Day: September 21, 2017

Europe remains the most peaceful region, but the 2017 Global Peace Index shows that peace in the U.S. has taken a tumble.

Each year the non-profit think tank Institute for Economics and Peace performs an in-depth analysis on trends in peace, its economic value, and how to develop peaceful societies. Known as the Global Peace Index (GPI), the report takes into consideration 23 qualitative and quantitative indicators; for 2017 there were 163 independent states and territories included, accounting for 99.7 per cent of the world’s population.

While last year saw a dip in peace, this year, surprisingly, peace has seen an uptick. According to the report, “the results of the 2017 GPI find that the global level of peace has slightly improved this year by 0.28 per cent, with 93 countries improving, while 68 countries deteriorated.”

Europe remains the most peaceful region in the world, while the largest regional drops in score happened in North America, followed by sub-Saharan Africa and the Middle East and North Africa. The report notes:

“The score for North America deteriorated entirely as a result of the US, which more than offset a mild improvement in Canada. The US’s score has been dragged down largely because of a deterioration in two indicators: level of perceived criminality in society and the intensity of organised internal conflict. The latter measure has deteriorated because of the increased levels of political polarisation within the US political system. The US also has experienced the fourth largest drop in Positive Peace globally, after Syria, Greece and Hungary in the ten years to 2015.”

(Making America less peaceful does not feel like making America great again.)

Meanwhile, here are the countries that ranked as most peaceful.

1. Iceland
2. New Zealand
3. Portugal
4. Austria
5. Denmark
6. Czech Republic
7. Slovenia
8. Canada
9. Switzerland
10. Ireland (tie)
10. Japan (tie)

If you’re wondering how the United States fared specifically, it went from 103 in 2016 to 114 this year, dropping 11 spots.

“The past year has been a deeply worrying one for the US, with the presidential campaign highlighting the deep divisions within American society. Accordingly, the score for intensity of organised internal conflict has worsened,” notes the report. “Data have also shown a declining level of trust in government and other citizens which has generated a deterioration in the score for level of perceived criminality in society.

“Social problems within the US are also likely to become more entrenched and racial tensions may continue to simmer,” the authors add. “Reflecting these tensions, rising homicide rates in several major American cities led to a deterioration in the homicide rate indicator, contributing to the decline in the US’s peace score.”

The five countries at the sad end of the list all suffer from ongoing conflicts, among other tragedies; Syria is at the bottom as the least peaceful, followed by Afghanistan, Iraq, South Sudan and Yemen.

You can download the 135-page report here. It’s long but fascinating; it is pretty grim – exploring terrorism, refugees, war – but there is hope and upward thinking as well. Beginning on page 80 is the section on Positive Peace, which represents the “capacity for a society to meet the needs of its citizens, reduce the number of grievances that arise and resolve remaining disagreements without the use of violence.” More of that, please.

To learn more about peace policy and the potential for making the world a more peaceful place, visit Institute for Economics and Peace. Also see the United Nations’ page for more about the International Day of Peace.

Hundreds of thousands of computers getting penetrated by a corrupted version of an ultra-common piece of security software was never going to end well. But now it’s becoming clear exactly how bad the results of the recent CCleaner malware outbreak may be. Researchers now believe that the hackers behind it were bent not only on mass infections, but on targeted espionage that tried to gain access to the networks of at least 20 tech firms.

Earlier this week, security firms Morphisec and Cisco revealed that CCleaner, a piece of security software distributed by Czech company Avast, had been hijacked by hackers and loaded with a backdoor that evaded the company’s security checks. It wound up installed on more than 700,000 computers. On Wednesday, researchers at Cisco’s Talos security division revealed that they’ve now analyzed the hackers’ "command-and-control" server to which those malicious versions of CCleaner connected.

On that server, they found evidence that the hackers had attempted to filter their collection of backdoored victim machines to find computers inside the networks of 20 tech firms, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself. In about half of those cases, says Talos research manager Craig Williams, the hackers successfully found a machine they’d compromised within the company’s network, and used their backdoor to infect it with another piece of malware intended to serve as a deeper foothold, one that Cisco now believes was likely intended for industrial espionage.

"When we found this initially, we knew it had infected a lot of companies," says Williams. "Now we know this was being used as a dragnet to target these 20 companies worldwide…to get footholds in companies that have valuable things to steal, including Cisco unfortunately."

A Wide Net

Cisco says it obtained a digital copy of the hackers’ command-and-control server from an unnamed source involved in the CCleaner investigation. The server contained a database of every backdoored computer that had "phoned home" to the hackers’ machine between September 12 and 16. That included over 700,000 PCs, just as Avast has said in the days since it first revealed its CCleaner debacle. (Initially the company put the number much higher, at 2.27 million.) But the database also showed a list of specific domains onto which the hackers sought to install their secondary malware payload, as well as which ones received that second infection.

The secondary payload targeted 20 companies in all, but Williams notes that some companies had more than one computer compromised, and some had none. He declined to say which of the targets had in fact been breached, but Cisco says it’s alerted all the affected companies to the attack.

Williams also notes the target list Cisco found likely isn’t comprehensive; it appears to have been "trimmed," he says. It may have included evidence of other targets, successfully breached or not, that the hackers had sought to infect with their secondary payload earlier in the month-long period when the corrupted version of CCleaner was being distributed. "It’s very likely they modified this through the monthlong campaign, and it’s almost certain that they changed the list around as they progressed and probably targeted even more companies," says Williams.

That target list presents a new wrinkle in the unfolding analysis of the CCleaner attack, one that shifts it from what might have otherwise been a run-of-the-mill mass cybercrime scheme to a potentially state-sponsored spying operation that cast a wide net, and then filtered it for specific tech-industry victims. Cisco and security firm Kaspersky have both pointed out that the malware element in the tainted version of CCleaner shares some code with a sophisticated hacking group known as Group 72, or Axiom, which security firm Novetta named a Chinese government operation in 2015.

Cisco concedes that code reuse alone doesn’t represent a definitive link between the CCleaner attack and Axiom, not to mention China. But it also notes that one configuration file on the attackers’ server was set for China’s time zone—while still acknowledging that’s not enough for attribution.

Supply Chain Woes

For any company that may have had computers running the corrupted version of CCleaner on their network, Cisco warns that its findings mean merely deleting that application is no guarantee the CCleaner backdoor wasn’t used to plant a secondary piece of malware on their network, one with its own, still-active command and control server. Instead, the researchers recommend that anyone affected fully restore their machines from backup versions prior to the installation of Avast’s tainted security program. "If you didn’t restore your system from backup, you’re at high risk of not having cleaned this up," Williams says.

The exact dimensions of the CCleaner attack will likely continue to be redrawn, as analysis continues. But it already represents another serious example in the string of software supply-chain attacks that have recently rocked the internet. Two months earlier, hackers hijacked the update mechanism of the Ukrainian accounting software MeDoc to deliver a destructive piece of software known as NotPetya, causing massive damage to companies in Ukraine as well as in Europe and the United States. In that case, as in the CCleaner attack, victims installed seemingly legitimate software from a small but trusted company, only to find that it had been silently corrupted, deeply infecting their IT systems.

In the days following the NotPetya attack, many in the security research community shifted their assessment of the attack from a criminal ransomware outbreak to something more insidious, targeted, and created by nation-state hackers. Now, it seems that the mystery surrounding the CCleaner attack may be moving in that same, disturbing direction.

After years of half-heartedly and occasionally hamfistedly building gadgets, Google’s finally all-in on the hardware game. Google will announce a number of new products on October 4, reportedly including two new phones, a smaller version of the Google Home, and a high-end laptop. And on Wednesday, the company announced an agreement with struggling manufacturer HTC that will import a team of engineers over to Google, to help close the gap between Mountain View’s hardware ambitions and its present reality.

The tie-up’s not quite the acquisition that had been rumored, but rather a “cooperation agreement.” Google is hiring a team of HTC employees—the company wouldn’t comment on how many exactly—most of whom have already been working on Google’s Pixel phones. Those employees will stay in Taipei, Taiwan, where HTC is headquartered, but they’ll become full-on Googlers. In exchange for those workers and a non-exclusive license for some of HTC’s intellectual property, Google’s paying HTC $1.1 billion. Both sides hope to close the deal by early 2018. Even after the arrangement is finalized, HTC will continue making its own phones, and building Vive VR products.

According to one source, the agreement essentially shortcuts the acquisition process. Google doesn’t need an entire company; it just needs engineers that can help it tightly integrate Pixel hardware with its homegrown software. So rather than deal with enveloping HTC whole cloth, it can simply pay for and quickly get the team it needs. A team which, again, already makes Google hardware. In some ways, all that changes is the ID badge.

Moto Memories

But the ID badge matters. Google learned this the hard way. When it plunked down $13.3 billion to buy Motorola in 2011, the marriage seemed to make sense. Motorola offered a patent portfolio that would help Google fight in an increasingly litigious mobile industry, plus plenty of cash and assets. Those were all more important, and less exciting, than another little part of Motorola’s business that Google picked up: the hardware team. It seemed that finally, after years of watching other companies make Android phones that paled next to the iPhone, Google was taking its fate in its own hands.

The beautiful coupling of hardware and software, of course, didn’t happen. Google made a big show of not favoring Moto in any way, walling the company off from the very software makers it needed to produce truly great products. “Motorola will remain a licensee of Android and Android will remain open,” Larry Page wrote in a blog post announcing the acquisition. “We will run Motorola as a separate business.” The real problem, according to former employees, was that Google just wasn’t serious about making hardware. It saw itself as a platform company, not a phone company.

Today, though, the time seems right for Google to assert more control over the Android ecosystem. Android dominates so completely that even if, say, LG feels threatened by Google’s hardware aggression, it has virtually no recourse. “At least until the next big technology wave comes, and probably even then, we’re likely stuck with iOS and Android,” says Avi Greengart, who tracks devices and platforms for analysis firm GlobalData. “I don’t even think anyone’s pissed at this point. I think they’re resigned.” Plus, Google made these ambitions clear a long time ago; the Pixel already exists, and it didn’t drive anyone out of business yet.

And in a lot of ways, HTC fits Google far better than Motorola ever did. The two companies have a long history of working together: In addition to the Pixel, HTC manufactured the very first Android phone, the G1. HTC has also had a long run of success as a white-label manufacturer building devices for other companies, and even made a few of the best early Android phones, like the ceramic One X. Even its current device, the HTC U11, ranks among the best Android phones on the market.

Streamlining

If all goes well, the new team of former HTC-ers could finally centralize and simplify Google’s manufacturing, which has previously sat somewhere on the spectrum between “complicated” and “chaos.” The company built phones with Huawei and LG, routers with TP-Link and Asus, augmented-reality gear with Lenovo, and lots of in-house products with various contract manufacturers. While Apple preaches the integration of hardware and software, Google’s been all over the place.

Tighter control over manufacturing affects more than just the bottom line. “Bringing that design capability in-house would likely allow Google to design exactly the phones it wants to, giving it both more freedom and a greater ability to optimize designs to get exactly what it wants and needs from the hardware,” says Jan Dawson, chief analyst at Jackdaw Research. New technologies like augmented reality and virtual assistants, especially, require massive power and optimization. Apple’s ARKit works so well in part because of Apple’s new A11 Bionic processor, and its dedicated GPU and neural-processing chips. If Google wants Google Assistant and ARCore to work seamlessly, it needs to make sure the underlying hardware can support them. And even if its traditional Android hardware partners churn out workhorse devices, Google risks that Samsung and others (but mostly Samsung) will eventually want push everyone to Bixby and the Gear VR instead.

As always, a shift like this takes time to fully shake out. It’ll likely be a couple of years before we see what happens when Google lets a bunch of HTC employees hang out in the Googleplex with Android engineers. There are lots of unanswered questions, too: What does this talent drain do to HTC’s existing products, from its phones to its Re cameras to the scale and fitness band it built with Under Armour? What does this mean for a company like LG, Google’s supposed partner for the Pixel 2 XL? One thing we do know, more surely than ever: Google’s a hardware company now. And it’s coming for everybody.