4 ms·

All big and security-responsible companies issue their employees special phones and laptops when they go on business trips to countries like China or Russia and

All big and security-responsible companies issue their employees special phones and laptops when they go on business trips to countries like China or Russia and these are quarantined immediately after they return. They get wiped, X-rayed, disassembled and checked, including any accessory (chargers, mice, etc.). The more critical the field, the more you have to treat those devices as untrusted before attaching them to your trusted zone.

C1sc0cat 8y ago
I would imagine you would treat any kit that has been to those countries as disposable on return and crush them
rcaught 8y ago
Add the USA to that list.
- skj 8y ago
  Are you saying companies should or that you know of companies that do?
  - hutzlibu 8y ago
    As far as I know, big EU companys do that, when they visit US, or they don't have sensitive information with them in the first place.
    - close04 8y ago
      The problem is not the data on the machine, it's that you connect that machine to your trusted network when you're back.
    - laurentl 8y ago
      Especially when border cops can seize your phone / ask for your passwords
  - close04 8y ago
    Some companies certainly do that (in case the question was for me).
  - hef19898 8y ago
    One of the companies named in thr Bloomberg article does. They just deatroy your laptop if it was in the hands of customs without your supervision for any length. US customs explicitly included, which is kind of wierd if you ask me.
    - jyounker 8y ago
      That doesn't strike me as odd at all.
    - close04 8y ago
      That’s perfectly expected. It’s not a stretch of the imagination to think border checks are abused for industrial espionage. If it gives your country a major advantge nothing is off limits these days.
  - lb1lf 8y ago
    My employer - doing lots of interesting engineering in among others the marine and aerospace sectors - certainly do that; we're based in Europe. Basically, any device brought to the US and a number of other countries are issued for one-time use; if they leave our custody for even an instant, they are to be scrapped.
jnbiche 8y ago
> They get wiped, X-rayed, disassembled and checked, including any accessory (chargers, mice, etc.). Given how sophisticated these attacks can be, I'd think they'd issue disposable equipment to be destroyed on return, like a cheap netbook or something. I don't see how you could trust an individual viewing a simple X-ray scan to detect some extra microchip the size of a signal conditioning coupler.
- close04 8y ago
  Procedures change, as attacks get more sophisticated the next step could be disposable devices. But an attack like the one described in this article won't be mitigated by having a disposable device. On the other hand having your laptop "hijacked" while on a business trip will most likely involve some extra PCB or components that are a little more obvious that something that's "built in". Then again many companies or public institutions would find it hard to justify shredding each week maybe tens of laptops and phones that still have to be good enough to work on. Basically they still have to be a "standard issue" device with your company's software stack, config, etc. I'm sure someone can find a good compromise between security and wastefulness.
  - astrange 8y ago
    Does the security team have any motivation to reduce waste? Unless you're finding hacks in your devices already I see no reason to think they aren't just making you jump through hoops because it's funny.
    - close04 8y ago
      Of course not. But remember that someone else is holding their purse strings so they might care about that.
  - a1369209993 8y ago
    The obvious solution would be to earmark some number of dedicated "china laptops" that will never be trusted with anything important, and get reused everytime someone has to visit China. If they get backdoored... who cares? They can only spy on things that were getting spyed on anyway due to being in China.
datavirtue 8y ago
And none of those measures would have protected against the compromise detailed in the article.
- close04 8y ago
  Sure, we were discussing someone saying their devices came with extra PCBs inside (it's a bit hard to follow but scroll up to the original comment, currently first on the page). > We would be getting products from China with added boards to beam credit card information. >> Trying to guess the contents of a box that you cannot open sounds a bit like madness. >>> Use X-ray? or whatever can penetrate the exterior shell 2 different types of attacks, 2 different types of responses.
com2kid 8y ago
> All big and security-responsible companies issue their employees special phones and laptops when they go on business trips to countries like China or Russia From what I understand, Boeing does this when employees visit France. They have had problems with men in nice suits going through laptops stored hotel safes.

C1sc0cat 8y ago

I would imagine you would treat any kit that has been to those countries as disposable on return and crush them

rcaught 8y ago

Add the USA to that list.

skj 8y ago
Are you saying companies should or that you know of companies that do?
- hutzlibu 8y ago
  As far as I know, big EU companys do that, when they visit US, or they don't have sensitive information with them in the first place.
  - close04 8y ago
    The problem is not the data on the machine, it's that you connect that machine to your trusted network when you're back.
  - laurentl 8y ago
    Especially when border cops can seize your phone / ask for your passwords
- close04 8y ago
  Some companies certainly do that (in case the question was for me).
- hef19898 8y ago
  One of the companies named in thr Bloomberg article does. They just deatroy your laptop if it was in the hands of customs without your supervision for any length. US customs explicitly included, which is kind of wierd if you ask me.
  - jyounker 8y ago
    That doesn't strike me as odd at all.
  - close04 8y ago
    That’s perfectly expected. It’s not a stretch of the imagination to think border checks are abused for industrial espionage. If it gives your country a major advantge nothing is off limits these days.
- lb1lf 8y ago
  My employer - doing lots of interesting engineering in among others the marine and aerospace sectors - certainly do that; we're based in Europe. Basically, any device brought to the US and a number of other countries are issued for one-time use; if they leave our custody for even an instant, they are to be scrapped.

jnbiche 8y ago

> They get wiped, X-rayed, disassembled and checked, including any accessory (chargers, mice, etc.). Given how sophisticated these attacks can be, I'd think they'd issue disposable equipment to be destroyed on return, like a cheap netbook or something. I don't see how you could trust an individual viewing a simple X-ray scan to detect some extra microchip the size of a signal conditioning coupler.

close04 8y ago
Procedures change, as attacks get more sophisticated the next step could be disposable devices. But an attack like the one described in this article won't be mitigated by having a disposable device. On the other hand having your laptop "hijacked" while on a business trip will most likely involve some extra PCB or components that are a little more obvious that something that's "built in". Then again many companies or public institutions would find it hard to justify shredding each week maybe tens of laptops and phones that still have to be good enough to work on. Basically they still have to be a "standard issue" device with your company's software stack, config, etc. I'm sure someone can find a good compromise between security and wastefulness.
- astrange 8y ago
  Does the security team have any motivation to reduce waste? Unless you're finding hacks in your devices already I see no reason to think they aren't just making you jump through hoops because it's funny.
  - close04 8y ago
    Of course not. But remember that someone else is holding their purse strings so they might care about that.
- a1369209993 8y ago
  The obvious solution would be to earmark some number of dedicated "china laptops" that will never be trusted with anything important, and get reused everytime someone has to visit China. If they get backdoored... who cares? They can only spy on things that were getting spyed on anyway due to being in China.

datavirtue 8y ago

And none of those measures would have protected against the compromise detailed in the article.

close04 8y ago
Sure, we were discussing someone saying their devices came with extra PCBs inside (it's a bit hard to follow but scroll up to the original comment, currently first on the page). > We would be getting products from China with added boards to beam credit card information. >> Trying to guess the contents of a box that you cannot open sounds a bit like madness. >>> Use X-ray? or whatever can penetrate the exterior shell 2 different types of attacks, 2 different types of responses.

com2kid 8y ago

> All big and security-responsible companies issue their employees special phones and laptops when they go on business trips to countries like China or Russia From what I understand, Boeing does this when employees visit France. They have had problems with men in nice suits going through laptops stored hotel safes.