Earlier quoted context omitted.
Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…
Maybe you and me are missing something here. It seems crazy that somebody would go to these lengths without switching suppliers, there must be an underlying reason that is assumed to be understood by the informed reader. (But isn't understood by me and you it seems.)
The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
601–610 of 818 posts
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#602Earlier quoted context omitted.
> Has the West completely lost the ability ... at first I had the same thought. but i have to question how securely the same manufacturing could be done in a US plant. the US employee base has its fair share of desperate, ethically challenged individuals. and plenty of incentives to make a quick buck could be offered here too. idk.
The consequences if US citizens or residents get caught engaging in espionage for a foreign government are go-to-jail-for-years serious.
OTOH, given US law enforcement's low efficiency what are the chances of being caught? and what if it's merely corporate espionage?
finally, the US is an open society with strong personal freedom guarantees builtin. what if the perpetrator has ties to a foreign country and simply leaves the US after they've installed the vulnerabilities?
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#603Saying "Well the Chinese companies are different" or "It's just rogue employees" or "We just have to accept it" is not good enough.
We need a little bit more economic nationalism and realize that this shit matters. How is it so shocking? How did a Canadian security firm find something before the CIA/DoD? How is this not a NatSec program to be inspecting this stuff through shell company orders and honeypots, like we have on the Internet?
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#604Earlier quoted context omitted.
You're starting to realize that not all cultures are that great. >I think it’s more that you’ve valued the low per unit price over having a healthy contract. Well, when the choice is to either play ball or go out of business, it's not a tough decision.
> You're starting to realize that not all cultures are that great. What measures a culture's greatness? How can this value be empirically deduced?
That's not to say that there is a such thing as single-dimension "greatness" metric. However, outlawing value judgments is going too far in the other direction. Of course, such things can be quite sensitive, and should be done thoughtfully.
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#605Earlier quoted context omitted.
There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company. The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assu…
This still sounds nuts to me. Two thoughts: > they typically will not be thinking they are doing anything wrong. They are just testing if you notice and if you do not they will say it makes no difference for you but saves them costs. This is how children behave. Still feels like you’re rewarding bad behavior. You’re enabling them. I think it’s more that you’ve valued the low per unit price over having a healthy contr…
From a naive Finnish perspective you could see American business culture as dishonest. People lie all the time and promise things that are false and you need massive amount of legalese or they fuck you over. When they say something, you can't trust it as much as you can trust a Finn (or Swede). American way is to lie to your face in pre-negotiation but then be truthful to the legally binding agreement. Germans or Belgians are more truthful beforehand and they stick to deals better without legal enforcement looming over them, but require more detailed written deals than Finns. Who is right? Should we punish Americans for their behavior or adopt their culture?
Of course not. You must understand that that the level of acceptable exaggeration, overpromise and bullshit and trickery is strictly culture dependent and relative. Someone is dishonest if they "lie this amount above average" in their cultural context. After you make an adjustment, you know how to get the truth.
Chinese manufacturers have the capability to stick to standards, take responsibility and deliver high quality stuff. It's just more dependent on personal relationship. Just placing an order has less trust as default. Either you develop "quanxi" with your suppliers or work trough some third party that understands both worlds. Third party understands what you need and knows how to get it from the Chinese suppliers because they have a relationship.
Chinese pay the cost that comes with their business culture. They can't network as fast as you can in open western cultures with more default trust between strangers.
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#606I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…
Could this be solved by a clause in the contract that specified if any randomly sampled devices came tampered with, the manufacturer did not get paid?
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#607Earlier quoted context omitted.
You are underestimating the FUN of playing anti-anti-^N-hacks. I have had the privilege to be paid to so anti-anti-^N-hacking on a firewall thingy in the past and it was a challenge and a joy!
The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#608Earlier quoted context omitted.
This still sounds nuts to me. Two thoughts: > they typically will not be thinking they are doing anything wrong. They are just testing if you notice and if you do not they will say it makes no difference for you but saves them costs. This is how children behave. Still feels like you’re rewarding bad behavior. You’re enabling them. I think it’s more that you’ve valued the low per unit price over having a healthy contr…
This is just how low trust societies function for hundreds if not thousands of years. This is also why families tend to be much stronger in these places. The American idea of a strong family is different from what I'm describing, since it just centers on immediate family. My definition of strong family bonds, implies both closeness and dependency not just on your immediate family, but even on your distant cousins on…
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#609Earlier quoted context omitted.
> To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry Perhaps this sounds too dull to ask, but what stops the terminal from just ... not separating the keyboard and display?
Certification. Worked in the same industry, and there were very strict both hardware and software requirements for POS software. Having gone trough credit-card audits, early EMV certification programs, and certification to place non-payment software next to payment software on such systems, I can tell you - it's no joke :)
I'm not so sure. "And then initial supplier inserted hardware that thwarted all those pressing considerations" sounds a punchline to me. :(.
Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple
#610Earlier quoted context omitted.
Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…
There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company. The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assu…