6 ms·

If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (Y

by tlb 6y ago

If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (You should also do your own checks)

simonh 6y ago
Nobody can prove a negative like that. We're talking about data centre servers here, that's what the Bloomberg story is about. For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure (which isn't impossible if there are specific targets) but there's no way to do that without the transmissions being visible. I think a hack like this is much more likely to be viable against consumer and mobile devices. Given that this is all a genuine risk, the Bloomberg story is particularly harmful. It creates the real risk that reports of genuine hacks or vulnerabilities will be sidelined due to reporting on issues like this being tarnished by association. Crying wolf is not good preparation for dealing with real wolves.
- tremon 6y ago
  For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure I don't think knowledge about the target network is required, just the ability to detect what default route is used by the OS. It also wouldn't need to "phone home", just phone into a controlled network. It wouldn't be a complete fantasy to assume that some software telemetry/update endpoints are compromised. And steganography using TCP sequence numbers is a real possibility, so once a link to a friendly endpoint is established, the backdoor wouldn't even need to generate its own packets.

6 ms·

If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (Y

by tlb 6y ago

simonh 6y ago
Nobody can prove a negative like that. We're talking about data centre servers here, that's what the Bloomberg story is about. For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure (which isn't impossible if there are specific targets) but there's no way to do that without the transmissions being visible. I think a hack like this is much more likely to be viable against consumer and mobile devices. Given that this is all a genuine risk, the Bloomberg story is particularly harmful. It creates the real risk that reports of genuine hacks or vulnerabilities will be sidelined due to reporting on issues like this being tarnished by association. Crying wolf is not good preparation for dealing with real wolves.
- tremon 6y ago
  For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure I don't think knowledge about the target network is required, just the ability to detect what default route is used by the OS. It also wouldn't need to "phone home", just phone into a controlled network. It wouldn't be a complete fantasy to assume that some software telemetry/update endpoints are compromised. And steganography using TCP sequence numbers is a real possibility, so once a link to a friendly endpoint is established, the backdoor wouldn't even need to generate its own packets.