Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We purchased a machine from China and it came with malware preinstalled

rmcybernetics.com

Post reply on HN
Print view View original

291–300 of 342 posts

Re: We purchased a machine from China and it came with malware preinstalled

#291

Post by ChrisLomont »

emiliobumachar wrote: post #279
ChrisLomont wrote: post #275

Earlier quoted context omitted.

>the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.

For a whole computer stack, that's true enough. Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

I don't think that's true. Care to pick some metric to check it?

If anything, having source also makes it easier to auto scan for flaws at the source level and find holes.

I know from CVEs that OS projects has a significant number of high profile long standing holes in it.

Re: We purchased a machine from China and it came with malware preinstalled

#292

Post by dec0dedab0de »

tgv wrote: post #32
dec0dedab0de wrote: post #26

Earlier quoted context omitted.

https://www.pcworld.com/article/519855/amazon_kindle_1984_la... That story is about a lawsuit from one of the people they took it from. Amazon sold 1984 on the Kindle store without permission, and when they realized their error they deleted it from everyone's kindle and refunded their money.

That's really something entirely different than malware. You know that Amazon books on kindle are subject to that. It's not malware on the Kindle, it's their whole schtick.

That's really something entirely different than malware. You know that Amazon books on kindle are subject to that. It's not malware on the Kindle, it's their whole schtick.

At the time it was suspected, but unknown. I remember the outrage, I'm not sure If I was lurking on here before I made an account, or I read it on slashdot or digg or something. Here are the HN comments from the time. https://news.ycombinator.com/item?id=710506

Re: We purchased a machine from China and it came with malware preinstalled

#294

Post by space_fountain »

BiteCode_dev wrote: post #241
space_fountain wrote: post #226

Earlier quoted context omitted.

But, and this is where the equivalency annoys me. You could literally end up in jail for saying some of these things about China in China. You could just as well talked about abuses of women and the me to movement, but the reason that hasn't happened in China may well be not that there men are somehow better behaved, but that they appear to have put a women who did come out with an accusation under house arrest until…

Yes, cancer is worse than diabetes. Not the point. The point of my comment is: I assume any gov to have such backdoor if they can.

Well, but we can assume with different probabilities. For sure there are people in every government who would if they could, but the fact that the US has mechanisms to expose this sort of thing and lots of people in individual companies who feel like you and there are still no stories of this, that is evidence that it isn't happening at least not at any sort of scale

Re: We purchased a machine from China and it came with malware preinstalled

#295

Post by happytiger »

not2b wrote: post #154
happytiger wrote: post #150

Earlier quoted context omitted.

A lot of Chinese company owners have moved production to Vietnam, Thailand. Laos, Cambodia, Indonesia, etc., specifically because they are aware of this changing preference in the West. Chinese owned business is not China-based business, but most Chinese-owned businesses are subject to CCP influences. As you pointed out: manufacturing standards vary factory to factory and region to region, and quality issues abound i…

There's another, more capitalist reason: wages in most of those countries are lower than wages in China. It's not because of "changing preference".

That’s definitely part of it.

But for context I’m basing part of that opinion on conversations I had with factory owners I’ve done business with in some of those countries running import/export. Many Chinese manufacturers see the conflict between the US and China as bad for business and have optioned third party countries to continue doing business no matter what happens. They’re very smart people.

Re: We purchased a machine from China and it came with malware preinstalled

#296

Post by squarefoot »

emiliobumachar wrote: post #279
ChrisLomont wrote: post #275

Earlier quoted context omitted.

>the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.

For a whole computer stack, that's true enough. Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

> Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

Case in point, the famous Borland InterBase backdoor that went unnoticed for about 7 years and 3 versions of the software but was discovered in 8 months by one developer after Borland released InterBase as Open Source.

https://www.zdnet.com/article/borland-interbase-backdoor-det...

Re: We purchased a machine from China and it came with malware preinstalled

#297

Post by contingencies »

I've just passed the 20 year anniversary of my arrival in China. Having lived in at least eight cities over that period and traveled broadly, I would strongly caution against assuming this is a deliberate attack by the vendor, much less the government. The vast majority of Windows instances in China are sourced from pirated distribution media and it is usual for those to be infected. This affects everyone domestically, not just machines shipped out. Furthermore, most apps are pirated with the same issues. Finally, many people's thumb drives touch a plethora of dirty machines (printing shops that support the still largely paper-driven bureaucracy, photography shops, work and home PCs, etc.) and thus are excellent vectors for malware. As usual, Hanlon's razor: resist over-attribution to malice.

Re: We purchased a machine from China and it came with malware preinstalled

#298

Post by adhesive_wombat »

ed25519FUUU wrote: post #88
RunSet wrote: post #27

Earlier quoted context omitted.

I have seen enough stories of supply-line sabotage to think that if you are going to build your infrastructure with Chinese hardware, air-gapping it is a necessity. Probably a good idea to air-gap your pick and place machine even if it is not Chinese.

Airgapping wouldn’t be enough here since it infects any USB device plugged in. You’ll have to run the USB through some antivirus any time you want to use a new design from a “good” computer.

USBs exist that have physical write switches, and there's also old-school media like CD-Rs which can in theory be used too.

Hell, with a bit of fiddling, you could probably design a one-way RS232 serial system by simply not connecting the TX pin on a downstream device.

Then for good measure snap off the pin and block the corresponding socket's hole with superglue so the cable cannot be reversed.

There are also write protector devices which mirror a block storage device as read only, but will not issue a write, as used for forensics.

Re: We purchased a machine from China and it came with malware preinstalled

#299

Post by defanor »

ChrisLomont wrote: post #290
defanor wrote: post #288

Earlier quoted context omitted.

I think the context somehow gets lost in this discussion. You indeed need a chain of trust in general, and can't inspect all the software alone even if it's FLOSS, but I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about) and similar one-off ones that come from an untrusted source: there's no trust there, no reliance on others inspecting it, but if you have the so…

>I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about In that case, open source rarely has even one possible replacement, so there's no comparison. >but if you have the source code, it's often reasonable to read As someone working in code daily, I disagree. I find lots of open source projects once you get out of the few big ones to be a massive mess of code. And m…

Sounds like we had quite a different experience, and picturing different things too.

> In that case, open source rarely has even one possible replacement, so there's no comparison.

There's usually just one program shipped by a vendor in these cases, and most of the time it's indeed closed-source -- that's what I started with.

Big and widely used FLOSS projects are far from these programs shipped by small hardware manufacturers, I wasn't talking about those. Just as the established and polished commercial projects are far from those: you're getting some buggy and unsupported programs from unknown hardware vendors, possibly even with malware as in TFA, not Photoshop.

> Have you honestly read over an entire open source program to check it?

I have, pretty sure that many others read those too, but haven't read entire sources of large projects like GIMP; plenty of programs and libraries are just a few KLOC (or even just hundreds of LOC) long, easy to skim.

> As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it.

I have rather hard time imagining these being any major modifications and considered easy with arbitrary compiled binaries, while suspecting merely reading sources being something mythical. But once again, you're probably picturing a hairy mess of a huge project's source code, and I picture integration tasks like turning a buggy Windows GUI program into a working multi-threaded Linux daemon -- where having source code makes it easier (and I'm certainly reading at least decompiled code when that's an option), as well as making it practical/easier to see what the program is doing.

Re: We purchased a machine from China and it came with malware preinstalled

#300

Post by StreamBright »

defanor wrote: post #48
StreamBright wrote: post #43

Earlier quoted context omitted.

> proprietary (with constant risk of malware, indeed) being proprietary has nothing to do with risk of malware, indeed

To be precise, I had in mind closed-source software: the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And especially in case of specialized software, that wasn't inspected by others either. Though these terms seem to be used interchangeably quite commonly [1], likely because of a strong correlation. [1] https://en.wikipedia.org/wiki/Proprietary_software Edi…

> the software you can't inspect with reasonable effort/time before running

What was the last time you inspected any command or application you executed on your computer?

How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running?

You have absolutely unrealistic view on this subject. Btw. Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.

Post reply on HN