4 ms·

Well, the specific concern is that all new tech ships with OTA update capability. Infrastructure should probably never have this in the first place for a varie

Well, the specific concern is that all new tech ships with OTA update capability. Infrastructure should probably never have this in the first place for a variety of reasons, but it does and it will because the of huge cost savings it can enable. When the Chinese government can tightly control the companies under it, and those companies control the OTA update, then nothing produced by those companies can ever be considered safe so longer as China is considered adversarial. The same could absolutely be said about US made products being used in countries that the USA is adversarial against, and that's likely how the USA government started thinking about it. "Hey, what's a great way to deal with China if we go to war? Whataminute, they could do that to US!" Just look at the havoc that has happened unintentionally due to bad updates being pushed out on a large scale and extrapolate to what could happen with a malicious actor at full control.

TallGuyShort 7y ago
>> The same could absolutely be said about US made products being used in countries that the USA is adversarial against Such as, itself.
- Junk_Collector 7y ago
  Well of course. Every country has at some point been hostile to it's own citizens or some segment of it's population. It's something that the citizenry need to push back on and keep the government in check. But by and large, the US is no where near as adversarial to it's citizens, companies, or infrastructure as China.
  - erikpukinskis 7y ago
    That claim would need some substantiation. Not sure how you even measure that. Certainly, if you and I started spending repeated 30 minute looking for examples of adversarial actions taken by the US and China against their people, neither of us would run out of examples before tomorrow. So what are you claiming exactly?
    - Junk_Collector 7y ago
      I was responding to TallShortGuy's snarky assertion that the US conducts espionage on itself. Of course it does, everyone knows it does, and almost every other country does the same. The fact that the US spies on itself does not mean that there is not a greater threat of espionage from China or that the US should ignore the possibility. I was also asserting that I personally do not believe that a government should conduct espionage on it's own people and that society needs to push back against such actions. Even in cases where another country is highly adversarial to you, the milder home country might be much worse because of their proximity and involvement in your day to day life.
simion314 7y ago
I don't see how the trade war fixes the possible security issue caused by a potential OTA update in a potential conflict, a solution would be to make illegal OTA updates for critical hardware and software without getting the update reviewed. So military or other important things would buy only products that are reviewed and with updates that are signed by the government. Or even simpler have this hardware and software setup to only get OTA updates and commands only from central command. This feels so hypocritical considering that many PC around the world run CPUs that have Intel ME or equivalent and there is no media coverage of known backdoors in CPUs(I know technically it is a fully featured remote management feature that had some bugs in the past but Intel assures us that there are no more critical bugs and for sure no intentional bugs and this enterprise feature is also included in all CPUs not only in enterprise ones)
- Junk_Collector 7y ago
  The trade war won't fix issues with OTA as a vulnerability. It is useful for the US to point it out to tip things in their favor so it gets a lot of coverage. I also agree with you that the solution to OTA updates is tight control, but that isn't realistic either. They are talking about drones in the article. These are devices bought and run by companies that build infrastructure in the US but are not directly related to the government. They want OTA because it has legitimate benefits in worker time and cost savings and helps keep their "fleet" running with all the latest features. Now, an example attack might be an OTA update for the drone controller to shunt mapping data back to home base in China to give them high quality military maps of infrastructure for attack planning. The attack might be unrealistic, but the spying threat isn't. Alternatively, if car autopilot takes off, imagine the economic damage an OTA attack could do that causes 30% of the traffic in the US to just stop. To prevent this sort of attack, you would have to review ALL code coming out of China since you can't directly hold them responsible after the fact when they are out of your sovereign jurisdiction. The kind of dedicated and educated workforce required to code check all firmware/software updates for such huge classes of consumer products is just not going to happen and it can only get worse. Intel ME is an abomination, but it's also well known and gets a lot of coverage. It's just not in the mainstream news right this minute.
amaccuish 7y ago
I don't understand for example why 5g infrastructure can't work like WSUS. All your devices point at your own update servers, and on the update servers you can approve and decline the distribution of certain upstream updates.

TallGuyShort 7y ago

>> The same could absolutely be said about US made products being used in countries that the USA is adversarial against Such as, itself.

Junk_Collector 7y ago
Well of course. Every country has at some point been hostile to it's own citizens or some segment of it's population. It's something that the citizenry need to push back on and keep the government in check. But by and large, the US is no where near as adversarial to it's citizens, companies, or infrastructure as China.
- erikpukinskis 7y ago
  That claim would need some substantiation. Not sure how you even measure that. Certainly, if you and I started spending repeated 30 minute looking for examples of adversarial actions taken by the US and China against their people, neither of us would run out of examples before tomorrow. So what are you claiming exactly?
  - Junk_Collector 7y ago
    I was responding to TallShortGuy's snarky assertion that the US conducts espionage on itself. Of course it does, everyone knows it does, and almost every other country does the same. The fact that the US spies on itself does not mean that there is not a greater threat of espionage from China or that the US should ignore the possibility. I was also asserting that I personally do not believe that a government should conduct espionage on it's own people and that society needs to push back against such actions. Even in cases where another country is highly adversarial to you, the milder home country might be much worse because of their proximity and involvement in your day to day life.

simion314 7y ago

I don't see how the trade war fixes the possible security issue caused by a potential OTA update in a potential conflict, a solution would be to make illegal OTA updates for critical hardware and software without getting the update reviewed. So military or other important things would buy only products that are reviewed and with updates that are signed by the government. Or even simpler have this hardware and software setup to only get OTA updates and commands only from central command. This feels so hypocritical considering that many PC around the world run CPUs that have Intel ME or equivalent and there is no media coverage of known backdoors in CPUs(I know technically it is a fully featured remote management feature that had some bugs in the past but Intel assures us that there are no more critical bugs and for sure no intentional bugs and this enterprise feature is also included in all CPUs not only in enterprise ones)

Junk_Collector 7y ago
The trade war won't fix issues with OTA as a vulnerability. It is useful for the US to point it out to tip things in their favor so it gets a lot of coverage. I also agree with you that the solution to OTA updates is tight control, but that isn't realistic either. They are talking about drones in the article. These are devices bought and run by companies that build infrastructure in the US but are not directly related to the government. They want OTA because it has legitimate benefits in worker time and cost savings and helps keep their "fleet" running with all the latest features. Now, an example attack might be an OTA update for the drone controller to shunt mapping data back to home base in China to give them high quality military maps of infrastructure for attack planning. The attack might be unrealistic, but the spying threat isn't. Alternatively, if car autopilot takes off, imagine the economic damage an OTA attack could do that causes 30% of the traffic in the US to just stop. To prevent this sort of attack, you would have to review ALL code coming out of China since you can't directly hold them responsible after the fact when they are out of your sovereign jurisdiction. The kind of dedicated and educated workforce required to code check all firmware/software updates for such huge classes of consumer products is just not going to happen and it can only get worse. Intel ME is an abomination, but it's also well known and gets a lot of coverage. It's just not in the mainstream news right this minute.

amaccuish 7y ago

I don't understand for example why 5g infrastructure can't work like WSUS. All your devices point at your own update servers, and on the update servers you can approve and decline the distribution of certain upstream updates.