Sometimes You Have to Pick Your Partners Carefully- Huawei

October 5 addendum - "60 Minutes" to have story on Huawei on October 6
 http://www.bizjournals.com/dallas/blog/2012/10/huawei-on-60-minutes-sunday-night.html

Interesting August 27 article (and video) by CNET, “Inside Huawei, and the Chinese tech giant that’s rattling nerves in DC”.  Huawei is a $32 billion technology company, with 140,000 employees worldwide  (including Silicon Valley in California) and the holder of over 50,000 patents.  A US congressional committee has been having ongoing discussions with the organization because of their fears that the company may be a national security threat.

According to the article, “Congressmen Mike Rogers (R-Mich.) and C.A. Dutch Ruppersberger (D-Md.) said they were investigating "the threat posed to our critical infrastructure and counter-intelligence posture by companies with potential ties to the Chinese government.”  Some of this does come across as posturing in an election year.  In because this in involved with the  area of national security, the internet, hacking activities,  corporate and government “monitoring” of other nations by governments, there’s a cause for some concern.

Why Huawei?  The House Intelligence Committee has been vague, according to the article.  They said that they  “have received claims with varying degrees of credibility about cyberattacks internationally that may have been enabled by Huawei technology.”  This may be a bit of a stretch.  Nonetheless, the US government is specific with high tech companies about technologies that can’t be sold to specific countries, such as Syria.  

In March, the Australian government blocked Huawei from bidding on any contracts for the country's A$38 billion (roughly US$39 billion) National Broadband Network.

Symantec had ended a four-year-old joint venture with Huawei earlier in the year because of fears that the relationship could prevent it from getting information from the US about cyberthreats. Neither article discusses whether other US or global antivirus vendors such as Mcafee, Avg Technologies, Kaspersky, Sophos,  or Trend Micro, have a relationship with Huawei. Some immediate questions?  Are there areas that aren't cyber security sensitive that these companies could partner with Huawei on? What's the  tradeoff between immediate  business justification, public relations hits and  potential long term business?  It's that perception versus reality thing.

Slight correction - AVG Technologies could be in a quiet mode with respect to Huawei.  From a Thursday morning Google search using  Huawei and AVG Technologies:

AVG Partners with Huawei

blogs.avg.com/view-from-the-top/avg-partners-huawei/

1 day ago - AVG security solutions are now provided to millions of Huawei customers globally, starting in ... And now, through our new alliance with Huawei, a leading global ...

This is probably AVG Technologies' Mobilation antivirus product for the  Android OS. There also seems to be a promotion going on (can't tell exactly where) for home users owning a Huawei smart phone.

In January, the Pentagon transferred an information-sharing pilot program, called the Joint Cybersecurity Services Pilot, to the Department of Homeland Security.  Originally, the program was intended to share classified National Security Agency intelligence with military contractors.  The government was expected    to extend the program beyond those companies to antivirus companies, like Symantec, and network providers.  According to a March article in the New York Times, Symantec became “worried that its ties to Huawei would be a disadvantage when it came to being the recipient of classified threat information”. 

In 2011, Huawei released their   "Statement on Establishing a Global Cyber Security Assurance System".  Huawei held four meetings in 2011 to decide on   the company’s overall cyber security strategy.  Huawei stated that they are “Willing to work with all governments, customers and partners through various channels to jointly cope with cyber security threats and challenges from cyber security.”

   

In the enterprise, Huawei has an extensive portfolio of products in networking, IT infrastructure, and security.  On the consumer side, products include mobile phones, tablets, broadband, and modems.

http://news.cnet.com/8301-1035_3-57484472-94/inside-huawei-the-chinese-tech-giant-thats-rattling-nerves-in-dc/   

http://www.nytimes.com/2012/03/27/technology/symantec-dissolves-alliance-with-huawei-of-china.html?_r=1

 

AV-Comparatives Testing – 2012 Mash-up

The table below combines results from four different tests from AV-Comparatives.  Through the wonders of Excel, I was able to calculate a simple average and sort the results, first by result, and by alphabetical order.  There was quite a range in the results.  Great consistency among the top finishers, though.  Test results used in  the table were from:

• Whole Product Dynamics Real World Protection Test, March through June 2012
• Antivirus Comparative -   On Demand Detection of Malicious Software, March 2012
• Antivirus Comparative - Retrospective/Proactive Test, July 2012
• Antiphishing Test, July 2012

Congrats to the top finishers!  Kaspersky finished no lower than third in any of the tests, BitDefender seventh, and F-Secure, fifth.  I’m intentionally not showing a table of the raw data.  Blogs about each test are available, and the complete tests are on the AV-comparatives (www.av-comparatives.org ) web site. 

AV-Comparatives named Kaspersky Product of the Year for 2011.  Other top rated products, in alphabetical order,  were from Avira, BitDefender, Eset, and F-Secure.  Based on testing to date, there may be some changes at the end of the year.

Vendor  in the table   (listed   for Google purposes) are: F-Secure, G Data, BullGuard, Avira, Panda, Avast, ESET,  QiHoo, Sophos, eScan, PC Tools, McAfee, AVG Technologies, Microsoft, Tencent, GFI, Trend Micro, Fortinet, Webroot, and AhnLab.

About AV-Comparatives www.av-comparatives.org

AV-Comparatives is an Austrian Non-Profit-Organization, which provides independent antivirus software tests free to the public.  Go to the AV-comparatives website for complete details about the organization, the many tests they perform, and to download copies of test reports.

AV-Comparatives Anti-Phishing Test - July 2012

AV-Comparatives has published their AV-Comparatives Anti-Phishing Test, July 2012.  Products from eighteen vendors were included in the test.  All of them were paid products except for Avast who requested that their Avast Free Antivirus 7.0 product be used for the test.  Koule.  The top five products were from BitDefender, McAfee, and Kaspersky, BullGuard, and F-Secure.  These were the only vendors whose products scored over 90%. Phishing is a stinky business, but a profitable one for the bad guys.

Percentage of Blocked Web Sites by the Leading Vendors 

97.4% - BitDefender

97.0% - McAfee

94.8% - Kaspersky

92.2% - BullGuard

91.1% - F-Secure 

Overall, eleven vendors’   products received three stars.  For the vendors better known for their free products, Avast   and Avira   received two stars, and AVG Technologies,one star.  No vendor received this test’s cone of shame designation of “tested.”  The two lowest performing products were from eScan (57.7%) and ESET (58.0%).  574 phishing URL’s were part of the test.  A nice sized sample. 

According to SearchSecurity, phishing  phishing is an e-mail fraud method in which the perpetrator sends out legitimate-looking email in an attempt to gather personal and financial information from recipients.  Typically, the messages appear to come from well-known and trustworthy Web sites.  Web sites that are frequently spoofed by phishers include PayPal, eBay, MSN, Yahoo, and BestBuy.  

The users are typically directed to enter personal  details at a fake website whose look and feel are almost identical to the legitimate one.The FTC recommends that if you suspect you have been phished, forward the e-mail to spam@uce.gov or call the FTC help line, 1-877-FTC-HELP.

How Prevalent is Phishing

In their July report for the    first half of 2012, the RSA Anti-Fraud Command Center identified 195,487 unique phishing attacks – an increase of 19% over the second half of 2011.  The countries that had the largest volume of phishing attacks were the UK (42%), Canada (29%), and the United States (22%).  The US hosted the most phishing attacks, at 60%.  The Citadel Trojan was responsible for 20% of the Trojan attacks analyzed by RSA. 

For people who don’t think this is a business - the cost of a Citadel kit will run you $2,500 US.  However, you'll soon have to be vouched for by a current customer to purchase the kit.  RSA estimates that phishing attacks in the first half of 2012 could have potentially caused $687 million in total losses. 

Vendors in the test -  Avast, AVG Technologies, Avira, BitDefender, BullGuard, eScan, ESET, Fortinet, F-Secure,  G Data, GFI, Kaspersky, McAfee, PC Tools, Qihoo, Sophos, Trend Micro, and  Webroot.  Symantec wanted to choose which tests to participate in.  That wasn’t an option. For the time being, Symantec isn't  in any of AV-Comparative’s tests this year. PC Tools, their wholly owned subsidiary, is, however.

About AV-Comparatives www.av-comparatives.org

 

AV-Comparatives publishes a number of free great test reports over the year.  You can review results from their Real World Protection tests monthly. AV-Comparatives is an Austrian Non-Profit-Organization.  They provide independent Anti-Virus software tests free to the public. You can probably win bar bets over the results, since the most well known vendors are often not the ones with the best test performance.

NSS Labs - Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities?

NSS Labs released an interesting analysis brief on  August 15 – “Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities?”  NSS Labs conducted testing on thirteen consumer antivirus (AV) products.  The goal was to see how well the products  repelled attacks on systems not yet patched for a pair of current vulnerabilities.  Those used  in the test were the CVE-2012-1875 and CVE-2012-1889 vulnerabilities.  According to NSS, exploitation of either of these   can result in  remote code execution by the attacker.  Very bad for the user!  Look for an upcoming “Consumer Endpoint Group Test”  by NSS Labs in the near future. 

The Analysis Brief Top Scorers  Were

To cut to the chase, only four companies scored 100% on the test.  In alphabetical order, these were Avast, Kaspersky, McAfee, and Trend Micro. 

  

Two companies had products scoring 75%, ESET and Norton (I’m not listing all the  results to encourage people to register and download the free report).  No vendor scored 0% on the test with their tested product.  However, five of the products scored 25%.  One of them is based in Redmond, WA, however.  The cone of shame for all at the bottom. 

A Pair of the Recommendations

Two of the five recommendations of the study:   (1) Do not rely purely on AV software to protect your system.  Install HIPS (Host Intrusion Protection) or an Internet Security Suite as well.  (2) People utilizing Facebook, Gmail or other services that utilize HTTPS  need to have AV (at minimum) on their system.  Note that the first recommendation was install an Internet Security suite.   

In general, the products tested were  the vendor’s home Internet Security product.  It’s somewhat disappointing that BitDefender wasn’t included.  BitDefender tends to be near the top in any testing done by Av-comparatives and AV-test (www.av-comparatives.org and www.av-test.org ).

The tested  products - Avast Internet Security 7, AVG Internet Security 2012, Avira Internet Security 2012, CA Total Defense Internet Security Suite, ESET Smart Security 5, F-Secure Internet Security 2012, Kaspersky Internet Security, McAfee Internet Security 2012, Microsoft Security Essentials, Norman Security Suite Pro, Norton Internet Security 2012, Panda Internet Security 2012,  and Trend Micro Titanium + Internet Security.

At seven pages, the test is a good read.  The report is additive to the testing reports by the organizations listed above, as well as those performed by Virus Bulletin www.virusbtn.com . Go to these other sites to view additional test reports.  These are much superior to counting Facebook fan "likes"!  The wisdom of crowds doesn't always rule. 

NSS Labs www.nsslabs.com

NSS Labs, founded in 1991,  provides independent security research and testing.  They also provide subscription based information services and consulting.  

Major Moves by Hewlett Packard and CEO Meg Whitman

The sleeping giant is making some moves.  Last Wednesday,    ewHewlett Packard wrote down its investment in its enterprise services division by $8 billion.  To put this in perspective, Electronic Data Systems(EDS), which is part of this group, was purchased four years ago for $13 billion.  

 
The write-down is one of those accounting “things”.  Its recognition that the investment in EDS  was not as great an investment as HP originally thought it would be.  Some would say, “Oh, a major mistake.”  Others would say “market conditions.”  Regardless, it’s a hit to goodwill and an expense to the income statement.  It's  a non-cash adjustment to the balance sheet.  As a result of the charges, Hewlett-Packard said it would report a loss of $4.31 to $4.49 a share when it announces its third-quarter results on Aug. 22.

This week, an  interesting move by by HP CEO Meg Whitman.   The WebOS group is being spun off  as an independent but wholly owned subsidiary.  Its name, Gram.  The tagline - “Potent.  Light.  Nimble.  At the core of all things big and small.”  Gram will be in stealth mode for the next few months.  An open source version of WebOS will still take place in September.

   

My humble opinion is that the market will like the Gram news on Thursday.  It’s not a light move, name notwithstanding! This gives Gram the opportunity to innovate  more quickly than it would if were still in the HP corporate  framework. Not quite a skunk works.   Going against Gram is the fact they’ve lost brainpower over the last several months. Reactions by tablet makers?  They probably won’t make any grand statements.   

August 15 marked day 328 of Meg Whitman’s tenure as CEO.  The stock has dropped   15% since she took over as CEO, hitting a one-year low of $17.41 in early August.  Both the Dow and NASDAQ are up a little over 20% during that time.  Dell has dropped by about 12% over this period.

Whitman  has stated since the beginning of her tenure as CEO September 22  that the turnaround will take time.  These and the layoffs announced   in May are major moves.  She and HP are  not standing still. 

http://www.crn.com/news/mobility/240005635/hp-spins-off-webos-business-as-gram.htm?cid=nl_alert

 

http://www.nytimes.com/2012/08/09/technology/hp-takes-8-billion-charge-on-eds-acquisition.html