8 ms·

This is common at many semiconductor companies. Not only is it a ban at one specific semiconductor oem I know of, the usb-ports are disabled and the usb-ports o

This is common at many semiconductor companies. Not only is it a ban at one specific semiconductor oem I know of, the usb-ports are disabled and the usb-ports on new issue computers are epoxied to prevent trying to use them. Semiconductor technology is one of the areas of global-technological competition which surely benefit from secrecy. For example, several years ago one of the c-level executives at this specific OEM was caught taking pictures inside of one of their customer's facility. Only the engineering staff from that oem is allowed inside those facilities now, and only for maintenence activity. It's a very secret industry, and getting even tighter now since China has been blocked from acquiring the latest semiconductor technology. China has so far invested over $40 billion in boosting their chip-making abilities, to acquire capital, IP, and knowledge-workers. Given their history of borrowing technology from other countries without attribution, if I were at the head of a semiconductor related company, I would clamp down on the secrets ahead of the danger.

blacksmith_tb 8y ago
Are cases locked / glued shut? It seems like it would be easy enough to connect a new usb header...
- rasz 8y ago
  or unplug a mouse for 5 seconds
  - Lionsion 8y ago
    If you're going through the trouble of epoxying USB ports, you could probably epoxy the mouse to its port as well. Or just monitor connected USB devices and shutdown if something unapproved is installed, a la USBKill. https://en.wikipedia.org/wiki/USBKill https://en.wikipedia.org/wiki/USBKill
    - TeMPOraL 8y ago
      If mouse is epoxied - cut the cable, cut and splice in a male->female cable, connect your device.
      - chrischen 8y ago
        I think they are trying to discourage accidental use of/the urge to use the USB ports.
      - floatingatoll 8y ago
        Doing so would trigger a USB disconnection event, which under a sufficiently paranoid ecosystem would immediately terminate the entire enclosure and lock the door and call security.
    - AstralStorm 8y ago
      Epoxy is a pain, just use a sticky connector envelope instead. USB disconnect disabling whole USB host is trivial to code. You would disable on disconnect instead of whitelisting as there can be USB host bugs. Add a boot password so that only admin can start the machine... Plus the are solutions where drivers are also put in a VM to further reduce attack surface.
- Nelson69 8y ago
  While visiting a Chinese division of an American company I worked for about 8 years ago they had Dell desktops, in a tower configuration and they had a metal (steel) super structure around them. A case within a case. You could unlock it, plug in USB, monitors, ethernet, etc. route the cables out through a slot and then lock it. You couldn't reach the the different ports and sockets when it was locked. It was all relatively stout too. Interestingly, they did have internet in the building but you had to have management permission and go to the security office to access it. If you wanted to download something, it was a fairly involved procedure. They were paranoid about people stealing their stuff and then also very paranoid about misappropriating something they shouldn't and creating legal problems in Europe or North America. They didn't seem to be all that concerned about stealing other people's IT but they wanted to control everything such that it didn't contaminate anything they wanted to sell where it mattered. I nearly created a situation when I pulled out my phone to take a picture of an "engrish" sign they had on the wall. It'll be interesting to see how the security culture in the US changes or doesn't, a lot of younger developers would be put off if you attempted to somehow restrict their access to the internet from work computers or restricted your ability to plug a phone or some arbitrary device in for charging of whatever. At every job I've had this century it has been fairly trivial to download nearly all of their source code and take it home if you wanted to. Trying to take the politics out of it, we're very much engaged in a cyber cold war with a number of nations that absolutely want to take our secrets; I won't speculate on the real impact but the Russians did meddle in our election.
- rdtsc 8y ago
  > Are cases locked / glued shut? It seems like it would be easy enough to connect a new usb header... Well sure. I think the idea is to prevent mistakes and people just randomly plugging usb sticks they get from conferences as gifts or when they work from home. People will forget and do that anyway even if it is the rule. When someone start disassembling the laptop or runs around with a screw driver trying to get the epoxy out of the ports, it would a bit hard to claim it was an accidental mistake. In that case, those people can probably find a way to exfiltrate data or to infect the system without the aid of USB keys.
xbryanx 8y ago
How do you connect a keyboard or mouse?
- jay-anderson 8y ago
  https://en.wikipedia.org/wiki/PS/2_port https://en.wikipedia.org/wiki/PS/2_port
- genericone 8y ago
  To be fair, they are not completely locked down like I may have made it sound. The usb port restriction is absolutely true for laptops, but colo desktops probably do not have this restriction, or just a more lax restriction. Also, its not true for all laptops of the company, but usb access does require explicit permissions and a new-issue laptop, so they do have a list of people who have riskier laptops, and may need to be issued a different travel laptop vs engineering laptop. The laptop's epoxied ports likely prevent distracted traveling workers from having their laptops hacked with usb-keys inserted when they aren't looking.
  - pjmlp 8y ago
    The solution I have seen for desktops is to put them inside a locked metal case. You cannot access anything besides the power button.
  - StringyBob 8y ago
    I've seen the 'USB ports get taped up for a visiting engineers computer' thing before - so I wonder what they do with a MacBookPro nowadays (there is no separate display or power connector!)
    - AstralStorm 8y ago
      They use a laptop suited for business, obviously.
- dogma1138 8y ago
  An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accidental leakage and to make it difficult enough that intentional leakage would likely be detecte on time.
praneshp 8y ago
> Given their history of borrowing technology from other countries without attribution, Impressive choice of words!
- dgudkov 8y ago
  Strictly speaking, borrowing assumes returning at some point.
  - rosser 8y ago
    Is it "returning" a thing to sell it back to the people from whom you "borrowed" it?
    - astrodust 8y ago
      It's like how there's Starbucks coffee shops in Paris and Taco Bell in Mexico.
  - coupdejarnac 8y ago
    Strictly speaking, euphemisms substitute a mild, indirect, or vague term for a harsher term.
- Barrin92 8y ago
  It's always been an arms race and nations and companies have always strategically opened themselves up to acquire knowledge. When Germany was trying to catch up to the industrialised UK, they send business people to the UK to copy the layout of factory floors to reimplement them at home. For the longest time, Japan only allowed trade under restrictive conditions to maximise exposure to foreign technologies while minimising the impact of foreigners in Japan. It's a story as old as history and I honestly don't get why people are upset about it. It's even beneficial for the ecosystem overall because it helps transmitting knowledge and technology from advanced to disadvantaged regions, which in turn accelerates production and development.
  - joyeuse6701 8y ago
nickpsecurity 8y ago
Another common approach is thin clients that connect to VM's running on servers in protected rooms. My company does that. From there, most critical apps are web apps they monitor. Specific things that need Windows or Linux run in the VM's. There's even some solutions that support connecting USB devices to thin clients for use on remote VM's with some security on that process. I have no idea if that security is good but there's potential for secure devices designed for these use cases.
petra 8y ago
How can they prevent migration of talented people, given China's infinite war chest ?
- user5994461 8y ago
  China is in China. Geography is a pretty good limitation against poaching.
  - loeg 8y ago
    Geography, politics, and ordinary racism against non-Chinese.
- wolfgke 8y ago
  > How can they prevent migration of talented people, given China's infinite war chest ? The Renminbi is very difficult to convert.
  - basementcat 8y ago
    I've never had a problem converting modest amounts of CNY <-> USD at any bank in China or in the USA. Are you referring to capital export controls (~100k CNY/year)?
    - wolfgke 8y ago
      > Are you referring to capital export controls (~100k CNY/year)? Yes.
      - avastmick 8y ago
        Sorry, this is not true. I live and work in China and move far than that a year. Also the NZ / Australian property markets are both in a bubble caused by Chinese cash investment by wealthy individuals, 100k CNY won't buy anything. 100k CNY is only 15k USD.
visarga 8y ago
> the usb ports are disabled and the usb ports on new issue computers are epoxied to prevent trying to use them. That means many current day laptops can't be charged.
- deleted 8y ago
  [deleted]
- tzs 8y ago
  They could glue in a USB data blocker, which is a thing that plugs into a USB port and has a USB socket on the other end and has the power lines connected between the port and socket but not the data lines.
ci5er 8y ago
I used to work in semi- in Asia, and it was pretty loose compared to Financial and Pharma. Maybe things have gotten tighter, but...
- genericone 8y ago
  I think it depends on the tier at which the company does its business in. Is the OEM involved in the latest nodes, or are they working with sizes >100nm? Secrets are kept tight for any company with any tech relating to the latest nodes <10nm. It just so happens that IBM has been working on sub-10nm processes for a long time, so they have a lot of secrets to keep, hence I am not surprised by the article heading.
  - ci5er 8y ago
    I get your point, but even when everyone was at a micron, 100nm was the super-secret stuff. This "ratio" has been a constant for ~40 years.
walrus01 8y ago
Taken to its logical full extent you might as well build a SCIF. Intelligence agency standard for facility that can handle air gapped SECRET and Top Secret data. If you look at the office park directly west of fort Meade, MD, some of those have SCIFs inside them. Not cheap.
beefield 8y ago
> the usb-ports are disabled and the usb-ports on new issue computers are epoxied to prevent trying to use them. How are they planning to use new laptops that are powered via usb-c?
- gl0w 8y ago
  They probably don't use laptops, since laptops can easily be taken off site.

blacksmith_tb 8y ago

Are cases locked / glued shut? It seems like it would be easy enough to connect a new usb header...

rasz 8y ago
or unplug a mouse for 5 seconds
- Lionsion 8y ago
  If you're going through the trouble of epoxying USB ports, you could probably epoxy the mouse to its port as well. Or just monitor connected USB devices and shutdown if something unapproved is installed, a la USBKill. https://en.wikipedia.org/wiki/USBKill https://en.wikipedia.org/wiki/USBKill
  - TeMPOraL 8y ago
    If mouse is epoxied - cut the cable, cut and splice in a male->female cable, connect your device.
    - chrischen 8y ago
      I think they are trying to discourage accidental use of/the urge to use the USB ports.
    - floatingatoll 8y ago
      Doing so would trigger a USB disconnection event, which under a sufficiently paranoid ecosystem would immediately terminate the entire enclosure and lock the door and call security.
  - AstralStorm 8y ago
    Epoxy is a pain, just use a sticky connector envelope instead. USB disconnect disabling whole USB host is trivial to code. You would disable on disconnect instead of whitelisting as there can be USB host bugs. Add a boot password so that only admin can start the machine... Plus the are solutions where drivers are also put in a VM to further reduce attack surface.
Nelson69 8y ago
While visiting a Chinese division of an American company I worked for about 8 years ago they had Dell desktops, in a tower configuration and they had a metal (steel) super structure around them. A case within a case. You could unlock it, plug in USB, monitors, ethernet, etc. route the cables out through a slot and then lock it. You couldn't reach the the different ports and sockets when it was locked. It was all relatively stout too. Interestingly, they did have internet in the building but you had to have management permission and go to the security office to access it. If you wanted to download something, it was a fairly involved procedure. They were paranoid about people stealing their stuff and then also very paranoid about misappropriating something they shouldn't and creating legal problems in Europe or North America. They didn't seem to be all that concerned about stealing other people's IT but they wanted to control everything such that it didn't contaminate anything they wanted to sell where it mattered. I nearly created a situation when I pulled out my phone to take a picture of an "engrish" sign they had on the wall. It'll be interesting to see how the security culture in the US changes or doesn't, a lot of younger developers would be put off if you attempted to somehow restrict their access to the internet from work computers or restricted your ability to plug a phone or some arbitrary device in for charging of whatever. At every job I've had this century it has been fairly trivial to download nearly all of their source code and take it home if you wanted to. Trying to take the politics out of it, we're very much engaged in a cyber cold war with a number of nations that absolutely want to take our secrets; I won't speculate on the real impact but the Russians did meddle in our election.
rdtsc 8y ago
> Are cases locked / glued shut? It seems like it would be easy enough to connect a new usb header... Well sure. I think the idea is to prevent mistakes and people just randomly plugging usb sticks they get from conferences as gifts or when they work from home. People will forget and do that anyway even if it is the rule. When someone start disassembling the laptop or runs around with a screw driver trying to get the epoxy out of the ports, it would a bit hard to claim it was an accidental mistake. In that case, those people can probably find a way to exfiltrate data or to infect the system without the aid of USB keys.

xbryanx 8y ago

How do you connect a keyboard or mouse?

jay-anderson 8y ago
https://en.wikipedia.org/wiki/PS/2_port https://en.wikipedia.org/wiki/PS/2_port
genericone 8y ago
To be fair, they are not completely locked down like I may have made it sound. The usb port restriction is absolutely true for laptops, but colo desktops probably do not have this restriction, or just a more lax restriction. Also, its not true for all laptops of the company, but usb access does require explicit permissions and a new-issue laptop, so they do have a list of people who have riskier laptops, and may need to be issued a different travel laptop vs engineering laptop. The laptop's epoxied ports likely prevent distracted traveling workers from having their laptops hacked with usb-keys inserted when they aren't looking.
- pjmlp 8y ago
  The solution I have seen for desktops is to put them inside a locked metal case. You cannot access anything besides the power button.
- StringyBob 8y ago
  I've seen the 'USB ports get taped up for a visiting engineers computer' thing before - so I wonder what they do with a MacBookPro nowadays (there is no separate display or power connector!)
  - AstralStorm 8y ago
    They use a laptop suited for business, obviously.
dogma1138 8y ago
An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accidental leakage and to make it difficult enough that intentional leakage would likely be detecte on time.

praneshp 8y ago

> Given their history of borrowing technology from other countries without attribution, Impressive choice of words!

dgudkov 8y ago
Strictly speaking, borrowing assumes returning at some point.
- rosser 8y ago
  Is it "returning" a thing to sell it back to the people from whom you "borrowed" it?
  - astrodust 8y ago
    It's like how there's Starbucks coffee shops in Paris and Taco Bell in Mexico.
- coupdejarnac 8y ago
  Strictly speaking, euphemisms substitute a mild, indirect, or vague term for a harsher term.
Barrin92 8y ago
It's always been an arms race and nations and companies have always strategically opened themselves up to acquire knowledge. When Germany was trying to catch up to the industrialised UK, they send business people to the UK to copy the layout of factory floors to reimplement them at home. For the longest time, Japan only allowed trade under restrictive conditions to maximise exposure to foreign technologies while minimising the impact of foreigners in Japan. It's a story as old as history and I honestly don't get why people are upset about it. It's even beneficial for the ecosystem overall because it helps transmitting knowledge and technology from advanced to disadvantaged regions, which in turn accelerates production and development.
- joyeuse6701 8y ago

nickpsecurity 8y ago

Another common approach is thin clients that connect to VM's running on servers in protected rooms. My company does that. From there, most critical apps are web apps they monitor. Specific things that need Windows or Linux run in the VM's. There's even some solutions that support connecting USB devices to thin clients for use on remote VM's with some security on that process. I have no idea if that security is good but there's potential for secure devices designed for these use cases.

petra 8y ago

How can they prevent migration of talented people, given China's infinite war chest ?

user5994461 8y ago
China is in China. Geography is a pretty good limitation against poaching.
- loeg 8y ago
  Geography, politics, and ordinary racism against non-Chinese.
wolfgke 8y ago
> How can they prevent migration of talented people, given China's infinite war chest ? The Renminbi is very difficult to convert.
- basementcat 8y ago
  I've never had a problem converting modest amounts of CNY <-> USD at any bank in China or in the USA. Are you referring to capital export controls (~100k CNY/year)?
  - wolfgke 8y ago
    > Are you referring to capital export controls (~100k CNY/year)? Yes.
    - avastmick 8y ago
      Sorry, this is not true. I live and work in China and move far than that a year. Also the NZ / Australian property markets are both in a bubble caused by Chinese cash investment by wealthy individuals, 100k CNY won't buy anything. 100k CNY is only 15k USD.

visarga 8y ago

> the usb ports are disabled and the usb ports on new issue computers are epoxied to prevent trying to use them. That means many current day laptops can't be charged.

deleted 8y ago
[deleted]
tzs 8y ago
They could glue in a USB data blocker, which is a thing that plugs into a USB port and has a USB socket on the other end and has the power lines connected between the port and socket but not the data lines.

ci5er 8y ago

I used to work in semi- in Asia, and it was pretty loose compared to Financial and Pharma. Maybe things have gotten tighter, but...

genericone 8y ago
I think it depends on the tier at which the company does its business in. Is the OEM involved in the latest nodes, or are they working with sizes >100nm? Secrets are kept tight for any company with any tech relating to the latest nodes <10nm. It just so happens that IBM has been working on sub-10nm processes for a long time, so they have a lot of secrets to keep, hence I am not surprised by the article heading.
- ci5er 8y ago
  I get your point, but even when everyone was at a micron, 100nm was the super-secret stuff. This "ratio" has been a constant for ~40 years.

walrus01 8y ago

Taken to its logical full extent you might as well build a SCIF. Intelligence agency standard for facility that can handle air gapped SECRET and Top Secret data. If you look at the office park directly west of fort Meade, MD, some of those have SCIFs inside them. Not cheap.

beefield 8y ago

> the usb-ports are disabled and the usb-ports on new issue computers are epoxied to prevent trying to use them. How are they planning to use new laptops that are powered via usb-c?

gl0w 8y ago
They probably don't use laptops, since laptops can easily be taken off site.