Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden leak: Cavium networking hardware may contain NSA backdoor

twitter.com

Post reply on HN
Print view View original

351–360 of 628 posts

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#351

Post by madars »

archontes wrote: post #253
squarefoot wrote: post #60

When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but governments can't exercise power over something they cannot control, and truly private communications would take away some of that control. To me there are no conspiracy theories or other strange reasons for being able to decrypt any seemingly private information except…

It's clear that they feel that way also. The engineer Andreas Spiess recently appeared in a briefing on dangerous, anarchy-enabling technologies simply for making a youtube video on an encrypted messaging protocol over lora mesh networking. They're carefully watching and cataloging any communications technology they can't compromise.

Which briefing was that? Edit: it appears to be this https://networkcontagion.us/wp-content/uploads/NCRI-White-Pa... ("Network-Enabled Anarchy: How Militant Anarcho-Socialist Networks Use Social Media to Instigate Widespread Violence Against Political Opponents and Law Enforcement" via https://www.youtube.com/watch?v=EAQI2ZSmxPU; thanks to a sibling comment)

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#352

Post by sneak »

JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Ubiquiti is all cloud based. If the government wants in to your auto-updating ubnt hardware, it's just a simple court order away. They don't need a backdoor.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#353

Post by cpursley »

slackfan wrote: post #113
RationPhantoms wrote: post #38

Earlier quoted context omitted.

If you're not under the threat cone of nation state surveillance (like trying to exfiltrate the radar-asborbing paint formula on the F35) then I wouldn't be too concerned. "That's not the point! It's about privacy!" Sure. I'll choose it ignore the fact that our civilization is somehow still functioning in a post-nuclear world.

Sure. See you in the gulag, comerade

Comrade is of Latin origin. In Russian, tovarisch is the correct term. At least get it right if you're trying to be edgy.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#354

Post by jdblair »

Help me out here:

if my network hardware is compromised, but all of my communication is encrypted, that leaves… traffic analysis? hoovering up the data and storing it to decrypt in the future when it becomes feasible? using the router as a foothold to attack the rest of my network?

The first two are already happening for data that leaves my LAN. Unencrypted data on my LAN is vulnerable, and there is plenty of unencrypted traffic on my LAN in practice. Is that the risk?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#355

Post by sneak »

Astronaut3315 wrote: post #330
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Some specific Ubiquiti gear uses Cavium SOCs, but certainly not all. The UDM Pro uses an Annapurna Labs SOC and my old EdgeRouter-X was Mediatek.

Unifi stuff auto updates from the vendor, which is subject to US law.

The SoC manufacturer is irrelevant.

If the USG wants in, it's just a click away in any case.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#356

Post by jacquesm »

l33t7332273 wrote: post #335
jacquesm wrote: post #319

Earlier quoted context omitted.

We're talking about normal people, not psychopaths.

Terrorists are generally highly altruistic, not psychopaths. It’s a lot easier to blow yourself up(or to spread ideology which encourages it)for a cause that you believe is helping people, in particular _your_ people.

The terrorists that blow themselves up and that blow other people up are usually misguided brainwashed angry young men. It's nothing to do with ideology, everything to do with power. Or did you think blowing up schools full of girls is something people genuinely believe helps their people, to give just one example?

Ordinary people just want to be left alone. Old guys wishing for more power will use anything to get it, including sacrificing the younger generations.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#357

Post by rangerelf »

ipaddr wrote: post #213
api wrote: post #70

Earlier quoted context omitted.

Literally hosed. There's a funny jargon term "rubber hose cryptography" that's used to refer to the cryptanalysis method where you beat someone with a rubber hose until they give you the key. It's 100% effective against all forms of cryptography including even post-quantum algorithms.

You would be surprised that for a percent this would not work. Some even like it. Some have a deathwish and want to be a martyr. Some people blow themselves up to further a cause. Also put under heavy stress memories of keys cannot be recalled at times. It's probably slightly less effective than threatening to kill family members but probably more than threat of jail time. Either way you require someone alive and wit…

It doesn't matter, something will be found that will coerce them into talking. Nobody is an island. Everyone has a breaking point, if it's not rubber hoses, it's socks full of rocks, or it's bottles of mineral water, or any number of methods. Don't think for a second that someone hasn't thought of a better way to get information out of somebody else.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#358

Post by dariosalvi78 »

SamPatt wrote: post #315
archontes wrote: post #253

Earlier quoted context omitted.

It's clear that they feel that way also. The engineer Andreas Spiess recently appeared in a briefing on dangerous, anarchy-enabling technologies simply for making a youtube video on an encrypted messaging protocol over lora mesh networking. They're carefully watching and cataloging any communications technology they can't compromise.

The guy with the Swiss accent? What's your source on this?

https://www.youtube.com/watch?v=EAQI2ZSmxPU

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#359

Post by jdblair »

jdblair wrote: post #354

Help me out here: if my network hardware is compromised, but all of my communication is encrypted, that leaves… traffic analysis? hoovering up the data and storing it to decrypt in the future when it becomes feasible? using the router as a foothold to attack the rest of my network? The first two are already happening for data that leaves my LAN. Unencrypted data on my LAN is vulnerable, and there is plenty of unencry…

still thinking… if the three-letter-agency has compromised the random number generator, then that means all traffic encrypted by the router may be easier to crack.

What data is encrypted on the router? VPNs, for one. So a VPN, and all the plaintext traffic sent over it, could be made vulnerable.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#360

Post by aborsy »

api wrote: post #70
enkid wrote: post #65

Earlier quoted context omitted.

If your threat model includes the nation state where you physical infrastructure is, you're hosed.

Literally hosed. There's a funny jargon term "rubber hose cryptography" that's used to refer to the cryptanalysis method where you beat someone with a rubber hose until they give you the key. It's 100% effective against all forms of cryptography including even post-quantum algorithms.

This would not work well, because you can’t do it in a secret manner. Overuse of the rubber hose cryptography will become known, and there will be public backlash.
Post reply on HN