Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor found in a China-made US military chip

cl.cam.ac.uk

Post reply on HN
Print view View original

31–40 of 159 posts

Re: Backdoor found in a China-made US military chip

#31

Post by tptacek »

jsprinkles wrote: post #28
tptacek wrote: post #13

The Cambridge Security Lab is not fucking around. Assume this is not hype. I'm less curious about whether overseas silicon is backdoored than I am in how exposed the attack/activation surface for those backdoors are.

I'm respectful of your qualifications, but annoyed when you use your credentials without qualification. A paranoid man might assume your comments are strategically placed to benefit parties you're aligned with, based on how little context there is here; I know better, others might not. "These are good guys. This paper is the real deal." I appreciate what you bring to HN, but that this is the top comment worries me, p…

You caught me. I'm a secret shill for Ross Anderson.

Re: Backdoor found in a China-made US military chip

#32

Post by jsprinkles »

tptacek wrote: post #31
jsprinkles wrote: post #28

Earlier quoted context omitted.

I'm respectful of your qualifications, but annoyed when you use your credentials without qualification. A paranoid man might assume your comments are strategically placed to benefit parties you're aligned with, based on how little context there is here; I know better, others might not. "These are good guys. This paper is the real deal." I appreciate what you bring to HN, but that this is the top comment worries me, p…

You caught me. I'm a secret shill for Ross Anderson.

That wasn't the gist of my comment, but okay. I'm disappointed that you feel the rest of my comment wasn't worth your time, and you chose to attach to a throwaway hypothetical. Alas, it was worth a shot.

Re: Backdoor found in a China-made US military chip

#34

Post by toufka »

gouranga wrote: post #23

The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever! They would buy expensive stuff fabbed specially in the US rather than import usually. I did a lot of work for the UK Ministry of Defence and the US Department of Defence over the years on custom silicon and FPGA work and the paranoia factor is scary. We had the layouts of everything bought in - even 74-s…

I think the problem is that there are too many suppliers. Everyone wants to be a middle-man. If the government asks for domestic parts from it's big contractors, the big ones ask their small ones, and they ask theirs and so on. But at the end of the day someone realizes it's cheaper to outsource it - does so - and forges the documentation. As the part travels all the way back up the chain each one says it's domestic.

The chain is only as strong as its weakest link.

Re: Backdoor found in a China-made US military chip

#36

Post by DanBC »

kryptiskt wrote: post #11

"Currently there is no economical or timely way of ascertaining if a manufacturer's specifications have been altered during the manufacturing process (99% of chips are manufactured in China)," That claim about 99% of chips being manufactured in China is very easy to verify as being utterly false. I have to wonder about the trustworthiness of the rest.

Is there any way to mangle it to being true? I don't think so.

Maybe 99% of volume, but not type, is produced in China.

Or 99% of types are made in China, but with volume elsewhere.

Maybe 99% of this particular IC family are made in China, with the rest being made elsewhere is something that works.

Re: Backdoor found in a China-made US military chip

#37

Post by rhizome »

gouranga wrote: post #23

The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever! They would buy expensive stuff fabbed specially in the US rather than import usually. I did a lot of work for the UK Ministry of Defence and the US Department of Defence over the years on custom silicon and FPGA work and the paranoia factor is scary. We had the layouts of everything bought in - even 74-s…

Hopefully this isn't too political for HN, but I suggest combining your surprise with the news that China was given a direct line around Wall Street to buy Treasuries directly from the USG:

http://www.reuters.com/article/2012/05/21/us-usa-treasuries-...

There's a relationship here.

Re: Backdoor found in a China-made US military chip

#39

Post by wolf550e »

toufka wrote: post #34
gouranga wrote: post #23

The bit that surprises the fuck out of me is that they're buying stuff in from China. I've never seen that - ever! They would buy expensive stuff fabbed specially in the US rather than import usually. I did a lot of work for the UK Ministry of Defence and the US Department of Defence over the years on custom silicon and FPGA work and the paranoia factor is scary. We had the layouts of everything bought in - even 74-s…

I think the problem is that there are too many suppliers. Everyone wants to be a middle-man. If the government asks for domestic parts from it's big contractors, the big ones ask their small ones, and they ask theirs and so on. But at the end of the day someone realizes it's cheaper to outsource it - does so - and forges the documentation. As the part travels all the way back up the chain each one says it's domestic.…

They need custody chain management. I assumed they had one. And everyone who signed for it has securety clearance meaning they signed a paper that basically says "I understand that I'll go to jail for twenty years if I'm caught lying about anything".

Re: Backdoor found in a China-made US military chip

#40

Post by DanBC »

To people complaining about the language - this reads more like a short briefing note for politicians or non-technical managers. That's why things like Stuxnet are mentioned; to give context and scale.

The author would probably like to stay involved with this tech, or at least to be able to hand it off to CESG.[1]

[1] I assume CESG. Perhaps QinetiQ[2] would do it?

[2] I have no idea what they do. All those Qs? You've seen 007? They're the real Q department. I doubt they do laser beam watches.

Post reply on HN