Live data from Hacker News

The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

bloomberg.com

601–610 of 818 posts

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#601

Earlier quoted context omitted.

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

Maybe you and me are missing something here. It seems crazy that somebody would go to these lengths without switching suppliers, there must be an underlying reason that is assumed to be understood by the informed reader. (But isn't understood by me and you it seems.)

Profit. Changing suppliers is going to cost money.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#602

Earlier quoted context omitted.

> Has the West completely lost the ability ... at first I had the same thought. but i have to question how securely the same manufacturing could be done in a US plant. the US employee base has its fair share of desperate, ethically challenged individuals. and plenty of incentives to make a quick buck could be offered here too. idk.

The consequences if US citizens or residents get caught engaging in espionage for a foreign government are go-to-jail-for-years serious.

ok. a fair point.

OTOH, given US law enforcement's low efficiency what are the chances of being caught? and what if it's merely corporate espionage?

finally, the US is an open society with strong personal freedom guarantees builtin. what if the perpetrator has ties to a foreign country and simply leaves the US after they've installed the vulnerabilities?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#603
We need to get the fuck out of China. It is becoming less credible to throw our hands up and say "China has all the silicon manufacturing, guess we have to put up with it!" - this is national security, both directly via hardware in the DoD and through our economic stability.

Saying "Well the Chinese companies are different" or "It's just rogue employees" or "We just have to accept it" is not good enough.

We need a little bit more economic nationalism and realize that this shit matters. How is it so shocking? How did a Canadian security firm find something before the CIA/DoD? How is this not a NatSec program to be inspecting this stuff through shell company orders and honeypots, like we have on the Internet?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#604

Earlier quoted context omitted.

You're starting to realize that not all cultures are that great. >I think it’s more that you’ve valued the low per unit price over having a healthy contract. Well, when the choice is to either play ball or go out of business, it's not a tough decision.

> You're starting to realize that not all cultures are that great. What measures a culture's greatness? How can this value be empirically deduced?

There are many important and worthwhile discussions that our empirical tools are not able to significantly contribute to.

That's not to say that there is a such thing as single-dimension "greatness" metric. However, outlawing value judgments is going too far in the other direction. Of course, such things can be quite sensitive, and should be done thoughtfully.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#605

Earlier quoted context omitted.

There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company. The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assu…

This still sounds nuts to me. Two thoughts: > they typically will not be thinking they are doing anything wrong. They are just testing if you notice and if you do not they will say it makes no difference for you but saves them costs. This is how children behave. Still feels like you’re rewarding bad behavior. You’re enabling them. I think it’s more that you’ve valued the low per unit price over having a healthy contr…

It's not rewarding bad behavior when you take it into account in the deal. Moralization is useless when you do business with different cultures. When you notice something what would be out of ordinary in your culture, you estimate the cost and find out how locals solve it. Different cultures have different kinks and people living there know to adjust to them. It can be fun to figure out how other cultures function.

From a naive Finnish perspective you could see American business culture as dishonest. People lie all the time and promise things that are false and you need massive amount of legalese or they fuck you over. When they say something, you can't trust it as much as you can trust a Finn (or Swede). American way is to lie to your face in pre-negotiation but then be truthful to the legally binding agreement. Germans or Belgians are more truthful beforehand and they stick to deals better without legal enforcement looming over them, but require more detailed written deals than Finns. Who is right? Should we punish Americans for their behavior or adopt their culture?

Of course not. You must understand that that the level of acceptable exaggeration, overpromise and bullshit and trickery is strictly culture dependent and relative. Someone is dishonest if they "lie this amount above average" in their cultural context. After you make an adjustment, you know how to get the truth.

Chinese manufacturers have the capability to stick to standards, take responsibility and deliver high quality stuff. It's just more dependent on personal relationship. Just placing an order has less trust as default. Either you develop "quanxi" with your suppliers or work trough some third party that understands both worlds. Third party understands what you need and knows how to get it from the Chinese suppliers because they have a relationship.

Chinese pay the cost that comes with their business culture. They can't network as fast as you can in open western cultures with more default trust between strangers.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#606
post #74

I have worked in card payment industry. We would be getting products from China with added boards to beam credit card information. This wasn't state-sponsored attack. Devices were modified while on production line (most likely by bribed employees) as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag. Once…

Could this be solved by a clause in the contract that specified if any randomly sampled devices came tampered with, the manufacturer did not get paid?

I'm sure the Chinese government would be willing to keep afloat companies that allow them to tamper with.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#607

Earlier quoted context omitted.

You are underestimating the FUN of playing anti-anti-^N-hacks. I have had the privilege to be paid to so anti-anti-^N-hacking on a firewall thingy in the past and it was a challenge and a joy!

The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.

a good hack can sometimes be it's own reward

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#608

Earlier quoted context omitted.

This still sounds nuts to me. Two thoughts: > they typically will not be thinking they are doing anything wrong. They are just testing if you notice and if you do not they will say it makes no difference for you but saves them costs. This is how children behave. Still feels like you’re rewarding bad behavior. You’re enabling them. I think it’s more that you’ve valued the low per unit price over having a healthy contr…

This is just how low trust societies function for hundreds if not thousands of years. This is also why families tend to be much stronger in these places. The American idea of a strong family is different from what I'm describing, since it just centers on immediate family. My definition of strong family bonds, implies both closeness and dependency not just on your immediate family, but even on your distant cousins on…

Not much to add, but want to note that you're spot on. I've encountered this SO many times over the years and this is always the explanation I'm given. At first it just made me indignant, too, and to some degree I guess it still does, but now I just try to let it go.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#609

Earlier quoted context omitted.

> To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry Perhaps this sounds too dull to ask, but what stops the terminal from just ... not separating the keyboard and display?

Certification. Worked in the same industry, and there were very strict both hardware and software requirements for POS software. Having gone trough credit-card audits, early EMV certification programs, and certification to place non-payment software next to payment software on such systems, I can tell you - it's no joke :)

Certification [...] I can tell you - it's no joke :)

I'm not so sure. "And then initial supplier inserted hardware that thwarted all those pressing considerations" sounds a punchline to me. :(.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#610

Earlier quoted context omitted.

Wait a minute... So your company has a Chinese equipment supplier, finds out that the supplier is tampering with your purchased equipment, and your solution is to add criteria to the incoming inspection? No wonder China keeps screwing with you guys. You aren't supposed to eat that cost! Write a PO with tons of fine print that says "We will disassembly units at random for compliance inspection. Non compliant products…

There were other considerations like the fact we were actually buing it from large reputable company and what happened was that some employees were doing it with no involvement of the company. The fact is, doing any kind of hardware production in China, you have to be aware Chineese have different value system and you would not be suited doing any business if you throw tantrum at any sign of apparent dishonesty (assu…

[deleted]
Post reply on HN