6 ms·

This is great. The next question will be how much trust can we place in the networks of our allies that still use compromised equipment from Huawei?

Ekaros 5y ago
And real question how much trust the "allies" can place in any equipment from USA...
- WarOnPrivacy 5y ago
  The last clear report we had was from 2013 and the answer then was "Trust. LOL!"
- sct202 5y ago
  Shouldn't be too much of a worry since the next 2 largest vendors of telecom equipment are European (Nokia and Ericsson). Although, Nokia owns the remnants of a bunch of US companies like Lucent and Motorola Networks so they may be more connected to the US.
  - jpgvm 5y ago
    I would say the biggest and most important chunks of both came from Nortel. Vast majority of what we consider as 4G and 5G was developed at Nortel and during the collapse was scooped up by Ericson/Nokia and Huawei (though the latter mostly just hired ex-Nortel researchers and engineers).
    - 1cvmask 5y ago
      Not 5G. The reason why Huawei became a leader in 5G is that they created all their technology around the discoveries of Erdal Arikan and bet the whole farm on it: https://www.wired.com/story/huawei-5g-polar-codes-data-breakthrough/ https://www.wired.com/story/huawei-5g-polar-codes-data-break... https://en.wikipedia.org/wiki/Erdal_Ar%C4%B1kan https://en.wikipedia.org/wiki/Erdal_Ar%C4%B1kan
    - throwaway4web 5y ago
      > Vast majority of what we consider as 4G and 5G was developed at Nortel and during the collapse was scooped up by Ericson This is simply not true. Source: worked for Ericsson for 17 years. Worker on both 4G and 5G / cloud native. Also worked with ex Nortel people.
    - 908B64B197 5y ago
      > Vast majority of what we consider as 4G and 5G was developed at Nortel Citation needed here. The company was dead years before they drafted the first spec for 4G.
  - 1cvmask 5y ago
    Those are also compromised. Phillips telecoms used to have trapdoors for the NSA and so did Ericsson. Some of the Nokia routers from the early 2000s made in Oregon also did allegedly. https://www.schneier.com/blog/archives/2006/02/phone_tapping_i.html https://www.schneier.com/blog/archives/2006/02/phone_tapping... https://www.schneier.com/blog/archives/2006/06/greek_wiretappi_1.html https://www.schneier.com/blog/archives/2006/06/greek_wiretap... https://theintercept.com/2018/03/01/nsa-global-surveillance-sigint-seniors/ https://theintercept.com/2018/03/01/nsa-global-surveillance-...
    - throwaway4web 5y ago
      The Greek wiretapping case involving Ericsson equipment was not due to a “trapdoor” but a malicious implant installed by a threat actor. This is documented in an excellent article by the IEEE [1] Darknet Diaries produced a podcast on the whole affair which makes for great listening. The podcast episode includes additional details which have surfaced after the IEEE article mentioned [2] [1] https://spectrum.ieee.org/the-athens-affair https://spectrum.ieee.org/the-athens-affair [2] https://darknetdiaries.com/episode/64/ https://darknetdiaries.com/episode/64/
- PontifexMinimus 5y ago
  Any country that doesn't want others to read its communications is going to have to produce its own telecoms equipment, because the temptation of a country to put backdoors in it is just too high.
- dleslie 5y ago
  Let's imagine this as personal relationships. On the one hand, your trusted and long-term partner shares a credit card and bank account with you, so you're aware that they know how and where you're spending money. You spend a lot of time together at home, so it's likely they're listening into your phone calls. On the other hand, a malicious individual has infiltrated your bank account and installed surveillance equipment in your home. These two situations are not the same.
  - mehlmao 5y ago
    Is the malicious individual the NSA backdooring Juniper and other firewalls, is it China, or both?
    - dleslie 5y ago
      It's obviously China. We might not like everything our partners do, but there's a reason we have a basis of trust with them and not with clearly adversarial and malicious entities.
      - jacquesm 5y ago
        There is hard proof that both Belgium and Germany had various networks/major telcos compromised. And I would not be at all surprised if there were others.
        dleslie 5y ago
        It's been a few generations since either Belgium or Germany had concentration camps, and both are allies of the Five Eyes, to varying extents.
        jacquesm 5y ago
        What on earth does that have to do with this?
- kube-system 5y ago
  If you have an agreement with [country A] to work together in pursuit of the same goals, and you don't have an agreement with [country B] to work together in pursuit of the same goals. Which one would you trust more? Building alliances is nearly synonymous with building trust.
- nonethewiser 5y ago
  It's not simply a matter of trust. You should assume it's all insecure. It's a matter of whose interests align with yours the most.
echelon 5y ago
> The next question will be how much trust can we place in the networks of our allies that still use compromised equipment from Huawei? Start a similar program to replace their equipment, too.
- Dah00n 5y ago
  Not very likely IMO. Even if they US paid for the hardware many (most?) users of Huawei tele equipment would not want to touch it (especially not US made). Huawei had a much better reputation (and in my experience they still do with people that actually touch the hardware) for listening to requests from users/buyers than pretty much any other manufacture. There's a reason their equipment is widespread and unlike what most seem to believe price is at best on par with them being better. The difference in what I have heard and read from people that work with this and the mainstream-media etc. is mindbogglingly different. Only in a few articles in mainstream-media have I seen those people even asked their opinion and then the picture is much, much less one-sided.
jpgvm 5y ago
Do people already need a reminder of the Juniper JunOS situation? I don't think this is a good thing. On one had we have Huawei which is untrusted by default, everyone assumes it has a backdoor but yet there are no reports of said backdoor and no evidence that networks using the hardware have suffered from exfiltration or infiltration. On the other hand Juniper was very publicly compromised and networks running their hardware were most definitely subject to attack. That said; this is probably primarily focused on wireless networks and if they are replacing Huawei it will be with Ericson or Nokia gear which I think we can have some manner of trust in. EDIT: My point is I think the Huawei equipment being assumed untrusted is a better model than assumed "trusted" suppliers that can easily be back doored because no-one is looking as hard.
- redis_mlc 5y ago
  > I don't think this is a good thing. The CCP has been at war with the US since 1947, but you don't think it's a good thing?
- sebow 5y ago
  I don't know what you're talking about with "allegedly". Bloomberg "allegedly" found HW backdoors in huawei, Vodafone also "allegedly" found backdoors in their equipment from huawei back in the day(i think about a decade ago). When you go talk to your red-team pentester friends, you quickly find out that the black market is full of 0days or full-blown backdoors for huawei equipment, from routers to consumer-grade mobile phones.They're not the only ones, but there's a clear discrepancy. While in the consumer space Huawei might not be ever fully-banned (imo even though they should, because people are f*cking stupid and it's already too late), in gov & military(especially NATO) infrastructure, i'm guaranteeing they're already(US,AUS,JP,PL,RO) or soon to be banned. Now the what-about argument is gonna follow here, saying "how about western companies that also engage in privacy-violating and espionage policies?".Yes that's also obviously true, but to a much lesser degree, and those companies/corporations main concern is money&profit,unlike Huawei.They might collude with governments and institutions, but they're not fully controlled by one, like in the fascistic China at the moment.And i say fascistic because chinese companies conveniently use 'free'-markets inside China and Western countries up to the point where their gov. notices and dictates their every move.
Veserv 5y ago
This is meaningless. Even if we assume that all Huawei products are currently backdoored, the security of commercial IT products is so bad that they pose no impediment to any organization more talented than a group of script kiddies. A complete replacement of all Huawei equipment does not in any way materially improve security of the network against a competent nation state attacker. At most it might cause their operational budget to increase by 0.1% to fund exploit development of the replacement equipment on the off chance that they are utterly incompetent and do not already have a hoard of hundreds of exploits in all existing systems like the CIA did as revealed in the Vault 7 hack. A material increase in security would require switching from Huawei to systems around 1000x better than prevailing systems otherwise you should have exactly zero trust that the security of the network can even minimally impede an adversary like China.
- kube-system 5y ago
  > Even if we assume that all Huawei products are currently backdoored, the security of commercial IT products is so bad that they pose no impediment to any organization more talented than a group of script kiddies. The primary issue that the USG has with Huawei equipment is not technical security. It’s trust and governance. I’ll give you a really simplistic hypothetical example: Let’s say a Cisco and a Huawei box have the same exact vulnerability, and the US and China engage in an all-out cyber war. China can simply block Huawei’s support staff with sanctions. They don’t need a back door. Meanwhile the Cisco tech is already patching the Cisco box. Equal technology, unequal results. Not all issues regarding technology are about purely technical issues. Technology has to be implemented, maintained, patched, supported, etc. Those are primarily concerns of trust.
ClumsyPilot 5y ago
"how much trust can we place" If we really cared about trust, we would mandate that all national infrustructure be open source and, at a minimum, independantly security reviwed, and written in a safe language. This comes across just political posturing as usual.

Ekaros 5y ago

And real question how much trust the "allies" can place in any equipment from USA...

WarOnPrivacy 5y ago
The last clear report we had was from 2013 and the answer then was "Trust. LOL!"
sct202 5y ago
Shouldn't be too much of a worry since the next 2 largest vendors of telecom equipment are European (Nokia and Ericsson). Although, Nokia owns the remnants of a bunch of US companies like Lucent and Motorola Networks so they may be more connected to the US.
- jpgvm 5y ago
  I would say the biggest and most important chunks of both came from Nortel. Vast majority of what we consider as 4G and 5G was developed at Nortel and during the collapse was scooped up by Ericson/Nokia and Huawei (though the latter mostly just hired ex-Nortel researchers and engineers).
  - 1cvmask 5y ago
    Not 5G. The reason why Huawei became a leader in 5G is that they created all their technology around the discoveries of Erdal Arikan and bet the whole farm on it: https://www.wired.com/story/huawei-5g-polar-codes-data-breakthrough/ https://www.wired.com/story/huawei-5g-polar-codes-data-break... https://en.wikipedia.org/wiki/Erdal_Ar%C4%B1kan https://en.wikipedia.org/wiki/Erdal_Ar%C4%B1kan
  - throwaway4web 5y ago
    > Vast majority of what we consider as 4G and 5G was developed at Nortel and during the collapse was scooped up by Ericson This is simply not true. Source: worked for Ericsson for 17 years. Worker on both 4G and 5G / cloud native. Also worked with ex Nortel people.
  - 908B64B197 5y ago
    > Vast majority of what we consider as 4G and 5G was developed at Nortel Citation needed here. The company was dead years before they drafted the first spec for 4G.
- 1cvmask 5y ago
  Those are also compromised. Phillips telecoms used to have trapdoors for the NSA and so did Ericsson. Some of the Nokia routers from the early 2000s made in Oregon also did allegedly. https://www.schneier.com/blog/archives/2006/02/phone_tapping_i.html https://www.schneier.com/blog/archives/2006/02/phone_tapping... https://www.schneier.com/blog/archives/2006/06/greek_wiretappi_1.html https://www.schneier.com/blog/archives/2006/06/greek_wiretap... https://theintercept.com/2018/03/01/nsa-global-surveillance-sigint-seniors/ https://theintercept.com/2018/03/01/nsa-global-surveillance-...
  - throwaway4web 5y ago
    The Greek wiretapping case involving Ericsson equipment was not due to a “trapdoor” but a malicious implant installed by a threat actor. This is documented in an excellent article by the IEEE [1] Darknet Diaries produced a podcast on the whole affair which makes for great listening. The podcast episode includes additional details which have surfaced after the IEEE article mentioned [2] [1] https://spectrum.ieee.org/the-athens-affair https://spectrum.ieee.org/the-athens-affair [2] https://darknetdiaries.com/episode/64/ https://darknetdiaries.com/episode/64/
PontifexMinimus 5y ago
Any country that doesn't want others to read its communications is going to have to produce its own telecoms equipment, because the temptation of a country to put backdoors in it is just too high.
dleslie 5y ago
Let's imagine this as personal relationships. On the one hand, your trusted and long-term partner shares a credit card and bank account with you, so you're aware that they know how and where you're spending money. You spend a lot of time together at home, so it's likely they're listening into your phone calls. On the other hand, a malicious individual has infiltrated your bank account and installed surveillance equipment in your home. These two situations are not the same.
- mehlmao 5y ago
  Is the malicious individual the NSA backdooring Juniper and other firewalls, is it China, or both?
  - dleslie 5y ago
    It's obviously China. We might not like everything our partners do, but there's a reason we have a basis of trust with them and not with clearly adversarial and malicious entities.
    - jacquesm 5y ago
      There is hard proof that both Belgium and Germany had various networks/major telcos compromised. And I would not be at all surprised if there were others.
      - dleslie 5y ago
        It's been a few generations since either Belgium or Germany had concentration camps, and both are allies of the Five Eyes, to varying extents.
        jacquesm 5y ago
        What on earth does that have to do with this?
kube-system 5y ago
If you have an agreement with [country A] to work together in pursuit of the same goals, and you don't have an agreement with [country B] to work together in pursuit of the same goals. Which one would you trust more? Building alliances is nearly synonymous with building trust.
nonethewiser 5y ago
It's not simply a matter of trust. You should assume it's all insecure. It's a matter of whose interests align with yours the most.

echelon 5y ago

> The next question will be how much trust can we place in the networks of our allies that still use compromised equipment from Huawei? Start a similar program to replace their equipment, too.

Dah00n 5y ago
Not very likely IMO. Even if they US paid for the hardware many (most?) users of Huawei tele equipment would not want to touch it (especially not US made). Huawei had a much better reputation (and in my experience they still do with people that actually touch the hardware) for listening to requests from users/buyers than pretty much any other manufacture. There's a reason their equipment is widespread and unlike what most seem to believe price is at best on par with them being better. The difference in what I have heard and read from people that work with this and the mainstream-media etc. is mindbogglingly different. Only in a few articles in mainstream-media have I seen those people even asked their opinion and then the picture is much, much less one-sided.

jpgvm 5y ago

Do people already need a reminder of the Juniper JunOS situation? I don't think this is a good thing. On one had we have Huawei which is untrusted by default, everyone assumes it has a backdoor but yet there are no reports of said backdoor and no evidence that networks using the hardware have suffered from exfiltration or infiltration. On the other hand Juniper was very publicly compromised and networks running their hardware were most definitely subject to attack. That said; this is probably primarily focused on wireless networks and if they are replacing Huawei it will be with Ericson or Nokia gear which I think we can have some manner of trust in. EDIT: My point is I think the Huawei equipment being assumed untrusted is a better model than assumed "trusted" suppliers that can easily be back doored because no-one is looking as hard.

redis_mlc 5y ago
> I don't think this is a good thing. The CCP has been at war with the US since 1947, but you don't think it's a good thing?
sebow 5y ago
I don't know what you're talking about with "allegedly". Bloomberg "allegedly" found HW backdoors in huawei, Vodafone also "allegedly" found backdoors in their equipment from huawei back in the day(i think about a decade ago). When you go talk to your red-team pentester friends, you quickly find out that the black market is full of 0days or full-blown backdoors for huawei equipment, from routers to consumer-grade mobile phones.They're not the only ones, but there's a clear discrepancy. While in the consumer space Huawei might not be ever fully-banned (imo even though they should, because people are f*cking stupid and it's already too late), in gov & military(especially NATO) infrastructure, i'm guaranteeing they're already(US,AUS,JP,PL,RO) or soon to be banned. Now the what-about argument is gonna follow here, saying "how about western companies that also engage in privacy-violating and espionage policies?".Yes that's also obviously true, but to a much lesser degree, and those companies/corporations main concern is money&profit,unlike Huawei.They might collude with governments and institutions, but they're not fully controlled by one, like in the fascistic China at the moment.And i say fascistic because chinese companies conveniently use 'free'-markets inside China and Western countries up to the point where their gov. notices and dictates their every move.

Veserv 5y ago

This is meaningless. Even if we assume that all Huawei products are currently backdoored, the security of commercial IT products is so bad that they pose no impediment to any organization more talented than a group of script kiddies. A complete replacement of all Huawei equipment does not in any way materially improve security of the network against a competent nation state attacker. At most it might cause their operational budget to increase by 0.1% to fund exploit development of the replacement equipment on the off chance that they are utterly incompetent and do not already have a hoard of hundreds of exploits in all existing systems like the CIA did as revealed in the Vault 7 hack. A material increase in security would require switching from Huawei to systems around 1000x better than prevailing systems otherwise you should have exactly zero trust that the security of the network can even minimally impede an adversary like China.

kube-system 5y ago
> Even if we assume that all Huawei products are currently backdoored, the security of commercial IT products is so bad that they pose no impediment to any organization more talented than a group of script kiddies. The primary issue that the USG has with Huawei equipment is not technical security. It’s trust and governance. I’ll give you a really simplistic hypothetical example: Let’s say a Cisco and a Huawei box have the same exact vulnerability, and the US and China engage in an all-out cyber war. China can simply block Huawei’s support staff with sanctions. They don’t need a back door. Meanwhile the Cisco tech is already patching the Cisco box. Equal technology, unequal results. Not all issues regarding technology are about purely technical issues. Technology has to be implemented, maintained, patched, supported, etc. Those are primarily concerns of trust.

ClumsyPilot 5y ago

"how much trust can we place" If we really cared about trust, we would mandate that all national infrustructure be open source and, at a minimum, independantly security reviwed, and written in a safe language. This comes across just political posturing as usual.