4 ms·

So by subsidizing each webcam by a dollar or two, China is able to deploy millions of pieces of hardware to the U.S. that can be used to map and destroy our inf

So by subsidizing each webcam by a dollar or two, China is able to deploy millions of pieces of hardware to the U.S. that can be used to map and destroy our infrastructure for a total cost of a few hundred thousand dollars. If done purposefully, this has to be one of the most efficient military spends in history.

throwaway729 10y ago
In the short term. Such a strategy, if proven, would be devastating to China.
- Cozumel 10y ago
  It can never be proven and that's the ingenuity of it, meanwhile the company does a token PR effort to fix the issue still leaving millions of weaponisable devices employed. It's not the first time China has been 'caught' doing something like this either https://intelligence.house.gov/sites/intelligence.house.gov/files/documents/Huawei-ZTE%20Investigative%20Report%20(FINAL).pdf https://intelligence.house.gov/sites/intelligence.house.gov/...
  - kuschku 10y ago
    And most amazingly, it’s a strategy the NSA devised and used in the first place, now employed against them. Poetic justice.
Cozumel 10y ago
I made that same point the other day too, it's ingenious!
tdkl 10y ago
You forgot the part where people are voluntarily buying those, because they cost less. Of course those made in California would be totally safe, but damn shame about that globalism.
- TeMPOraL 10y ago
  That's the point, though - a government could indirectly subsidize a product to increase its adoption, exploiting the fact that "people are voluntarily buying those, because they cost less".
  - tdkl 10y ago
    They "could" also do the same for the good old capitalistic result of more devices sold, but without any backdoors.
- the_trapper 10y ago
  > Of course those made in California would be totally safe Maybe I'm too cynical, but from what I know about the NSA and other three letter US Government agencies, I beg to differ. Additionally, good luck finding any type of electronic device that is entirely made in the USA. I honestly can't think of anything with a printed circuit board that is assembled in the USA from 100% American-made parts. Then of course there's always the whole engineers taking shortcuts to meet unrealistic deadlines thing. Somehow network security tends to be very low on the list of priorities when you have to make a profit.
  - tdkl 10y ago
    I probably forgot to add "/s" at the end of that sentence.
  - dimino 10y ago
    This has nothing to do with governments, it's freaking hard to build secure software. There'd be bugs in American software just like there are bugs in the foreign software.
CoryG89 10y ago
Sounds a little paranoid to me. These insecure devices are just being pushed out into the wild. It doesn't matter if they are imported into the US. They can be used to attack Chinese infrastructure just as easily.
- drzaiusapelord 10y ago
  A lot of malware and ransomware is hardcoded to ignore Russian IPs as per Brian Krebs. The malware runs, does a quick check to see its public IP, and if its Russian it exits. A list for China's IPs could also be put into these devices.
  - CoryG89 10y ago
    Unless I am uninformed, I don't think it's the case that any of these IoT devices come with malware preinstalled. They are just vulnerable because of weak default identical passwords. The fear is about these devices being exploited, not that they are malicious themselves. My argument still stands. You could just as easily load malware which ignores American IPs.
verytrivial 10y ago
I initially chuckled at this comment.
jerf 10y ago
While at least theoretically possible, I think it fails Occam's Razor. Anyone who has worked in this industry in an even remotely security-sensitive area knows this is currently the state of the art, and preventing this from happening requires a major effort. The default for an organization is to throw together a feature as quickly as possible, develop for engineer convenience (which is the cheapest thing to do), and then throw it out there with no plans to support it in the future unless they can show revenue resulting from that. We don't need to hypothesize a conspiracy to produce that result when it would take a very powerful conspiracy to prevent that from happening. Now, if you can show me that the same manufacturers make cameras for China's internal use that are fully secured, that would make me change my mind. But based on the occasional "trips to Chinese tech bazaar" reports we see here sometimes, I'd be surprised. (On a similar note, in my political blog reading I saw a lot of paranoia that the DDoSes last week were somehow motivated by name-your-choice of political actor. However, per what we are discussing right now, we don't need to hypothesize that. It is completely plausible that criminals have come into possession of that much power. The trendlines have been clear for a while; we've been getting DDoSes ~25% larger than the largest one ever recorded about every ~three months for a long time now, and most of them do not seem to be state actors. Just because they're out to get you doesn't mean that it may not be paranoia, to invert a famous quote.)

throwaway729 10y ago

In the short term. Such a strategy, if proven, would be devastating to China.

Cozumel 10y ago
It can never be proven and that's the ingenuity of it, meanwhile the company does a token PR effort to fix the issue still leaving millions of weaponisable devices employed. It's not the first time China has been 'caught' doing something like this either https://intelligence.house.gov/sites/intelligence.house.gov/files/documents/Huawei-ZTE%20Investigative%20Report%20(FINAL).pdf https://intelligence.house.gov/sites/intelligence.house.gov/...
- kuschku 10y ago
  And most amazingly, it’s a strategy the NSA devised and used in the first place, now employed against them. Poetic justice.

Cozumel 10y ago

I made that same point the other day too, it's ingenious!

tdkl 10y ago

You forgot the part where people are voluntarily buying those, because they cost less. Of course those made in California would be totally safe, but damn shame about that globalism.

TeMPOraL 10y ago
That's the point, though - a government could indirectly subsidize a product to increase its adoption, exploiting the fact that "people are voluntarily buying those, because they cost less".
- tdkl 10y ago
  They "could" also do the same for the good old capitalistic result of more devices sold, but without any backdoors.
the_trapper 10y ago
> Of course those made in California would be totally safe Maybe I'm too cynical, but from what I know about the NSA and other three letter US Government agencies, I beg to differ. Additionally, good luck finding any type of electronic device that is entirely made in the USA. I honestly can't think of anything with a printed circuit board that is assembled in the USA from 100% American-made parts. Then of course there's always the whole engineers taking shortcuts to meet unrealistic deadlines thing. Somehow network security tends to be very low on the list of priorities when you have to make a profit.
- tdkl 10y ago
  I probably forgot to add "/s" at the end of that sentence.
- dimino 10y ago
  This has nothing to do with governments, it's freaking hard to build secure software. There'd be bugs in American software just like there are bugs in the foreign software.

CoryG89 10y ago

Sounds a little paranoid to me. These insecure devices are just being pushed out into the wild. It doesn't matter if they are imported into the US. They can be used to attack Chinese infrastructure just as easily.

drzaiusapelord 10y ago
A lot of malware and ransomware is hardcoded to ignore Russian IPs as per Brian Krebs. The malware runs, does a quick check to see its public IP, and if its Russian it exits. A list for China's IPs could also be put into these devices.
- CoryG89 10y ago
  Unless I am uninformed, I don't think it's the case that any of these IoT devices come with malware preinstalled. They are just vulnerable because of weak default identical passwords. The fear is about these devices being exploited, not that they are malicious themselves. My argument still stands. You could just as easily load malware which ignores American IPs.

verytrivial 10y ago

I initially chuckled at this comment.

jerf 10y ago

While at least theoretically possible, I think it fails Occam's Razor. Anyone who has worked in this industry in an even remotely security-sensitive area knows this is currently the state of the art, and preventing this from happening requires a major effort. The default for an organization is to throw together a feature as quickly as possible, develop for engineer convenience (which is the cheapest thing to do), and then throw it out there with no plans to support it in the future unless they can show revenue resulting from that. We don't need to hypothesize a conspiracy to produce that result when it would take a very powerful conspiracy to prevent that from happening. Now, if you can show me that the same manufacturers make cameras for China's internal use that are fully secured, that would make me change my mind. But based on the occasional "trips to Chinese tech bazaar" reports we see here sometimes, I'd be surprised. (On a similar note, in my political blog reading I saw a lot of paranoia that the DDoSes last week were somehow motivated by name-your-choice of political actor. However, per what we are discussing right now, we don't need to hypothesize that. It is completely plausible that criminals have come into possession of that much power. The trendlines have been clear for a while; we've been getting DDoSes ~25% larger than the largest one ever recorded about every ~three months for a long time now, and most of them do not seem to be state actors. Just because they're out to get you doesn't mean that it may not be paranoia, to invert a famous quote.)