11 ms·
NSA-style backdoor in Huawei laptops found by Microsoft
- mikejb 8y agoFor the record, this is the article from Microsoft Security: https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/ https://www.microsoft.com/security/blog/2019/03/25/from-aler...
- snazz 8y agoAlso, 5 days ago: https://news.ycombinator.com/item?id=19567399 https://news.ycombinator.com/item?id=19567399
- deleted 8y ago[deleted]
- Someone1234 8y agoWhere they don't describe it as a "backdoor." Simply what it is: A local privilege escalation in a driver. Privilege escalations aren't that rare unfortunately. Kind of cool that ATP might be able to detect some of them going forward, particularly in drivers that are often black-boxes.
- wallace_f 8y agoI have no expertise in security. Why could nation states not just build their backdoors this way? What's the difference?
- Someone1234 8y agoThis isn't a backdoor, nation state or otherwise. LPEs are super boring and common, there's often several a month discovered on Windows (inc. third party services/software/drivers/etc). For it to be a backdoor it would typically need to facilitate the ability to access the system itself (e.g. Remote code execution, hidden credentials, etc), but even then intent is implied with the word which we simply don't have here. Plus it LPEs aren't as powerful as they once were. Most of the good stuff is now running in userspace, the only thing a LPE grants you is persistence. To give you an idea of how overblown this is: HP used to run a local webserver as SYSTEM (highest priv) which any webpage could call via iFrame to execute local commands. I don't consider that a backdoor either, even though that issue is ten times more serious than this one.
- shawnz 8y agoFearmongering. They clearly state in the article that there is no evidence that this is a backdoor. There is no new information here compared to the detailed writeup which was already posted here last week.
- sjroot 8y agoCan you link to the article you are referring to? Edit: https://news.ycombinator.com/item?id=19567399 https://news.ycombinator.com/item?id=19567399
- luxuryballs 8y agowhat you’re saying is what? we don’t know if it was intentional or not?
- deleted 8y ago[deleted]
- KerrickStaley 8y agoThe title of this article is misleading. "Backdoor" implies a deliberate mechanism built into the software, but here there's no evidence that the vulnerability wasn't simply a mistake.
- throwaway8879 8y agoIt's China. I'm not American and don't have a dog in this fight, but I'm inclined to believe that the Chinese are never up to any good.
- AYBABTME 8y agoThat's straight up racist.
- lawnchair_larry 8y agoIt has nothing to do with race. Stop throwing around that word.
- shawnz 8y agoI assume they meant the Chinese government, not the Chinese people.
- AYBABTME 8y agoThe real problem here isn't that this company is Western or from China, it's that all this stuff relies on trusting humans to have done due diligence on our behalf, without having means to verify. It's closed source junkware on a closed source OS.
- tedunangst 8y agoHow many backdoor styles are there?
- haberman 8y agoIs this any different than any other jailbreak bug that has ever been discovered? https://en.wikipedia.org/wiki/IOS_jailbreaking#History_of_exploit-disabling_patch_releases https://en.wikipedia.org/wiki/IOS_jailbreaking#History_of_ex...
- chapium 8y agoThis is why government should use open source.
- everdrive 8y agoWhat exactly is an "NSA-style" backdoor?
- auiya 8y agoA click-bait phrase you insert in a headline when you want to be needlessly hyperbolic and have no idea what you're talking about.
- cjbprime 8y agoFlagged for title: there's no evidence it was a backdoor rather than some subtly insecure driver programming.
- ProAm 8y agoI mean if the US government spies on us and we don't care, why would we care if China does? Same same?
- earenndil 8y ago> the US government spies on us and we don't care I care.
- manofmanysmiles 8y agoThis is far from a complete answer, but consider Psychological Warfare [1]. With vast amounts of "boring" data about people's preferences in movies, music, friends, choice of words in messages, an actor can construct psychological profiles of individuals and populations and use those to manipulate people. This is exactly what the Cambridge Analytica "scandal" is about. Individually, you may have nothing to hide, but in aggregate, the data is rather powerful. [1] https://en.wikipedia.org/wiki/Psychological_warfare https://en.wikipedia.org/wiki/Psychological_warfare I also just dug up another article about Big Data and PSYOPS. https://www.nybooks.com/daily/2018/03/21/the-digital-military-industrial-complex/ https://www.nybooks.com/daily/2018/03/21/the-digital-militar...
- dlivingston 8y ago> In short, having a Looks like China got him before he could finish typing
- ryanlol 8y agoSo how exactly is China supposed to go about spying on people using a LPE backdoor?
- kansface 8y agoThe US government spies on you to prevent the next 9/11 so it goes. China spies on you to steal your IP to give to its native businesses. You should probably care about the later far more than the former.
- 8y ago
- ryanlol 8y agoNSA-style backdoor for LPE? Bullshit.
- jchw 8y agoIs there any irony in describing it as an "NSA-style backdoor"? I mean, from a context of fearing Chinese espionage. Not sure what my opinion is, but that stuck out to me.
- rrggrr 8y agoAmend US law so there is CIVIL LIABILITY for backdoors with substantial statutory damages. The Tort bar in the US will make quick work of this and the problem will diminish, possibly cease. Also, while I'm at it, it would be nice if Unbox Therapy and other like it would make mention of the Botnet threat in their product reviews.
- ipsum2 8y ago> it would be nice if Unbox Therapy and other like it would make mention of the Botnet threat in their product reviews Do you expect Youtubers to have a top-class security team to reverse engineer firmware? This was discovered weeks/months later after the product was released.
- ryanlol 8y agoSo what kind of statutory damages would you deem appropriate for LPE backdoors? How do you differentiate between backdoors and bugs?
- jfk13 8y agoGood luck coming up with a legally-watertight definition of "backdoors" as distinct from "bugs", and proving which category any given flaw belongs to. Or do you want civil liability with substantial damages for every bug that might ever be exploited?
- OrgNet 8y agoIf you can prove somehow that it is a backdoor and not a bug, there should be CRIMINAL LIABILITY.
- chris_mc 8y agoI guess this is "Red Scare 2.0"? Is it? I'm not sure whether to worry about China or not, I feel like all my worry is driven by the political forces in the USA and Europe rather than facts. It seems so one-sided that "China is Evil" that I feel like I'm being duped. I love my Huawei watch, but I've stopped using it because of the fear of spying, even if I don't have facts to support the fear. I don't trust nearly any source to properly vet this information, how can I? Is this all a ploy to take down China as a growing world power to save the America-Europe hegemony? I feel like at this point, I don't see a ton of difference between the two, both torture people (America's war on "terror"), both are committing genocide (America's ICE separating families), both are spying like crazy on the other, etc.
- dlivingston 8y agoDespite the fervor, I haven't seen anything that indicates that Huawei is necessarily malicious. I have seen, though, many things that indicate that their dev practices just plain suck - and that alone is enough for me not to buy their products. EDIT: Also, that's a major false equivalence.
- chris_mc 8y agoYes their watch was okay but their software sucked. I think it's more likely China has spies within Huawei rather than Huawei being a literal intelligence operation. American engineers generally balk at inserting backdoors, why wouldn't Chinese engineers?
- ssnistfajen 8y ago>Upon investigation, researchers found a driver containing components that run with ring-0 privileges in the kernel. >"We traced the anomalous behaviour to a device management driver developed by Huawei," researchers said in the post. "Digging deeper, we found a lapse in the design that led to a vulnerability that could allow local privilege escalation." >Researchers who reported the vulnerability to Huawei said the company responded and cooperated quickly and professionally. A patch was released earlier this year on 19 January. A rather clickbait-y title for what actually happened. Of course though, rehashed old news is great for harvesting karma when it's the right bogeyman.
- ChuckMcM 8y agoKarma aspersions aside :-) It does sound like "manufacturer driver has an exploit", gets reported, exploit gets fixed. Wrapped around a completely different narrative where an intelligence service 'diverts' a delivery and installs an exploit. Reminding us once again that as far as has been documented in the open media the US is the only country that has been identified as having done this. Sadly this is Tony Morbin's modus operandi.[1] That said, two nice takeaways, one the standard tools that Microsoft shipts found a problem, and the vendor quickly patched it. Both of those things are good news. [1] https://www.scmagazine.com/author/tony-morbin/ https://www.scmagazine.com/author/tony-morbin/
- djsumdog 8y agoI wonder what the lapse in design was. It'd be nice of Huawei disclosed what type of security vulnerability it was and how they fixed it.
- monocasa 8y agoMicrosoft has a good write up on the flaw at least. https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/ https://www.microsoft.com/security/blog/2019/03/25/from-aler...
- criddell 8y agoMaybe they named the key _NSAKEY which created a namespace collision with a totally non-NSA key that Microsoft added years ago. Just in case you hadn't already seen this: https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY
- AJRF 8y agoThe past few articles i've read about Huawei - (The British Code review article from the Register and this) make it sound like the US is dressing what is actually incompetence as malicious intent because a) Trade war b) Chinese boogeyman makes US companies look better? The double-think of the rhetoric against Huawei is staggering considering US programs like Prism were state-mandated data collection at a massive scale against private citizens and a secret courts program to access private sector companies data on those same citizens.
- saas_sam 8y agoSlight difference in that the Chinese government routinely disappears political dissidents while in the U.S. we give them talk shows.
- ska 8y agoIt isn't an either or question though. Chinese govt behavior being worse doesn't mean US govt behavior isn't bad, and shouldn't be called out. The current rash of scripted pearl clutching about Huawei etc. is nothing if not disingenuous... so it's fair to call that out too. [edit] to clarify about the "disengenous" part. It's not about saying "This is bad", it's about saying "This is bad, we would never do anything like that, can you believe it, what evil people" when in fact it is something you do, or have done, and given the chance will probably do again. This obviously doesn't cover all of the bad behavior of Chinese govt, but it certainly does some. Saying "we caught out country X doing something we don't like but also do to them" maybe doesn't have the same ring to it, but has the advantage of being honest.
- saas_sam 8y agoI don't understand. You either think it's legitimate to call out bad behavior (US or Chinese) or you think doing so is disingenuous pearl-clutching. Is it only pearl-clutching when it's about the far worse behavior of the Chinese gov't? Or are you advocating for a constant apologizing for US misdeeds any time another countries' misdeeds are raised, even if that other countries' are far worse...?
- seppin 8y agoWhat's the difference between a vulnerability shared with China's intelligence agencies and a bug? Deniability I guess. I guess US intel yelling at the top of their lungs this has and will happen isn't enough for some.
- alexeiz 8y agoI'm shocked, shock to find all the hacking going on here! Seriously, I'm not even surprised. Whether it's intentional or not doesn't matter. Huawei pays a lot for advertising to all popular laptop reviewers on Youtube. But I'm not even considering buying Huawei laptops because I'm pretty sure it's full of crap like this.