9 ms·

My assumption is that all intelligence services in all countries would love to have access to fully compromised networks. They spend all their time thinking abo

My assumption is that all intelligence services in all countries would love to have access to fully compromised networks. They spend all their time thinking about how to access information, so they would be fairly incompetent not to consider this. Does that mean that all systems are compromised? No, because there are risks associated with tapping in to these systems. Partly it depends on if they have access to the systems, but mostly on the possible blow-back if they get caught. Example: Swedens FRA (NSA equivalent) could in theory ask Ericsson (a Swedish company), to install a backdoor. But, Sweden has a fairly free press, and there are good chances that someone would leak this information. If it got leaked it would be a major scandal that could go as far as toppling the government and destroy one of Swedens most important export companies. Its very risky, and its a risk no one wants to take, so the parts made in sweden are probably not compromised. China, on the other hand has almost no risks associated with adding backdoor. No free press, hard suppression of whistle blowers, and since most foreign intelligence services already assume the equipment is compromised, there is no real reputational damage either. I assume they are all compromised, why wouldn't they be? The US is somewhere in between. Sometimes companies are compromised by intelligence services, but much more often I think its employees. Why try to change Tim Cooks stance on privacy, when all you need to do is find one Apple employee, willing to take a sack of money to "do their country a great service"?

marsven_422 6y ago
"Sweden has a fairly free press" That's so wrong it hurts! All our press are dependent on government "presstöd" aka handouts.
- Swenrekcah 6y ago
  The press can be free regardless. If the allocations are according to some objective metrics then I don’t see a problem.
  - whatshisface 6y ago
    Objective metrics can be as biased as subjective metrics.
    - Swenrekcah 6y ago
      I disagree. The complaint was that a grant from the government makes the press less free to criticise the government. If the grant is clearly and legally bound to be determined according to a set of objective and publicly available metrics I do not see that it would be such a big problem. Of course a vindictive government could do what they can to negatively affect the press outlet in question but similarly could a supporting public affect them. In any case it can all be accounted and prepared for as long as the process is objective and transparent.
    - 1cvmask 6y ago
      The selection of arbitrary objective metrics and the weight associated to them is subjective by nature. Every ranking system is subjective by definition even if the outcomes are measured objectively. Every ranking system is by definition mathematical garbage that we use to evaluate whatever we feel the need to evaluate. We still need them as filters and for other reasons.
  - fallingknife 6y ago
    If the government has the power to grant money and set metrics, it also has the power to take it away, and change the metrics. So if you are getting a grant based on "objective metrics," it might be a good idea to not piss of the people defining them.
    - Swenrekcah 6y ago
      Of course but that is a move that costs the government something in political capital. There are always dangers in criticising the powers that be, but I can not see that these kinds of press grants are a big problem. If the country is a democratic one to begin with, the grants do more good by insulating the press from commercial powers than they do bad in this way, in my opinion.
      - fallingknife 6y ago
        It may well be a good trade off. I'm just pointing out that there is never a way to be completely free from whoever is paying the bills.
- quelsolaar 6y ago
  According to Reporters without borders, Sweden ranks 4th in the world, in press freedom. I think that would qualify as "fairly free". https://rsf.org/en/ranking_table https://rsf.org/en/ranking_table
  - 1cvmask 6y ago
    Always be wary of such (and for that matter any) rankings and take them with a massive amount of salt. These NGOs are often fronts for agendas. https://rsf.org/en/our-supporters https://rsf.org/en/our-supporters They have the CIA vehicle for regime change as one of their sponsors, the amusingly named National Endowment for Democracy that specializes in overthrowing non-white democracies and regime change. https://en.wikipedia.org/wiki/National_Endowment_for_Democracy https://en.wikipedia.org/wiki/National_Endowment_for_Democra... https://williamblum.org/chapters/rogue-state/trojan-horse-the-national-endowment-for-democracy https://williamblum.org/chapters/rogue-state/trojan-horse-th...
    - freeflight 6y ago
      > National Endowment for Democracy that specializes in overthrowing non-white democracies and regime change. They also don't mind white regime change, NED, along with NATO, the US DoS, and a couple of other rather relevant names, where openly sponsoring [0] "Yat's our man" [1], who ended up becoming PM of Ukraine after Euromaidan escalated into a full blown coup. [0] https://web.archive.org/web/20200328203654/https://openukraine.org/en/about/partners https://web.archive.org/web/20200328203654/https://openukrai... [1] https://www.bbc.com/news/world-europe-26079957 https://www.bbc.com/news/world-europe-26079957
- pa7ch 6y ago
  Independent and free are not the same thing. You could say sweden's press is free despite its dependance. However, maybe the sweden gov values free press and the press is free via this relationship.
cratermoon 6y ago
> there are risks associated with tapping in to these systems Which is why the intelligence services never do the hacking themselves. Instead, they buy the data off the "dark web", from the hackers whole stole and the information brokers who trade in it. If they have to do that, that is. In the US at least, agencies can just buy data on the open market. Supposedly "anonymized", but I'm pretty sure everyone reading this knows that protection is flimsy.
- goodpoint 6y ago
  Plenty of evidence proves that intelligent services: - Buy exploits on the market, with the US govt being the biggest buyer. - Buy data off legitimate advertising and intelligence companies - Hire people to find bugdoors - Hire people to infiltrate all sorts of companies and extract information or plant bugdoors - Convince or coerce companies to plant bugdoors in their own products - Do the hacking themselves, plant hardware backdoors and so on Unsurprisingly, they use all available methods.
  - cratermoon 6y ago
    OK, I should not have said never, but when the option is between "we could hack this but if we get caught it would be an international diplomatic incident" and "hey there's a broker over here with the data for sale", the do buy it.
adammenges 6y ago
There’s a clear bias in your thinking against the US and for Sweden. Any of the points you bring up could equally apply to both places, but you come out bring the negative against one and the positive against the other.
sneak 6y ago
> The US is somewhere in between. Bart Gellman's book says that Snowden warned him not to be the only person in possession of the leaked data prior to publication, as the US intelligence community would kill him (Gellman) instantly to prevent the publication of the information contained therein. This was the biggest takeaway from the book, for me: the US military will assassinate US citizens (journalists!) in the middle of New York City without due process or a trial to prevent them from carrying out journalism. We expect this kind of cloak and dagger shit from the CIA, but it pays to think about it in clear terms: the US military can and will assassinate US citizens engaging in constitutionally protected activity in the middle of Manhattan with no consequences whatsoever.
- afrodc_ 6y ago
  Is there proof of this or is this conjecture?
  - sneak 6y ago
    Two examples we know of of the CIA assassinating Americans without trial or consequences: https://en.wikipedia.org/wiki/Anwar_al-Awlaki https://en.wikipedia.org/wiki/Anwar_al-Awlaki https://en.wikipedia.org/wiki/Abdulrahman_al-Awlaki https://en.wikipedia.org/wiki/Abdulrahman_al-Awlaki The potential murder of Gellman was stated by Snowden, who was trained by the CIA, and was stated on more than one occasion.
    - opnitro 6y ago
      Also this, which wasn't directly the CIA but by CIA backed groups: https://en.wikipedia.org/wiki/Orlando_Letelier https://en.wikipedia.org/wiki/Orlando_Letelier, a political assassination on US soil. (Although not a US citizen)
      - selectodude 6y ago
        That's one heck of a leap to blame on the CIA.
rcarmo 6y ago
Nobody needs backdoors when there are quite complete legal interception features regulated into core systems. Plus everything is IP these days, so tapping a call is trivial. It just can't really be done towards outside the telco network without anyone noticing, the world isn't a hacker movie...
ng55QPSK 6y ago
Google Ericsson Vodafone Greece. And for US, google Cloud Act.
- NKosmatos 6y ago
  The wiretapping scandal you are referring to is known as "The Athens Affair" and has to do with infiltration of Ericsson software exchanges by experts on how the software is working. Vodafone is/was the one to blame here and it wasn't a fault of the software provided by Ericsson. More info here: https://spectrum.ieee.org/telecom/security/the-athens-affair https://spectrum.ieee.org/telecom/security/the-athens-affair
- ChrisKnott 6y ago
  The CLOUD Act is a mechanism for legal authorities to compel companies to produce data they hold, even if it is stored on servers outside the US. I don't think it's fair to characterise that as a backdoor.
  - MomoXenosaga 6y ago
    The US can use the front door and nobody can stop them. That's the dividend of being a superpower. It's the good old gunboat diplomacy for the 21st century. What are local potentates going to do against America?
riazrizvi 6y ago
> Does that mean that all systems are compromised? No, because there are risks associated with tapping in to these systems. Partly it depends on if they have access to the systems, but mostly on the possible blow-back if they get caught. Isn’t it common knowledge that the US and China is spying on everyone? The main difference is that China is not a military ally, and its government spying, which is unfettered, supports its private enterprise that is government financed and owned. US govt spying is unfettered. US corporate spying far more restricted because US businesses are bound by Federal and State laws, and it’s not centrally coordinated, instead US businesses are autonomous entities. And though US corporate spying on customers is rampant, it is also transparently written into usage contracts. US corporate spying is obviously for profit, and since the US and Europe are strategically tied through NATO, it’s not on the same threat level. China and its axis ally Russia, clearly bump up against the West because our political systems are fundamentally opposite, democratic vs autocratic. What this translates to is Chinese investors are agressively running around buying into key strategic businesses, advised by data gathering in coordination with its government, with a view to maintaining control, which reflects how the country is managed itself. American investors are running around buying/competing against business in coordination with data rich parent company entities, with a view to making money. But because it’s a democratic country where laws preserve autonomy even against the government, it’s a free for all and anyone can play, even Chinese owned American companies. Which is a reflection of how the US is managed itself. This is also how Europe is managed, so I do believe Chinese control of telcos is a bigger threat to Europe’s way of life.
- whatshisface 6y ago
  >China and its axis ally Russia, clearly bump up against the West because our political systems are fundamentally opposite, democratic vs autocratic. This is a speck of misapprehension that slipped in to your otherwise great writeup. Governments don't naturally conflict because they have different forms and they don't make automatic friends when they are similar. The US is presently allied with many autocracies. Middle-aged Europe was uniformly feudal, and constantly at war. Pre-WWII America was strictly isolationist and despite being a democracy had a fairly sized pro-Hitler element. Governments conflict when they have something to conflict over.
DyslexicAtheist 6y ago
this isn't how any of this works. we're talking about ISP's & Telco networks not some data-center at FAANG. - no need for backdoors since Huawei, Ericsson & Nokia are full to the brim with bugdoors (Huawei tops the chart here since many years already and as anyone involved in Inter-Operability-Testing (IOT) at the NEV will confirm). - no need for "compromising networks" when you have the actual vendor (Huawei, Nokia, Ericsson often their subcontractors) sitting totally legally in your ISP's network and being paid for responding to the alarms raised and escalated by O&M. - even the attacks against 3/4/5G become academic in the discussion of nation state threat actors when they can operate and exploit simply as an insider of the system. These weaknesses (as outrageous as they are) are useful but it's a different threat model
- quelsolaar 6y ago
  I don't have any non-public insight as to how intelligence agencies operate, so this is pure conjecture on my part: If I was I was a intelligence agency in a country where there is a risk of blow-back, like in Europe or the US, I might prefer to use exploits. That way you haven't compromised your own country infrastructure (as much) and the risk of leaks is much lower since you dont have to work with an outside entity. A government agency forcing a domestic company to add backdoors, looks much worse if it gets out, then an agency using existing bugs. If I'm a Intelligence agency in a country that doesn't care about blow-back like China or Russia, why bother finding and using an exploit, when you can call up the vendor and have them design the system with your use-case in mind? You dont have to worry about someone fixing the bug you have spent man years making exploitable, and you can make sure the backdoor can only be used by you. Its way more convenient and cost effective.
  - rocqua 6y ago
    > why bother finding and using an exploit, when you can call up the vendor and have them design the system with your use-case in mind? China is now suffering fron Huawei blowback in quite a few western countries.
    - quelsolaar 6y ago
the-dude 6y ago
Airbus to sue over US-German spying row [0] [0] https://www.bbc.com/news/world-europe-32542140 https://www.bbc.com/news/world-europe-32542140
secondcoming 6y ago
If the Dutch would get Philips to weaken crypto devices [0], [1] then it wouldn't surprise me if the Swedes would ask the same of Ericsson [2] [0] https://www.vpro.nl/argos/lees/onderwerpen/cryptoleaks/2020/cryptoleaks-in-the-netherlands-former-philips-top-cryptographer-admits-to-compromising-encryption-devices.html https://www.vpro.nl/argos/lees/onderwerpen/cryptoleaks/2020/... [1] https://www.ceesjansen.nl/en/cryptography/ https://www.ceesjansen.nl/en/cryptography/ [2] https://www.tandfonline.com/doi/full/10.1080/02684527.2020.1743538 https://www.tandfonline.com/doi/full/10.1080/02684527.2020.1...
1cvmask 6y ago
Ericsson has sold equipment with backdoors (as has other historical Western vendors like Philips telecommuncations) for the NSA and CIA. “There is a root backdoor in the telnetd of Ericssons AXE backdoor” https://www.schneier.com/blog/archives/2006/03/more_on_greek_w.html https://www.schneier.com/blog/archives/2006/03/more_on_greek... https://www.schneier.com/blog/archives/2020/04/another_story_o.html https://www.schneier.com/blog/archives/2020/04/another_story... The article in Dutch on Philips Telecommuncations (which became Lucent later on): https://www.volkskrant.nl/nieuws-achtergrond/nederland-luisterde-jarenlang-landen-af-dankzij-superchip~bc9a9ce4/ https://www.volkskrant.nl/nieuws-achtergrond/nederland-luist... https://www.schneier.com/blog/archives/2007/07/story_of_the_gr_1.html https://www.schneier.com/blog/archives/2007/07/story_of_the_... https://www.schneier.com/blog/archives/2006/02/phone_tapping_i.html https://www.schneier.com/blog/archives/2006/02/phone_tapping... https://theintercept.com/2015/09/28/death-athens-rogue-nsa-operation/ https://theintercept.com/2015/09/28/death-athens-rogue-nsa-o... https://www.theguardian.com/commentisfree/2015/sep/30/athens-affair-encryption-backdoors https://www.theguardian.com/commentisfree/2015/sep/30/athens... and all time favorite: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
- quelsolaar 6y ago
  I'm aware of a number of backdoor that have been inserted by western governments. Linus claims at one point the NSA asked him to put in a backdoor in to Linux. The difference is that in a free society Linus can go public and that makes it much more risky for a intelligence service to try it. It doesn't mean it doesn't happen. The "Back doors" in AXE are a slightly different thing. Many countries have laws that says that law enforcement have the right to wiretap phone calls under some circumstances. This means that telcos want and ask for this feature so that they can comply with the law. The telcos are aware of the systems capability because they need it to be there. Anyone who reads the law can see that the telcos has to facilitate wiretapping, but they obviously dont want to advertise it, so its an open secret. Its quite different if you deliver a solution, with a hidden back door that the customer dont know about or have asked for, for the benefit of the intelligence service in the country of manufacturing. Enabling a nation to wiretap illegally in countries where they do not have jurisdiction.
mr_toad 6y ago
> would love to have access to fully compromised networks If this became known the subjects of interest would stop using those networks. Only the low level criminals would be dumb enough to get caught.
MomoXenosaga 6y ago
After Watergate in the 1970s a huge debate broke out in the US about spying and surveillance. The compromise they reached is that non US citizens are not covered by the Constitution. I think you're giving the US and it's people too much credit. Ultimately America will do whatever it must to maintain it's superpower status. Any country that is serious about cyber security needs to develop and maintain its own communication network.

marsven_422 6y ago

"Sweden has a fairly free press" That's so wrong it hurts! All our press are dependent on government "presstöd" aka handouts.

Swenrekcah 6y ago
The press can be free regardless. If the allocations are according to some objective metrics then I don’t see a problem.
- whatshisface 6y ago
  Objective metrics can be as biased as subjective metrics.
  - Swenrekcah 6y ago
    I disagree. The complaint was that a grant from the government makes the press less free to criticise the government. If the grant is clearly and legally bound to be determined according to a set of objective and publicly available metrics I do not see that it would be such a big problem. Of course a vindictive government could do what they can to negatively affect the press outlet in question but similarly could a supporting public affect them. In any case it can all be accounted and prepared for as long as the process is objective and transparent.
  - 1cvmask 6y ago
    The selection of arbitrary objective metrics and the weight associated to them is subjective by nature. Every ranking system is subjective by definition even if the outcomes are measured objectively. Every ranking system is by definition mathematical garbage that we use to evaluate whatever we feel the need to evaluate. We still need them as filters and for other reasons.
- fallingknife 6y ago
  If the government has the power to grant money and set metrics, it also has the power to take it away, and change the metrics. So if you are getting a grant based on "objective metrics," it might be a good idea to not piss of the people defining them.
  - Swenrekcah 6y ago
    Of course but that is a move that costs the government something in political capital. There are always dangers in criticising the powers that be, but I can not see that these kinds of press grants are a big problem. If the country is a democratic one to begin with, the grants do more good by insulating the press from commercial powers than they do bad in this way, in my opinion.
    - fallingknife 6y ago
      It may well be a good trade off. I'm just pointing out that there is never a way to be completely free from whoever is paying the bills.
quelsolaar 6y ago
According to Reporters without borders, Sweden ranks 4th in the world, in press freedom. I think that would qualify as "fairly free". https://rsf.org/en/ranking_table https://rsf.org/en/ranking_table
- 1cvmask 6y ago
  Always be wary of such (and for that matter any) rankings and take them with a massive amount of salt. These NGOs are often fronts for agendas. https://rsf.org/en/our-supporters https://rsf.org/en/our-supporters They have the CIA vehicle for regime change as one of their sponsors, the amusingly named National Endowment for Democracy that specializes in overthrowing non-white democracies and regime change. https://en.wikipedia.org/wiki/National_Endowment_for_Democracy https://en.wikipedia.org/wiki/National_Endowment_for_Democra... https://williamblum.org/chapters/rogue-state/trojan-horse-the-national-endowment-for-democracy https://williamblum.org/chapters/rogue-state/trojan-horse-th...
  - freeflight 6y ago
    > National Endowment for Democracy that specializes in overthrowing non-white democracies and regime change. They also don't mind white regime change, NED, along with NATO, the US DoS, and a couple of other rather relevant names, where openly sponsoring [0] "Yat's our man" [1], who ended up becoming PM of Ukraine after Euromaidan escalated into a full blown coup. [0] https://web.archive.org/web/20200328203654/https://openukraine.org/en/about/partners https://web.archive.org/web/20200328203654/https://openukrai... [1] https://www.bbc.com/news/world-europe-26079957 https://www.bbc.com/news/world-europe-26079957
pa7ch 6y ago
Independent and free are not the same thing. You could say sweden's press is free despite its dependance. However, maybe the sweden gov values free press and the press is free via this relationship.

cratermoon 6y ago

> there are risks associated with tapping in to these systems Which is why the intelligence services never do the hacking themselves. Instead, they buy the data off the "dark web", from the hackers whole stole and the information brokers who trade in it. If they have to do that, that is. In the US at least, agencies can just buy data on the open market. Supposedly "anonymized", but I'm pretty sure everyone reading this knows that protection is flimsy.

goodpoint 6y ago
Plenty of evidence proves that intelligent services: - Buy exploits on the market, with the US govt being the biggest buyer. - Buy data off legitimate advertising and intelligence companies - Hire people to find bugdoors - Hire people to infiltrate all sorts of companies and extract information or plant bugdoors - Convince or coerce companies to plant bugdoors in their own products - Do the hacking themselves, plant hardware backdoors and so on Unsurprisingly, they use all available methods.
- cratermoon 6y ago
  OK, I should not have said never, but when the option is between "we could hack this but if we get caught it would be an international diplomatic incident" and "hey there's a broker over here with the data for sale", the do buy it.

adammenges 6y ago

There’s a clear bias in your thinking against the US and for Sweden. Any of the points you bring up could equally apply to both places, but you come out bring the negative against one and the positive against the other.

sneak 6y ago

> The US is somewhere in between. Bart Gellman's book says that Snowden warned him not to be the only person in possession of the leaked data prior to publication, as the US intelligence community would kill him (Gellman) instantly to prevent the publication of the information contained therein. This was the biggest takeaway from the book, for me: the US military will assassinate US citizens (journalists!) in the middle of New York City without due process or a trial to prevent them from carrying out journalism. We expect this kind of cloak and dagger shit from the CIA, but it pays to think about it in clear terms: the US military can and will assassinate US citizens engaging in constitutionally protected activity in the middle of Manhattan with no consequences whatsoever.

afrodc_ 6y ago
Is there proof of this or is this conjecture?
- sneak 6y ago
  Two examples we know of of the CIA assassinating Americans without trial or consequences: https://en.wikipedia.org/wiki/Anwar_al-Awlaki https://en.wikipedia.org/wiki/Anwar_al-Awlaki https://en.wikipedia.org/wiki/Abdulrahman_al-Awlaki https://en.wikipedia.org/wiki/Abdulrahman_al-Awlaki The potential murder of Gellman was stated by Snowden, who was trained by the CIA, and was stated on more than one occasion.
  - opnitro 6y ago
    Also this, which wasn't directly the CIA but by CIA backed groups: https://en.wikipedia.org/wiki/Orlando_Letelier https://en.wikipedia.org/wiki/Orlando_Letelier, a political assassination on US soil. (Although not a US citizen)
    - selectodude 6y ago
      That's one heck of a leap to blame on the CIA.

rcarmo 6y ago

Nobody needs backdoors when there are quite complete legal interception features regulated into core systems. Plus everything is IP these days, so tapping a call is trivial. It just can't really be done towards outside the telco network without anyone noticing, the world isn't a hacker movie...

ng55QPSK 6y ago

Google Ericsson Vodafone Greece. And for US, google Cloud Act.

NKosmatos 6y ago
The wiretapping scandal you are referring to is known as "The Athens Affair" and has to do with infiltration of Ericsson software exchanges by experts on how the software is working. Vodafone is/was the one to blame here and it wasn't a fault of the software provided by Ericsson. More info here: https://spectrum.ieee.org/telecom/security/the-athens-affair https://spectrum.ieee.org/telecom/security/the-athens-affair
ChrisKnott 6y ago
The CLOUD Act is a mechanism for legal authorities to compel companies to produce data they hold, even if it is stored on servers outside the US. I don't think it's fair to characterise that as a backdoor.
- MomoXenosaga 6y ago
  The US can use the front door and nobody can stop them. That's the dividend of being a superpower. It's the good old gunboat diplomacy for the 21st century. What are local potentates going to do against America?

riazrizvi 6y ago

> Does that mean that all systems are compromised? No, because there are risks associated with tapping in to these systems. Partly it depends on if they have access to the systems, but mostly on the possible blow-back if they get caught. Isn’t it common knowledge that the US and China is spying on everyone? The main difference is that China is not a military ally, and its government spying, which is unfettered, supports its private enterprise that is government financed and owned. US govt spying is unfettered. US corporate spying far more restricted because US businesses are bound by Federal and State laws, and it’s not centrally coordinated, instead US businesses are autonomous entities. And though US corporate spying on customers is rampant, it is also transparently written into usage contracts. US corporate spying is obviously for profit, and since the US and Europe are strategically tied through NATO, it’s not on the same threat level. China and its axis ally Russia, clearly bump up against the West because our political systems are fundamentally opposite, democratic vs autocratic. What this translates to is Chinese investors are agressively running around buying into key strategic businesses, advised by data gathering in coordination with its government, with a view to maintaining control, which reflects how the country is managed itself. American investors are running around buying/competing against business in coordination with data rich parent company entities, with a view to making money. But because it’s a democratic country where laws preserve autonomy even against the government, it’s a free for all and anyone can play, even Chinese owned American companies. Which is a reflection of how the US is managed itself. This is also how Europe is managed, so I do believe Chinese control of telcos is a bigger threat to Europe’s way of life.

whatshisface 6y ago
>China and its axis ally Russia, clearly bump up against the West because our political systems are fundamentally opposite, democratic vs autocratic. This is a speck of misapprehension that slipped in to your otherwise great writeup. Governments don't naturally conflict because they have different forms and they don't make automatic friends when they are similar. The US is presently allied with many autocracies. Middle-aged Europe was uniformly feudal, and constantly at war. Pre-WWII America was strictly isolationist and despite being a democracy had a fairly sized pro-Hitler element. Governments conflict when they have something to conflict over.

DyslexicAtheist 6y ago

this isn't how any of this works. we're talking about ISP's & Telco networks not some data-center at FAANG. - no need for backdoors since Huawei, Ericsson & Nokia are full to the brim with bugdoors (Huawei tops the chart here since many years already and as anyone involved in Inter-Operability-Testing (IOT) at the NEV will confirm). - no need for "compromising networks" when you have the actual vendor (Huawei, Nokia, Ericsson often their subcontractors) sitting totally legally in your ISP's network and being paid for responding to the alarms raised and escalated by O&M. - even the attacks against 3/4/5G become academic in the discussion of nation state threat actors when they can operate and exploit simply as an insider of the system. These weaknesses (as outrageous as they are) are useful but it's a different threat model

quelsolaar 6y ago
I don't have any non-public insight as to how intelligence agencies operate, so this is pure conjecture on my part: If I was I was a intelligence agency in a country where there is a risk of blow-back, like in Europe or the US, I might prefer to use exploits. That way you haven't compromised your own country infrastructure (as much) and the risk of leaks is much lower since you dont have to work with an outside entity. A government agency forcing a domestic company to add backdoors, looks much worse if it gets out, then an agency using existing bugs. If I'm a Intelligence agency in a country that doesn't care about blow-back like China or Russia, why bother finding and using an exploit, when you can call up the vendor and have them design the system with your use-case in mind? You dont have to worry about someone fixing the bug you have spent man years making exploitable, and you can make sure the backdoor can only be used by you. Its way more convenient and cost effective.
- rocqua 6y ago
  > why bother finding and using an exploit, when you can call up the vendor and have them design the system with your use-case in mind? China is now suffering fron Huawei blowback in quite a few western countries.
  - quelsolaar 6y ago

the-dude 6y ago

Airbus to sue over US-German spying row [0] [0] https://www.bbc.com/news/world-europe-32542140 https://www.bbc.com/news/world-europe-32542140

secondcoming 6y ago

If the Dutch would get Philips to weaken crypto devices [0], [1] then it wouldn't surprise me if the Swedes would ask the same of Ericsson [2] [0] https://www.vpro.nl/argos/lees/onderwerpen/cryptoleaks/2020/cryptoleaks-in-the-netherlands-former-philips-top-cryptographer-admits-to-compromising-encryption-devices.html https://www.vpro.nl/argos/lees/onderwerpen/cryptoleaks/2020/... [1] https://www.ceesjansen.nl/en/cryptography/ https://www.ceesjansen.nl/en/cryptography/ [2] https://www.tandfonline.com/doi/full/10.1080/02684527.2020.1743538 https://www.tandfonline.com/doi/full/10.1080/02684527.2020.1...

1cvmask 6y ago

Ericsson has sold equipment with backdoors (as has other historical Western vendors like Philips telecommuncations) for the NSA and CIA. “There is a root backdoor in the telnetd of Ericssons AXE backdoor” https://www.schneier.com/blog/archives/2006/03/more_on_greek_w.html https://www.schneier.com/blog/archives/2006/03/more_on_greek... https://www.schneier.com/blog/archives/2020/04/another_story_o.html https://www.schneier.com/blog/archives/2020/04/another_story... The article in Dutch on Philips Telecommuncations (which became Lucent later on): https://www.volkskrant.nl/nieuws-achtergrond/nederland-luisterde-jarenlang-landen-af-dankzij-superchip~bc9a9ce4/ https://www.volkskrant.nl/nieuws-achtergrond/nederland-luist... https://www.schneier.com/blog/archives/2007/07/story_of_the_gr_1.html https://www.schneier.com/blog/archives/2007/07/story_of_the_... https://www.schneier.com/blog/archives/2006/02/phone_tapping_i.html https://www.schneier.com/blog/archives/2006/02/phone_tapping... https://theintercept.com/2015/09/28/death-athens-rogue-nsa-operation/ https://theintercept.com/2015/09/28/death-athens-rogue-nsa-o... https://www.theguardian.com/commentisfree/2015/sep/30/athens-affair-encryption-backdoors https://www.theguardian.com/commentisfree/2015/sep/30/athens... and all time favorite: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG

quelsolaar 6y ago
I'm aware of a number of backdoor that have been inserted by western governments. Linus claims at one point the NSA asked him to put in a backdoor in to Linux. The difference is that in a free society Linus can go public and that makes it much more risky for a intelligence service to try it. It doesn't mean it doesn't happen. The "Back doors" in AXE are a slightly different thing. Many countries have laws that says that law enforcement have the right to wiretap phone calls under some circumstances. This means that telcos want and ask for this feature so that they can comply with the law. The telcos are aware of the systems capability because they need it to be there. Anyone who reads the law can see that the telcos has to facilitate wiretapping, but they obviously dont want to advertise it, so its an open secret. Its quite different if you deliver a solution, with a hidden back door that the customer dont know about or have asked for, for the benefit of the intelligence service in the country of manufacturing. Enabling a nation to wiretap illegally in countries where they do not have jurisdiction.

mr_toad 6y ago

> would love to have access to fully compromised networks If this became known the subjects of interest would stop using those networks. Only the low level criminals would be dumb enough to get caught.

MomoXenosaga 6y ago

After Watergate in the 1970s a huge debate broke out in the US about spying and surveillance. The compromise they reached is that non US citizens are not covered by the Constitution. I think you're giving the US and it's people too much credit. Ultimately America will do whatever it must to maintain it's superpower status. Any country that is serious about cyber security needs to develop and maintain its own communication network.