Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

bloomberg.com

Post reply on HN
Print view View original

391–400 of 818 posts

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#391

Post by HillaryBriss »

> That left the decision about where to build commercial systems resting largely on where capacity was greatest and cheapest ... “You can have less supply than you want and guarantee it’s secure, or you can have the supply you need, but there will be risk. Every organization has accepted the second proposition.”

Once the critical mass of electronics manufacturing moved outside the US and manufacturers outsourced the bulk of work, there was no longer any alternative.

Economists say this is ok or even really good for global welfare.

But do any economic models accurately account for this type of economic damage, this type of cost to government, consumers, companies like Supermicro, Apple, Amazon, etc?

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#392

Post by close04 »

octosphere wrote: post #276

Just as a sidenote: X-raying PCBs and then diffing them against clean PCBs is a worthwhile thing to do if you're concerned about hardware backdoors, or 'interdiction' of hardware in a supply chain. I do this sometimes when ordering super-critical equipment like Thinkpads from the U.S as you never know what lurks on the motherboard (keyloggers, etc). I have a clean Thinkpad that I use to compare against potential back…

Once you do a thorough sweep and decide one device is clean all it takes is a small PCB revision and you have to start over. It becomes a very expensive exercise after a point (time and money) that is reserved for the most critical of situations.

The problem is a good hack doesn't need the most critical of situations to succeed. It can creep in through the most innocent cracks and climb its way up the chain.

And some hardware hacks are beyond what a regular Xray PCB check would outline, like a modified piece of silicon in a chip. Xrays are great for more obvious changes, not necessarily for something that was inserted at the very start of the supply chain.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#393

Post by matthewwiese »

gkanai wrote: post #331
blackrock wrote: post #304

I don't know which is more disturbing here. That the Chinese military is technically competent enough to pull off such a thing. Or that they are incompetent enough, to not secure their own back doors and networks, and allowed the FBI, NSA, and other American government organizations, the ability to counter-hack them, and monitor all their internal communications. The truth is somewhere in between. So, this article is…

> America is finally admitting, that they too, actively spy on other countries. The Snowden revelations made that very clear to all years ago, no?

One doesn't even need Snowden to know this. Given even a little reading of the IC's (intelligence community), and more specifically CIA's, history. What else do you think they do all day, if not for spying on other countries?

As mercutio2 mentioned in a reply to your same parent, the controversy w/r/t Snowden is domestic spying.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#394

Post by amatecha »

EwanToo wrote: post #344

Amazon are going all out on the denial https://aws.amazon.com/blogs/security/setting-the-record-str...

Yeah, I mean that's what I would say too if some government intelligence agency told me I cannot say a word about this and have to deny it vehemently! haha :)

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#395

Post by pjc50 »

malandrew wrote: post #381
pjc50 wrote: post #362

Earlier quoted context omitted.

> the real oblivion (destruction of shareholder value) with criminal charge for the company officers This very rarely happens even if people have got killed. Also, good luck suing a Chinese company in China.

I reckon this could be addressed with contractual guarantees in exchange for doing business in the first place. Make it a contractual requirement that the supplier agree to adjudication in the United States in the case of security related concerns or other tampering with the final product or with the designs. They could still refuse if something happens, but I reckon at that point you can just work to shut them out e…

You can't lock China out of the market without diplomatic implications. Even assuming you managed to get a purely private boycott of China together without somehow violating anti-trust law, by the time it started making a serious dent in the market the Chinese government would have started making representations to the US State Department. Where it goes from there is anyone's guess.

(Ironically the other direction prevails in regard to Israel: there are anti-boycott laws! https://www.lrb.co.uk/v40/n14/amjad-iraqi/short-cuts )

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#396

Post by Nasrudith »

folli wrote: post #170
jsjohnst wrote: post #122

Earlier quoted context omitted.

> as once they were closed they would have anti-tampering mechanism activated so that later it would not be possible to open the device without setting the tamper flag You didn’t specify what type of anti-tamper was used, but I wanted to jump in and say usually that means nothing. The US government intercepted packages [0] and put in back doors (removing and replacing the seals), so I’m not sure why you were so quick…

The chinese government is probably not interested enough in credit card numbers to warrant involvement.

People said the same thing about personal detail metadata as well. While theft would be foregone foolishness tracking transactions could have value to them. Granted it would probably be easier to snoop on the fiscal institutions.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#397

Post by pjc50 »

ryandrake wrote: post #383
lmilcin wrote: post #327

Earlier quoted context omitted.

Ah, yes, and then we would voluntarily go out of business. And the supplier will just have another customer that would not be so principled.

Huh? This would be between you and the Chinese manufacturer. If you found s tampered unit, you don’t pay them. How should that make you go out of business?

They need the units from somewhere, with a deadline determined by their own runway, and presumably only some of the Chinese ones were compromised. Sure, they could avoid paying, but then they have to spend months getting the production run going somewhere else .. which might also be compromised.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#398

Post by jiveturkey »

awayenberg wrote: post #64

So the chip shown in the article looks like a typical SMD balun, it is a type of transformer used to adapt impedance between two transmission line. It’s designed to replace a series a lumped element (capacitor, inductors, resistors) normally used for impedance adaptation (in a T or Pi network). The most common used for the device is directly between an antenna an a RF front-end to serve as an antenna tuner. Technical…

you would be extremely hard pressed to fit that amount of logic (and code) into that small of a package. and to operate intelligently, as you suggest, it needs a CPU clock, not available to it from where it would sit. And it would need to do signal analysis in real time, with no power and no clock.

it's not possible.

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#399

Post by RanInt1111 »

TheOtherHobbes wrote: post #193
m_mueller wrote: post #96

Earlier quoted context omitted.

> Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems? I'd like to know this too. Has the West completely lost the ability to mass produce microchips at even a reasonable cost for financial applications?

Offshoring has its costs. It's the unknown unknowns that get you.

[flagged]

Re: The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

#400

Post by [deleted] »

blackrock wrote: post #364

This reminds me of that old story about the Xerox copy machines that the Soviet Union bought. Where each unit was planted with a image recorder. And for years, the American spy agencies had a great laugh, that they were able to intercept all the documents that the Russians made a copy of. Back then, this was an off-network infiltration. Where the copied images, were retrieved during regular servicing intervals by a X…

[deleted]
Post reply on HN