3 ms·

It seems wise for the US to ensure that they control major backbones and don't become dependent on critical backbone links owned by (potential) adversaries. Si

It seems wise for the US to ensure that they control major backbones and don't become dependent on critical backbone links owned by (potential) adversaries. Similarly, it's understandable that the Chinese want to start building their own backbone infrastructure so they're cannot be cut off from the world if they end up in a conflict with the U.S.. From that perspective, it makes sense that Huawei would start laying these cables. It can be seen as a defensive move. I've long been wondering whether the Chinese have subverted IP infrastructure hardware, which is all produced in China, often by Chinese companies like TP-Link. How much of that stuff has a kill switch in it that they can activate if a conflict with the West breaks out?

neltnerb 7y ago
I'm kind of skeptical that there's a real risk here too... seems like a simple enough matter to ensure stuff you're worried about security of stays on channels you control right? This doesn't seem like that big a challenge, it sounds like more of a defensive measure than a threat.
dalore 7y ago
But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure. Perhaps the higher end, non-consumer facing, equipment might have it. But for the cheap tp-link devices I highly doubt it.
- whenchamenia 7y ago
  We still have no idea what the Intel ME microcode is, present on almost every pc manufactured. I think it is very possible, plausable, or even likely.
  - dalore 7y ago
    And also the the software that runs embedded in the mobile phone chips (not the phone, but the chips for stuff like GSM/3G etc). And that's why the fight for 5g is important. All the more reason it's not in the cheap TP-Link routers but in the mobile phone chips which can't be examined so easily.
    - the_duke 7y ago
      Why is that? Won't 5G also have dedicated hardware?
      - namibj 7y ago
        There are multiple usable open-source LTE handset software implementations. They work with a suitable SDR like e.g. a LimeSDR or similar. AFAIK not even a single open-source UMTS software implementation works well enough for practical, day-to-day use. More than one of the LTE implementations archived that reliability. They all guzzle power though, IIRC. But that's the easy part (offload ping detection and FEC (de-)coding to an FPGA).
        ignoramous 7y ago
        Are there opensource impl for LTE baseband for smartphones? Which ones? I've heard of OsmocomBB and it is 2G only, IIRC. https://osmocom.org/projects https://osmocom.org/projects
        cedivad 7y ago
        https://github.com/srsLTE/srsLTE https://github.com/srsLTE/srsLTE
        ignoramous 7y ago
        Thanks. I've heard of srs before but failed to notice their ENB project. > srsENB has been tested and validated with the following handsets: LG Nexus 5 and 4 Motorola Moto G4 plus and G5 Huawei P9/P9lite, P10/P10lite, P20/P20lite Huawei dongles: E3276 and E398 That's a very limited set of handsets. I wonder what's stopping them from adding support for more devices: Is it lack of contributors (no traction, lack of interest), or the cost of development (insanely difficult to reverse engineer, potential IP infringement etc), or limited and buggy functionality (doesn't work with certain carriers etc)?
        the_duke 7y ago
- ceejayoz 7y ago
  > But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure. Meltdown was only discovered last year, despite being a vulnerability in virtually all Intel CPUs made since 1995. I suspect there are substantially more eyeballs on Intel, too.
  - lolc 7y ago
    Try building Meltdown on purpose! Who will know? How do they defend design choices to those who can't know? Nobody can afford this in breadth. Granted, you can manufacture a rigged batch and keep it secret. But you can't have a broad capability and expect it to remain secret for long.

neltnerb 7y ago

I'm kind of skeptical that there's a real risk here too... seems like a simple enough matter to ensure stuff you're worried about security of stays on channels you control right? This doesn't seem like that big a challenge, it sounds like more of a defensive measure than a threat.

dalore 7y ago

But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure. Perhaps the higher end, non-consumer facing, equipment might have it. But for the cheap tp-link devices I highly doubt it.

whenchamenia 7y ago
We still have no idea what the Intel ME microcode is, present on almost every pc manufactured. I think it is very possible, plausable, or even likely.
- dalore 7y ago
  And also the the software that runs embedded in the mobile phone chips (not the phone, but the chips for stuff like GSM/3G etc). And that's why the fight for 5g is important. All the more reason it's not in the cheap TP-Link routers but in the mobile phone chips which can't be examined so easily.
  - the_duke 7y ago
    Why is that? Won't 5G also have dedicated hardware?
    - namibj 7y ago
      There are multiple usable open-source LTE handset software implementations. They work with a suitable SDR like e.g. a LimeSDR or similar. AFAIK not even a single open-source UMTS software implementation works well enough for practical, day-to-day use. More than one of the LTE implementations archived that reliability. They all guzzle power though, IIRC. But that's the easy part (offload ping detection and FEC (de-)coding to an FPGA).
      - ignoramous 7y ago
        Are there opensource impl for LTE baseband for smartphones? Which ones? I've heard of OsmocomBB and it is 2G only, IIRC. https://osmocom.org/projects https://osmocom.org/projects
        cedivad 7y ago
        https://github.com/srsLTE/srsLTE https://github.com/srsLTE/srsLTE
        ignoramous 7y ago
        Thanks. I've heard of srs before but failed to notice their ENB project. > srsENB has been tested and validated with the following handsets: LG Nexus 5 and 4 Motorola Moto G4 plus and G5 Huawei P9/P9lite, P10/P10lite, P20/P20lite Huawei dongles: E3276 and E398 That's a very limited set of handsets. I wonder what's stopping them from adding support for more devices: Is it lack of contributors (no traction, lack of interest), or the cost of development (insanely difficult to reverse engineer, potential IP infringement etc), or limited and buggy functionality (doesn't work with certain carriers etc)?
      - the_duke 7y ago
ceejayoz 7y ago
> But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure. Meltdown was only discovered last year, despite being a vulnerability in virtually all Intel CPUs made since 1995. I suspect there are substantially more eyeballs on Intel, too.
- lolc 7y ago
  Try building Meltdown on purpose! Who will know? How do they defend design choices to those who can't know? Nobody can afford this in breadth. Granted, you can manufacture a rigged batch and keep it secret. But you can't have a broad capability and expect it to remain secret for long.