompson’s reign as CEO.

Washington pays Thompson’s firm a lot of money to pro­tect govern­ment com­pu­ters from the same viruses they supplied to China.

And now Obama might nomi­nate him for Secre­tary of Commerce…

Mind you, the U.S. government pays Symantec a lot of money to protect U.S. government computers from the very same computer viruses they gave to an oppressive regime that openly despises U.S. national security interests. How much more ironic can you get?

Not only did Symantec arm China with cyber-smallpox technology … they did it right under the very noses of the White House and the FBI. Symantec’s executive team actually decided “we’re going to arm China and we’re not going to arm the U.S.” And John Thompson sat at the very top of the company’s executive team that made this decision.

For at least two years during Thompson’s reign at Symantec, his people advised the White House and the FBI on global cyber-threats to U.S. national security. Symantec often flew their people into D.C. on the company’s dime so they could personally brief people like Richard Clarke. Thompson’s people stood next to White House senior staffer Richard Clarke in his famous “Y2K situation room,” ready to help out if China had dared to launch a cyber-attack.

And at the very same time, Thompson’s people also opened a pipeline to China so they could smuggle digital munitions to a country the U.S. now believes is responsible for hordes of cyber-attacks launched against federal, state, and local government networks.

For at least two years during Thompson’s reign, his company armed Beijing’s oppressive regime for a single reason: commerce. Symantec wanted to pave governmental inroads to China’s growing corporate market for PCs and software.

Does America really need a Commerce Secretary who spent two years arming China with network warfare weapons, all while keeping the White House in the dark?

“CEO Thompson” kept all of this a secret from both Clinton and Bush. What will “Secretary Thompson” keep secret from Obama?


Let’s suppose Thompson dons the mantle of Commerce. And let’s suppose China releases an über-virus that makes a shambles of our banking & commerce networks. “Team Obama” descends on the White House for an emergency cabinet meeting.

“Here’s what we know,” says the Secretary of Defense. “Beijing attacked us with a virus that has the telltale signature of a Symantec goat file. In fact, we think they built this virus based on what Symantec delivered to them on March 12, 2000 at 08:43am Pacific Time.” The Secretary of Commerce shifts nervously in his seat.

“We think China did this on purpose — used one of Symantec’s goat files,” the Secretary of Defense continues. “We think they did it just to put us in the very quandary we’re in right now.”

Obama speaks up. “I don’t get it. What quandary are we in right now?”

The Secretary of Defense coughs nervously. “Mr. President, Symantec’s delivery of viruses on March 12, 2000 included an email trail from senior management. Marketing had complained that the virus experts were deliberately trying to slow down the transfer of viruses to China. The last email comes directly from senior corporate management. The person who sent that email, told the director of virus research to give Marketing what they need so Symantec can keep their commerce moving in China … and ‘commerce’ is a direct quote from the email. The senior corporate manager warned that if the flow of viruses didn’t go up immediately, he said John Thompson would personally come down there and fire the director of virus research.”

The Secretary of Commerce blurts out “I didn’t write that email!” All eyes in the room turn toward John Thompson. “Somebody at my company must have been using my name in vain, Mr. President.”

President Obama frowns and turns back to his Defense Secretary. “Okay. I see the quandary.” He turns again to the Commerce Secretary. “John, you are excused from the rest of this meeting…”