Slashdot Mirror
Can You Trust Chinese Computer Equipment?
Ian Lamont writes "Suspicions about China slipping eavesdropping technology into computer exports have been around for years. But the recent spying attacks, attributed to China, on Google and other Internet companies have revived the hardware spying concerns. An IT World blogger suggests the gear can't be trusted, noting that it wouldn't be hard to add security holes to the firmware of Chinese-made USB memory sticks, computers, hard drives, and cameras. He also implies that running automatic checks for data of interest in the compromised gear would not be difficult." The blog post mentions Ken Thompson's admission in 1983 that he had put a backdoor into the Unix C compiler; he laid out the details in the 1983 Turing Award lecture, Reflections On Trusting Trust: "The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."
This is just another reason for me to not want to buy Chinese made goods. Unfortunately, so much is made in China that it is nearly impossible to completely avoid the country.
I don't like Linux. This doesn't make me a troll.
No.
Considering where a lot of this stuff comes from, it should probably read, "Can You Trust Computer Equipment?"
Freedom is drinking a beer in the park when you're supposed to be at work.
Cause it's only the chinese that spy on other countries cause the rest of us are all friends and friends don't spy on eachother ... oh wait ... Seems that red paranoia have had a bit of a colour change.
Sure this might be software related so it's write once - copy everywhere but would you really want to do that. Cause if you plant it everywhere, "everyone" will have it leading to a larger chanse it will be found and out blow the entire operation out of the water. But have they really ever found any evidence for this on a large scale? Seems overly complex and prone to failure. Sure if you bug a phone, switch or whatever that is one thing but to plant it in every single device you ship. That would or could seriously mess with the profit margin and nobody is going to stand for that.
If you didn't build it yourself perhaps this is just the risk you run.
It is a rather simple military rule that you create your own information networks. You don't let your enemy or even your ally. Using Chinese made equipment for any military equipment is a bad idea. This is a no-brainer.
excitingthingstodo.blogspot.com
While the USB memory key (in this example) could have low level software to snoop your data, how are they going to get it? Is the USB key going to open a TCP/IP or UDP connection back to their servers without tripping my firewall that a new application is trying to connect? Is my virus scanner going to get tripped that something suspicious is coming out of the key without my interaction?
Most decent virus scanners and firewalls will pick up on this. In a lot of corporate networks USB Mass media is disabled. I'd love to see a proof of concept that can get around these common checks... If anyone has a USB key that can do this, please let me know :-) I'll happily test it.
Looks completely made up to me. Why just think about the times that the consumer has ran across hidden malware such as the Sony Rootkit incident. Experts saw unusual traffic and traced it back to a CD. Same thing would happen if a piece of equipment had hidden malware in it, someone would notice the suspicious traffic and trace it back to the source.
Don't know something? Look it up. Still don't know? Then ask.
IMO people are worrying far too much about an exploit mechanism that is simply not needed if the Chinese want to spy on the West, or anyone else for that matter.
The problem with building backdoors into the hardware or firmware is that such backdoors are traceable. You know where it was made. The right forensics people can probably tell you the exact factory it came out of. And how many people would buy chips from a Chinese fab once someone found a hardware backdoor inserted into a product? The Chinese want to make money first and foremost, not shoot themselves in the foot adding a backdoor that might have a one-in-a-million shot of giving them access to a system they even cared about, but would destroy an entire industry if they were caught. It's not worth the risk.
The smart thing to do is what they (and everyone else) are doing right now - use software exploits over the net to gain access. The attack can be targeted, the attackers can easily hide their tracks, the attacks can be modified as needed, and you have plausible deniability if you're caught. That's the smart way to subvert your enemies, and as long as governments and businesses keep running Windows, it's the way that they'll keep using.
Comment removed based on user account deletion
and before thinking that "this is crazy, a U.S. firm wouldn't possibly do that" bear in mind that i've already had some experience of receiving a very weird series of SPAM messages, following which my machine started acting very very weird.
my guess is that simply by receiving that SPAM message, there was encoded within it some power-fluctuations or signal fluctuations which the CPU could pick up and "activate" whatever it was that was wanted to be activated by whomever it was that sent the SPAM message.
To be fair, the "Troll" mod is also used as a substitute for "Batshit-Crazy".
WARNING! This post is encoded with power and signal fluctuations that which will cause your machine to start acting very very weird. Again, if your computer starts acting very very weird after you read this it is because of this post.
Now that I think about it, I'm pretty sure everything I just said is completely wrong.
All around on the interwebs, people say that the American government has a secret agenda in ruling the world more than it does now. There is the CIA, the NSA and other 3 letters that makes anyone fear. Since they are all American and all are evil according even to some American people, should I trust things that come from that the USA?
I understand you poor Americans ARE terrified and scared because you can feel the power slipping away from your fingers but this is getting ridiculous, dont yo think? The level of FUD on China oat /. is reaching USA gov levels. Come on now, how bullshiting can you get and how low can you go??? A LOT lower than I ever imagined. Shame on you, shame!
This is MY last message here, I am deleting my account and NEVER coming back here.
You have officially become complete bullshitters.
I got permanently modded -1 because I dared to question Israel on
The proximal causes of WWI were a combination of the secrecy of the treaties and the necessity of starting mobilization N days before any attack by an aggressor.
It was a system-level failure : prudent mobilizations for defense were indistinguishable from those intended for offensive operations, and no country could foresee the effects of their foreign policy actions.
Of course, we can't now, either. Multi-lateral international diplomacy with war is a game that makes 3D or 3-way chess look like tic-tac-toe. Nobody plays 3D or 3-way chess, as you can't play enough games in a lifetime to know whether you are getting better or not.
"The Constitution, the WHOLE Constitution, and nothing but the CONSTITUTION."
"But I guarantee you..."
That's a hell of a guarantee to make, especially given how extensively the US is currently known to spy on its citizens.
Not defending China here at all, nor saying that things in the western world are _that_ bad, but I think they are much closer than you claim.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
No.
There, that's all there is to it. Chinese, Korean, Vietnamese, American, British, Indian, or other.
You can't trust the companies, and you can't trust the governments. Everywhere a corrupt person _could_ have (or create) access to data they shouldn't, there _will_ be a corrupt person working at it.
Maybe it's the Chinese government, maybe it's a hacker at a chip factory, maybe it's the Russian mafia, maybe it's a rogue NSA operative (or the NSA itself), but SOMEONE will do this eventually. They may not be after your data, but if it becomes useful (i.e. valuable) to them, then they'll use it.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
I was a gung-ho CS student when this article came out, and we spent a LOT of time hashing it over. He specifically did not say that he had done this, and while I don't remember him making an outright denial, we concluded that he hadn't. After all, the C compilers of that day were still small enough to be understood by a single human, and comparing C code to the assembly code generated from it (or comparing that assembly code to generated machine instructions) was not very challenging.
Maybe the Jargon File entry is right, and he did implement it as a proof-of-concept, but it wasn't widely distributed. It was easy enough for an interested (and bored) undergrad to check out over a weekend, but hard enough that compiler distributions weren't routinely examined.
With today's optimizing compilers and layers upon layers of abstraction, though, it seems like there's more than enough room for plenty such exploits. Pham Nuwen can still have his backdoor into the localizers.
Lets see: Xerox machines in the Kremlin with cameras. AT&T handing information over for the asking. Warrantless wiretaps. The Patriot Act. Asshats from Microsoft saying it would be a good idea for everybody on the Internet to have an I.D. (your papers please?). The Chinese government is just one more hole in the Swiss cheese. Oh wait, never mind, it's perfectly fine if WE do it. *sigh*