Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We purchased a machine from China and it came with malware preinstalled

rmcybernetics.com

Post reply on HN
Print view View original

311–320 of 342 posts

Re: We purchased a machine from China and it came with malware preinstalled

#311

Post by jacknews »

southerntofu wrote: post #253
jacknews wrote: post #63

Earlier quoted context omitted.

Do any of them steal IP, as is alleged here, and has certainly happened in other cases involving Chinese, often state-controlled, companies?

Do western artists and corporations borrow stuff from other cultures and competitors? All 20th century rock & roll, most of hollywood, and pretty much all of pre-90s Silicon Valley is based on that premise. That you think it's theft is a debatable/controversial point of view on Internet forums, but if that is to be the case, many more people/corporations from USA should feel threatened, not just a few chinese scapego…

Um, no, there's a very clear difference between 'borrowing' ideas, building on other people's achievements etc, and outright theft, when you copy someone's detailed designs wholesale, especially from secret proprietary plans obtained through illegal espionage.

Re: We purchased a machine from China and it came with malware preinstalled

#312

Post by klondike_ »

phendrenad2 wrote: post #306
mrunkel wrote: post #15

Given that Windows 7 _Ultimate_ was installed on what is essentially an OEM machine, it's very likely that it's a pirated copy with a "home brewed" license key. I think the most reasonable explanation is that either the OS was sourced already infected, or the crack tool they used was infected.

Alright let's think about this. If equipment was entering the US with pirated Windows licenses, wouldn't Microsoft ask customs enforcement to block them until the manufacturer stopped pirating? Also why would Windows Ultimate indicate piracy? Wouldn't it be weird if "Windows Home" flashed up on the screen while booting an industrial machine? It's more likely to make sense that Windows Home isn't licensed for use on i…

>why would Windows Ultimate indicate piracy?

Microsoft sells an embedded, stripped down version of Windows with extended support life for industrial machines like this. Ultimate is intended for workstations and power users.

Re: We purchased a machine from China and it came with malware preinstalled

#313

Post by 692 »

southerntofu wrote: post #254
692 wrote: post #77

Earlier quoted context omitted.

I was royally pissed off when I suspected my brand new Lenovo laptop was acting strange. The only in the end to stop it was to reinstall the OS, I then later found out it was the superfish issue https://slate.com/technology/2015/02/lenovo-superfish-scanda... I will never buy Lenovo again

The problem is more or less all hardware manufacturers do that. There's variations: some bundle only the Windows backdoor, some bundle Superfish, some bundle Intel/AMD's anti-theft and ME/PSP features. That society is ok with that is a huge problem to say the least.

I doubt you can compare superfish against bloatware antitheft "feature"

Re: We purchased a machine from China and it came with malware preinstalled

#314

Post by StreamBright »

defanor wrote: post #48
StreamBright wrote: post #43

Earlier quoted context omitted.

> proprietary (with constant risk of malware, indeed) being proprietary has nothing to do with risk of malware, indeed

To be precise, I had in mind closed-source software: the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And especially in case of specialized software, that wasn't inspected by others either. Though these terms seem to be used interchangeably quite commonly [1], likely because of a strong correlation. [1] https://en.wikipedia.org/wiki/Proprietary_software Edi…

It took only 13 years to spot this in a FOSS project:

https://linux.slashdot.org/story/22/01/25/2259214/major-linu...

Re: We purchased a machine from China and it came with malware preinstalled

#315

Post by defanor »

StreamBright wrote: post #300
defanor wrote: post #48

Earlier quoted context omitted.

To be precise, I had in mind closed-source software: the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And especially in case of specialized software, that wasn't inspected by others either. Though these terms seem to be used interchangeably quite commonly [1], likely because of a strong correlation. [1] https://en.wikipedia.org/wiki/Proprietary_software Edi…

> the software you can't inspect with reasonable effort/time before running What was the last time you inspected any command or application you executed on your computer? How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running? You have absolutely unrealistic view on this subject. Btw. Apple and many compa…

I'm surprised how this discussion turns out: didn't expect those bits to be controversial at all, and sibling comments make it sound like it's almost better to not have access to sources.

> What was the last time you inspected any command or application you executed on your computer?

A few months ago, and didn't run new code from untrusted sources since.

> How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running?

So far I haven't run into languages I can't read. Spotting malicious code could indeed be tricky, a subtle but critical vulnerability would easily evade quick skimming, just as malware is still possible even when it comes from a somewhat trusted source. But I'm more certain that a program does what it says it does after skimming its code.

> Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.

That's how basic antiviruses work, not specific to Apple. They have to first add that checksum into a database, which isn't viable when we're talking about a small hardware manufacturer shipping their custom software to dozens of clients.

Re: We purchased a machine from China and it came with malware preinstalled

#316

Post by csmpltn »

MathMonkeyMan wrote: post #304
csmpltn wrote: post #30

The malware analysis report they've ordered ( https://www.rmcybernetics.com/files/pdf/Malware-analysis-Fly... ) is extremely light on details. Yes, some things look suspicious (packing, lack of signatures, hardcoded IP addresses/hostnames, network traffic) - but I'm not seeing any clear-cut evidence that this is malware?

I'm no expert, but I'm also not convinced that the device contained malware. > We sent the file for proper malware analysis which did confirm that it did indeed contain malware. The malware would collect user data and send it to a remote address. Presumably it would be a way to steal company information such as designs, accounts, and so on. Pretty shady stuff! Or, you know, it might be doing anything at all on the in…

There's nothing in this analysis report which proves beyond doubt that this is malware.

There's plenty of software out there that behaves this way. I don't think they have solid ground for claiming they've been hit with malware here.

Re: We purchased a machine from China and it came with malware preinstalled

#317

Post by rmellow »

ianai wrote: post #51
starfallg wrote: post #41

Earlier quoted context omitted.

>I'm not saying that I don't buy anything made in China, almost everything is made in China, but everyone should avoid Chinese crapware. If you spend just a small bit of effort, you can look for items not made in China. They are usually higher quality. Japanese companies (and increasingly large American ones) are moving / have moved their production elsewhere due to an increasingly hostile business environment in Chi…

Is there a reliable way to research non-Chinese manufactured products? I know to just look for the “made in” somewhere on the page or product, but it’s not as simple as including a search tag in a field, either.

Sadly Amazon doesn't respect the NOT operator anymore:

https://webapps.stackexchange.com/questions/20069/is-there-a...

Re: We purchased a machine from China and it came with malware preinstalled

#318

Post by jacknews »

Scoundreller wrote: post #251
jacknews wrote: post #63

Earlier quoted context omitted.

Do any of them steal IP, as is alleged here, and has certainly happened in other cases involving Chinese, often state-controlled, companies?

Do companies hire/recruit (ex-)employees from competitors to re-implement the same features? Yes. Lots of IP between your ears. No point in the code/manuals/docs when you wrote them yourself. You’ll know they’re not exactly correct and may appreciate being able rewrite from the ground-up now knowing what you now know.

Sure, but if the employee brings along the architecture documents or the source code, that's theft. What's alleged here is that a CHinese company is exfiltrating actual PCB designs via PnP machine malware.

Re: We purchased a machine from China and it came with malware preinstalled

#319

Post by mkbkn »

ianai wrote: post #51
starfallg wrote: post #41

Earlier quoted context omitted.

>I'm not saying that I don't buy anything made in China, almost everything is made in China, but everyone should avoid Chinese crapware. If you spend just a small bit of effort, you can look for items not made in China. They are usually higher quality. Japanese companies (and increasingly large American ones) are moving / have moved their production elsewhere due to an increasingly hostile business environment in Chi…

Is there a reliable way to research non-Chinese manufactured products? I know to just look for the “made in” somewhere on the page or product, but it’s not as simple as including a search tag in a field, either.

This browser addon claims to show the origin country of any item: https://www.wecultivate.us/

I haven't tried it much though (I'm not in the USA).

Post reply on HN