Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in a China-made US military chip

cl.cam.ac.uk

Post reply on HN
Print view View original

111–120 of 159 posts

Re: Backdoor found in a China-made US military chip

#111

Post by nekojima »

mng2 wrote: post #103
coopdog wrote: post #81

Earlier quoted context omitted.

Does Taiwan count as part of China? A brief look at the Taiwan-China relationship shows it's a more difficult question than it initially seems

According to China (the People's Republic of China), Taiwan (the Republic Of China) is a "renegade province." Both the PRC and the ROC claim that they are the legitimate government of China. In the US, ever since Nixon instituted the "two China" policy, China is always taken to mean the PRC. Perhaps the security researchers are not aware of this distinction, but I am also not familiar with how the issue is treated in…

Nixon acknowledged the "One China" policy, not two, when the US shifted diplomatic support from Taiwan (Republic of China) to mainland China (PRC).

Taiwan is not a "major" US ally, rather the US is Taiwan's major ally. The US has several other regional countries it has a significantly greater alliances with, such as Japan, South Korea and Philippines. Though through an act of Congress, the US may (depending on the situation) have some obligations to aid Taiwan in its defense if attacked by mainland China.

Re: Backdoor found in a China-made US military chip

#112

Post by tptacek »

jsprinkles wrote: post #97
tptacek wrote: post #93

Earlier quoted context omitted.

I find it exhausting to have to write things defensively just to ward off drama. The fact that I had to offer was very simple: that the security group at Cambridge is very credible. And you knew that, because you acknowledged in your comment. I'm left wondering why you commented at all.

Excellent! They are credible. Why? Because you said so? That is good information, but just hearing your reasoning would make your comment a lot more credible itself without your reputation, which many people aren't familiar with. Other people here are making the case that the motives behind this research aren't perfectly pure, so, presenting the unique insight that you have on the credibility of this group would be a…

I am sorry that it upset you that I was unable to share details about a bug, but I am unwilling to withhold heads-ups to the other people here running apps behind nginx just to save your feelings.

I think if you use the search box at the bottom of the screen, you'll have no trouble at all finding thousands and thousands of words spelling out in great detail what I think about bcrypt.

I am a person, not a web service. You cannot file bugs every time I don't provide exactly the comments in exactly the tone you're looking for. Or, as you're amply demonstrating, you can, but it's unlikely to do you any good.

Re: Backdoor found in a China-made US military chip

#113

Post by tptacek »

laughinghan wrote: post #65
tptacek wrote: post #13

The Cambridge Security Lab is not fucking around. Assume this is not hype. I'm less curious about whether overseas silicon is backdoored than I am in how exposed the attack/activation surface for those backdoors are.

"Currently there is no economical or timely way of ascertaining if a manufacturer's specifications have been altered during the manufacturing process (99% of chips are manufactured in China)," That claim about 99% of chips being manufactured in China is very easy to verify as being utterly false. I have to wonder about the trustworthiness of the rest. - kryptiskt, http://news.ycombinator.com/item?id=4030818 It has ac…

A hardware security researcher's inability to perform Gartner-correct market research is not relevant to his/her ability to decap, image, and analyze silicon, and thus not at all relevant to me. Wow do I ever not care about this particular gotcha.

Re: Backdoor found in a China-made US military chip

#114

Post by jianmeng »

This thing is unfair for the china telecom companys.

China telecom is JUST working hard for the aims that everybody in the world can enjoy communicate with each other,even in the poorest country. This aim is good to internet span quick in developing country.

That bring us a better internet environment to start business.

If UK is affair of cheap telecom equipment from China, Just buy Ericsson's.

So stop those rummor.

Re: Backdoor found in a China-made US military chip

#115

Post by nl »

mng2 wrote: post #103
coopdog wrote: post #81

Earlier quoted context omitted.

Does Taiwan count as part of China? A brief look at the Taiwan-China relationship shows it's a more difficult question than it initially seems

According to China (the People's Republic of China), Taiwan (the Republic Of China) is a "renegade province." Both the PRC and the ROC claim that they are the legitimate government of China. In the US, ever since Nixon instituted the "two China" policy, China is always taken to mean the PRC. Perhaps the security researchers are not aware of this distinction, but I am also not familiar with how the issue is treated in…

The parent's point is that PRCTaiwanese relations are more complex than they appear. Words like "renegade province" make it sound like they are sworn enemies, but the parent is right: it is much more complex than that.

As a random but relevant example, Foxconn is a Taiwanese company but much of its manufacturing capacity is on the Chinese mainland.

Taiwan is politically an ally of the US, but economically it is much more closely aligned with China.

Re: Backdoor found in a China-made US military chip

#116

Post by lifeisstillgood »

ChuckMcM wrote: post #70

Interesting discussion. Some denial, some tin hat, some contemplative. I think I've had all of those emotions with this sort of thing. There are diagnostics in our network switches that allow for traffic to be replicated and sent to other ports with a different destination mac (this isn't port mirroring is more like port re-directing). Clearly in the hands of a bad guy they might set up a machine on the LAN to get a…

I'm sorry I am not sure what you are saying here. It seems to be "this is far more likely to be a test engineers backdoor that was not on the spec" then a Chinese backdoor added at the fab"

with no evidence either way, I am guessing that US intelligence (and others?) are loudly saying this is happening not because they can prove it in silicon but convincing human intelligence has told them

I happen to think that the techniques developed to analysis silicon are going to be useful all round, and that a backdoor in a chip does not make a successful cyber attack in the wild, but if these are real in-the-fab additions then the implications are so large we should be prepared to not label this "it's just a test component" and look at ideas like validating silicon (noted somewherre else below)

Re: Backdoor found in a China-made US military chip

#117

Post by laughinghan »

tptacek wrote: post #113
laughinghan wrote: post #65

Earlier quoted context omitted.

"Currently there is no economical or timely way of ascertaining if a manufacturer's specifications have been altered during the manufacturing process (99% of chips are manufactured in China)," That claim about 99% of chips being manufactured in China is very easy to verify as being utterly false. I have to wonder about the trustworthiness of the rest. - kryptiskt, http://news.ycombinator.com/item?id=4030818 It has ac…

A hardware security researcher's inability to perform Gartner-correct market research is not relevant to his/her ability to decap, image, and analyze silicon, and thus not at all relevant to me. Wow do I ever not care about this particular gotcha.

Is that a "no, I cannot provide any reason to take this seriously besides my (arrogant) word and this vague, exaggerated, ugly, poorly coded web page"?

This security lab's tendency to exaggerate the seriousness of the security problem they've identified is exactly what is in question here.

Re: Backdoor found in a China-made US military chip

#118

Post by mfukar »

Estragon wrote: post #77
toemetoch wrote: post #12

Earlier quoted context omitted.

Last week a report was released that revealed 1800 cases during a 1-year survey. [pdf] This is just one device, he has good reasons to advertise his expertise. [pdf] http://www.armed-services.senate.gov/Publications/Counterfei...

1800 cases of counterfeit parts, not 1800 cases of maliciously designed parts. There could well be malice involved, but the vast majority of those cases were almost certainly economically motivated.

He needs to provide more specific information and evidence.

Heed your own advice.

Re: Backdoor found in a China-made US military chip

#119

Post by SkyMarshal »

jsprinkles wrote: post #97
tptacek wrote: post #93

Earlier quoted context omitted.

I find it exhausting to have to write things defensively just to ward off drama. The fact that I had to offer was very simple: that the security group at Cambridge is very credible. And you knew that, because you acknowledged in your comment. I'm left wondering why you commented at all.

Excellent! They are credible. Why? Because you said so? That is good information, but just hearing your reasoning would make your comment a lot more credible itself without your reputation, which many people aren't familiar with. Other people here are making the case that the motives behind this research aren't perfectly pure, so, presenting the unique insight that you have on the credibility of this group would be a…

Pro-tip: If you don't understand or want more clarification, just ask. If you disagree, say why. It's not hard, and usually effective. Skip all the other BS.

If tptacek or anyone else wants to speak in Zen koans and leave it up to motivated readers to figure out what he meant, so be it. No one owes anyone anything here, and you should think of it as a chance to sharpen your research and investigative skills.

But seriously, omit the entitlement and drama. It's the last thing HN needs.

Re: Backdoor found in a China-made US military chip

#120

Post by chmike »

helmut_hed wrote: post #82

As a former chip designer I question the idea that the manufacturer introduced this backdoor (if indeed there is one). found a previously unknown backdoor inserted by the manufacturer. This backdoor has a key... It's hard to understand what this guy is talking about. Is he claiming that the manufacturer added additional hardware that the designers were unaware of? Or they made modifications to existing circuitry so i…

I share this opinion and I'm surprized so few HN readers have considered this possibility. It could make sense since the chinise could use the chip for themselves.
Post reply on HN