Slashdot Mirror
The Messy Truth About Infiltrating Computer Supply Chains (theintercept.com)
In October last year, Bloomberg Businessweek published an alarming story: Operatives working for China's People's Liberation Army had secretly implanted microchips into motherboards made in China and sold by U.S.-based Supermicro.
While Bloomberg's story -- which has been challenged by numerous players -- may well be completely (or partly) wrong, the danger of China compromising hardware supply chains is very real, judging from classified intelligence documents, reports The Intercept.
From the report: U.S. spy agencies were warned about the threat in stark terms nearly a decade ago and even assessed that China was adept at corrupting the software bundled closest to a computer's hardware at the factory, threatening some of the U.S. government's most sensitive machines, according to documents provided by National Security Agency whistleblower Edward Snowden. The documents also detail how the U.S. and its allies have themselves systematically targeted and subverted tech supply chains, with the NSA conducting its own such operations, including in China, in partnership with the CIA and other intelligence agencies. The documents also disclose supply chain operations by German and French intelligence.
What's clear is that supply chain attacks are a well-established, if underappreciated, method of surveillance -- and much work remains to be done to secure computing devices from this type of compromise. "An increasing number of actors are seeking the capability to target ... supply chains and other components of the U.S. information infrastructure," the intelligence community stated in a secret 2009 report. "Intelligence reporting provides only limited information on efforts to compromise supply chains, in large part because we do not have the access or technology in place necessary for reliable detection of such operations."
What's clear is that supply chain attacks are a well-established, if underappreciated, method of surveillance -- and much work remains to be done to secure computing devices from this type of compromise. "An increasing number of actors are seeking the capability to target ... supply chains and other components of the U.S. information infrastructure," the intelligence community stated in a secret 2009 report. "Intelligence reporting provides only limited information on efforts to compromise supply chains, in large part because we do not have the access or technology in place necessary for reliable detection of such operations."
The NSA admits doing exactly this to target high-value individuals. Order a computer, they intercept the package, in a few hours it's opened and modified and packed back up with OEM stickers like new. You would never know.
China is just much more broad and bold with their attempts to catch up using 3rd party companies that are actually 1st party ChiCom Party owned entities.
Supermicro may or may not have been a real story - however, if it WAS REAL, the NSA and SECINT have no obligation to inform the public of that, only to mitigate it as they mitigate dozens of things we know nothing of.
The problem isn't that there's no evidence, the problem is that we have no legal authority to demand evidence if it exists to know either way. Journalism has to catch them red-handed by itself for us to find things out.
Hence Edward Snowden's revelations.
Want to protect your supply chain from tariffs, spying, and other political crap? Diversify! Make components in as many countries as possible, and when one is compromised, shut it down and make it someplace else.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Think about it: if every computer on the planet is streaming private material to China, what the hell would China do with all that data? And why would I care? its not like the Chinese are going to send me for re-education. OTOH, we can see what happens when the NSA comes after you.
Sent from my ASR33 using ASCII
that China still calls their military the "China's People's Liberation Army". The people were "Liberated" a long time ago. It's just the army now.
I don't think it matters that we've handed so much manufacturing over to the Chinese. The folks running the show, what we usually call the Ruling Class, are global now. They might have the occasional spat here and there over who's yacht's bigger or who's the richest this week but they're not really fighting (and by extension the countries they run aren't fighting).
I suppose it's a good thing. A World War isn't the solution (though it's one way to kick your economy up a notch). But anything we're seeing here is at best a pissing match between billionaires.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
How does it "generate hate" to point out that China attacks the US constantly online and seeks to overthrow our superpower status technologically through subterfuge because they have a less capable military currently?
Maybe you just don't understand hegemony? It's always going to be there until we have either world governance (UN is toothless by design..) or one power cements itself as the only power.
Pretending China is an equal-opposite analogue of the US is where these analogies fail. They are not a country of actual laws. They are actually a cabal.
Yes, the US is served by defending itself from China, and vice versa. To jump to an omni-beneficial relationship would require serious restructuring that won't happen without bloodshed in either case.
So, detente instead. Pretending it's unwarranted or immoral is to not understand the point of it.
Maybe you didn't consider the possibility that from China's standpoint, the US started it, and the only reason the US citizens aren't outraged about this is because they've been outright lied to by their own intelligence agencies gone rogue.
Greedy suit-wearing McMansion-dwelling fat-bellied US bosses couldn't resist the temptation of outsourcing to China for cheap and now the rest of us have to pay for it.
This makes me think of the backstory to The War Against the Chtorr series by David Gerrold. After losing several devastating conflicts, the US is forced into giving up it's military might and provide reparations to other countries. Instead of money, it provides food and high tech goods, such as computers and electronics, making the world dependent on US technology. All of the ICs have Trojan Horses hardwired into them that are undetected, which can were used as kill switches. That comes in real handy when some of those countries decide to invade the US in order to "liberate" resources that they want.
Could something like this be used by China to cripple enemy economic and military might in a future conflict? We'd be fools not to consider this a very realistic possibility.
Beware of Sales Reps bearing gifts.
Closed firmware... How is there not a class action lawsuit against Intel for this?
Iran knows not to buy industrial controls from the U.S. (Stuxnet). And the U.S. should know not to buy computers and phones from China.
“Common sense is not so common.” — Voltaire