Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden leak: Cavium networking hardware may contain NSA backdoor

twitter.com

Post reply on HN
Print view View original

121–130 of 628 posts

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#121

Post by saalweachter »

jacquesm wrote: post #95
dmayle wrote: post #90

Earlier quoted context omitted.

That's actually not true. It can do nothing about M of N cryptography. (That's when a key is broken up such that there are N parts, and at least M (less than N) are required to decrypt. It doesn't matter how many rubber hoses you have, one person can fully divulge or give access to their key and it's still safe.

Sure, so you hit all of the people that have all of the pieces. Problem solved.

Or you publicly announce you're hitting 1 of the N people with the rubber hose until M-1 of the other people send you their key fragments.

It's not like these keys are shared among disinterested strangers who have no attachment to each other.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#122

Post by ramesh31 »

perihelions wrote: post #2

How the NSA successfully manage to prevent the Washington Post and friends from discovering and reporting on this malicious backdoor? They've been sitting on these documents for a decade. Are the journalists just that *uncurious* about the deep contents of the documents they hold exclusive access to? Was this some kind of organizational failing?

>How the NSA successfully manage to prevent the Washington Post and friends from discovering and reporting on this malicious backdoor? They've been sitting on these documents for a decade.

Washington Post -> Bezos -> AWS -> Cavium

Pretty simple to understand, really.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#123

Post by snoman »

kyleplum wrote: post #96
dmayle wrote: post #90

Earlier quoted context omitted.

That's actually not true. It can do nothing about M of N cryptography. (That's when a key is broken up such that there are N parts, and at least M (less than N) are required to decrypt. It doesn't matter how many rubber hoses you have, one person can fully divulge or give access to their key and it's still safe.

That situation just requires a longer hose

Or M hoses.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#124

Post by sschueller »

RationPhantoms wrote: post #38
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

If you're not under the threat cone of nation state surveillance (like trying to exfiltrate the radar-asborbing paint formula on the F35) then I wouldn't be too concerned. "That's not the point! It's about privacy!" Sure. I'll choose it ignore the fact that our civilization is somehow still functioning in a post-nuclear world.

A Mann is being executed in Saudia Arabia for tweeting a negative tweet about the government to his tiny following. Not exactly someone who thinks they are a target of a nation state.

[1] https://www.hrw.org/news/2023/08/29/saudi-arabia-man-sentenc...

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#125

Post by pixl97 »

dmayle wrote: post #90
api wrote: post #70

Earlier quoted context omitted.

Literally hosed. There's a funny jargon term "rubber hose cryptography" that's used to refer to the cryptanalysis method where you beat someone with a rubber hose until they give you the key. It's 100% effective against all forms of cryptography including even post-quantum algorithms.

That's actually not true. It can do nothing about M of N cryptography. (That's when a key is broken up such that there are N parts, and at least M (less than N) are required to decrypt. It doesn't matter how many rubber hoses you have, one person can fully divulge or give access to their key and it's still safe.

Lets say for example

Bob, Jon, and Tom have pieces of the key. Bob and Jon are in the US and arrested over and commanded by a court to give up the key. Tom is the holdout. The US will issue an international arrest warrant, and now Tom can never safely fly again or the plane will be diverted to the nearest US friendly airport where they will be extradited. So, yea, "safe" is very situational here.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#126

Post by tristor »

tltimeline2 wrote: post #39
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

wasn't ubiquiti totally compromised in that breach a couple of years ago?

No. It turns out that breach was faked, effectively. It was done by manipulating Brian Krebs. He's since issued a mea culpa (although a somewhat weak one): https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiqui...

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#127

Post by BlueTemplar »

zimmerfrei wrote: post #46

More interestingly, Cavium (now Marvell) also designed and manufactured the HSMs which are used by the top cloud providers (such as AWS, GCP, possibly Azure too), to hold the most critical private keys: https://www.prnewswire.com/news-releases/caviums-liquidsecur...

[flagged]

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#128

Post by Freestyler_3 »

colordrops wrote: post #44
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Ubiquiti has many other problems besides this. The worst is their vendor lockin, where even basic network operations are not possible if you happen to have any non-ubiquiti hardware in your network. You should stay away.

I ran UBQT hardware with mikrotik router and third party firewall. UBQT replaced old frankenstein hardware that had the worst channel management etc. Everything got so much better, customers issues dropped to almost zero (sometimes was hundreds of issues a day) We always had other vendor for part of the network, and that had no impact.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#129

Post by vasco »

enkid wrote: post #65
api wrote: post #52

Earlier quoted context omitted.

Is there anyone here who actually thought cloud provider HSMs were secure against the provider itself or whatever nation state(s) have jurisdiction over it? It would never occur to me to even suspect that. I assume that anything I do in the cloud is absolutely transparent to the cloud provider unless it's running homomorphic encryption, which is still too slow and limited to do much that is useful. I would trust them…

If your threat model includes the nation state where you physical infrastructure is, you're hosed.

I mean in the end everything is people just like Logan Roy said in Succession. Cryptography or any software protections are the same. It's a great quote that is very true:

> "Oh, yes... The law? The law is people. And people is politics. And I can handle of people."

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#130

Post by iinnPP »

thewildginger wrote: post #82
hammock wrote: post #56

Earlier quoted context omitted.

>Law firms aren't terribly entrepreneurial. Personal injury guys are the most entrepreneurial people I know...

That's why other lawyers call them ambulance chasers. Their ethics are notoriously questionable.

We're such a weird society when it comes to enforcing laws on business. It's all "scummy" behavior.

For examples: Accessibility laws, consumer protection laws, and privacy laws.

It's a trivial matter to determine which websites don't comply with the easy targets of accessibility. Yet the concept of running such a scanner, automatically, and charging for corrections, is seen as predatory behavior.

There was an article about grocery pricing with obvious collusion, dark practices, and misinformation yet nothing is done. Business as usual, people need to understand it and work around it. Problem is, it's clearly outside the realm of the average intellectual ability.

Predatory behavior is everywhere. I don't feel compelled to list even a single example.

If the lawyer chasing the ambulance results in a law being followed instead of ignored, that is a positive thing.

Post reply on HN