Skip to main content

Intel warned Chinese tech firms of security flaws before telling U.S. government

top tech stories intel
Image used with permission by copyright holder

Intel warned certain customers, including Chinese tech firms, of the Spectre and Meltdown security flaws before notifying the United States government, the Wall Street Journal reportedThe flaws were first discovered by Google’s Project Zero team in June 2017. Intel held off on disclosing the issue while it worked on possible fixes. The company planned to make the announcement on January 9, but The Register broke the story on January 2. Intel then confirmed the news the next day.

Intel did notify several major tech firms in an effort to limit the potential damage and help work on fixes. A representative from the Department of Homeland Security said that the department did not learn of the flaws until the news was broken, however. Homeland Security is often notified of such issues before the public, and often acts as a source of guidance for how to address them.

In response to questions from Rep. Greg Walden (R-Ore.), Intel has since revealed the reason it didn’t disclose the flaws to government agencies and officials. It claimed that since there was “no indication that any of these vulnerabilities had been exploited by malicious actors,” it didn’t see the need, according to Reuters. It also revealed that it didn’t think the flaw would be capable of harming critical infrastructure because it didn’t believe it could affect industrial control systems.

Alphabet, a department of which discovered the Meltdown and Spectre flaws, had extended its typical 90-day grace period before revealing the bug to the public twice, to January 3 and then January 9.

The NSA was one of those agencies left in the dark about the problem. Rob Joyce, the White House’s top official on matters of cybersecurity, sent out a tweet saying that the NSA was unaware of the vulnerabilities.

Intel refused to name any of the companies it warned prior to the scheduled January 9 announcement, though several of the companies had been identified, including Microsoft, Amazon, Chinese computer manufacturer Lenovo, and Chinese cloud-computing firm Alibaba Group Holding. A representative from Intel said that it had planned to brief others, including the U.S. government, prior to the January 9 announcement, but the company said that it was unable to do so because the story was reported sooner than expected.

Recent correspondence to representatives from Microsoft stated that it did inform several antivirus makers about the flaws a number of weeks before the public reveal.

Jake Williams, a former employee of the National Security Agency and current president of Rendition Infosec LLC, told the Wall Street Journal that the Spectre and Meltdown vulnerabilities would have been of great interest to any intelligence organization.

Williams also warned that it is a “near certainty” that the Chinese government was aware of Spectre and Meltdown before the U.S., given that the Communist Party closely monitors such communications.

Representatives from the Chinese government did not comment on this story. In the past, however, the country’s foreign ministry has said that it is “resolutely opposed” to all forms of hacking.

Updated on February 23: Updated information on Intel revelations.

Editors' Recommendations

Eric Brackett
Former Digital Trends Contributor
Homeland Security wants to expand airport facial scans to U.S. citizens
uk retail giant to use face scanning tech

U.S. citizens exiting and entering the country at facilities such as airports are currently exempt from the facial scan process demanded of noncitizens, but that could soon change.

The Department of Homeland Security (DHS) recently proposed expanding facial recognition checks to Americans “to help prevent persons attempting to fraudulently use U.S. travel documents and identify criminals and known or suspected terrorists.”

Read more
U.S. government launches national security investigation into TikTok
tiktok

The U.S. government launched a national security investigation into the popular app TikTok on Friday — looking expressly into the Chinese company’s acquisition of the app Musical.ly. TikTok purchased the company for $1 billion roughly two years ago.

The Committee on Foreign Investment in the United States (CFIUS) is reportedly investigating the deal now in part because TikTok did not seek clearance from CFIUS when it acquired the company. CFIUS reviews are confidential.

Read more
U.S. Interior Department grounds 800-strong drone fleet over security fears
DJI Mavic 2 Pro

The U.S. Department of the Interior (DoI) has grounded all 800 of its drones over security concerns, the Wall Street Journal reported on Thursday.

The multi-rotor, remotely controlled copters are used by the department for a range of tasks, including land and forest monitoring, dam inspections, and assisting efforts to tackle wildfires and other natural disasters.

Read more