5 ms·
The vulnerability is not in the computer chip. The vulnerability is in the management software of the OEMs. I was expecting some exotic VPU hardware backdoor.
by aritmo 6y ago
The vulnerability is not in the computer chip. The vulnerability is in the management software of the OEMs.
I was expecting some exotic VPU hardware backdoor.
Nevertheless, the article was a good read.
- dathinab 6y agoBut it's in the software which ships with this chips and is meant to be used by everyone using the chip. > Many such devices on the market today are based on HiSilicon (a Huawei brand) hi3520d ARM SoC running a special Linux distribution called HiLinux, with a set of user-space utilities and a custom web application on top. (emphasis mine) So while this is not a hardware backdoor it's in no way less problematic. EDIT: Which you never said it was... Anyway it's useful to know that it's the software which is chipped alongside with the chip and not some arbitrary 3rd party software some arbitrary OEM put on-top of it.
- yorwba 6y agoThat the chip is running an operating system provided by the chip manufacturer does not imply the OEM didn't add their own stuff. Even the part you emphasized includes the "custom web application on top" which is probably not provided by HiSilicon. (Otherwise, what's custom about it?)
- nitrogen 6y agoThat could mean custom to HiSilicon rather than something off the shelf from the Linux world?
- PragmaticPulp 6y agoRead Huawei’s breakdown of each claim: https://www.huawei.com/en/psirt/security-notices/2020/huawei-sn-20200917-01-hisilicon-en https://www.huawei.com/en/psirt/security-notices/2020/huawei... They defend HiSilicon and suggest that the vulnerabilities were introduced on top of the SDK by the vendor.
- jml7c5 6y agoYeah, it seems this is all just buggy application code. The title should probably be changed to something less suggestive, particularly given current paranoia around Chinese surveillance.
- throwaway4good 6y agoHey ... we need the clicks and the traffic ...
- yokaze 6y agoCVE-2020-24215. Full administrative access with hard-coded password: https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/#backdoor-password-cve-2020-24215 https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabili... Commonly known as backdoor.
- a1369209993 6y agoThey're not claiming it's not a backdoor; they're claiming the backdoor is not in "HiSilicon based hardware video encoders", but rather in management software associated with said encoders. The former would be near impossible to fix, whereas the latter can (supposedly) easily be replaced. Edit: to be clear: 1, I don't know that the backdoor isn't in the hardware itself, but that's what they're claiming. 2, it sounds like the software in question is the manufacturer-provided drivers for the hardware, which is worth emphasizing, but not the same as the hardware itself being compromised.
- Yc4win 6y agoExactly. I see the usual suspects are dancing around the fact since it's Chinese.
- rasz 6y agoThis is trivial to validate, HiSilicon SDK can be downloaded from https://dl.openipc.org/SDK/HiSilicon https://dl.openipc.org/SDK/HiSilicon
- laksdjfkasljdf 6y agoHow do you separate closed source hardware that only works with closed source software from each other?
- matheusmoreira 6y agoYet another reason not to trust proprietary OEM software. This article is really nice since it explains part of the reverse engineering process, helping others achieve the non-trivial task of replacing bad OEM stuff with free software.