Snowden leak: Cavium networking hardware may contain NSA backdoor

Post by [deleted] » Tue, Sep 19, 2023, 6:20 PM UTC

hammock wrote: post #56

hcurtiss wrote: post #27

Earlier quoted context omitted.

Law firms aren't terribly entrepreneurial. Absent somebody paying them their hourly rate, I suspect not a single document would be read. Newspapers regularly take risks deploying humans to investigate issues without any assurance there will be a story at the bottom, but even the newspaper business has less appetite for that these days (as an aside, I suspect it's that margin that the financial investors have exploite…

>Law firms aren't terribly entrepreneurial. Personal injury guys are the most entrepreneurial people I know...

Post by freedomben » Tue, Sep 19, 2023, 6:22 PM UTC

c7DJTLrn wrote: post #291

some_random wrote: post #75

Earlier quoted context omitted.

Snowden leaked a shit ton of documents, the vast majority of which had absolutely nothing to do with any kind of NSA wrongdoing. Journalists then had to go through and try to figure out what these documents actually meant (which they frequently misunderstood). Obviously they're still doing it to today.

>Snowden leaked a shit ton of documents, the vast majority of which had absolutely nothing to do with any kind of NSA wrongdoing Like how NSA collects a shit ton of data on citizens... the vast majority of which has absolutely nothing to do with any kind of wrongdoing. I'm only pointing this out because your comment has a negative tone towards what Snowden did.

Post by amenghra » Tue, Sep 19, 2023, 6:29 PM UTC

api wrote: post #52

zimmerfrei wrote: post #46

More interestingly, Cavium (now Marvell) also designed and manufactured the HSMs which are used by the top cloud providers (such as AWS, GCP, possibly Azure too), to hold the most critical private keys: https://www.prnewswire.com/news-releases/caviums-liquidsecur...

Is there anyone here who actually thought cloud provider HSMs were secure against the provider itself or whatever nation state(s) have jurisdiction over it? It would never occur to me to even suspect that. I assume that anything I do in the cloud is absolutely transparent to the cloud provider unless it's running homomorphic encryption, which is still too slow and limited to do much that is useful. I would trust them…

Post by [deleted] » Tue, Sep 19, 2023, 6:30 PM UTC

JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Post by dna_polymerase » Tue, Sep 19, 2023, 6:33 PM UTC

slt2021 wrote: post #311

drexlspivey wrote: post #196

Earlier quoted context omitted.

Trying to understand what crypto is the network hardware itself performing? TLS is end to end, even if you run a VPN on the router the keys were not generated there probably

crypto doesn't matter if chip itself has backdoor that will grant root access on some "magic" packet