Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden leak: Cavium networking hardware may contain NSA backdoor

twitter.com

Post reply on HN
Print view View original

441–450 of 628 posts

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#441

Post by BlueTemplar »

NorwegianDude wrote: post #170
tristor wrote: post #30

Earlier quoted context omitted.

Huawei stuff is proven to be compromised, just not by NSA, instead by China.

Isn't that just the US speaking in order to get more control? How is it proven? I've never seen any evidence of that, but there has been much evidence that the US does what they blames others of doing, like this and Cisco. At this point it seems the US is accusing others for doing bad things because that's what they themselves do. Huawei was growing really fast, threatening both Apple and Google. Then the US said it…

China has a LOT to gain from industrial espionage, is extremely well known for its industrial espionage, and also happens to effectively own EU telecoms (the 5G thing was like a decade too late).

It would be astounding if they didn't take advantage of this.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#442

Post by BlueTemplar »

owenmarshall wrote: post #223
mrweasel wrote: post #88

Earlier quoted context omitted.

I'm currently replacing my network equipment with Mikrotik, not because I believe it to be safer than Ubiquity, but because then at least it's made in the EU. But now I'm thinking: Is it better that the US is spying on me in Europe, vs. having EU governments do it? I feel like I'd be somewhat more safe from the US, compared to if my own government decides to spy on me. Maybe I should look into Chilean network equipme…

> But now I'm thinking: Is it better that the US is spying on me in Europe, vs. having EU governments do it? I feel like I'd be somewhat more safe from the US, compared to if my own government decides to spy on me. https://en.wikipedia.org/wiki/Five_Eyes > In recent years, documents of the FVEY have shown that they are intentionally spying on one another's citizens and sharing the collected information with each othe…

None of these are EUropean countries.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#443

Post by DyslexicAtheist »

supriyo-biswas wrote: post #99
joezydeco wrote: post #66

Earlier quoted context omitted.

Ayup. We use AWS CloudHSM to hold our private signing keys for deploying field upgrades to our hardware. And when we break the CI scripts I see Cavium in the AWS logs. Now I gotta take this to our security team and figure out what to do.

I'd be surprised if you get anything more than generic statements about how they take security very seriously and they are open to suggestions, but avoid addressing the mentioned concerns directly (and this applies to all cloud providers out there, not just AWS). I'm sure a few others here would like to see their response as well.

wouldnt such a backdoor invalidate all promises made by external audits e.g. https://cloud.google.com/security/compliance/offerings and more importantly wouldn't it violate safe harbor agreement with the EU or whatever sham this safe-harbor was replaced with?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#444

Post by ormax3 »

jstarfish wrote: post #385
ormax3 wrote: post #293

Earlier quoted context omitted.

sounds like something LLMs can help with, sift through huge amounts of documents to summarize and highlight the interesting ones

If only. The biggest problems right now are limited context size and basic security, including having to share such documents with God-knows-how-many third parties. Tangent, but we use Azure instead of OpenAI due to data-retention concerns. To ensure nobody's inputting anything classified or proprietary, Legal demanded implementation of an "AI safety" tool...so we demoed one that ships all prompts to a third party's…

Nowadays even consumer-level hardware can run some decent local LLMs, completely offline.

You might want to browse /r/LocalLLaMA/ if "security" is an issue for you.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#445

Post by sofixa »

TheRealDunkirk wrote: post #276
perihelions wrote: post #2

How the NSA successfully manage to prevent the Washington Post and friends from discovering and reporting on this malicious backdoor? They've been sitting on these documents for a decade. Are the journalists just that *uncurious* about the deep contents of the documents they hold exclusive access to? Was this some kind of organizational failing?

In the US, we have this passionate fantasy about Woodward and Bernstein and the Post and the Pulitzer and the movie and Redford and Hoffman and the Academy Award, about how the Press played the part of the "fourth estate" as the Founders intended, and rooted out a corrupt politician, and forced him to resign. It's all bullshit. The people who broke into the Watergate Hotel were CIA, Woodward was formerly CIA, and "De…

> about how the Press played the part of the "fourth estate" as the Founders intended

The rest of your post is quite the bullshit (easily probable with publicly accessible archives bullshit at that), but this is also wrong. The mythological god-like creatures that crafted America as their divine powers ordained it didn't "intend" for the press to be "the fourth power". That term was first used after the US revolution, and in the UK. You're just retconing stuff into your mythology, and everyone knows that doesn't work and leaves a poor taste.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#446

Post by BlueTemplar »

mrweasel wrote: post #88
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

I'm currently replacing my network equipment with Mikrotik, not because I believe it to be safer than Ubiquity, but because then at least it's made in the EU. But now I'm thinking: Is it better that the US is spying on me in Europe, vs. having EU governments do it? I feel like I'd be somewhat more safe from the US, compared to if my own government decides to spy on me. Maybe I should look into Chilean network equipme…

In democratic countries we also have rights against (unjustified) spying by our governments. Sounds like a better long-term plan for everyone is to make them work. Especially when even the ideal equipment won't do much against metadata spying by ISPs and cellphone carriers...

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#447

Post by wdb »

baz00 wrote: post #182
wdb wrote: post #180

Earlier quoted context omitted.

Using AWS Greengrass?

Never even heard of that one!

Imagine doing a job interview they ask do you know AWS. Sure, I know AWS, and explain what you built with Greengrass, Lambda's, RDS etc. and then get rejected for not knowing AWS lol

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#448

Post by dfox »

convivialdingo wrote: post #406
dfox wrote: post #239

Earlier quoted context omitted.

Except Hash_DRBG is neither deprecated nor backdoored. See NIST SP 800-90A Rev. 1 section 10.1.1.1 for description of the algorithm.

Well, true.. the Hash_DRBG hashing algorithm remains. But it's rather likely that previous FIPS validations occurred utilizing the actual backdoored and deprecated algorithm as an input to the Hash_DRBG, rendering it's security properties suspect. In NIST SP 800-90A Rev. 1, the HASH_DRBG section has been significantly updated to that effect. For instance, Appendix E: (Informative) Revisions. Section 10: Section 10 no…

The backdoor in DualEC_DRBG only works if there is some way for the attacker to directly observe its outputs (eg. using that for IVs). If you use it as an inner CSPRNG that seeds other faster algorithms the backdoor is irrelevant, but well, such a construction is total nonsense that only ever makes sense in the FIPS certification framework (DualEC_DRBG is ridiculously slow and not meaningfully more secure than the other FIPS CSPRNGs).

On the other hand, I have the feeling that if you instantiate Hash_DRBG with certain classes of insecure hash functions (think MD2) the mechanism that protects the construction from effects of birthday paradox makes it simpler to break the underlying hash function, but for this attack to work the underlying hash function have to be really bad and this attack is probably impractical even for instantiations with MD4, much less the SHA variants in the specification.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#449

Post by inferiorhuman »

stephen_g wrote: post #79
JanSolo wrote: post #6

The tweet seems to imply that the entire Ubiquiti Networks line of network hardware could be compromised. That's a shame; I was thinking of installing some in my house. I'm sure that Ubiquiti's customers will not be happy if they find out that the US Govt can access their private data.

Pretty sure only the EdgeRouter and some of the older Unifi Security Gateways use Cavium chips. Most of the newer stuff (like the Dream Machine line) I don't think are anymore. None of the Unifi APs did either I don't think (the U6 ones have Mediatek chips in them)

Some of the EdgeRouter stuff (ER-Lite, ER-4) use Cavium SoCs. The ER-X uses a MediaTek SoC.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#450

Post by TheRealDunkirk »

sofixa wrote: post #445
TheRealDunkirk wrote: post #276

Earlier quoted context omitted.

In the US, we have this passionate fantasy about Woodward and Bernstein and the Post and the Pulitzer and the movie and Redford and Hoffman and the Academy Award, about how the Press played the part of the "fourth estate" as the Founders intended, and rooted out a corrupt politician, and forced him to resign. It's all bullshit. The people who broke into the Watergate Hotel were CIA, Woodward was formerly CIA, and "De…

> about how the Press played the part of the "fourth estate" as the Founders intended The rest of your post is quite the bullshit (easily probable with publicly accessible archives bullshit at that), but this is also wrong. The mythological god-like creatures that crafted America as their divine powers ordained it didn't "intend" for the press to be "the fourth power". That term was first used after the US revolution…

I have no idea what you're on about. The Founders of the US absolutely intended the press to be the last counterbalance on government overreach. It's literally why it's the First Amendment. Getting bogged down by terminology is perfect HN pedantry. Well done, sir!
Post reply on HN