China suspends partnership with Alibaba Cloud over cybersecurity flaw

467
2
China suspends partnership with Alibaba Cloud over cybersecurity flaw

BEIJING HONG KONG Reuters - Chinese regulators suspended an information-sharing partnership with Alibaba Cloud Computing, a subsidiary of the e-commerce conglomerate, over accusations it failed to report and address a cybersecurity vulnerability, according to state-backed media reports.

According to 21st Century Business Herald, the company's internal reforms did not immediately report vulnerabilities in the popular open-source logging framework Apache Log 4 j 2 to China's telecommunications regulator, but the notice said that MIIT suspended a cooperation with the cloud unit regarding cybersecurity threats and information sharing platforms, and restarted it in six months.

This latest measure shows Beijing's desire to strengthen control over key online infrastructure and data in the name of national security. The Chinese government has asked state-owned companies to migrate their data from private operators such as Alibaba and Tencent to a state-backed cloud system by next year.

The suspension highlights Beijing's concern about a vulnerability that has caused a wave of panic among corporations and governments around the world. Apache Log 4 j 2 is a Java-based tool that is widely used in enterprise systems and web applications.

This vulnerability can lead to remote control of equipment, which can lead to serious harms, such as the theft of sensitive information and interruption of equipment services. The telecommunications regulators said last week that it was a high-risk vulnerability.

According to the statement, the Alibaba Cloud has discovered a remote code execution vulnerability in the Apache Log 4 j 2 component, notifying the U.S. based Apache Software Foundation.

MIIT received a report from a third party about the issue, rather than from the Alibaba Cloud.

Alibaba Cloud didn't say anything about the suspension.