Hpe hub banner.png

HPE allowed Russia to inspect software used by US military

ArcSight cyber intelligence and intrusion detection system is used extensively across armed forces

HPE may have inadvertently provided Russia with information about vulnerabilities in software widely used by the US armed forces and many large businesses to detect and mitigate cyber attacks.

As reported by Reuters, HPE allowed the Russian authorities to inspect the code base of its ArcSight cyber defence software, which is used to spot intrusions and unusual activity on networks.

HPE allowed the code review last year. It was carried out by Echelon, a company with ties to the Russian military, on behalf of Russia's Federal Service for Technical and Export Control (FSTEC), a defence agency, because it intended to sell the software to Russian public sector institutions and private sector companies.

Allowing code inspections by foreign governments is not unknown, and indeed may be a requirement for tech companies wanting to do business in Russia; SAP, IBM and Cisco have submitted to similar processes in order to break into the Russian market. But the fact that ArcSight is used extensively in a defensive capacity by the Pentagon makes it a very sensitive issue. Cyber security firm Symantec declined to offer up its code for review for this reason.

The issue illustrates the dangers in using commercial software in a vital defensive role.

A spokesperson for the Pentagon said that HPE had not disclosed the fact of the inspection by Echelon to the US authorities, while HPE declined to say whether it had or not.

While the Russian agency was not permitted to remove the source code from where the review took place, security experts believe that simply studying it could allow a trained reviewer to spot certain vulnerabilities. This view is shared by six former US intelligence officials and previous ArcSight employees (the firm was purchased by Hewlett-Packard in 2010) who said the source code review could potentially aid the Russians in any attack on US defences.

"It's a huge security vulnerability," said Greg Martin, a former security architect at ArcSight. "You are definitely giving inner access and potential exploits to an adversary."

An in-depth understanding of ArcSight's cyber intelligence and intrusion detection software would certainly be advantageous to an attacker, but it would not on its own be sufficient to allow an attacker entry into US defensive systems, being just one in a series of defensive shields.

Nevertheless, it could allow an attacker to conceal their activities and at a time when Russia stands accused of increased hostile activity in cyber space, including manipulating the US presidential elections, the news that HPE allowed the code inspection, apparently without informing the authorities, will not go down well with ArcSight's user base.

HPE has not disclosed the extent of its commercial activities in Russia, but ArcSight is known to be used by a number of businesses in the country including VTB Bank and the Rossiya Segodnya media group, both of which are known to have Kremlin ties. In the US it is used extensively across the Armed Forces.

HPE sold ArcSight to UK software company Micro Focus last September.

HPE allowed Russia to inspect software used by US military

ArcSight cyber intelligence and intrusion detection system is used extensively across armed forces

Mergers

EU to decide fate of $14bn HPE-Juniper Networks merger next month

Threats and Risks

Over 380,000 web hosts affected by Polyfill attack

Threats and Risks

Gang leaks NHS patient data on the dark web - updated