7 ms·

While I have no doubt than basically anything from China is probably backdoored (and to the fault of western countries outsourcing manufacturing for cheap labou

While I have no doubt than basically anything from China is probably backdoored (and to the fault of western countries outsourcing manufacturing for cheap labour), what exactly has Huawei done? How do we know that the Cisco equipment also isn't backdoored and if I send a few malformed TCP packets it opens up its control plane on the receiving port? Compared to the last few decades, it seems like a strong hand banning these companies. Personally I would like all electronics and products to be made in countries that respect some level of human rights I am comfortable with, but that doesn't really seem like an option currently.

joemazerino 4y ago
Look up Nortel.
- unmole 4y ago
  The bloated tech gaint that refused to acknowledge the reality of the dotcom crash and then was brought down by an accounting scandal? That Nortel?
  - joemazerino 4y ago
    Yes. The Nortel that gave away proprietary equipment to Huawei for "testing" of which was returned in a tampered and obviously copied state.
reaperducer 4y ago
Your argument sounds like deflection and elementary school logic. If Cisco has problems, that should also be dealt with. But because Cisco has problems doesn't mean that Huawei shouldn't be dealt with. In Western cultures, we have the notion of "Two wrongs don't make a right." This is a classic Chinese government talking point. "Don't look at what we're doing. Look over there, instead!" For decades it's been using the same tactic when anyone criticizes China for trade imbalances and human rights abuses. It's really boring and base at this point.
- flumpcakes 4y ago
  > Your argument sounds like deflection and elementary school logic. A pessimistic and frankly rude reading of my comment. Cisco also has it's equipment manufactured outside of the united states, making them susceptible to similar backdooring without x-raying every board produced. > But because Cisco has problems doesn't mean that Huawei shouldn't be dealt with. Cisco is not getting banned by the FCC - so the comparison is moot.
  - cscurmudgeon 4y ago
    Cisco is also a US company while Huawei at the minimum colludes (and probably is controlled by) with an adversarial nation. https://en.wikipedia.org/wiki/Huawei#Collusion_with_Chinese_Communist_government https://en.wikipedia.org/wiki/Huawei#Collusion_with_Chinese_...
- throwaway199956 4y ago
  Cisco and Huawei can be subject to same set of regulations aginst having backdoors etc. But instead of general regulations and measures, what is promulgated is merely action against 2 particular firms, that is a targeted/particular regulation. Weather such targetted/discriminatory regulation as opposed to universal regulation is a legal action is a valid question. This particular law seems to give grant too much discretionary powers to the Executive, which never is a good idea.
- FpUser 4y ago
  ""In Western cultures, we have the notion of "Two wrongs don't make a right." I do not think it is specific to Western culture. And yes two wrongs definitely do not make it right and both must be punished. Now call me back when we see the first wrong being punished. We only seem to punish countries that fit very narrow criteria and murdering say hundreds of thousands is not the determining factor. Until then yes "Look over there" is a very valid argument.
blindriver 4y ago
Huawei singlehandedly destroyed Canada's Nortel Networks through espionage and sabotage. The CIA did an analysis and discovered that Huawei was dumping wireless equipment to small wireless providers in areas around US military basis at a loss. At the very least, the ability to disrupt communication of those military bases were easily achievable.
- Matl 4y ago
  > The CIA did an analysis I had my doubts, but not after the CIA said it's true.
  - proxyon 4y ago
    I was going to say whatever the CIA says assume the exact opposite. These guys literally invented the word misinformation.
- flumpcakes 4y ago
  Nortel networks haven't been around for nearly a decade. I've seen lots of news about 5G/Huaewi and 'core networks' only in the recent years in western countries (UK/US mainly). However, I haven't seen anything published that really reflects new risks/major backdoored products. I wouldn't 100% trust anything built in China, but there must be some reason people are only taking action now? Unless it's just "better late than never" response after years of this.
  - heavyset_go 4y ago
    People are taking action now because the West spent decades underestimating China, probably for xenophobic reasons. I'm willing to bet a lot of people assumed they weren't as capable as westerners and now it can't be denied. IMO, it was a classic mistake of underestimating a potential rival while stroking our own egos about how smart, capable and powerful we are in comparison. Reality finally trumped hubris.
    - seydor 4y ago
charleslmunger 4y ago
>How do we know that the Cisco equipment also isn't backdoored and if I send a few malformed TCP packets it opens up its control plane on the receiving port? Nothing so sophisticated is required. Look at the sheer number of "default credential" and "static credential" for a whole variety of products: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Cisco+credential+ https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Cisco+crede...
nr2x 4y ago
“I learned it from you dad”…
reshie 4y ago
it is probably paranoia but not improbable. they have direct control of these companies and can totally do this. others like the US would have to go less direct routes for these things.
Spooky23 4y ago
There’s a long history of telecom equipment being backdoored by the manufacturer or their national gov. You may recall everyone losing their shit on HN about the AT&T room in NYC where the fiber trunks were mirrored to a secret NSA room. Regardless of the whataboutism argument in Internet forums, it’s not in the national interest to give a hostile foreign power the ability to do something like that.
- 737min 4y ago
  Very well put, esp when the government is known for unapologetic surveillance and repression.
- flumpcakes 4y ago
  I agree. We should also force western companies to produce their products in the west too if they are needed for national security. A controller or motherboard in a switch or router being manufactured in China can have any number of bugs put in, up to and including making "fake" silicon that is backdoored.
fragmede 4y ago
We don't know that, because it's hard to prove a negative, but I'm also not sure if you chose Cisco on purpose, because a shortcoming by them was leaked: https://www.cnbc.com/2017/03/29/cisco-cyber-defense-flaws-exposed-by-wikileaks.html https://www.cnbc.com/2017/03/29/cisco-cyber-defense-flaws-ex... Supply chain management is a thing. Devices aren't assumed to get from the factory to you without interference and there is a lot of work behind the scenes to make assert they aren't interfered with.
Namidairo 4y ago
A Chinese brand I looked at has most of their network equipment connect back via MQTT with TLS, for IoT things. Except the agent had a pretty obvious command runner on one of the message handlers. I was a little afraid to ask them whether it was deliberate or just a really incompetently written backup update mechanism. To be fair, I was looking for arbitrary command execution for my own purposes at the time... I do get a decent chuckle when I see their OUI in scan results when out and about now. (About ~0.12% of the recorded results in Wigle it seems)
ScoobleDoodle 4y ago
Do you think Lenovo laptops are back door’s too?
- 737min 4y ago
  It is hard to know for sure, but it seems like a very hard temptation for any hostile, totalitarian government to resist? Imagine Germany selling radios to the UK in 1937...
- flumpcakes 4y ago
  I am typing on one now, but I wouldn't trust them to be used in any national security situation. Unfortunately we are beholden to autocratic countries as we have chosen cheap labour over everything else.
  - steve76 4y ago
    [dead]
- kube-system 4y ago
  Like Superfish?
fortuna86 4y ago
> what exactly has Huawei done? https://www.bloomberg.com/news/articles/2021-12-16/chinese-spies-accused-of-using-huawei-in-secret-australian-telecom-hack https://www.bloomberg.com/news/articles/2021-12-16/chinese-s...
SEJeff 4y ago
A few things to read: https://www.engadget.com/huawei-contractor-pakistan-backdoor-194308607.html https://www.engadget.com/huawei-contractor-pakistan-backdoor... https://www.notebookcheck.net/Huawei-caught-red-handed-The-company-has-backdoor-access-to-mobile-networks-worldwide.453724.0.html https://www.notebookcheck.net/Huawei-caught-red-handed-The-c... https://www.bloomberg.com/news/articles/2019-04-30/vodafone-found-hidden-backdoors-in-huawei-equipment https://www.bloomberg.com/news/articles/2019-04-30/vodafone-... Knowing the absolute mess this would cause diplomatically, they still said there was a back door: https://apnews.com/article/a0031b16e3a511e431b1e0a5f20edbf9 https://apnews.com/article/a0031b16e3a511e431b1e0a5f20edbf9 https://www.scmagazine.com/news/apt/microsoft-defender-advanced-threat-protection-atp-service-featured-in-windows-version-1809-discovered-an-nsa-inspired-backdoor-vulnerability-in-huawei-laptops https://www.scmagazine.com/news/apt/microsoft-defender-advan... Etc.
- mike_d 4y ago
  This one is good too: "A U.S. indictment alleges that Huawei and [CFO] Meng participated in a fraudulent scheme to obtain prohibited U.S. goods and technology for Huawei’s Iran-based business, and move money out of Iran by deceiving Western banks." https://www.reuters.com/article/us-huawei-iran-sanctions-exclusive/exclusive-newly-obtained-documents-show-huawei-role-in-shipping-prohibited-u-s-gear-to-iran-idUSKBN20P1VA https://www.reuters.com/article/us-huawei-iran-sanctions-exc...
kube-system 4y ago
> While I have no doubt than basically anything from China is probably backdoored (and to the fault of western countries outsourcing manufacturing for cheap labour), what exactly has Huawei done? Some others have pointed out some Huawei incidents, but that’s not the big problem. The big problem is, if you build your entire telecom infrastructure on Huawei gear, and then you go to war, it will then be weaponized. In the best case scenario, you have a telecom infrastructure for which you can’t get any parts, patches, or support. Replacing your entire telecom infrastructure is not something you want to do during the opening months of WWIII. It’s the same reason why we don’t want to rely on Chinese parts for our missiles.
- flumpcakes 4y ago
  I think this would also cover Cisco though, perhaps not so broadly. Our entire electronics industry is critically dependent on China for manufacturing. Thankfully the truly advanced stuff exists in Taiwan, Japan, South Korea, and the EU. But for cheap mass manufacturing, all of these parts end up in China. The west really needs to suck it up and have electronics designed and manufactured in the west. There are some good signs with the CHIPs act (if only the American companies were as patriotic instead of optimising for share price) and the EU are also making moves to be self sufficient for silicon. However, the entire electronics chain really needs local alternatives. It's crazy that I can get a prototype PCB manufactured and delivered from China faster and cheaper than anywhere local.
  - kube-system 4y ago
    The difference with Cisco is they’d want (/be required by shareholders) to continue to operate and shift production to other countries where electronics manufacturing does exist. And they have a management structure that is not beholden to CCP law.
deleted 4y ago
[deleted]

joemazerino 4y ago

Look up Nortel.

unmole 4y ago
The bloated tech gaint that refused to acknowledge the reality of the dotcom crash and then was brought down by an accounting scandal? That Nortel?
- joemazerino 4y ago
  Yes. The Nortel that gave away proprietary equipment to Huawei for "testing" of which was returned in a tampered and obviously copied state.

reaperducer 4y ago

Your argument sounds like deflection and elementary school logic. If Cisco has problems, that should also be dealt with. But because Cisco has problems doesn't mean that Huawei shouldn't be dealt with. In Western cultures, we have the notion of "Two wrongs don't make a right." This is a classic Chinese government talking point. "Don't look at what we're doing. Look over there, instead!" For decades it's been using the same tactic when anyone criticizes China for trade imbalances and human rights abuses. It's really boring and base at this point.

flumpcakes 4y ago
> Your argument sounds like deflection and elementary school logic. A pessimistic and frankly rude reading of my comment. Cisco also has it's equipment manufactured outside of the united states, making them susceptible to similar backdooring without x-raying every board produced. > But because Cisco has problems doesn't mean that Huawei shouldn't be dealt with. Cisco is not getting banned by the FCC - so the comparison is moot.
- cscurmudgeon 4y ago
  Cisco is also a US company while Huawei at the minimum colludes (and probably is controlled by) with an adversarial nation. https://en.wikipedia.org/wiki/Huawei#Collusion_with_Chinese_Communist_government https://en.wikipedia.org/wiki/Huawei#Collusion_with_Chinese_...
throwaway199956 4y ago
Cisco and Huawei can be subject to same set of regulations aginst having backdoors etc. But instead of general regulations and measures, what is promulgated is merely action against 2 particular firms, that is a targeted/particular regulation. Weather such targetted/discriminatory regulation as opposed to universal regulation is a legal action is a valid question. This particular law seems to give grant too much discretionary powers to the Executive, which never is a good idea.
FpUser 4y ago
""In Western cultures, we have the notion of "Two wrongs don't make a right." I do not think it is specific to Western culture. And yes two wrongs definitely do not make it right and both must be punished. Now call me back when we see the first wrong being punished. We only seem to punish countries that fit very narrow criteria and murdering say hundreds of thousands is not the determining factor. Until then yes "Look over there" is a very valid argument.

blindriver 4y ago

Huawei singlehandedly destroyed Canada's Nortel Networks through espionage and sabotage. The CIA did an analysis and discovered that Huawei was dumping wireless equipment to small wireless providers in areas around US military basis at a loss. At the very least, the ability to disrupt communication of those military bases were easily achievable.

Matl 4y ago
> The CIA did an analysis I had my doubts, but not after the CIA said it's true.
- proxyon 4y ago
  I was going to say whatever the CIA says assume the exact opposite. These guys literally invented the word misinformation.
flumpcakes 4y ago
Nortel networks haven't been around for nearly a decade. I've seen lots of news about 5G/Huaewi and 'core networks' only in the recent years in western countries (UK/US mainly). However, I haven't seen anything published that really reflects new risks/major backdoored products. I wouldn't 100% trust anything built in China, but there must be some reason people are only taking action now? Unless it's just "better late than never" response after years of this.
- heavyset_go 4y ago
  People are taking action now because the West spent decades underestimating China, probably for xenophobic reasons. I'm willing to bet a lot of people assumed they weren't as capable as westerners and now it can't be denied. IMO, it was a classic mistake of underestimating a potential rival while stroking our own egos about how smart, capable and powerful we are in comparison. Reality finally trumped hubris.
  - seydor 4y ago

charleslmunger 4y ago

>How do we know that the Cisco equipment also isn't backdoored and if I send a few malformed TCP packets it opens up its control plane on the receiving port? Nothing so sophisticated is required. Look at the sheer number of "default credential" and "static credential" for a whole variety of products: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Cisco+credential+ https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Cisco+crede...

nr2x 4y ago

“I learned it from you dad”…

reshie 4y ago

it is probably paranoia but not improbable. they have direct control of these companies and can totally do this. others like the US would have to go less direct routes for these things.

Spooky23 4y ago

There’s a long history of telecom equipment being backdoored by the manufacturer or their national gov. You may recall everyone losing their shit on HN about the AT&T room in NYC where the fiber trunks were mirrored to a secret NSA room. Regardless of the whataboutism argument in Internet forums, it’s not in the national interest to give a hostile foreign power the ability to do something like that.

737min 4y ago
Very well put, esp when the government is known for unapologetic surveillance and repression.
flumpcakes 4y ago
I agree. We should also force western companies to produce their products in the west too if they are needed for national security. A controller or motherboard in a switch or router being manufactured in China can have any number of bugs put in, up to and including making "fake" silicon that is backdoored.

fragmede 4y ago

We don't know that, because it's hard to prove a negative, but I'm also not sure if you chose Cisco on purpose, because a shortcoming by them was leaked: https://www.cnbc.com/2017/03/29/cisco-cyber-defense-flaws-exposed-by-wikileaks.html https://www.cnbc.com/2017/03/29/cisco-cyber-defense-flaws-ex... Supply chain management is a thing. Devices aren't assumed to get from the factory to you without interference and there is a lot of work behind the scenes to make assert they aren't interfered with.

Namidairo 4y ago

A Chinese brand I looked at has most of their network equipment connect back via MQTT with TLS, for IoT things. Except the agent had a pretty obvious command runner on one of the message handlers. I was a little afraid to ask them whether it was deliberate or just a really incompetently written backup update mechanism. To be fair, I was looking for arbitrary command execution for my own purposes at the time... I do get a decent chuckle when I see their OUI in scan results when out and about now. (About ~0.12% of the recorded results in Wigle it seems)

ScoobleDoodle 4y ago

Do you think Lenovo laptops are back door’s too?

737min 4y ago
It is hard to know for sure, but it seems like a very hard temptation for any hostile, totalitarian government to resist? Imagine Germany selling radios to the UK in 1937...
flumpcakes 4y ago
I am typing on one now, but I wouldn't trust them to be used in any national security situation. Unfortunately we are beholden to autocratic countries as we have chosen cheap labour over everything else.
- steve76 4y ago
  [dead]
kube-system 4y ago
Like Superfish?

fortuna86 4y ago

> what exactly has Huawei done? https://www.bloomberg.com/news/articles/2021-12-16/chinese-spies-accused-of-using-huawei-in-secret-australian-telecom-hack https://www.bloomberg.com/news/articles/2021-12-16/chinese-s...

SEJeff 4y ago

A few things to read: https://www.engadget.com/huawei-contractor-pakistan-backdoor-194308607.html https://www.engadget.com/huawei-contractor-pakistan-backdoor... https://www.notebookcheck.net/Huawei-caught-red-handed-The-company-has-backdoor-access-to-mobile-networks-worldwide.453724.0.html https://www.notebookcheck.net/Huawei-caught-red-handed-The-c... https://www.bloomberg.com/news/articles/2019-04-30/vodafone-found-hidden-backdoors-in-huawei-equipment https://www.bloomberg.com/news/articles/2019-04-30/vodafone-... Knowing the absolute mess this would cause diplomatically, they still said there was a back door: https://apnews.com/article/a0031b16e3a511e431b1e0a5f20edbf9 https://apnews.com/article/a0031b16e3a511e431b1e0a5f20edbf9 https://www.scmagazine.com/news/apt/microsoft-defender-advanced-threat-protection-atp-service-featured-in-windows-version-1809-discovered-an-nsa-inspired-backdoor-vulnerability-in-huawei-laptops https://www.scmagazine.com/news/apt/microsoft-defender-advan... Etc.

mike_d 4y ago
This one is good too: "A U.S. indictment alleges that Huawei and [CFO] Meng participated in a fraudulent scheme to obtain prohibited U.S. goods and technology for Huawei’s Iran-based business, and move money out of Iran by deceiving Western banks." https://www.reuters.com/article/us-huawei-iran-sanctions-exclusive/exclusive-newly-obtained-documents-show-huawei-role-in-shipping-prohibited-u-s-gear-to-iran-idUSKBN20P1VA https://www.reuters.com/article/us-huawei-iran-sanctions-exc...

kube-system 4y ago

> While I have no doubt than basically anything from China is probably backdoored (and to the fault of western countries outsourcing manufacturing for cheap labour), what exactly has Huawei done? Some others have pointed out some Huawei incidents, but that’s not the big problem. The big problem is, if you build your entire telecom infrastructure on Huawei gear, and then you go to war, it will then be weaponized. In the best case scenario, you have a telecom infrastructure for which you can’t get any parts, patches, or support. Replacing your entire telecom infrastructure is not something you want to do during the opening months of WWIII. It’s the same reason why we don’t want to rely on Chinese parts for our missiles.

flumpcakes 4y ago
I think this would also cover Cisco though, perhaps not so broadly. Our entire electronics industry is critically dependent on China for manufacturing. Thankfully the truly advanced stuff exists in Taiwan, Japan, South Korea, and the EU. But for cheap mass manufacturing, all of these parts end up in China. The west really needs to suck it up and have electronics designed and manufactured in the west. There are some good signs with the CHIPs act (if only the American companies were as patriotic instead of optimising for share price) and the EU are also making moves to be self sufficient for silicon. However, the entire electronics chain really needs local alternatives. It's crazy that I can get a prototype PCB manufactured and delivered from China faster and cheaper than anywhere local.
- kube-system 4y ago
  The difference with Cisco is they’d want (/be required by shareholders) to continue to operate and shift production to other countries where electronics manufacturing does exist. And they have a management structure that is not beholden to CCP law.

deleted 4y ago

[deleted]