5 ms·

> What unusual attack do they get access to by owning or manufacturing the equipment? It is incredibly easy to add almost undetectable backdoors to hardware, p

> What unusual attack do they get access to by owning or manufacturing the equipment? It is incredibly easy to add almost undetectable backdoors to hardware, particularly inside ICs. Here's one particularly clever attack described by security researchers at U of Michigan, but there are many: https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/ https://www.wired.com/2016/06/demonically-clever-backdoor-hi...

supernova87a 6y ago
How would a hardware vulnerability on router equipment handling traffic compromise data flowing over that router which has already been encrypted properly at the source/destination?
- mthoms 6y ago
  I'm no HW guy but when "activated", could it not brick itself? Or, only transmit packets passing to/from certain IP addresses?
  - solstice 6y ago
    That doesn't sound useful or very sophisticated from a spying POV. I guess mass-shutdown of Telco infrastructure would be catastrophic but that could most likely be avoided by having a mix of suppliers and a minimum of known-good hardware in the field.
    - rtkwe 6y ago
      You'd have to maintain that mixture of manufacturers broadly across all the 'critical' bits of infrastructure for it to really matter and there's a lot of infrastructure to defend. Just disrupting payments or mobile data sporadically across the US could deal a big blow to a lot of businesses. Just look how poorly they've fared with the COVID disruptions.
      - solstice 6y ago
        Disruptions would be there for sure. But I think building up that kind of capability is necessarily single-use only, and only makes sense if your goal is to use it as a direct prelude to an invasion of a country. Because people will relatively quickly discover where the problems came from, punish whoever's responsible and then switch manufacturers. I don't see how this could be of benefit to secret services whether from China or any other country, except in the worst case stated above. A few billions in economic losses due to stock market disruptive etc dont mean much in the grand scale of things (and can't therefore be very attractive for intelligence services). Military planners would be foolish to outright dismiss this possibility, sure, but I don't think us-China relations are at this point yet. (And hopefully never will.) The solution to all of this is to work together and increase the security of the overall system and ditch security through obscurity and security through NDA, go open-source and full inspectability for all critical infrastructure, be it comms, industrial controls, medical infrastructure, transport etc. And E2E encrypt all communications. Everything else is just screwing around with the symptoms instead of addressing the root causes.
        rtkwe 6y ago
        Just OSS isn't going to solve the paranoia around hidden backdoors in Chinese manufactured network equipment. A tiny co-processor looking for a trigger to brick the rest of the device would maybe require delidding to notice. The old adage is once they get access to your hardware there's very little in the way of attackers doing anything, how do you secure something when it's being manufactured almost 100% by an 'attacker' country's industrial base? I think the China-hawk paranoia is going too far but for national security paranoia it's relatively well grounded. It's hard to justify being able to certify that a thing is secure when the hardware could just be lying to you about the firmware checksum for example.
        solstice 6y ago
        That's of course true. Which is another reason why I think that eg voting computers are an inherently bad idea (independently of who manufactures them). But my main point was that this sort of capability embedded in routers can only be used once and likely only in an end of the world scenario and therefore is of limited interest to "China". Now I'm wondering whether I'm mistaken? If my connection to a website/device is properly encrypted (SSL/TLS), can a mitm attack (eg by an embedded hw bug) strip that encryption away? If so, that would be bad and would invalidate large parts of my argument above. If it doesn't however, then it wouldn't really matter that much I think. Unless... the device somehow saves a copy of the traffic for later decryption with better hardware down the line. That seems doable but not really feasible at scale. (Then again, maybe a few bugs in the routers installed at a few critical facilities or locations like downtown DC are enough to gobble up enough juicy traffic?) I think on the whole it was a bad idea to offshore virtually all production capabilities for chips and computer hardware. (This is especially true for Europe which lost its hw production to Asia and its software production to the US.) Now we have to cope with this situation as it is though, and it seems to me that the best way to do that is to improve transparency by doing what I wrote above, radically reducing complexity of protocols and the tech stack (eg openssl vs wireguard) and forcing companies to clean up their act wrt IT practices. Not easy at all, I know.
- monoideism 6y ago
  Your comment that I responded to was referring to smart phones (ie, multiple references to "apps" and "mobile") and now you're bringing up "routers"? Did you mean to do this? Because if not, it's what's called a bailey-and-motte fallacy. You've stated a very controversial, hard-to-defend position (what difference does compromised hardware make to a user's security?), mentioned it in a context where it would make a huge difference (smartphones), and now you've brought up a very specific scenario and context that is more reasonable (although still not as much as you appear to think). Again, your original question was "What unusual attack do they get access to by owning or manufacturing the equipment?". Your original post made no reference to routers or switches. To answer that original question explicitly, having a many types of hardware exploits on end-user equipment is game over - full access to all your data and communications on that device. Edit: And regarding compromised routers, from https://www.welivesecurity.com/2019/01/17/new-years-resolutions-routing-done-right/ https://www.welivesecurity.com/2019/01/17/new-years-resoluti..., here's a list of things that a hacked router could do to you, many of which would be of interest to nation-state attacker targeting a person or organization: - redirect you to a web page that phishes for your credentials, - dupe you into installing malware-laced versions of legit software, - be hijacked to conduct man-in-the-middle attacks (MitM) on what you would believe are secure and encrypted connections, - be corralled into a botnet in order to launch DDoS attacks against websites or even against aspects of the internet’s infrastructure, - be co-opted as an on-ramp to attacks at other devices within your network, - be used to spy on you via Internet-of-Things (IoT) devices, - be compromised with malware such as VPNFilter, or, as another threat du jour, be misused for covert cryptocurrency mining. Edit 2: And unless a website is only available via HTTPS, the end user is using an extension like HTTPS Everywhere, or the user carefully types in `https` as the URL protocol, then the end user is still vulnerable to SSL strip from a compromised router.
  - supernova87a 6y ago
    Sorry, we mixed up which hardware, in which questions. My question immediately above had to do with routers, etc. that the administration has also put attention onto.
    - 6y ago

supernova87a 6y ago

How would a hardware vulnerability on router equipment handling traffic compromise data flowing over that router which has already been encrypted properly at the source/destination?

mthoms 6y ago
I'm no HW guy but when "activated", could it not brick itself? Or, only transmit packets passing to/from certain IP addresses?
- solstice 6y ago
  That doesn't sound useful or very sophisticated from a spying POV. I guess mass-shutdown of Telco infrastructure would be catastrophic but that could most likely be avoided by having a mix of suppliers and a minimum of known-good hardware in the field.
  - rtkwe 6y ago
    You'd have to maintain that mixture of manufacturers broadly across all the 'critical' bits of infrastructure for it to really matter and there's a lot of infrastructure to defend. Just disrupting payments or mobile data sporadically across the US could deal a big blow to a lot of businesses. Just look how poorly they've fared with the COVID disruptions.
    - solstice 6y ago
      Disruptions would be there for sure. But I think building up that kind of capability is necessarily single-use only, and only makes sense if your goal is to use it as a direct prelude to an invasion of a country. Because people will relatively quickly discover where the problems came from, punish whoever's responsible and then switch manufacturers. I don't see how this could be of benefit to secret services whether from China or any other country, except in the worst case stated above. A few billions in economic losses due to stock market disruptive etc dont mean much in the grand scale of things (and can't therefore be very attractive for intelligence services). Military planners would be foolish to outright dismiss this possibility, sure, but I don't think us-China relations are at this point yet. (And hopefully never will.) The solution to all of this is to work together and increase the security of the overall system and ditch security through obscurity and security through NDA, go open-source and full inspectability for all critical infrastructure, be it comms, industrial controls, medical infrastructure, transport etc. And E2E encrypt all communications. Everything else is just screwing around with the symptoms instead of addressing the root causes.
      - rtkwe 6y ago
        Just OSS isn't going to solve the paranoia around hidden backdoors in Chinese manufactured network equipment. A tiny co-processor looking for a trigger to brick the rest of the device would maybe require delidding to notice. The old adage is once they get access to your hardware there's very little in the way of attackers doing anything, how do you secure something when it's being manufactured almost 100% by an 'attacker' country's industrial base? I think the China-hawk paranoia is going too far but for national security paranoia it's relatively well grounded. It's hard to justify being able to certify that a thing is secure when the hardware could just be lying to you about the firmware checksum for example.
        solstice 6y ago
        That's of course true. Which is another reason why I think that eg voting computers are an inherently bad idea (independently of who manufactures them). But my main point was that this sort of capability embedded in routers can only be used once and likely only in an end of the world scenario and therefore is of limited interest to "China". Now I'm wondering whether I'm mistaken? If my connection to a website/device is properly encrypted (SSL/TLS), can a mitm attack (eg by an embedded hw bug) strip that encryption away? If so, that would be bad and would invalidate large parts of my argument above. If it doesn't however, then it wouldn't really matter that much I think. Unless... the device somehow saves a copy of the traffic for later decryption with better hardware down the line. That seems doable but not really feasible at scale. (Then again, maybe a few bugs in the routers installed at a few critical facilities or locations like downtown DC are enough to gobble up enough juicy traffic?) I think on the whole it was a bad idea to offshore virtually all production capabilities for chips and computer hardware. (This is especially true for Europe which lost its hw production to Asia and its software production to the US.) Now we have to cope with this situation as it is though, and it seems to me that the best way to do that is to improve transparency by doing what I wrote above, radically reducing complexity of protocols and the tech stack (eg openssl vs wireguard) and forcing companies to clean up their act wrt IT practices. Not easy at all, I know.
monoideism 6y ago
Your comment that I responded to was referring to smart phones (ie, multiple references to "apps" and "mobile") and now you're bringing up "routers"? Did you mean to do this? Because if not, it's what's called a bailey-and-motte fallacy. You've stated a very controversial, hard-to-defend position (what difference does compromised hardware make to a user's security?), mentioned it in a context where it would make a huge difference (smartphones), and now you've brought up a very specific scenario and context that is more reasonable (although still not as much as you appear to think). Again, your original question was "What unusual attack do they get access to by owning or manufacturing the equipment?". Your original post made no reference to routers or switches. To answer that original question explicitly, having a many types of hardware exploits on end-user equipment is game over - full access to all your data and communications on that device. Edit: And regarding compromised routers, from https://www.welivesecurity.com/2019/01/17/new-years-resolutions-routing-done-right/ https://www.welivesecurity.com/2019/01/17/new-years-resoluti..., here's a list of things that a hacked router could do to you, many of which would be of interest to nation-state attacker targeting a person or organization: - redirect you to a web page that phishes for your credentials, - dupe you into installing malware-laced versions of legit software, - be hijacked to conduct man-in-the-middle attacks (MitM) on what you would believe are secure and encrypted connections, - be corralled into a botnet in order to launch DDoS attacks against websites or even against aspects of the internet’s infrastructure, - be co-opted as an on-ramp to attacks at other devices within your network, - be used to spy on you via Internet-of-Things (IoT) devices, - be compromised with malware such as VPNFilter, or, as another threat du jour, be misused for covert cryptocurrency mining. Edit 2: And unless a website is only available via HTTPS, the end user is using an extension like HTTPS Everywhere, or the user carefully types in `https` as the URL protocol, then the end user is still vulnerable to SSL strip from a compromised router.
- supernova87a 6y ago
  Sorry, we mixed up which hardware, in which questions. My question immediately above had to do with routers, etc. that the administration has also put attention onto.
  - 6y ago