8 ms·

First, wow this is both incredible and crazy! Both the China-side hacks and your side's anti-hack. Mind. Blown. Second, would have it been cheaper to manufactu

First, wow this is both incredible and crazy! Both the China-side hacks and your side's anti-hack. Mind. Blown. Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems?

m_mueller 8y ago
> Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems? I'd like to know this too. Has the West completely lost the ability to mass produce microchips at even a reasonable cost for financial applications?
- TazeTSchnitzel 8y ago
  It's not the chips that are the problem. Most of Intel's fabs are in the US, and their assembly sites are in a number of countries.
  - cwingrav 8y ago
    I think people should know how stark the differences for assembly in the US are vs outside of it. Something that costs, at low prototype volumes mind you, $20 in China for a dozen boards or so, would run hundreds of dollars in the US and still take the same amount of time. As it scales up, the ratio might improve, but these aren't like 10%-20% differences.
- raverbashing 8y ago
  This is not microchips, this is basic PCB assembly But I'd guess momentum is hard to change.
- baybal2 8y ago
  America has fabs, both old and leading edge, but ask industry giants like Gemalto to even bother to manufacture chips anywhere outside of Taiwan, assemble the final product outside of China. They will never do that, because they look for the cheapest solution. The bigger the company, the less it cares about things other than cost. This is why Mediatek and Broadcom can usurp the market of network SoCs, while making products with atrociously bad support. I personally dealt with both, and say that they wholely match their popular culture image. I don't know how it is with USA, but for Russia, the military doesn't care that their chips had frequency measured in kilohertz, and had sizes measured in square sentimetres, for as long as they get them made inside the country.
  - m_mueller 8y ago
    What about Japan? I know they've lost most of their semiconductor business as well, but they still have some capacity no?
    - baybal2 8y ago
      I don't know that.
    - hatergonnahate 8y ago
      Japan was ruined mostly because of population problem years ago and (very) slowly recovering. I've saw a TV drama in 2016 (http://www.ntv.co.jp/english/pc/2016/04/were-millennials-got-a-problem.html http://www.ntv.co.jp/english/pc/2016/04/were-millennials-got...) basically describing what the younger generation is still struggling.
    - village-idiot 8y ago
      I’m under the impression that China does not make chips, but they do final assembly cheaper and faster than everyone else. I don’t know if any companies do PCB manufacturing and assembly outside of China in large numbers.
      - baybal2 8y ago
        Not exactly, PCB assembly is super cheap everywhere thanks to propagation of chipshooters, what makes the cost go up is logistics - what do you do after you populate the board for your part? Ship it across the world, or to another factory behind the corner?
        hef19898 8y ago
        That largely depends on the size of your board and the total number you want to ship. As soon as you reach full truck loads or full container loads that additional shipping cost is marginal on a board level.
- TheOtherHobbes 8y ago
  Offshoring has its costs. It's the unknown unknowns that get you.
  - RanInt1111 8y ago
    I contend that they weren't unknown unknowns at all, they were ignored and mocked knowns due to self-delusion. How long have those who warned of the totalitarian communist dictatorship's real intentions been mocked and scorned and called all manner of manipulative and debate ending slurs and insults? What is really the only unknown unknown is the level of the invariable outcome of this fools errand of both subjugating and submitting to not only China, but very much also islam, Russians in the spirit of the soviets, and even Mexicans/Latin America. The biggest "unknown unknown" is the ultimate, albeit invariable outcome of this submission and self-destructive path the west is on. Not unknown in any way at all is that it will not end well. That is knowable, although many do not want to know that.
    - dang 8y ago
      Nationalistic flamewar is not welcome here; neither are political or ideological flamewar. We ban accounts that use HN primarily for those things. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here.
- HillaryBriss 8y ago
  > Has the West completely lost the ability ... at first I had the same thought. but i have to question how securely the same manufacturing could be done in a US plant. the US employee base has its fair share of desperate, ethically challenged individuals. and plenty of incentives to make a quick buck could be offered here too. idk.
  - whyaduck 8y ago
    The consequences if US citizens or residents get caught engaging in espionage for a foreign government are go-to-jail-for-years serious.
    - subcosmos 8y ago
      And it's not white collar resort prison ... no no no! https://www.youtube.com/watch?v=oBzvMLW0ii4 https://www.youtube.com/watch?v=oBzvMLW0ii4
    - datavirtue 8y ago
      Death penalty.
    - HillaryBriss 8y ago
      ok. a fair point. OTOH, given US law enforcement's low efficiency what are the chances of being caught? and what if it's merely corporate espionage? finally, the US is an open society with strong personal freedom guarantees builtin. what if the perpetrator has ties to a foreign country and simply leaves the US after they've installed the vulnerabilities?
ElBarto 8y ago
I think what is described is an issue with process. If the device is sealed with an anti-tampering system then the contents must be checked by a trusted entity before being sealed. Trying to guess the contents of a box that you cannot open sounds a bit like madness.
- tantalor 8y ago
  > guess the contents of a box Use X-ray? or whatever can penetrate the exterior shell
  - close04 8y ago
    All big and security-responsible companies issue their employees special phones and laptops when they go on business trips to countries like China or Russia and these are quarantined immediately after they return. They get wiped, X-rayed, disassembled and checked, including any accessory (chargers, mice, etc.). The more critical the field, the more you have to treat those devices as untrusted before attaching them to your trusted zone.
    - C1sc0cat 8y ago
      I would imagine you would treat any kit that has been to those countries as disposable on return and crush them
    - rcaught 8y ago
      Add the USA to that list.
      - skj 8y ago
        Are you saying companies should or that you know of companies that do?
        hutzlibu 8y ago
        As far as I know, big EU companys do that, when they visit US, or they don't have sensitive information with them in the first place.
godelmachine 8y ago
India
etatoby 8y ago
You are underestimating the FUN of playing anti-anti-^N-hacks. I have had the privilege to be paid to so anti-anti-^N-hacking on a firewall thingy in the past and it was a challenge and a joy!
- lmilcin 8y ago
  The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.
  - scoggs 8y ago
    Honestly if it weren't programming I feel like this is a movie-worthy story. To me it sounds so thrilling like a spy movie plot but am I just imagining that or was it actually this crazy / cool / integral to way bigger moving parts / things like I'm assuming? Regardless kudos. Your story definitely started my day on a happy note, thanks!
  - mercer 8y ago
    I'd very much love to hear more stories if you have any!
    - lmilcin 8y ago
      We had MasterCard end-to-end test auditor on site. This is the first time ever you get to do a transaction with real transaction system with real credit card. Due to requirements we opted to have the only large meeting room to have outside our secure zone. This created an issue as we had no network access from there and in the end we decided to use slow GPRS terminal for the test. The end-to-end test starts with offline transactions which by their very nature are quite fast (it is negotiated between terminal and card). But then we went to online transaction and it finished instantly too. The auditor, bewildered, proclaimed the test failed as he assumed it was incorrectly processed offline instead of going online. But then I pointed out to the printout to show ARQC (basically says it was certified online). Now, the real discussion started. The terminal was very slow taking quite few seconds to establish GPRS and then even more for the SSL handshake so the auditor said it was not possible to make it work. How it worked was that I have completely gutted OpenSSL and had entire cryptographic state stored locally (safely, using internal HSM) so the SSL session could be optimistically re-established without another handshake even after TCP connection was closed. The first message the terminal sends is already encrypted transaction message, there is no SSL handshake. I wrote an application to terminate the connection in our data center so that it stored the states of each connection in the database. The entire handshake was only done if the first message could not be decrypted successfully. The operating system was single-threaded with no multitasking of any kind. This meant that all applications on this device did their operations sequentially. Send network message, print something, display something, etc. I wrote a cooperative multitasking functionality into the application (using coroutines) so that it could work on multiple tasks at the same time (like talking to network and printing). I then have segregated all data on the printouts so that it can start printing without having to already have response from network. Hopefully if everything went right, the response would come before it even came to that place on the printout effectively looking as if it was done in zero time.
lmilcin 8y ago
This wasn't our device. There was a big, reputable company behind the device. We were ordering a number of those and they would be shipped to us directly from China. Also, we were basically locked in due to the magnitude of investment in the software we have developed for the device. Fortunately this only lasted for few months until it was dealt with. It was quite new back then (a decade ago) and it was a surprise for everybody I guess.
- joncrane 8y ago
  How was it finally "dealt with?"
  - lmilcin 8y ago
    I wouldn't know. We were just buying the stuff.
  - wolco 8y ago
    They got better at hiding and his company couldn't detect it. Problem solved.
frockington 8y ago
When I worked in telecom (a while ago) the manufacturing was shifted from China to Thailand/Other SE Asia due to this. The Thai companies weren't as efficient, but were much more open and honest when problems would arise., plus they didn't blatantly steal tech

m_mueller 8y ago

> Second, would have it been cheaper to manufacture somewhere more trustworthy (another country?) instead of spending all this time/money on your anti-hack systems? I'd like to know this too. Has the West completely lost the ability to mass produce microchips at even a reasonable cost for financial applications?

TazeTSchnitzel 8y ago
It's not the chips that are the problem. Most of Intel's fabs are in the US, and their assembly sites are in a number of countries.
- cwingrav 8y ago
  I think people should know how stark the differences for assembly in the US are vs outside of it. Something that costs, at low prototype volumes mind you, $20 in China for a dozen boards or so, would run hundreds of dollars in the US and still take the same amount of time. As it scales up, the ratio might improve, but these aren't like 10%-20% differences.
raverbashing 8y ago
This is not microchips, this is basic PCB assembly But I'd guess momentum is hard to change.
baybal2 8y ago
America has fabs, both old and leading edge, but ask industry giants like Gemalto to even bother to manufacture chips anywhere outside of Taiwan, assemble the final product outside of China. They will never do that, because they look for the cheapest solution. The bigger the company, the less it cares about things other than cost. This is why Mediatek and Broadcom can usurp the market of network SoCs, while making products with atrociously bad support. I personally dealt with both, and say that they wholely match their popular culture image. I don't know how it is with USA, but for Russia, the military doesn't care that their chips had frequency measured in kilohertz, and had sizes measured in square sentimetres, for as long as they get them made inside the country.
- m_mueller 8y ago
  What about Japan? I know they've lost most of their semiconductor business as well, but they still have some capacity no?
  - baybal2 8y ago
    I don't know that.
  - hatergonnahate 8y ago
    Japan was ruined mostly because of population problem years ago and (very) slowly recovering. I've saw a TV drama in 2016 (http://www.ntv.co.jp/english/pc/2016/04/were-millennials-got-a-problem.html http://www.ntv.co.jp/english/pc/2016/04/were-millennials-got...) basically describing what the younger generation is still struggling.
  - village-idiot 8y ago
    I’m under the impression that China does not make chips, but they do final assembly cheaper and faster than everyone else. I don’t know if any companies do PCB manufacturing and assembly outside of China in large numbers.
    - baybal2 8y ago
      Not exactly, PCB assembly is super cheap everywhere thanks to propagation of chipshooters, what makes the cost go up is logistics - what do you do after you populate the board for your part? Ship it across the world, or to another factory behind the corner?
      - hef19898 8y ago
        That largely depends on the size of your board and the total number you want to ship. As soon as you reach full truck loads or full container loads that additional shipping cost is marginal on a board level.
TheOtherHobbes 8y ago
Offshoring has its costs. It's the unknown unknowns that get you.
- RanInt1111 8y ago
  I contend that they weren't unknown unknowns at all, they were ignored and mocked knowns due to self-delusion. How long have those who warned of the totalitarian communist dictatorship's real intentions been mocked and scorned and called all manner of manipulative and debate ending slurs and insults? What is really the only unknown unknown is the level of the invariable outcome of this fools errand of both subjugating and submitting to not only China, but very much also islam, Russians in the spirit of the soviets, and even Mexicans/Latin America. The biggest "unknown unknown" is the ultimate, albeit invariable outcome of this submission and self-destructive path the west is on. Not unknown in any way at all is that it will not end well. That is knowable, although many do not want to know that.
  - dang 8y ago
    Nationalistic flamewar is not welcome here; neither are political or ideological flamewar. We ban accounts that use HN primarily for those things. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here.
HillaryBriss 8y ago
> Has the West completely lost the ability ... at first I had the same thought. but i have to question how securely the same manufacturing could be done in a US plant. the US employee base has its fair share of desperate, ethically challenged individuals. and plenty of incentives to make a quick buck could be offered here too. idk.
- whyaduck 8y ago
  The consequences if US citizens or residents get caught engaging in espionage for a foreign government are go-to-jail-for-years serious.
  - subcosmos 8y ago
    And it's not white collar resort prison ... no no no! https://www.youtube.com/watch?v=oBzvMLW0ii4 https://www.youtube.com/watch?v=oBzvMLW0ii4
  - datavirtue 8y ago
    Death penalty.
  - HillaryBriss 8y ago
    ok. a fair point. OTOH, given US law enforcement's low efficiency what are the chances of being caught? and what if it's merely corporate espionage? finally, the US is an open society with strong personal freedom guarantees builtin. what if the perpetrator has ties to a foreign country and simply leaves the US after they've installed the vulnerabilities?

ElBarto 8y ago

I think what is described is an issue with process. If the device is sealed with an anti-tampering system then the contents must be checked by a trusted entity before being sealed. Trying to guess the contents of a box that you cannot open sounds a bit like madness.

tantalor 8y ago
> guess the contents of a box Use X-ray? or whatever can penetrate the exterior shell
- close04 8y ago
  All big and security-responsible companies issue their employees special phones and laptops when they go on business trips to countries like China or Russia and these are quarantined immediately after they return. They get wiped, X-rayed, disassembled and checked, including any accessory (chargers, mice, etc.). The more critical the field, the more you have to treat those devices as untrusted before attaching them to your trusted zone.
  - C1sc0cat 8y ago
    I would imagine you would treat any kit that has been to those countries as disposable on return and crush them
  - rcaught 8y ago
    Add the USA to that list.
    - skj 8y ago
      Are you saying companies should or that you know of companies that do?
      - hutzlibu 8y ago
        As far as I know, big EU companys do that, when they visit US, or they don't have sensitive information with them in the first place.

godelmachine 8y ago

India

etatoby 8y ago

You are underestimating the FUN of playing anti-anti-^N-hacks. I have had the privilege to be paid to so anti-anti-^N-hacking on a firewall thingy in the past and it was a challenge and a joy!

lmilcin 8y ago
The day I figured out to measure the angular momentums and calculated the feasibility I was walking around the office proud like a peacock.
- scoggs 8y ago
  Honestly if it weren't programming I feel like this is a movie-worthy story. To me it sounds so thrilling like a spy movie plot but am I just imagining that or was it actually this crazy / cool / integral to way bigger moving parts / things like I'm assuming? Regardless kudos. Your story definitely started my day on a happy note, thanks!
- mercer 8y ago
  I'd very much love to hear more stories if you have any!
  - lmilcin 8y ago
    We had MasterCard end-to-end test auditor on site. This is the first time ever you get to do a transaction with real transaction system with real credit card. Due to requirements we opted to have the only large meeting room to have outside our secure zone. This created an issue as we had no network access from there and in the end we decided to use slow GPRS terminal for the test. The end-to-end test starts with offline transactions which by their very nature are quite fast (it is negotiated between terminal and card). But then we went to online transaction and it finished instantly too. The auditor, bewildered, proclaimed the test failed as he assumed it was incorrectly processed offline instead of going online. But then I pointed out to the printout to show ARQC (basically says it was certified online). Now, the real discussion started. The terminal was very slow taking quite few seconds to establish GPRS and then even more for the SSL handshake so the auditor said it was not possible to make it work. How it worked was that I have completely gutted OpenSSL and had entire cryptographic state stored locally (safely, using internal HSM) so the SSL session could be optimistically re-established without another handshake even after TCP connection was closed. The first message the terminal sends is already encrypted transaction message, there is no SSL handshake. I wrote an application to terminate the connection in our data center so that it stored the states of each connection in the database. The entire handshake was only done if the first message could not be decrypted successfully. The operating system was single-threaded with no multitasking of any kind. This meant that all applications on this device did their operations sequentially. Send network message, print something, display something, etc. I wrote a cooperative multitasking functionality into the application (using coroutines) so that it could work on multiple tasks at the same time (like talking to network and printing). I then have segregated all data on the printouts so that it can start printing without having to already have response from network. Hopefully if everything went right, the response would come before it even came to that place on the printout effectively looking as if it was done in zero time.

lmilcin 8y ago

This wasn't our device. There was a big, reputable company behind the device. We were ordering a number of those and they would be shipped to us directly from China. Also, we were basically locked in due to the magnitude of investment in the software we have developed for the device. Fortunately this only lasted for few months until it was dealt with. It was quite new back then (a decade ago) and it was a surprise for everybody I guess.

joncrane 8y ago
How was it finally "dealt with?"
- lmilcin 8y ago
  I wouldn't know. We were just buying the stuff.
- wolco 8y ago
  They got better at hiding and his company couldn't detect it. Problem solved.

frockington 8y ago

When I worked in telecom (a while ago) the manufacturing was shifted from China to Thailand/Other SE Asia due to this. The Thai companies weren't as efficient, but were much more open and honest when problems would arise., plus they didn't blatantly steal tech