4 ms·
Telecoms equipment from Huawei and others are no different to desktop OSs and consumer IoTs in that they do require software and firmware updates from time to
by rixrax 8y ago
Telecoms equipment from Huawei and others are no different to desktop OSs and consumer IoTs in that they do require software and firmware updates from time to time. And given that these updates come in a form of binary blobs, in some risk scenarios it’s a fair argument that you’re ‘just’ one [‘security’] update away from backdoor running in your system. Damned if you don’t [apply patches], damned if you do [and get more than you bargained for].
Another consideration altogether is what is a backdoor to begin with? A hard coded password? Absolutely! Some other obviously nefarious code that can be proven to be left there for one possible reason only? Absolutely. But what about a buffer overflow kind of programming ‘mistake’ deep in protocol stack that just happened to be missed by QA? Most of the telecoms gear highly likely is running SW written in memory unsafe languages and runs on OSes lacking [many of the] modern protections such as w^x or aslr. I think it would be hard to definitively say if these were left in intentionally with someone possessing ready made exploit, or just because of mistake.
So when we talk about evidence of backdoor, it’s as usual, not a simple black and white yes or no question. It’s more of a risk question, with a twist of international power plays.
- FooHentai 8y agoAlso fundamentally you can look at it like this: If I (as a nation-state) had the ability to embed a kill switch embedded into the telecoms hardware on which other nations depend, and over which I had exclusive knowledge and control, would it be in my interests to do that? Of course it would. Irrespective of which nation state we're talking about that's a Good Idea. Also, technically such a backdoor capability is almost undetectable (down to a sub-microcode analysis level), as per the Ken Thompson compiler hack.
- nneonneo 8y agoIt doesn’t even need to be a killswitch. If the hardware checks firmware signatures (as it reasonably should), then I can just hold a critical patch hostage. You can’t patch against some nasty bug until $DEMAND is met - and meanwhile I can sell the exploit to some other enemy of yours and let them have fun with your systems.
- burtonator 8y agoI was thinking that there might need to be some strategy for punishing 'too big to fail' companies that do nasty tricks like this. We can't just boycott because these companies are too big to fail often. I was thinking about some sort of Etherium based capital escrow. Basically every device you purchase has like a reward on it that's backed by capital in a wallet that Hauwei would purchase. It's theirs and their can earn interest on it BUT it's also backed by a smart contract.' If the customers all agree that their routers have been rooted they can unlock the wallet and take the money from Huawei effectively punishing them. ... this is just my rough thinking for now.