9 ms·

Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open driver

Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can selectively either shut off Ethernet chips or have them relay information elsewhere as instructed through magic packets, which of course won't be noticed because the leds won't blink and any other chipset seeing these packets will comply as well letting them pass through without allowing any form of sniffing or telling the system administrator (1)". I can't imagine any manufacturer risking their business by replying "nope, we won't comply"; they will jump when commanded to do so and if caught the standard reply will be "we were forced" or "they say it's for national security, you know, to catch those evil terrorists!". (1) it may seem absurd, sort of sci-fi, but having access to the underlying hardware and its firmware would make it not that hard to do. In that case, the only way to safely analyze network traffic would require very fast logic analyzers that wouldn't use any dedicated network chipsets. The point is: security through obscurity usually doesn't work well, unless the untrusted party is the hardware maker itself, or whoever decides what they put in the hardware; in that case security through obscurity becomes a lot more about obscurity than security, which makes it near 100% effective.

nabla9 7y ago
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
- dv_dt 7y ago
  Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request for cooperation and and order. Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.
  - nabla9 7y ago
    > they can ask & issue orders to not discuss the matter, They can't do that.
    - dv_dt 7y ago
      Why not in the form of a National Security letter? https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
      - nl 7y ago
        No, a national security letter can't do this. It can only compel the release of collected metadata to agencies.
        dv_dt 7y ago
        Are holes in security infrastructure required to collect metadata? Are keys, data that secures content - considered metadata? They're not content. Since you can't discuss the letters publicly, a claim could be that it is metadata, and compel keeping the request to collect it as such secret - similarly the fight from the silenced party, if there were any fight, could be out of public visibility.
        nl 7y ago
        No they aren't. Read the Wikipedia page you linked to. It's great that you can make claims like this based on zero evidence or even allegations, but there is no basis in fact for it. What's more the number of 3rd party people that have to be involved in something like this make it virtually impossible that the national security letter structure could keep them all silent, especially since there are numerous foreign nationals in the supply chains. Go read the huge amount of ACLU coverage of these, or the many articles linked, or the congressional testimony. There are no allegations that this mechanism is being used to do what you say.
- squarefoot 7y ago
  9/11 changed everything.
- jhayward 7y ago
  I would be interested in a review of applicable law which would limit the effect of a US FISA court order. I'm not aware of anything that would prevent the court from ordering a vendor to implement features to effectuate surveillance ordered by the court.
  - dragonwriter 7y ago
    FISC/FISCR don't order surveillance, they permits it; the only compulsory powers they have are to limit the scope and conditions of the surveillance permitted, and that's binding on the government under FISA, which criminalizes certain surveillance unless authorized by FISC/FISCR. And that's a pretty weak compulsion, since the people who are bound are the people who would ordinarily prosecute any federal crime, and they probably aren't interested in prosecuting themselves.
    - jhayward 7y ago
      FISA courts issue warrants, which are court orders. All US courts have the power of the writ which means they can issue further orders to effectuate an order or ruling. So a court can order a company to assist the government in the execution of a warrant. This is pretty long-settled law. The fact that some government agent applies for the warrant does not alter the fact that the warrant, once granted, is an order nor does it remove the power of the writ for further orders to effectuate the warrant.
- stiray 7y ago
  https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill... https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
derefr 7y ago
> I can't imagine any manufacturer risking their business by replying "nope, we won't comply" How about the risk to their business when a multinational corporation is X-raying their cores for backdoors (as one does) and finds the state backdoor, and then decides to no longer do business with the hardware manufacturer because of it—and also publicizes the existence of the backdoor, such that other multinationals pull out as well? (I say "multinationals" because, presumably, purely-domestic corporations could be compelled by the state to accept the backdoor and say nothing about it.)
- cortesoft 7y ago
  Has this happened?
  - jsjohnst 7y ago
    Yes. The specific scenario GP described is about SuperMicro and Amazon if my memory is correct on the parties involved. Edit: it was for sure SuperMicro and Amazon. https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies https://www.bloomberg.com/news/features/2018-10-04/the-big-h...
    - ChrisLomont 7y ago
      That story was widely debunked in followup stories. No one ever demonstrated any of the claims in that story.
      - jsjohnst 7y ago
        I didn’t say it wasn’t debunked, I said that it is what GP was talking about. I didn’t think the “debunked” part was relevant to the question asked that I was responding to. I guess you think it is, so my apologies.
        ChrisLomont 7y ago

nabla9 7y ago

> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.

dv_dt 7y ago
Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request for cooperation and and order. Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.
- nabla9 7y ago
  > they can ask & issue orders to not discuss the matter, They can't do that.
  - dv_dt 7y ago
    Why not in the form of a National Security letter? https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
    - nl 7y ago
      No, a national security letter can't do this. It can only compel the release of collected metadata to agencies.
      - dv_dt 7y ago
        Are holes in security infrastructure required to collect metadata? Are keys, data that secures content - considered metadata? They're not content. Since you can't discuss the letters publicly, a claim could be that it is metadata, and compel keeping the request to collect it as such secret - similarly the fight from the silenced party, if there were any fight, could be out of public visibility.
        nl 7y ago
        No they aren't. Read the Wikipedia page you linked to. It's great that you can make claims like this based on zero evidence or even allegations, but there is no basis in fact for it. What's more the number of 3rd party people that have to be involved in something like this make it virtually impossible that the national security letter structure could keep them all silent, especially since there are numerous foreign nationals in the supply chains. Go read the huge amount of ACLU coverage of these, or the many articles linked, or the congressional testimony. There are no allegations that this mechanism is being used to do what you say.
squarefoot 7y ago
9/11 changed everything.
jhayward 7y ago
I would be interested in a review of applicable law which would limit the effect of a US FISA court order. I'm not aware of anything that would prevent the court from ordering a vendor to implement features to effectuate surveillance ordered by the court.
- dragonwriter 7y ago
  FISC/FISCR don't order surveillance, they permits it; the only compulsory powers they have are to limit the scope and conditions of the surveillance permitted, and that's binding on the government under FISA, which criminalizes certain surveillance unless authorized by FISC/FISCR. And that's a pretty weak compulsion, since the people who are bound are the people who would ordinarily prosecute any federal crime, and they probably aren't interested in prosecuting themselves.
  - jhayward 7y ago
    FISA courts issue warrants, which are court orders. All US courts have the power of the writ which means they can issue further orders to effectuate an order or ruling. So a court can order a company to assist the government in the execution of a warrant. This is pretty long-settled law. The fact that some government agent applies for the warrant does not alter the fact that the warrant, once granted, is an order nor does it remove the power of the writ for further orders to effectuate the warrant.
stiray 7y ago
https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-million-for-a-back-door-into-rsa-encryption-according-to https://www.theverge.com/2013/12/20/5231006/nsa-paid-10-mill... https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG

derefr 7y ago

> I can't imagine any manufacturer risking their business by replying "nope, we won't comply" How about the risk to their business when a multinational corporation is X-raying their cores for backdoors (as one does) and finds the state backdoor, and then decides to no longer do business with the hardware manufacturer because of it—and also publicizes the existence of the backdoor, such that other multinationals pull out as well? (I say "multinationals" because, presumably, purely-domestic corporations could be compelled by the state to accept the backdoor and say nothing about it.)

cortesoft 7y ago
Has this happened?
- jsjohnst 7y ago
  Yes. The specific scenario GP described is about SuperMicro and Amazon if my memory is correct on the parties involved. Edit: it was for sure SuperMicro and Amazon. https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies https://www.bloomberg.com/news/features/2018-10-04/the-big-h...
  - ChrisLomont 7y ago
    That story was widely debunked in followup stories. No one ever demonstrated any of the claims in that story.
    - jsjohnst 7y ago
      I didn’t say it wasn’t debunked, I said that it is what GP was talking about. I didn’t think the “debunked” part was relevant to the question asked that I was responding to. I guess you think it is, so my apologies.
      - ChrisLomont 7y ago