Slashdot Mirror
Huawei Is Blocked in US, But Its Chips Power Cameras Everywhere (bloomberg.com)
An anonymous reader shares a report: Pelco, a California-based security camera maker, set lofty sales targets last year for a model with sharper video resolution and other cutting-edge features. That was until Congress derailed its plans. In August, updated legislation barred the U.S. military and government from buying tech gear from firms deemed too close to authorities in China. When the bill surfaced, Pelco scrapped any thought of providing its new GPC Professional 4K camera to the U.S. government and lowered its sales goals. The reason: The device uses parts from HiSilicon, the chip division of Huawei.
[...] Most of the focus is on Huawei telecom gear that helps run communications networks all over the world. But chips from the HiSilicon unit are also sparking concern because they power about 60 percent of surveillance cameras. That means Chinese chips process video from cameras that sit in places as varied as pizzerias, offices and banks across the U.S.
[...] Most of the focus is on Huawei telecom gear that helps run communications networks all over the world. But chips from the HiSilicon unit are also sparking concern because they power about 60 percent of surveillance cameras. That means Chinese chips process video from cameras that sit in places as varied as pizzerias, offices and banks across the U.S.
I mean yes, let's absolutely block ALL mnufacturers from China, because they spy sneakingly.
Following that same (valid) reasoning, since the USA has more than ten times the spying budget and we havd literal proof that they spy on ALL the people, including for corporate interests or sexual/love reasons, we should ban ALL US products ten times more.
Priorities, people!
It's the NSA/DHS/FBI/DEA/... that are the biggest threat, if you're US-American, since they have actual power over you.
Ban Huawei, if you are *Chinese*! Again since the Chinese government has powet over you.
Oh wait ... this is about protecting the US *corporate government*! Not the people!
It's about a spying monopoly ON the US-American people!
But seriously, if you have an Internet of Things device, it is being used to spy on you. Doesn't matter who made the chips, doesn't matter what it is doing.
We can argue about whether that is a main or secondary purpose, but It is a spying device that you voluntarily install.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
I'd partially question the reasoning behind this because it seems more political than science based. Although yes, a camera chip is a tad more complex than decades ago, I'm still willing to bet that if a manufacturing entity was crazy enough to insert spyware into such a chip that it would stand out like a sore thumb. You can't hide things entirely when you have scanning electron microscopes or X-ray technology. It's like asking the company constructing your house to build an actual secret passageway. A much more discrete way is to leave a lock on a window broken for example so that it doesn't look like you're making an obvious backdoor. The problem is on a chip the most likely way would be that it would leak a little EMI which would probably be only usable at extremely close range. I'm not saying this isn't impossible but it would be an impressive challenge.
... like they will send all Angela Merkel's nude images to the NSA [theguardian.com], trigger all WMDs in Iraq, and make you hyper paranoia if you are not already.
The US is already in the state of paranoia.
Or rather it is, but only as a commercial competitor. Those that cannot compete in fair market will often try anything. Kind of funny to see this happening in the US where the "free market" is a huge fetish. The whole "spying" thing is a big fat smokescreen.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I bought a web security cam for $15 on sale over the holidays. I can't figure out how they can retail for so cheap. It has a HiSilicon "camera" SoC. From what I saw with a quick web search, this SoC does everything in the device. Basic image capture stuff, handles whatever API the vendor app to connect to it needs, full recording to the SD card, etc. Apparently if I felt like jerry-rigging a cable, I could telnet (or SSH?) and get a (busybox?) shell. I'm sure there's enough processing in it to handle all kinds of stuff..
Many here will remember how harmless looking printers were used to hack corporate networks.
So yes, a camera chip is a pretty obscure place to hack, but it probably talks to the main system over an unsecured protocol that was never designed for a hostile chip at the other end.
Everything is so complex now, with so much power, that many weird things can be done.
For core network devices the restriction on Huawei makes sense as there is the side band maintenance network that core network infrastructure has. It's not so much them reading the data passing through the network as it is the ability for them to bring the network down.
That said you would be crazy to think the US doesn't have exactly the same capabilities in the Cisco and other US brand equipment that is installed around the world.
We use enterprise level surveillance software provided by a Canadian vendor. Two years ago, the vendor issued a security advisory suggesting their customers stop using HIK Vision cameras.
The surveillance software is configured to manage video using dedicated servers on the customer's premises and nothing else. This isn't cloud-based software.
When I asked why the vendor issued the advisory, the company's president cited two cases involving different sites. In one case, the cameras were detected attempting to reach servers in China despite being configured to serve video only to the customer's on-site servers.
In another incident, HIKVision responded to a request for tech support on a camera by sending a sample shot to the customer. The customer was surprised to see that the sample had been taken from his own camera. Again, the video was supposed to stay on the customer's premises; there are no off site servers talking to the servers tasked with managing video.
The vendor will no longer support HIKVision cameras unless the customer signs a hold harmless document specifically acknowledging the security risk the cameras pose.
Before I retired a few years ago I wrote drivers for cameras that went into cellphones. These things were hideously complex, and a minor tweak to some obscure "sets the delta alpha gamma anion setting" could have dramatic effects on the picture quality.
None of the 100+ registers had anything to do with networking. They weren't even directly connected to anything outside the 8-16 bit interface used to talk to them. I can't think of any way these sensors could be used for spying, unless they had a hidden, built in wireless link built in. Which I strongly doubt, as the prices between cameras was pennies per unit.
That said, if a single chip had a camera and network interface (which I never ran across) then there could be issues.
Please post the link to your completely unprotected feed from your in-house IP camera. If you don't want to then maybe re-assess why this restriction is in place.
As mentioned above - the 'camera' most likely has a CPU + network + operating system on it, all in the same chip. Plus it was probably sold at an impossibly low price (subsidised, perhaps?) so it would sell in decent quantity, and a few of them might end up in 'interesting' places.
The cameras should still be on their own network and firewalled from the outside world.
With core networking gear the concern is exploits through the control network which can't be firewalled.
This security camera maker used insecure parts, and had to lower targets when several governments said 'this cannot be trusted this way'
WHAT A VICTIM, BIG BAD AMERICANS
how short sighted y'all are
StoneCypher is Full of BS
Security cameras and their hub systems have been hacked like crazy, largely because the average user (homeowner, retail lackey, office lackey) doesn't even bother changing the default passwords, much less a firewall or any reasonable security measures. Here's a report of a website streaming over 70,000 hacked cameras, and here's a report of over a hundred police surveillance cameras being hacked to send spam right in DC. They're plenty hackable, just a matter of whether the Chinese state thinks it's worth risking sanctions from the countries they're surveilling.
But this could also easily be industrial espionage. In the US, anyone competing with Huawei could simply spend a few million lobbying to convince congress that it's happening. No proof is required, only that the capability is there, and that if China was doing it we might never know.