5 ms·

My personal take is: Huawei belongs to CCP. Korean and US companies do not belong to their governments. This should be an issue by default, in my opinion. That

by zobzu 7y ago

My personal take is: Huawei belongs to CCP. Korean and US companies do not belong to their governments. This should be an issue by default, in my opinion. That said it's not why I distrust Huawei (not that I trust Google, Cisco, Qualcomm all that much more - but I give them more benefit of the doubt). I don't even care about ATT because if you trust your carrier you're already toast, and I do not know any carrier that I respect as a company (despite them having great employees). Here's why I distrust Huawei and similar companies: From my 20y incident response experience in the field at very large companies, we've never caught the NSA or similar US agencies. Either because they're too good, we're unlucky, they're too bad at it, or because they don't actually need to, or do not backdoor. Who knows. What does bother me is that we caught other countries several times, sometimes using terribly bad tactics (where the defense was bad for various reasons that are usually also bad) and sometimes using relatively novel stuff that we'd never see before. Thankfully you do not have to trust me, ask any security engineer at any big company (amazon, fb, uber, google, lockheed, etc.). They'll either say they're not allowed to speak about it or give you an answer that's similar to the above (or break their NDAs, alternatively, I guess?!)

londons_explore 7y ago
> US companies do not belong to their governments. Did you see the news last week that GM is being forced to switch manufacturing to produce ventilators... Not paid to do it... Forced to... When that kind of thing happens, it's clear there isn't a separation line between company management and their governments.
- joaomacp 7y ago
  You are overgeneralizing: the US did this in a crisis. China has been doing this frequently. It's not valid to equate them.
bildung 7y ago
What do you think about Ciscos security history? They have had literally hundreds of remote code execution vulnerabilities. https://www.cvedetails.com/vulnerability-list/vendor_id-16/Cisco.html https://www.cvedetails.com/vulnerability-list/vendor_id-16/C... (sort by severity, right now there are 450 flaws with severity 9.0 or more in the list) I can't imagine that it is only incompetence that makes them implement new remote backdoors on an almost monthly basis.
luckylion 7y ago
> What does bother me is that we caught other countries several times, sometimes using terribly bad tactics (where the defense was bad for various reasons that are usually also bad) and sometimes using relatively novel stuff that we'd never see before. What are you trying to say, that sometimes they are reading a "how to hack a computer" guide and try admin/admin and sometimes Huawei is supplying 0days to them? As for NSA or similar US agencies: why would they hack US companies? They just send a friendly letter, attach a check for the inconvenience and have the companies build them a surveillance room. Outside the US, TAO is a thing. And when they get caught, you better have definite proof before you say that you believe it's them, because that might have severe consequences for you personally, your company and the international relations of your country.
mrtksn 7y ago
Could the reason be that the US and the others have different access to the companies? The US was caught when somebody blew the whistle, just Google for PRISM, for example. China and others could not have done that, therefore they would do something else. They make and ship hardware, therefore their vector of attack would be expected to be that hardware. Unlike the US though, I am not aware of any substantial attack that goes beyond speculation. There was supposed to be an IC implemented into Apple and Amazon servers according to Bloomberg but that story was refuted and went nowhere. So far, in reality, we have proven US surveillance(and Obama was very sorry about it) and speculations about Chinese surveillance. I am not sure that there's much going on here beyond the propaganda.
- amachefe 7y ago
  Saying US has been proven and not Chinese is the real propaganda. China has been caught countless times. Anyone working in network security or Telecom have their China story It is no longer treated with fanfare because unlike US it's is almost common.
  - mrtksn 7y ago
    Anecdotes of individual cases are not the same as the institutionalized spying and the presidential "oops, won't do it again" once the spying is revealed. I have no doubt that China or Saudi Arabia or Russia and so on have spying programs and there were cases of revealed moles installed in companies but it's nowhere nearly as substantial as US directly plugging into the systems that run globally and running mass surveillance programs. Google for Wikileaks, Snowden. Assange. The results will surprise you. All this debacle looks nothing more than the US not wanting competition. It doesn't even look like the Chinese mass spying efforts are beyond a startup stage when the US spying is equivalent of a giant and established corporation. Actually, not even a startup, more like mom and pop shops of spying. I think it's alright, US is no longer the country that stands for something beyond nationalism and most of the Western nations are not covered by that American Nationalism.
    - pas 7y ago
thawaway1837 7y ago
There is a lot of evidence about US backdoors. The invisible dots on every printed page in the world. The Snowden leaks. The fact that the US is publicly trying to get Apple to install backdoors on their phones and threatening to pass laws to make them do so (they don’t seem to be speaking up as much about google which makes me wonder if Google has already capitulated). The ability to get any cloud provider to share any info with the US government (this is theoretically better than China, because unlike China’s case, it requires judicial approval...in practice it isn’t much better, because judicial approval is given 100% of the time). I still strongly believe that if I had to lose my privacy, and needed to install a backdoors on my devices, I’d much rather it be to an American 3 letter agency than a Chinese one of any form. That doesn’t change the fact that the NSA and co have been proven to do much worse than what Huawei is being accused of doing potentially in the future.

by zobzu 7y ago

londons_explore 7y ago

> US companies do not belong to their governments. Did you see the news last week that GM is being forced to switch manufacturing to produce ventilators... Not paid to do it... Forced to... When that kind of thing happens, it's clear there isn't a separation line between company management and their governments.

joaomacp 7y ago
You are overgeneralizing: the US did this in a crisis. China has been doing this frequently. It's not valid to equate them.

bildung 7y ago

What do you think about Ciscos security history? They have had literally hundreds of remote code execution vulnerabilities. https://www.cvedetails.com/vulnerability-list/vendor_id-16/Cisco.html https://www.cvedetails.com/vulnerability-list/vendor_id-16/C... (sort by severity, right now there are 450 flaws with severity 9.0 or more in the list) I can't imagine that it is only incompetence that makes them implement new remote backdoors on an almost monthly basis.

luckylion 7y ago

> What does bother me is that we caught other countries several times, sometimes using terribly bad tactics (where the defense was bad for various reasons that are usually also bad) and sometimes using relatively novel stuff that we'd never see before. What are you trying to say, that sometimes they are reading a "how to hack a computer" guide and try admin/admin and sometimes Huawei is supplying 0days to them? As for NSA or similar US agencies: why would they hack US companies? They just send a friendly letter, attach a check for the inconvenience and have the companies build them a surveillance room. Outside the US, TAO is a thing. And when they get caught, you better have definite proof before you say that you believe it's them, because that might have severe consequences for you personally, your company and the international relations of your country.

mrtksn 7y ago

Could the reason be that the US and the others have different access to the companies? The US was caught when somebody blew the whistle, just Google for PRISM, for example. China and others could not have done that, therefore they would do something else. They make and ship hardware, therefore their vector of attack would be expected to be that hardware. Unlike the US though, I am not aware of any substantial attack that goes beyond speculation. There was supposed to be an IC implemented into Apple and Amazon servers according to Bloomberg but that story was refuted and went nowhere. So far, in reality, we have proven US surveillance(and Obama was very sorry about it) and speculations about Chinese surveillance. I am not sure that there's much going on here beyond the propaganda.

amachefe 7y ago
Saying US has been proven and not Chinese is the real propaganda. China has been caught countless times. Anyone working in network security or Telecom have their China story It is no longer treated with fanfare because unlike US it's is almost common.
- mrtksn 7y ago
  Anecdotes of individual cases are not the same as the institutionalized spying and the presidential "oops, won't do it again" once the spying is revealed. I have no doubt that China or Saudi Arabia or Russia and so on have spying programs and there were cases of revealed moles installed in companies but it's nowhere nearly as substantial as US directly plugging into the systems that run globally and running mass surveillance programs. Google for Wikileaks, Snowden. Assange. The results will surprise you. All this debacle looks nothing more than the US not wanting competition. It doesn't even look like the Chinese mass spying efforts are beyond a startup stage when the US spying is equivalent of a giant and established corporation. Actually, not even a startup, more like mom and pop shops of spying. I think it's alright, US is no longer the country that stands for something beyond nationalism and most of the Western nations are not covered by that American Nationalism.
  - pas 7y ago

thawaway1837 7y ago

There is a lot of evidence about US backdoors. The invisible dots on every printed page in the world. The Snowden leaks. The fact that the US is publicly trying to get Apple to install backdoors on their phones and threatening to pass laws to make them do so (they don’t seem to be speaking up as much about google which makes me wonder if Google has already capitulated). The ability to get any cloud provider to share any info with the US government (this is theoretically better than China, because unlike China’s case, it requires judicial approval...in practice it isn’t much better, because judicial approval is given 100% of the time). I still strongly believe that if I had to lose my privacy, and needed to install a backdoors on my devices, I’d much rather it be to an American 3 letter agency than a Chinese one of any form. That doesn’t change the fact that the NSA and co have been proven to do much worse than what Huawei is being accused of doing potentially in the future.