Home » Posts tagged 'cybersecurity'
Tag Archives: cybersecurity
Google Recommends Product From a Chinese Company with Communist Party and Military Ties for its ‘Advanced Protection Program’
Matthew Robertson, August 23, 2018
“Our goal is to make sure that any user facing an increased risk of online attacks enrolls in the Advanced Protection Program.” — Dario Salice, Advanced Protection Product Manager at Google.
Journalists and dissidents involved in Chinese affairs are accustomed to every so often receiving a pop-up banner on their Gmail from Google informing them that “state-sponsored attackers” may have been attempting to gain access to their accounts. To guard against such intrusions, Google suggests signing up for its Advanced Protection Program.
The Advanced Protection Program involves using a pair of security keys that can be purchased on Amazon. The problem? Google recommends a product — the Feitian MultiPass FIDO Security Key — manufactured in China, by a Chinese company that is part of an “IT-Military Alliance” with the People’s Liberation Army (PLA). Its chief of research and development of over 16 years is a former member of the PLA. And it does the vast majority of its business selling security hardware to Chinese state banks.
Google unveiled its Advanced Protection Program in October 2017 as reported by The New York Times. But the report did not explore the extensive relationships between the Chinese supplier, Beijing Feitian Chengxin Technology Co., Ltd., and the Chinese government.
Security keys like the Feitian MultiPass are an implementation of public key cryptography — the most well known version of which is PGP (Pretty Good Privacy) — in hardware form. They are a form of two-factor authentication that allow an individual with the key and the password to access an account; if either is missing, access is denied. The introduction of hardware to the security equation makes access safe from phishing, social engineering, and even attacks on cell phones that intercept temporary security keys sent via SMS.
It is unclear how feasible it may be for Chinese intelligence and military actors to install a backdoor in or otherwise compromise the hardware. But if the hardware manufacturer is mobbed up with one of the most sophisticated offensive cyber actors in the world, the “world’s worst abuser of internet freedom” according to Freedom House, and a country where a private company can never say no to government demand, the question arises: Can it be safe?
China Change examined security filings, advertisements, periodicals, and media reports to build a mosaic of the interlocking relationships between Chinese state organs and Feitian Chengxin (飞天诚信股份有限公司). The image that emerges does not appear encouraging for the computer security of Chinese dissidents and others who may be using the product.
Feitian was set up by four friends, three of whom were 1992 computer science graduates of Northern Jiaotong University (now Beijing Jiaotong University 北京交通大学): among them Huang Yu (黄煜), the current chairman, Li Wei (李伟), the general manager, and Lu Zhou (陆舟) their chief engineer. Han Xuefeng (韩雪峰), a middle-school friend of Huang Yu, was recruited from a computer job in the Ministry of Railways to form the company with them. The four continue to own the majority of the company’s shares.
The company was founded in 1998 at the beginning of a technology and internet boom in China. It has since become “the No.1 supplier of user authentication and transaction security for China Online Banking,” according to its website, employing 850 staff and serving thousands of businesses in 100 countries.
As Feitian grew, so too did its ties to official China. By 2015, the conference room in its main Beijing campus had a wall full of awards and certifications from Chinese government departments.
Dominance in the state bank market
The foundation of Feitian’s business in China has been in providing security fobs to state banks.
Lucrative contracts with the Industrial and Commercial Bank of China (the country’s largest) and China Merchants Bank were its first major orders in 2003, though it sat lower down in the food chain at that point, only able to operate as the original equipment manufacturer (OEM) for another brand.
By 2014, 85% of the company’s revenue was coming from state banks, and Feitian was among the top three such vendors by revenue in the country.
State information security a ‘precious business opportunity’
In 2003 the company joined the “IT-Military Alliance” (计算机世界科技拥军联盟) upon its founding. The event was hosted by the Network Infrastructure Department of the PLA’s General Armaments Department, along with other official organizations.
Only 12 companies formed the IT-Military Alliance. The founding ceremony was marketed as an opportunity for industry to present tribute to the PLA in celebration of the 76th year since its founding. Feitian notes on its website that “the head of the General Armaments Department expressed a deep interest in Feitian’s products,” and that “Feitian will inevitably provide earnest service to the giant military market under the grand strategy of ‘civil-military integration,’ and thus do our bit to help the construction of the nation’s informatized defensive infrastructure!”
Though it is unclear when in 2003 Feitian won its first contract with ICBC, it is difficult not to imagine that its involvement with the PLA — irresistible though it may have been — helped in forging such relationships. Its approval and verification by the State Cryptography Administration in 2004 was also flagged as a “key milestone.”
Already successful with banks in 2003, Feitian’s chief of research and development told the media in 2003 that the next areas of growth would be military and departments and offices for classified information (机要部门).
The logic was obvious to Feitian executives: “As government procurement strengthens and priority is given to domestic products, our country’s state information security will be pushed forward considerably, and this is a precious business opportunity for the vast field of security companies.”
It is difficult to find public information on the extent of that line of business. The company’s technology has however been certified as “military-use information security products.”
In 2006, the company was awarded over one million yuan from a fund for new technology set up by China’s Ministry of Science and Technology. “This is the country’s strong affirmation of Feitian Co., and a thorough recognition of its technological prowess, project management capacity, and reputation,” said an announcement in the scientific press at the time. Later in the year the company’s tech was declared “A New Important National Product” (国家重点新产品) by a number of government departments.
From 2007 onwards, Feitian was selected to provide a smart card identity recognition system (智能网络身份认证系统) as part of the Torch Program, China’s national plan to develop its high-technology industrial base.
The company is part of a Smartcard Intellectual Property Alliance, a kind of government-industry group associated with the Beijing Municipal Intellectual Property Rights Bureau. A member of the Bureau’s Party Group (党组) presided over the alliance’s founding ceremony, on the basis that “the smartcard security industry concerns national information security and is an area of high-technology strongly supported by Beijing.”
Since 2009 Feitian has been listed in numerous databases maintained by the Ministry of Public Security among the accepted providers of identity recognition systems. The list contains only Chinese companies trusted by the state, among them Huawei.
The company has also be the recipient of praise from former vice minister of Public Security Chen Zhimin (陈智敏) and other public and information security cadres, who are said to have expressed “excellent regard” for the company’s security management, and identification security.
Perhaps most notably, since 2002 its research and development chief has been Yu Huazhang (于华章), a graduate of the PLA’s Information Engineering University and for the first seven years of his career an assistant researcher in the PLA’s General Staff Department. In April 2010, he became a 1% shareholder in the company. He is also a vice general manager.
The company and its key engineers won third prize (among many others) in the 2014 Beijing Municipal Technology Awards for “Application and operating system research and development for a chip in a visible-button smart security card” (可视按键型智能密码钥匙片内操作系统研发与应用) which sounds similar to the product being vended for Google’s enhanced security.
Then there are the numerous exhibitions of official fealty on Feitian’s website, each not particularly significant taken on its own, but as a collection making clear that the company knows which way the wind blows. As a matter of routine, Feitian engages in activities like the following:
- Hosting workshops for Chinese academicians to explicate the “spirit” of a series of Xi Jinping’s important speeches in order to “implement and carry out” the political directives resultant from the 18th Party Congress;
- Hosting tours of officials studying at the Party School;
- Advertising its award for “important contributions” to information security given by the Party-Government Password Science & Technology Progress Award Assessment Committee (yes).
The company has been relatively profitable. Within its first year or so it had booked five million yuan in revenue, at gross profit of nearly 50%; by 2014 when it went public on the Shenzhen Stock Exchange its revenues were just over one billion yuan, 250 million yuan profit. (Its stock has been cut nearly in half since April 2018, however, due to “an inexplicable explosion in all manner of costs.”) In 2003 it occupied around 50% of the market for USB security keys, a dominance that it has likely grown since.
The company has sought to expand overseas for at least a decade, in 2007 noting on its website that “Feitian’s ePass identification authentication products have been adopted by governments, banks, and others around the world. We have won a strong reputation as an independent Chinese company with our own intellectual property striding onto the world stage in information security.”
It is difficult to gather data on the extent of those expansion efforts — though the recommendation by Google speaks well to at least a partial success.
But does this compromise user security?
It goes without saying that almost everything we have documented above is simply part and parcel of Chinese companies doing business in China — in particular in a sensitive sector like information and network security, and especially when doing large business with state banks. When the PLA invites your company to join in the “earnest celebration” of its anniversary, present gifts, and join its industrial “alliance,” you don’t respectfully decline.
The same would obtain if the company were ever approached by military or civilian intelligence and instructed to install backdoors in its security fobs, according to Tom Uren, a visiting fellow in the International Cyber Policy Centre at the Australian Strategic Policy Institute.
“Companies in China aren’t able to refuse to engage in intelligence activities. This is laid out very clearly in Article 7 of China’s new 2017 National Intelligence Law,” Uren wrote in an email.
The law states: “All organizations and citizens shall, in accordance with the law, support, cooperate with, and collaborate in national intelligence work, and guard the secrecy of national intelligence work they are aware of. The state will protect individuals and organizations that support, cooperate with, and collaborate in national intelligence work.”
A Chinese information security business has no choice in the matter. The question then becomes how feasible it is for the security device to be weakened or tampered with. At the very least, there is an obvious opportunity at the level of firmware — the software layer coded into a device that controls its hardware — for an adversary to create mischief.
“The firmware matters a lot, and that looks like why Google is planning to replace the firmware on their whitelabeled Feitian keys,” says Dan Guido, CEO of Trail of Bits, a New York-based computer security firm.
This refers to Google’s ‘Titan’ security keys, which appear to be Feitian hardware with Google’s own firmware. On its Advanced Protection Program page, however, Google links users directly to Feitian’s own website, not to the Titan keys with Google’s own firmware.
"Google builds its own hardware security keys."
You mean "Google sells Feitian security keys under its own brand name"? pic.twitter.com/V2RgoEkPiV
— Luc Van Braekel (@lvb) July 25, 2018
“Attackers will tend to use the easiest method to achieve their goals,” says Tom Uren. “Is compromising the Feitian security key supply chain the easiest way? Maybe. Phishing is certainly the easiest/cheapest way to hack data currently and security keys significantly reduce its effectiveness. It will certainly be an avenue that Chinese intelligence would have to consider if security keys are widely used by people of interest to them.”
The means by which attackers could gain unauthorized access through the keys are potentially numerous, including complex methods of introducing flaws in the cryptography or its implementation. Markus Vervier, a computer security researcher, has documented vulnerabilities in some implementations of U2F (universal two factor authentication). His work was not in reference to Feitian.
Yubico, a Swedish-founded company and Google’s other suggested vendor of U2F products, seems to have previously made a veiled suggestion as to the potential vulnerability of its competitor. CEO Stina Ehrensvard wrote on the company’s blog: “Yubico strongly believes there are security and privacy benefits for our customers by manufacturing and programming our products in the USA and Sweden.” The company declined to comment for this article.
Google did not respond to a request for comment. The FIDO Alliance, an organization that certifies hardware (and which has certified Feitian) for implementing the security protocols used in U2F products, did not respond to a request for comment. Feitian did not respond to a request for comment.
One security researcher refused to comment because it’s “obvious” that backdoors could be put into hardware at the manufacturing stage, and his team didn’t want to single out any particular country.
Perhaps the simplest test of the security of the Feitian keys is a gut check: would security experts themselves use them?
“No,” wrote Tom Uren. “I use Yubico keys.”
 亲历者说：“小乌鸡”如何变成“金凤凰” 中关村股权交易服务集团有限公司组织编写. 创客时代 亲历者讲创业. 2016
 “About.” n.d. Feitian Technologies Co. Accessed August 17, 2018. https://www.ftsafe.com/about.
 祝惠春. 2015. “飞天诚信大‘起底’ 看它如何变成创业板金凤凰-一卡通世界.” 经济日报. June 3, 2015. https://web.archive.org/web/20180817204339/http://news.yktworld.com/201506/201506031013120738.html.
 祝惠春 (2015)
 赵阳戈. 2014. “飞天诚信：市场占有率跻身行业前三.” 每经网. June 18, 2014. http://www.nbd.com.cn/articles/2014-06-18/842169.html; 韦伟. 2014. “飞天诚信业绩依赖银行 穿‘马甲’投标涉不正当竞争.” 财经频道, 中国经济网; May 15, 2014. http://finance.ce.cn/rolling/201405/15/t20140515_2816496.shtml.
 小晨. 八一前夕 科技拥军——计算机世界科技拥军捐赠仪式暨科技拥军联盟成立大会隆重举行. 微电脑世界,2003,(15).
 飞天诚信喜获国密办两项资质_商用密码生产定点和销售许可. 电脑编程技巧与维护 2004(6).
 胡滢. 锁住的商机. 中国电子商务杂志. 2003(8). 58
 飞天诚信荣获科技部技术创新基金支持. 电脑编程技巧与维护 2006(6).
 崔光耀. 行业 标杆 如何竖起 — 飞天营销总监徐东谈国内业务. 信息安全与通信保密 2007(7). 34-35
 2007: http://www.chinatorch.gov.cn/2/c100933/201402/72b304fcfb264910977d831759d23d9e.shtml; 2009: http://www.chinatorch.gov.cn/2/dddtt/200908/63f169a86da8411d804c555cb53767d9.shtml; 2011: http://www.most.gov.cn/tztg/201110/W020111013381125627477.pdf; 2016: http://www.chinatorch.gov.cn/2/c100924/201611/f2e7a55aef2847b8a3d578d6ec19c6ec.shtml
 “北京市成立智能卡行业知识产权联盟.” 2015. HRWF.com. May 2, 2015. https://web.archive.org/web/20180819201245/http://www.hwrf.com.cn/news/87276.html.
 飞天诚信守护首都网络安全. 电脑编程技巧与维护. 2015(10),97.
 2014年北京市科学技术奖获奖公告三等奖. May 6, 2015. http://jxw.beijing.gov.cn/creditbj/sxgs/14819.jhtml
 胡滢. 锁住的商机. 中国电子商务杂志. 2003(8). 58
Google Advanced Protection Program: How to lock down your account (Google takes aim at “targeted” online attacks. Here’s everything you need to know about the new security option — including whether you should use it), CNet, October 17, 2017.
GOOGLE STAFF TELL BOSSES CHINA CENSORSHIP IS “MORAL AND ETHICAL” CRISIS, The Intercept, August 16, 2018.
GOOGLE EXECUTIVES MISLED STAFF IN MEETING ON CHINA CENSORSHIP. HERE ARE 13 QUESTIONS THEY MUST ANSWER. The Intercept, August 17, 2018.
New Gmail feature could open more users to phishing risks: Government officials, ABC News, July 17, 2018.
Support Our Work
At China Change, a few dedicated staff on a shoe string budget bring you information and produce videos about human rights, rule of law, and civil society in China. We want to help you understand aspects of China’s political landscape that are the most censored and least understood. We are a 501(c)(3) organization, and your contribution is tax-deductible. For offline donation, check our “Become a Benefactor” page. Thank you.
Safeguard defenders, September 19, 2017
Among the many revelations into the systematic repression of the human rights community to have come to light since the beginning of the 709 Crackdown have been accounts from those released about the access of police and state security to chat logs and emails, even communications and documents those people thought they had deleted.
This heightened awareness has certainly pushed the idea of taking digital security precautions in how to prevent sensitive information from falling into the hands of police in the event of detention. However, the focus of trainings and guidebooks is often directed in the wrong direction, namely on more advanced hacking and sophisticated intrusion. This continued focus on advanced threats actually has and will continue to harm human rights defenders’ safety. This is because it is not only nearly impossible to defend against such high level threats but that also in almost every case this is not the real threat. In the end, time is consumed trying to defend against a largely non-existent threat.
It is true that the capability of the Chinese Government concerning data forensics and hacking has developed like other aspects of the country, but those often limited resources are used against other bigger, and usually international, targets. On top of that, police and state security know well that the impunity with which they can act means that they have more direct, easier, access to whatever a human rights defenders’ computer or phone might hold; namely the use of direct threats, torture and intimidation against family, friends and loved ones. There are exceptions, but against these tools of repression, few people can stand up for long.
Real security must thus be based on the fact that a defenders’ computer and phone will be taken, and chances are that they will be forced to give up the information the police is after. The threat of torture or disappearance is sadly quite effective against even the best password or encrypted file. Any training and training material must be based on this reality. Digital security requires physical and behavioral changes in addition to passwords and applications.
The reality is also that digital security solutions that decrease the efficiency of our phones and computers are likely to be abandoned after time, regardless of the quality or number of trainings the rights defender or journalist has attended. Security solutions are only solutions if they are actually applied and maintained, something a lot of training material seems to gloss over when they offer solutions that are realistically not feasible for the majority of rights defenders.
Real security, that is sufficient and sustainable, can only come from finding the middle path, by focusing on real threats, while offering solutions that come from basic behavior rather than advanced technological solutions.
The newly released Practical Digital Protection self-study guide has been developed with these considerations in mind. It was developed over 12 months, together with journalists, lawyers, NGO workers and rights defenders across China, looking at their own experiences with security issues, detentions, interrogations and data forensic techniques applied by police and state security. The manual doesn’t only provide behavior-based solutions, but also real-life stories from defenders illustrating how their own best or worst case solutions have had a direct impact on how their technology has either been used against them, their partners, and coworkers, or prevented from being exploited by the State.
The following abridged story is one of several from the Practical Digital Protection manual.
A seasoned rights defense lawyer received a message on Telegram from a trusted colleague that the police had been asking questions about her and that she should expect to be detained or at least questioned. She had at this point already taken on many rights defense cases and worked with many other similar lawyers for several years. She was quite skilled in cybersecurity, having always been afraid police might detain her or take her computer and try to use her information against her. She rarely used WeChat, and never for work. She even knew how to use hidden encryption, not only to protect the data itself, but also to hide its very existence. Police can’t ask about what they don’t know exist she figured, correctly.
The information she had wasn’t just about her, but also about others. If this information fell into the wrong hands it didn’t just mean possible imprisonment for her, but for others. She had already been smart enough to realize that normal encryption would be of little help. If police knew what to ask for, she doubted that she would be able to resist for long, as she as a lawyer was well aware that the legal protections against torture and mistreatment in China are barely worth the paper they are written on.
When the police eventually detained her and placed her alone in a cell, to undergo more than a month of interrogations, they also seized her computer, several phones, and USBs.
After a few days in detention, she was very surprised when the police began to start each new day by showing her documents from her computer. She knew these documents had been stored in a hidden encrypted space that the police did not have access too, or even knew about. She was frantic each time the police produced one of these documents. These documents threatened to expose some of her sensitive rights defense work and provide evidence that would make it easy for the police to go after her clients or other lawyers she had worked with.
Before being detained she had agreed to a cover story with her colleagues who might also be detained. Some of the documents the police produced challenged their cover story, and severely increased hers and their risks.
The documents the police had were very random. Many of them were also just partial, a few pages of a larger document. How did they get these documents, she continued to wonder.
In the end, the police did not find the ‘smoking gun’ they were looking for, and even though she remains to this day under threat, having been released on ‘bail’, with police able to pick her up again any day they wish, the fact that most documents remained protected saved her.
Only after her release, with time and access to information online did she figure out what had gone wrong. File Recovery program it read. With this, she would learn of something that even many of those skilled in Cybersecurity fails to understand, or if they do understand it, fails to realize how big of a threat it is.
Data, she realized, are like memories. They linger for a long time, and even when they begin to fade, it happens slowly, and only parts of it disappear. Data, once ‘deleted,’ she realized, is not actually deleted, but continues to lie on the hard drive, only not visible to the normal user. It’s all still there, until the space holding the data is filled up with something new. The fact that most of data was in an encrypted space didn’t always matter, as many of the documents she had produced over the years had been created on the desktop (outside the encrypted area), before being moved to the encrypted space (which leaves traces of the original). An act of laziness. Many documents had also been deleted over time, she like most thus assumed they were safe. It had been deleted after all.
So what had happened? All those documents that had been on her normal hard drive, once moved to the encrypted storage, were readily available to the police using File Recovery, easy to use programs available for free online. All they had to do was scan her hard drive in detail, and step by step pieces of old data long ago deleted could be put together. This is because the documents weren’t properly erased from her computer. But there are solutions. Programs such as CCleaner for example, securely delete files to make sure nobody can ever recover them. Understanding how data deletion really works, and making secure deletion part of a normal routine will drastically increase security.
Safeguard Defenders new practical digital protection manual (English and Chinese editions) can be found at practicaldigitalprotection.com.
In addition to the current Chinese- and English language editions, other editions are being produced in collaboration with Reporters Without Borders, with a Vietnamese and a Turkish edition coming this fall.
Safeguard Defenders 的最新数字安全实用手册目前有英文版和中文版，可以在网站 practicaldigitalprotection.com 下载。
Also from Safeguard Defenders:
What to Make of the Explosive New WeChat and QQ Spying Revelations? September 10, 2017