Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

bloomberg.com

Post reply on HN
Print view View original

211–220 of 818 posts

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#211

Post by m_mueller »

baybal2 wrote: post #139
m_mueller wrote: post #96

Earlier quoted context omitted.

> Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems? I'd like to know this too. Has the West completely lost the ability to mass produce microchips at even a reasonable cost for financial applications?

America has fabs, both old and leading edge, but ask industry giants like Gemalto to even bother to manufacture chips anywhere outside of Taiwan, assemble the final product outside of China. They will never do that, because they look for the cheapest solution. The bigger the company, the less it cares about things other than cost. This is why Mediatek and Broadcom can usurp the market of network SoCs, while making pr…

What about Japan? I know they've lost most of their semiconductor business as well, but they still have some capacity no?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#212

Post by i_am_nomad »

Dowwie wrote: post #83

This story could easily be interpreted as anti-China propaganda. Could you think of any other sovereign power who would want a backdoor into servers used by billions of people across the internet? Hardware comes from China. This doesn't mean that the Chinese government orchestrated the attack. The United States government is having a trade war with China. This article's publication isn't just coincidence. Further, th…

The United States is having a trade war with China partially because of this kind of thing.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#213

Post by ethbro »

nithinm wrote: post #160
Dowwie wrote: post #83

This story could easily be interpreted as anti-China propaganda. Could you think of any other sovereign power who would want a backdoor into servers used by billions of people across the internet? Hardware comes from China. This doesn't mean that the Chinese government orchestrated the attack. The United States government is having a trade war with China. This article's publication isn't just coincidence. Further, th…

your comment looks like an pro-china propaganda. In china the state has heavy control on all the companies. The hardware is manufactured in china. I don't think something like this is happen without the state's knowledge.

It seems like many people take communist-like propaganda at face value.

The Chinese government would like to have almost-complete control. The Chinese government publicly says it has high levels of control.

But when they can't effectively regulate their medical (mass HIV infection from blood plasma needle reuse), food (tainted milk), or chemical (unlicensed mass CFC production) industries... reality seems to differ.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#214

Post by lmilcin »

ElBarto wrote: post #173
lmilcin wrote: post #162

Earlier quoted context omitted.

The point is that the process was to assure the device wasn't tampered AFTER shipped from manufacturer. Nobody thought it could already have been modified so early in the process. This is the eternal cat and mouse game. When I started in IT in 90s it was assumed that company network was quite safe and you didn't always need passwords, maybe for critical resources only.

I would think that, logically, and as illustrated, "the device wasn't tampered AFTER shipped from manufacturer" means after YOU have shipped it to customers. The anti-tampering system is to prevent modifications in the field.

The manufacturer shipped the device to us from China. We were already customer. The device would already have been locked. We would customize it some more (injecting cryptographic keys, application, placing our labels on the device) and then send them to merchants. The merchants were never customers, they would get it on loan from us. This was the only way to do it as the device could not be re-used with other acquirer so it only functioned as long as the merchant had valid merchant account with us.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#216

Post by gnode »

ycmbntrthrwaway wrote: post #204
lmilcin wrote: post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

> We could not measure all possible angular momentums but it was possible to measure one or two that would not be known to the attacker. You only need to measure three angular momentums, all other can be calculated. See https://en.wikipedia.org/wiki/Moment_of_inertia#Motion_in_sp... "This shows that the inertia matrix can be used to calculate the moment of inertia of a body around any specified rotation axis in the b…

Maybe they're also measuring centrifugal force for rotations with axes not intersecting the centre of mass.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#217

Post by akuji1993 »

Avamander wrote: post #165
akuji1993 wrote: post #71

Earlier quoted context omitted.

This is because, contrary to what a lot of people say about dark themes (even though it's mostly a meme at this point), dark letters on white background are better to read than white letters on black background.

"People with astigmatism (approximately 50% of the population) find it harder to read white text on black than black text on white. Part of this has to do with light levels: with a bright display (white background) the iris closes a bit more, decreasing the effect of the "deformed" lens; with a dark display (black background) the iris opens to receive more light and the deformation of the lens creates a much fuzzier…

I actually have astigmatism so that might be why I think it's even harder to read on black/dark themes. So yeah, definitely true in my case.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#218

Post by scoggs »

lmilcin wrote: post #157
etatoby wrote: post #140

Earlier quoted context omitted.

You are underestimating the FUN of playing anti-anti-^N-hacks. I have had the privilege to be paid to so anti-anti-^N-hacking on a firewall thingy in the past and it was a challenge and a joy!

The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.

Honestly if it weren't programming I feel like this is a movie-worthy story. To me it sounds so thrilling like a spy movie plot but am I just imagining that or was it actually this crazy / cool / integral to way bigger moving parts / things like I'm assuming? Regardless kudos. Your story definitely started my day on a happy note, thanks!

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#219

Post by jekub »

caf wrote: post #200
lmilcin wrote: post #196

Earlier quoted context omitted.

The device outer enclosure was tamper evident but the device itself was tamper proof HSM, basically. Any kind of intrusion (melting, dissolving, drilling, etc.) into a secure internal enclosure (separate processor, memory and battery) would cause internal battery to be disconnected from internal SRAM and basically the device would loose all cryptographic material and then self-destruct. To give a bit of background, w…

Those VISA/MasterCard rules can't be universal because there's at least one bank issuing merchant terminals that run Android and take the PIN on the touchscreen: https://www.commbank.com.au/business/merchant-services/eftpo...

This only accept contact-less payment who doesn't require pincode.
Post reply on HN