7 ms·

A little off topic: I think multiple countries should join together to co-sponsor security evaluation labs to check Cisco, Huawei, and all telecom companies. Th

A little off topic: I think multiple countries should join together to co-sponsor security evaluation labs to check Cisco, Huawei, and all telecom companies. These labs should get access to hardware design, software, etc. This can be done in a way that mostly protects individual company’s intellectual property. I suspect that the top telecom tech companies would go along with this idea, to get vetted, if it would help increase their business. Right now there are two European and one Chinese company who can ship 5G gear. I would like all 5G, and older gear also, to be vetted by international security labs.

soared 8y ago
> This /cannot/ be done in a way that mostly protects individual company’s intellectual property /from spilling into other countries hands/ Fixed.
quotz 8y ago
Yeah, the problem is that unlike the EU and US companies, Huawei is just the institutional arm of a communist dictatorship regime masked as a company.
- cup 8y ago
  And CIA seeded companies aren't?
  - quotz 8y ago
    USA is not a communist country, big difference. With political administration changes, also do foreign policy opinions change, along with whatever CIA has to do with foreign sovereignties. One USA regime pardons Manning, another jails him/her. One USA regime bombs Syria, another doesnt. Also, CIA seeded companies are just a few and none of the big ones. Palantir and Oculus are their biggest, not sure Oculus can spy on foreign countries but ok.
    - monocasa 8y ago
      Yeah it's just a coincidence that Cisco can't seem to quit shipping hardcoded root backdoors to their routers... https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
      - olliej 8y ago
        I know right? If you ship horrible security flaws so often, eventually no one will think they're intentional :D Honestly you could probably do it without engineers knowing about it simply by cutting QA and red team budgets. I'm not saying I think that's what happens at Cisco. Having worked at large companies that actively try to ship secure products, and having observed (as a paying end user) the general terrible-ness of networking hardware, that it is more plausible that they're just not being careful - I want to say incompetent by that is likely unfair to the majority of engineers there. Of course nothing says that various gov. agencies in many countries aren't auditing the equipment themselves and making use of flaws without publicizing them.
        monocasa 8y ago
        There's screwing up and having bugs. And then there's leaving in five separate root logins in just in the first half of 2018. Like, come on.
        olliej 8y ago
        the problem with that statement though is that's also what happens with every internet attached device people buy. At this point I would be surprised if an off the shelf IoT/IoS device didn't have at least one root login and RCE via a command line passed in a url.
        monocasa 8y ago
        I'm talking about the big iron that provides core infrastructure to corporate intranets, and the Internet at large. Comparing that to fly by night IoT shovelware is a bit disingenuous, IMO.
  - deleted 8y ago
    [deleted]
  - cfarm 8y ago
    It ultimately comes down to trust. For example, if the Chinese president decided to make a law that they can't demand data from Chinese companies any more, it's not like Trump would roll this back. Similar to Snowden, do you still trust our government isn't spying on us anymore?
theNJR 8y ago
Sort of like UN weapons inspects?
- dylan604 8y ago
  I like that. If we are using vocabulary like Cyber Warfare, Cyber Attacks, and even now seeing actual bombs blowing up buildings as a retaliation of a cyber attack, then why not. Who would be the Scott Ritter of the cyber world? Although, the only people that I'd trust to understand the equipment are the exact people I wouldn't trust with my equipment! ;-)
dajohnson89 8y ago
good idea but it sounds like a highly expensive affair
igravious 8y ago
That's a very good idea. We do it for sensitive stuff like nukes, maybe we should start regarding vital telecoms and networking stuff the same way.

soared 8y ago

> This /cannot/ be done in a way that mostly protects individual company’s intellectual property /from spilling into other countries hands/ Fixed.

quotz 8y ago

Yeah, the problem is that unlike the EU and US companies, Huawei is just the institutional arm of a communist dictatorship regime masked as a company.

cup 8y ago
And CIA seeded companies aren't?
- quotz 8y ago
  USA is not a communist country, big difference. With political administration changes, also do foreign policy opinions change, along with whatever CIA has to do with foreign sovereignties. One USA regime pardons Manning, another jails him/her. One USA regime bombs Syria, another doesnt. Also, CIA seeded companies are just a few and none of the big ones. Palantir and Oculus are their biggest, not sure Oculus can spy on foreign countries but ok.
  - monocasa 8y ago
    Yeah it's just a coincidence that Cisco can't seem to quit shipping hardcoded root backdoors to their routers... https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
    - olliej 8y ago
      I know right? If you ship horrible security flaws so often, eventually no one will think they're intentional :D Honestly you could probably do it without engineers knowing about it simply by cutting QA and red team budgets. I'm not saying I think that's what happens at Cisco. Having worked at large companies that actively try to ship secure products, and having observed (as a paying end user) the general terrible-ness of networking hardware, that it is more plausible that they're just not being careful - I want to say incompetent by that is likely unfair to the majority of engineers there. Of course nothing says that various gov. agencies in many countries aren't auditing the equipment themselves and making use of flaws without publicizing them.
      - monocasa 8y ago
        There's screwing up and having bugs. And then there's leaving in five separate root logins in just in the first half of 2018. Like, come on.
        olliej 8y ago
        the problem with that statement though is that's also what happens with every internet attached device people buy. At this point I would be surprised if an off the shelf IoT/IoS device didn't have at least one root login and RCE via a command line passed in a url.
        monocasa 8y ago
        I'm talking about the big iron that provides core infrastructure to corporate intranets, and the Internet at large. Comparing that to fly by night IoT shovelware is a bit disingenuous, IMO.
- deleted 8y ago
  [deleted]
- cfarm 8y ago
  It ultimately comes down to trust. For example, if the Chinese president decided to make a law that they can't demand data from Chinese companies any more, it's not like Trump would roll this back. Similar to Snowden, do you still trust our government isn't spying on us anymore?

theNJR 8y ago

Sort of like UN weapons inspects?

dylan604 8y ago
I like that. If we are using vocabulary like Cyber Warfare, Cyber Attacks, and even now seeing actual bombs blowing up buildings as a retaliation of a cyber attack, then why not. Who would be the Scott Ritter of the cyber world? Although, the only people that I'd trust to understand the equipment are the exact people I wouldn't trust with my equipment! ;-)

dajohnson89 8y ago

good idea but it sounds like a highly expensive affair

igravious 8y ago

That's a very good idea. We do it for sensitive stuff like nukes, maybe we should start regarding vital telecoms and networking stuff the same way.