The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple • Hacker News Board

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#591

Post by LargeWu » Thu, Oct 04, 2018, 6:17 PM UTC

adamrezich wrote: post #355

onepremise wrote: post #342

Earlier quoted context omitted.

Seriously, why are we still outsourcing chip manufacturing to other countries? Sure it's cheaper, but we sacrifice a lot to have a society of corporate slaves build our tech. Security, core domain knowledge, capability, corporate secrets, patent rewards and enforcement, etc... All of it you throw away the minute you ship your manufacturing out of the country. I've seen enough board printing machines out there to star…

It's hard to compete domestically against low prices caused by China's completely different standards for wages and human rights for laborers. Plus, here we don't like the idea of manufacturing industries being subsidized by the government (except in the case of "defense" of course...), while China obviously has no qualms with doing so.

> except in the case of "defense" of course...

Well, this thread is exactly the reason we subsidize the defense industry to make sure things are produced in the US.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#592

Post by PurpleBoxDragon » Thu, Oct 04, 2018, 6:18 PM UTC

lmilcin wrote: post #427

zelon88 wrote: post #406

Earlier quoted context omitted.

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company. The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assu…

>The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty

Sounds like the solution is not doing business with them and pushing for a ban on others doing business with them (since this largely has a socialized cost when things go wrong, such as individual people having their credit cards stolen).

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#593

Post by freeflight » Thu, Oct 04, 2018, 6:19 PM UTC

blackrock wrote: post #304

I don't know which is more disturbing here. That the Chinese military is technically competent enough to pull off such a thing. Or that they are incompetent enough, to not secure their own back doors and networks, and allowed the FBI, NSA, and other American government organizations, the ability to counter-hack them, and monitor all their internal communications. The truth is somewhere in between. So, this article is…

> Or that they are incompetent enough, to not secure their own back doors and networks, and allowed the FBI, NSA, and other American government organizations, the ability to counter-hack them, and monitor all their internal communications.

Wait.. did I miss something in the article? The closest thing to that, I remember happening, had the roles reversed [0], and should be an important lesson about not underestimating the opposition.

[0] https://foreignpolicy.com/2018/08/15/botched-cia-communicati...

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#594

Post by lern_too_spel » Thu, Oct 04, 2018, 6:20 PM UTC

alfalfasprout wrote: post #322

guelo wrote: post #199

Earlier quoted context omitted.

NSLs require secrecy not lying.

The snowden leaks among others show that most companies aware of PRISM ended up flat out lying about it. Either it's a type of NSL we haven't seen before or employees receive death threats, etc.

No, none of the companies lied about it. The companies worked with the FBI's Data Intercept Technology Unit. They would obviously have no knowledge of a dowstream data processing system like PRISM.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#595

Post by cremp » Thu, Oct 04, 2018, 6:21 PM UTC

closeparen wrote: post #535

mthoms wrote: post #367

Earlier quoted context omitted.

Canadian steel is considered by this administration to be a national security risk. But Chinese made boards and chips installed in weapons systems and crucial data centers? No problem. Let that sink in for a moment. https://www.wsj.com/articles/dont-trust-the-chinese-to-make-...

The thing being called a national security risk is a lack of domestic production capability. No one is saying Canadian steel is sabotaged or something.

Though it is, because it happened with Kobe Steel. (Not saying Canada specifically.)

They faked the data on what it could handle; and with things such as aircraft, lives depend on that data.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#596

Post by freeflight » Thu, Oct 04, 2018, 6:21 PM UTC

matthewwiese wrote: post #393

gkanai wrote: post #331

Earlier quoted context omitted.

> America is finally admitting, that they too, actively spy on other countries. The Snowden revelations made that very clear to all years ago, no?

One doesn't even need Snowden to know this. Given even a little reading of the IC's (intelligence community), and more specifically CIA's, history. What else do you think they do all day, if not for spying on other countries? As mercutio2 mentioned in a reply to your same parent, the controversy w/r/t Snowden is domestic spying.

> As mercutio2 mentioned in a reply to your same parent, the controversy w/r/t Snowden is domestic spying.

In the US maybe, but most of the US's supposed "allies", and their citizens, would probably disagree with that interpretation.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#597

Post by lern_too_spel » Thu, Oct 04, 2018, 6:24 PM UTC

MrBingley wrote: post #246

zjfroot wrote: post #113

Statements from Amazon, Apple, Supermicro and Chinese government. https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... From Apple: "Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we h…

What liars. Apple has done this before as well, when they said they had "never heard" of PRISM, despite a Snowden leak showing the exact opposite. https://www.theguardian.com/world/2013/jun/06/us-tech-giants...

The Snowden leak confirmed Apple's statement. It showed that Apple worked with the FBI on a system to process court ordered user data requests. Apple would obviously have no knowledge of the code name of a downstream NSA system that processed that data.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#598

Post by joker112 » Thu, Oct 04, 2018, 6:24 PM UTC

dagenix wrote: post #527

pickleman wrote: post #486

Earlier quoted context omitted.

You're starting to realize that not all cultures are that great. >I think it’s more that you’ve valued the low per unit price over having a healthy contract. Well, when the choice is to either play ball or go out of business, it's not a tough decision.

> You're starting to realize that not all cultures are that great. That's sounding pretty racist

Did you mean... culturist?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#599

Post by PurpleBoxDragon » Thu, Oct 04, 2018, 6:24 PM UTC

pjc50 wrote: post #361

whatshisface wrote: post #299

Earlier quoted context omitted.

Another implication of the parallel axis theorem is that the attacker could perfectly mimic every moment of inertia by shaving plastic. They wouldn't have to know which two axes were being tested because there are only three real numbers worth of information in the system to begin with (once center of mass and total mass have been dealt with.) In the whole MOI tensor there are only six free numbers which sounds like…

> What was this company doing in hiring an untrustworthy manufacturer to handle secure devices? That's playing a game you've lost from the start You're assuming that there were feasible alternatives; from their comment below: "wasn't our device. There was a big, reputable company behind the device. We were ordering a number of those and they would be shipped to us directly from China. ... Also, we were basically lock…

Business lesson to include a 'no China' if the hardware handles anything sensitive, with a large fee for violating it for the middle man servicing the contract.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#600

Post by candiodari » Thu, Oct 04, 2018, 6:25 PM UTC

liveoneggs wrote: post #525

zelon88 wrote: post #406

Earlier quoted context omitted.

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

he's saying that his company knowingly allows a percentage of fraud, identity, and financial theft to occur against his customers' customers because there are enough layers of indirection where they (he and his bosses) probably can't be held personally responsible. Enough efforts (fancy tables with big receipts, etc) have been provided for coverage in case of a court case or media blitz but actually using a reputable…

I guess it's news to you that the financial sector and especially banks in fact do exactly that:

https://www.creditcards.com/credit-card-news/credit-card-sec...

But it doesn't stop with the cards. ATMs, Tax Fraud, ... almost all businesses within banks have to deal with fraud and there is some threshold that they just allow to happen.