20 ms·

> Specifically, on top of Japan, the U.S. and Australia, cables connected to NATO members should be off-limits to Huawei. I don't understand this at all... if

> Specifically, on top of Japan, the U.S. and Australia, cables connected to NATO members should be off-limits to Huawei. I don't understand this at all... if the communications across the cable are properly secured then it shouldn't matter what cables it runs across.

lallysingh 7y ago
These aren't military links. Lots of stuff is unencrypted or shittily so.
- jsty 7y ago
  Surely a few potential snooping countries have the capabilities to tap seabed fibre by now, and we'd be better served having carriers add encryption at the link level regardless of who laid the cable.
  - lallysingh 7y ago
    The carriers would get subpoena/NSL'd in a heartbeat
glitchc 7y ago
Huh? Are you kidding? Each cable bundle can transmit petabytes of data per second. Think of all the Netflix movies being watched in Japan and Australia transmitted over that cable. Why would anyone encrypt that? Furthermore, the hardware required to encrypt, even if feasible (and that’s unclear), would be astronomical in cost. Plus, it’s not just about access. A malicious actor could always damage or destroy the cable, cutting off a primary channel of communications.
- SoReadyToHelp 7y ago
  "Encryption is so expensive!" cries the 1990s
  - glitchc 7y ago
    ... you must be a front-end developer.
    - Jonnax 7y ago
      You don't seem to know what you're talking about. 1) A user wouldn't stream Netflix from a data centre in America. It would be local to the country on the Netflix CDN 2) The stream is encrypted. Firstly with whatever DRM the video uses then with TLS. 3) The majority of internet traffic is encrypted. It doesn't matter too much if the transport over fibre isn't. 4) If someone cared about security they would uses VPN where they had control over both sides.
      - siffland 7y ago
        You are correct Netflix goes out of their way to reduce netowrk traffic. https://openconnect.netflix.com/ https://openconnect.netflix.com/ This is a pretty good read, albiet a few years old. https://gizmodo.com/this-box-can-hold-an-entire-netflix-1592590450 https://gizmodo.com/this-box-can-hold-an-entire-netflix-1592...
    - silverfox17 7y ago
      The vast majority of data sent over these cables will be encrypted. It's all normal day-to-day traffic.
    - HeWhoLurksLate 7y ago
      woooosh
- ac29 7y ago
  That's a lousy example because Netflix movies are definitely encrypted.
  - ceejayoz 7y ago
    They're also almost always served via a local CDN node. A million Australians watching the latest Game of Thrones episodes probably means a couple dozen transfers of that file across the Pacific, not a million. If you're an ISP, Netflix will even send you (free!) servers for this. https://openconnect.netflix.com/en/ https://openconnect.netflix.com/en/
    - HeWhoLurksLate 7y ago
      > If you're an ISP, Netflix will even send you (free!) servers for this. startyourownisp.com I think this might be a bit much for getting some freebies. It would be fun, though. Unfortunately, it would take me a lot of work in the place I'm at for this to make any sense at all.
      - Operyl 7y ago
        You’d have to prove that it’d be beneficial bandwidth wise, which seems unlikely.
- dalore 7y ago
  Setting up an asymmetrical encryption channel can be hard (and expensive). But once it's set up it moves to a cheaper faster symmetrical encryption which rotates the keys. There are dedicated chips for this encryption that it barely takes any processing power at all. Also note that would be the backbone encryption channels, but inside those people would be using https which is encryption further up the networking stack. It's encrypted turtles all the way down.
envy2 7y ago
The concern is less about traffic interception and more about being able to sever / significantly undermine a country's ability to communicate during, for instance, time of war. This is also largely where the 5G infra concerns come from.
- contingencies 7y ago
  The internet was literally designed to solve this problem.
  - woliveirajr 7y ago
    yes, but doesn't as it is used nowadays. Few and big backbones are responsable for almost all traffic. Few and big CDNs serving most of the contents that are used by everybody. Even few apps are "essential" for daily life. Big money was/is created when internet become business as usual: few and big corps taking the biggest share.
    - mamon 7y ago
      Big backbones are only needed for commercial traffic, like Netflix. If it comes to war, I think the first thing US government will do is it will force all ISPs to cut off private network connections in order to 1) save the bandwith 2) stop spreading of inconvenient news.
the_watcher 7y ago
> if the communications across the cable are properly secured I think the history of human communications is an ample demonstration of why this is a poor assumption.
sp332 7y ago
Are you thinking of encryption or something? Because that doesn't prevent an eavesdropper knowing how much data was transferred, to and from whom, and when. That could all be sensitive information.
- nickpsecurity 7y ago
  The Five Eyes governments have access to Layer 2 and 3 encryptors for site-to-site protection rated by their security services to be way more secure than most stuff out there. They also have ability to do constant transmission of packets to hide metadata. Only Defense organizations are allowed to buy them. They can buy and deploy them if concerned about untrusted intermediaries. When they don't usually means something else is the problem.
  - JumpCrisscross 7y ago
    > Only Defense organizations are allowed to buy them Source? Encryption has not been treated as a munition by the United States since the 90s.
    - nickpsecurity 7y ago
      That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requirements for RNG's, assuring implementations, failing safe, side channel mitigation, etc. NSA puts them through rigorous pentesting. If NSA cant hack it, then it gets approved to protect Defense assets. There's strong controls on handling the hardware and key systems. Feel free to try to buy NSA's Inline Media Encryptor or General Dynamics Type 1 encryptors. They'll tell you that you can't buy it. Go try. Ask them for a HAIPE implementation while you're at it. I hope you prove me wrong. Far as export, I looked into that in 2014. I found that only a few things, like mass market and ecommerce, got reclassified. High-assurance systems (EAL6/7) they couldnt hack were still munitions. So were custom crypto and some other things. People got fooled: NSA reclassified just the stuff they'd be able to hack anyway. Big progress but not what people thought. https://www.schneier.com/blog/archives/2014/11/the_return_of_c.html#c6682917 https://www.schneier.com/blog/archives/2014/11/the_return_of... They tried to pull more crap about a year after I wrote that: https://www.computerworld.com/article/2925339/us-proposes-tighter-export-rules-for-computer-security-tools.html https://www.computerworld.com/article/2925339/us-proposes-ti... I don't know what current state of affairs is. I assume they've set it up where they can deny selectively if they feel the need to. So far, most "security" products are too insecure for them to need to do that.
kop316 7y ago
The issue is probably availability. Assuming Huawei to be an adversary, if they have control of communications, they can decide to drop all packets (or slow or drop some, etc.). This would wreck plenty of havoc on communications.
- thinkling 7y ago
  It seems wise for the US to ensure that they control major backbones and don't become dependent on critical backbone links owned by (potential) adversaries. Similarly, it's understandable that the Chinese want to start building their own backbone infrastructure so they're cannot be cut off from the world if they end up in a conflict with the U.S.. From that perspective, it makes sense that Huawei would start laying these cables. It can be seen as a defensive move. I've long been wondering whether the Chinese have subverted IP infrastructure hardware, which is all produced in China, often by Chinese companies like TP-Link. How much of that stuff has a kill switch in it that they can activate if a conflict with the West breaks out?
  - neltnerb 7y ago
    I'm kind of skeptical that there's a real risk here too... seems like a simple enough matter to ensure stuff you're worried about security of stays on channels you control right? This doesn't seem like that big a challenge, it sounds like more of a defensive measure than a threat.
  - dalore 7y ago
    But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure. Perhaps the higher end, non-consumer facing, equipment might have it. But for the cheap tp-link devices I highly doubt it.
    - whenchamenia 7y ago
      We still have no idea what the Intel ME microcode is, present on almost every pc manufactured. I think it is very possible, plausable, or even likely.
edejong 7y ago
Confidentiality, integrity and availability. Those are the components of a secure system. Crypto provides the first two. But what about the third?
- thaumasiotes 7y ago
  The third is a lot less important and doesn't call for the same approaches as the first two. If availability is compromised, that is obvious to the end user(s).
  - gsich 7y ago
    It's still important. Otherwise you get statements like: "the most secure computer is one that isn't turned on" like that wouldn't be obvious.
    - thaumasiotes 7y ago
      That statement is correct, obviously, and its wisdom is actually implemented in things like network segmentation, air gaps, and cold wallets. Availability is still important, but, as I said, much less important than integrity. (The importance of confidentiality varies.) And having a problem you know about is pretty much always a significant upgrade compared to having a problem you don't know about.
  - edejong 7y ago
    None of them are less important. All three need to be present in order for a system to be secure. Especially when it comes to attacking infrastructure, removing the availability of operations on this infrastructure is a good attack vector. This can be done by, for example, creating a temporary ban on logging in. It can be done by reporting a hacking attempt from the legitimate IP address range.
Spooky23 7y ago
I'd assume that "properly secured" isn't meaningful for large state actors. The US spent billions routing international telecom infrastructure through US and allied points of presence for a reason.
- phkahler 7y ago
  And they really dont want anyone using good end to end e encryption for the same reason ;-)
windexh8er 7y ago
It's not just the cable plant but also the transport gear that are the add/drop points for their OSN/OTN. I feel like the article fails to expose this. When the first active element in an optical network is Huawei they can choose to siphon (or worse?) optical lambdas at will. Platforms like this are common for submarine applications: http://carrier.huawei.com/en/products/fixed-network/transmission/wdm-otn/osn8800 http://carrier.huawei.com/en/products/fixed-network/transmis...
- wbl 7y ago
  Which shouldn't matter. The network is untrusted.
  - late2part 7y ago
    Maybe. The !00g lambdas can be trivially encrypted end to end.
  - windexh8er 7y ago
    I'd generally agree with you but network position carries a weight and value. Being at the crux of a NAP has significant "free" upside meaning that I can easily DoS any downstream on the network and subjectively block, throttle, and generally impede others at will. I can also still easily manipulate critical services such as DNS, BGP and others as well as use my position for intelligence gathering and masquerading. Just because we shouldn't trust the network doesn't mean other services have the luxury of strong crypto.
tyingq 7y ago
Remember "ssl added and removed here"? https://arstechnica.com/tech-policy/2013/10/new-docs-show-nsa-taps-google-yahoo-data-center-links/ https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...
- arcticfox 7y ago
  That cheeky smiley face gets me every time
  - erklik 7y ago
    Also how they quickly defined GFE to be Google Front End.
- mda 7y ago
  Not anymore though. Everything is encrypted now.
  - tyingq 7y ago
    Everything escalates, including the NSA's capabilities...
  - _ink_ 7y ago
    DNS isn't. And BGP is utterly insecure.
    - baroffoos 7y ago
      DNS over https is becoming more common now firefox is using it.
      - Benjamin_Dobell 7y ago
        Also, if you've got a ASUS router, check out Merlin (after market) firmware, which recently added support for DNS-over-TLS. It works quite well.
    - 7y ago
megaremote 7y ago
Right. And it doesn't matter if the burglars have keys to your house if they don't know the alarm code, right?
_bxg1 7y ago
At a certain point you place trust in SSL certificate authorities. Couldn't a company that runs the infrastructure itself spoof IP addresses and man-in-the-middle everything?
- munchbunny 7y ago
  What do you mean by that? Like a country redirects DNS resolution to their own controlled IP's and gets one of their CA's to issue duplicate certs? That could certainly happen and would be devastatingly effective until other people catch on. Spoofing IP's alone isn't enough, but CA infrastructure is very much based on a trust that is weaker than we'd like to admit.
_ink_ 7y ago
If it were properly encrypted it might be negitible. But DNS for instance still isn't. And the BGP is completly broken. There was a case recently where someone used BGP to redirect users of myetherwallet to steal their coins. They failed to obtain a SSL certificate so the users could have noticed. But with a more sufisticated attacker I think the average user has no chance to detect such an attack.
thelittleone 7y ago
Being "properly secured" isn't as simple as it seems because it's not a matter of simply securing against today's threats, but for those in the future, for as long as those communications need to remain secret. It's possible, perhaps even likely that all communications would be recorded for decryption later when if / new techniques become available.
frozenport 7y ago
They can cut the cables or slow down traffic.

lallysingh 7y ago

These aren't military links. Lots of stuff is unencrypted or shittily so.

jsty 7y ago
Surely a few potential snooping countries have the capabilities to tap seabed fibre by now, and we'd be better served having carriers add encryption at the link level regardless of who laid the cable.
- lallysingh 7y ago
  The carriers would get subpoena/NSL'd in a heartbeat

glitchc 7y ago

Huh? Are you kidding? Each cable bundle can transmit petabytes of data per second. Think of all the Netflix movies being watched in Japan and Australia transmitted over that cable. Why would anyone encrypt that? Furthermore, the hardware required to encrypt, even if feasible (and that’s unclear), would be astronomical in cost. Plus, it’s not just about access. A malicious actor could always damage or destroy the cable, cutting off a primary channel of communications.

SoReadyToHelp 7y ago
"Encryption is so expensive!" cries the 1990s
- glitchc 7y ago
  ... you must be a front-end developer.
  - Jonnax 7y ago
    You don't seem to know what you're talking about. 1) A user wouldn't stream Netflix from a data centre in America. It would be local to the country on the Netflix CDN 2) The stream is encrypted. Firstly with whatever DRM the video uses then with TLS. 3) The majority of internet traffic is encrypted. It doesn't matter too much if the transport over fibre isn't. 4) If someone cared about security they would uses VPN where they had control over both sides.
    - siffland 7y ago
      You are correct Netflix goes out of their way to reduce netowrk traffic. https://openconnect.netflix.com/ https://openconnect.netflix.com/ This is a pretty good read, albiet a few years old. https://gizmodo.com/this-box-can-hold-an-entire-netflix-1592590450 https://gizmodo.com/this-box-can-hold-an-entire-netflix-1592...
  - silverfox17 7y ago
    The vast majority of data sent over these cables will be encrypted. It's all normal day-to-day traffic.
  - HeWhoLurksLate 7y ago
    woooosh
ac29 7y ago
That's a lousy example because Netflix movies are definitely encrypted.
- ceejayoz 7y ago
  They're also almost always served via a local CDN node. A million Australians watching the latest Game of Thrones episodes probably means a couple dozen transfers of that file across the Pacific, not a million. If you're an ISP, Netflix will even send you (free!) servers for this. https://openconnect.netflix.com/en/ https://openconnect.netflix.com/en/
  - HeWhoLurksLate 7y ago
    > If you're an ISP, Netflix will even send you (free!) servers for this. startyourownisp.com I think this might be a bit much for getting some freebies. It would be fun, though. Unfortunately, it would take me a lot of work in the place I'm at for this to make any sense at all.
    - Operyl 7y ago
      You’d have to prove that it’d be beneficial bandwidth wise, which seems unlikely.
dalore 7y ago
Setting up an asymmetrical encryption channel can be hard (and expensive). But once it's set up it moves to a cheaper faster symmetrical encryption which rotates the keys. There are dedicated chips for this encryption that it barely takes any processing power at all. Also note that would be the backbone encryption channels, but inside those people would be using https which is encryption further up the networking stack. It's encrypted turtles all the way down.

envy2 7y ago

The concern is less about traffic interception and more about being able to sever / significantly undermine a country's ability to communicate during, for instance, time of war. This is also largely where the 5G infra concerns come from.

contingencies 7y ago
The internet was literally designed to solve this problem.
- woliveirajr 7y ago
  yes, but doesn't as it is used nowadays. Few and big backbones are responsable for almost all traffic. Few and big CDNs serving most of the contents that are used by everybody. Even few apps are "essential" for daily life. Big money was/is created when internet become business as usual: few and big corps taking the biggest share.
  - mamon 7y ago
    Big backbones are only needed for commercial traffic, like Netflix. If it comes to war, I think the first thing US government will do is it will force all ISPs to cut off private network connections in order to 1) save the bandwith 2) stop spreading of inconvenient news.

the_watcher 7y ago

> if the communications across the cable are properly secured I think the history of human communications is an ample demonstration of why this is a poor assumption.

sp332 7y ago

Are you thinking of encryption or something? Because that doesn't prevent an eavesdropper knowing how much data was transferred, to and from whom, and when. That could all be sensitive information.

nickpsecurity 7y ago
The Five Eyes governments have access to Layer 2 and 3 encryptors for site-to-site protection rated by their security services to be way more secure than most stuff out there. They also have ability to do constant transmission of packets to hide metadata. Only Defense organizations are allowed to buy them. They can buy and deploy them if concerned about untrusted intermediaries. When they don't usually means something else is the problem.
- JumpCrisscross 7y ago
  > Only Defense organizations are allowed to buy them Source? Encryption has not been treated as a munition by the United States since the 90s.
  - nickpsecurity 7y ago
    That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requirements for RNG's, assuring implementations, failing safe, side channel mitigation, etc. NSA puts them through rigorous pentesting. If NSA cant hack it, then it gets approved to protect Defense assets. There's strong controls on handling the hardware and key systems. Feel free to try to buy NSA's Inline Media Encryptor or General Dynamics Type 1 encryptors. They'll tell you that you can't buy it. Go try. Ask them for a HAIPE implementation while you're at it. I hope you prove me wrong. Far as export, I looked into that in 2014. I found that only a few things, like mass market and ecommerce, got reclassified. High-assurance systems (EAL6/7) they couldnt hack were still munitions. So were custom crypto and some other things. People got fooled: NSA reclassified just the stuff they'd be able to hack anyway. Big progress but not what people thought. https://www.schneier.com/blog/archives/2014/11/the_return_of_c.html#c6682917 https://www.schneier.com/blog/archives/2014/11/the_return_of... They tried to pull more crap about a year after I wrote that: https://www.computerworld.com/article/2925339/us-proposes-tighter-export-rules-for-computer-security-tools.html https://www.computerworld.com/article/2925339/us-proposes-ti... I don't know what current state of affairs is. I assume they've set it up where they can deny selectively if they feel the need to. So far, most "security" products are too insecure for them to need to do that.

kop316 7y ago

The issue is probably availability. Assuming Huawei to be an adversary, if they have control of communications, they can decide to drop all packets (or slow or drop some, etc.). This would wreck plenty of havoc on communications.

thinkling 7y ago
It seems wise for the US to ensure that they control major backbones and don't become dependent on critical backbone links owned by (potential) adversaries. Similarly, it's understandable that the Chinese want to start building their own backbone infrastructure so they're cannot be cut off from the world if they end up in a conflict with the U.S.. From that perspective, it makes sense that Huawei would start laying these cables. It can be seen as a defensive move. I've long been wondering whether the Chinese have subverted IP infrastructure hardware, which is all produced in China, often by Chinese companies like TP-Link. How much of that stuff has a kill switch in it that they can activate if a conflict with the West breaks out?
- neltnerb 7y ago
  I'm kind of skeptical that there's a real risk here too... seems like a simple enough matter to ensure stuff you're worried about security of stays on channels you control right? This doesn't seem like that big a challenge, it sounds like more of a defensive measure than a threat.
- dalore 7y ago
  But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure. Perhaps the higher end, non-consumer facing, equipment might have it. But for the cheap tp-link devices I highly doubt it.
  - whenchamenia 7y ago
    We still have no idea what the Intel ME microcode is, present on almost every pc manufactured. I think it is very possible, plausable, or even likely.

edejong 7y ago

Confidentiality, integrity and availability. Those are the components of a secure system. Crypto provides the first two. But what about the third?

thaumasiotes 7y ago
The third is a lot less important and doesn't call for the same approaches as the first two. If availability is compromised, that is obvious to the end user(s).
- gsich 7y ago
  It's still important. Otherwise you get statements like: "the most secure computer is one that isn't turned on" like that wouldn't be obvious.
  - thaumasiotes 7y ago
    That statement is correct, obviously, and its wisdom is actually implemented in things like network segmentation, air gaps, and cold wallets. Availability is still important, but, as I said, much less important than integrity. (The importance of confidentiality varies.) And having a problem you know about is pretty much always a significant upgrade compared to having a problem you don't know about.
- edejong 7y ago
  None of them are less important. All three need to be present in order for a system to be secure. Especially when it comes to attacking infrastructure, removing the availability of operations on this infrastructure is a good attack vector. This can be done by, for example, creating a temporary ban on logging in. It can be done by reporting a hacking attempt from the legitimate IP address range.

Spooky23 7y ago

I'd assume that "properly secured" isn't meaningful for large state actors. The US spent billions routing international telecom infrastructure through US and allied points of presence for a reason.

phkahler 7y ago
And they really dont want anyone using good end to end e encryption for the same reason ;-)

windexh8er 7y ago

It's not just the cable plant but also the transport gear that are the add/drop points for their OSN/OTN. I feel like the article fails to expose this. When the first active element in an optical network is Huawei they can choose to siphon (or worse?) optical lambdas at will. Platforms like this are common for submarine applications: http://carrier.huawei.com/en/products/fixed-network/transmission/wdm-otn/osn8800 http://carrier.huawei.com/en/products/fixed-network/transmis...

wbl 7y ago
Which shouldn't matter. The network is untrusted.
- late2part 7y ago
  Maybe. The !00g lambdas can be trivially encrypted end to end.
- windexh8er 7y ago
  I'd generally agree with you but network position carries a weight and value. Being at the crux of a NAP has significant "free" upside meaning that I can easily DoS any downstream on the network and subjectively block, throttle, and generally impede others at will. I can also still easily manipulate critical services such as DNS, BGP and others as well as use my position for intelligence gathering and masquerading. Just because we shouldn't trust the network doesn't mean other services have the luxury of strong crypto.

tyingq 7y ago

Remember "ssl added and removed here"? https://arstechnica.com/tech-policy/2013/10/new-docs-show-nsa-taps-google-yahoo-data-center-links/ https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...

arcticfox 7y ago
That cheeky smiley face gets me every time
- erklik 7y ago
  Also how they quickly defined GFE to be Google Front End.
mda 7y ago
Not anymore though. Everything is encrypted now.
- tyingq 7y ago
  Everything escalates, including the NSA's capabilities...
- _ink_ 7y ago
  DNS isn't. And BGP is utterly insecure.
  - baroffoos 7y ago
    DNS over https is becoming more common now firefox is using it.
    - Benjamin_Dobell 7y ago
      Also, if you've got a ASUS router, check out Merlin (after market) firmware, which recently added support for DNS-over-TLS. It works quite well.
  - 7y ago

megaremote 7y ago

Right. And it doesn't matter if the burglars have keys to your house if they don't know the alarm code, right?

_bxg1 7y ago

At a certain point you place trust in SSL certificate authorities. Couldn't a company that runs the infrastructure itself spoof IP addresses and man-in-the-middle everything?

munchbunny 7y ago
What do you mean by that? Like a country redirects DNS resolution to their own controlled IP's and gets one of their CA's to issue duplicate certs? That could certainly happen and would be devastatingly effective until other people catch on. Spoofing IP's alone isn't enough, but CA infrastructure is very much based on a trust that is weaker than we'd like to admit.

_ink_ 7y ago

If it were properly encrypted it might be negitible. But DNS for instance still isn't. And the BGP is completly broken. There was a case recently where someone used BGP to redirect users of myetherwallet to steal their coins. They failed to obtain a SSL certificate so the users could have noticed. But with a more sufisticated attacker I think the average user has no chance to detect such an attack.

thelittleone 7y ago

Being "properly secured" isn't as simple as it seems because it's not a matter of simply securing against today's threats, but for those in the future, for as long as those communications need to remain secret. It's possible, perhaps even likely that all communications would be recorded for decryption later when if / new techniques become available.

frozenport 7y ago

They can cut the cables or slow down traffic.