7 ms·

Huawei stuff is proven to be compromised, just not by NSA, instead by China.

by tristor 3y ago

bigger_inside 3y ago
a CIA claim isn't "proof". I've never seen anything to prove it, just imperialist hysterics
- bhouston 3y ago
  It is fair to think that if the CIA is compromising US companies, then China is likely doing the same to Chinese companies. To assume otherwise is wishful thinking.
MaKey 3y ago
Where is the proof?
- kube-system 3y ago
  Chinese law requires Huawei to cooperate with their intelligence agencies.
  - DiogenesKynikos 3y ago
    That doesn't prove anything. You're just saying that Huawei could theoretically be compromised, but the above commenter asked for evidence.
    - kube-system 3y ago
      They are compromised in terms of governance, and their legal environment is the proof of this. Nobody has ever claimed that Huawei devices have backdoors. The issue is that the supply chain is compromised by legal means, not the hardware or software currently being shipped has technical vulnerabilities.
      - DiogenesKynikos 3y ago
        > Nobody has ever claimed that Huawei devices have backdoors. Just a few comments up in this thread, someone claimed definitively that Huawei equipment has been proven to be compromised, meaning backdoored. > They are compromised in terms of governance We don't have any known examples of Huawei being forced by the Chinese government to compromise its equipment. This is still a wholly theoretical discussion. In contrast, we know that the US government has inserted backdoors into American (and not just American) equipment, and is able to secretly compel companies to comply with US spying.
      - lmm 3y ago
        If you're using that non-standard definition of "compromised" then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised. I'd love it if people actually stuck to some principles and stopped buying from any of these countries. But using that legal situation as a reason to single out China/Huawei is bullshit.
        kube-system 3y ago
        "compromised" might be a word used by the tech community to refer specifically to technical compromises, but the word means something much more broad outside of tech forums. > then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised. Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other.
        lmm 3y ago
        > Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other. Doesn't seem to stop them from taking immensely hostile actions, e.g. the US spying on Merkel's emails, or helping killers and rapists who work for them evade arrest in "allied" countries. Governments are large and complex and have many competing interests. Why would/should one trust any of the ones I mentioned more than the government of China?
  - Aachen 3y ago
    As does the USA, so we shouldn't be using Windows or Yubico either, or virtually any other software/hardware from any other vendor because there's few countries that let you do illegal-over-there things without having a mechanism to force you It's a "pick your poison" situation, not a "they've got national security letters and so you can't trust them" one
    - kube-system 3y ago
      This is why security is not a "one size fits all" exercise. The first thing you must do is define your threat model. The reason the Chinese government doesn't want to build their telecom system on Cisco hardware is the same exact reason the USG doesn't want to do the same with Huawei hardware. Because neither government is delusional enough to think that parts/service/updates wouldn't be immediately sanctioned in times of war. The US and China are already sanctioning each other's tech. The risk of building critical infrastructure on it is obvious.
      - DiogenesKynikos 3y ago
        > The US and China are already sanctioning each other's tech. It's not symmetrical. Since Trump, the US has been extraordinarily aggressive in its use of sanctions against Chinese companies, whereas China has been very reluctant to retaliate directly. The US has sanctioned hundreds of Chinese tech companies. China has only recently begun to retaliate in kind, but has so far only sanctioned a few US companies (Micron is the only prominent example that comes to mind).
        kube-system 3y ago
        It isn't. And I didn't say it was. But the current state isn't the ultimate risk that is being considered. The ultimate risk is war, under which both the US and China would invoke defense powers to compel industry to act in their respective nations' interest, and would apply wide sanctions.
        DiogenesKynikos 3y ago
- HideousKojima 3y ago
  Since the Snowden leaks (and honestly since long before) it's been safe to assume that if a nation state has the means and motive to commit <insert form of illegal surveillance here>, then they will.
ElectricalUnion 3y ago
If anything, you probably need several layers of different, non-aligned country vendors to have some Swiss cheese model security. So some Huawei stuff, somewhere, as long as it isn't only Huawei stuff.
- J_Shelby_J 3y ago
  lmao it's like using a multi-hop VPN to hop through multiple jurisdictions, but in your own home!
- arecurrence 3y ago
  This is a great idea in that they’ll likely also patch their stuff when they discover the other team has exploited it.
- phatfish 3y ago
  Network designs i have seen often include this for much the same reason. A perimeter firewall is from one vendor and an internal firewall is from another. If there is a security issue with one device the other should not be effected in the same way.
- slt2021 3y ago
  checkpoint firewall (Israel), PAN/fortinet firewall (US), and huawei firewall (china) daisy chained - should keep each other in sync and provide defense in depth :D
rakoo 3y ago
China is way less dangerous to me than the NSA
- Aaronstotle 3y ago
  How is the NSA personally dangerous to you?
  - lcnPylGDnU4H9OF 3y ago
    Compared to any TLAs in China, the NSA is far more likely to take action against a US citizen for a thing that citizen chose to say. It's likely there's a low amount of actual danger but it's greater than that of what China poses.
  - MSFT_Edging 3y ago
    If you live in the US, you're under US federal jurisdiction. Unless you're regularly traveling to China or unearthing info that can seriously harm China, they're not going to send anyone after you. I rather be spied on by a foreign government than my own.
  - deleted 3y ago
    [deleted]
  - rakoo 3y ago
    As a non US citizen living in a western country, the NSA has no qualms analyzing everything I do/say/think, including in my activism, and tell on me to the government of my country.
tristor 3y ago
[flagged]
- NorwegianDude 3y ago
  That's not proof, that's just an accusation. Huawei even offered up source access to customers as a way to prove that they didn't do that. Not saying they don't do such things, but the evidence is lacking.
- RockRobotRock 3y ago
  [flagged]
  - tristor 3y ago
    I'd usually agree, except when it comes to saying anything critical of China on the Internet, my statement is very true. The wumao is a real thing, and they're pervasive within online tech.
    - RockRobotRock 3y ago
      Well your comment isn't greyed out or flagged, so they must be on vacation today :)
    - airgapstopgap 3y ago
      I wonder if you have enough self-awareness to notice why your behavior here might be considered bizarre. No, people who point out that your government routinely and brazenly backdoors equipment and software everyone uses (or rather, has forced upon them to use), while Chinese actions of this sort are evidenced to a lesser extent, and so the onus in justifying the use of that country's products is on the US at least as much as on China, are mostly not "wumao", nor whataboutists, nor anything of the sort. They're making an entirely sound argument an unbiased person would make given the context, you're just using those mind-killing political notions to dismiss a topic that offends your patriotic sensibilities. Wumaos are low-paid grunts and sincere idiots who disingenuously downvote, report and post irrelevant nonsense regarding racist imperialist AmeriKKKa or legitimate Chinese clay/territorial waters/6000 years of peaceful history. This is very easy to see. You're free to suspect any interlocutor as being one, of course, but if that's your only retort, you'd do better not stooping to the level of an undeniable propagandist and instead conceding the object-level issue – or keeping silent.
NorwegianDude 3y ago
Isn't that just the US speaking in order to get more control? How is it proven? I've never seen any evidence of that, but there has been much evidence that the US does what they blames others of doing, like this and Cisco. At this point it seems the US is accusing others for doing bad things because that's what they themselves do. Huawei was growing really fast, threatening both Apple and Google. Then the US said it was not safe while trying to sabotage both smart phone sales and mobile networks sales. The US pressured allied countries to not choose Huawei for 5G, and didn't let companies work with them. Huawei was also willing to compromise by giving network operators acces to source code. Is Huawei bad? I don't know, and I've yet to see any evidence. Does the US do exactly what they are accusing other for? Yes, that has been proven multiple times. We live in a day where we talk about privacy and security, while giving large corporations full control over our iOS and Android devices. How useful is e.g. E2E encryption really when the os itself has a direct connection to the mothership?
- BlueTemplar 3y ago
  China has a LOT to gain from industrial espionage, is extremely well known for its industrial espionage, and also happens to effectively own EU telecoms (the 5G thing was like a decade too late). It would be astounding if they didn't take advantage of this.
- HardlyCurious 3y ago
  There is ample evidence of China's intentions and capability to install backdoors. Everything made in China or a heavily influenced Chinese country should be assumed to be compromised, even if 'proven' otherwise. Chances are we just haven't found the backdoor yet.
  - lmm 3y ago
    Sure - but all that is equally true of the US.
    - HardlyCurious 3y ago
      True of the US yes. Equally? I probably wouldn't say that. The US govt doesn't have the same control over media the the Chinese govt has. So they have to work harder to keep things out of public view. The US also has to massage the way they work to be somewhat within the bounds of the constitution.
throwaway67743 3y ago
It was never proven to be compromised though. GCHQ concluded after many years that they were sloppy, not malicious. All of the fear mongering by the US is what gave everyone the impression they were compromised.
DiogenesKynikos 3y ago
To my knowledge, no proof has actually been publicly presented for this claim. There have been a few stories that didn't pan out (like the one that boiled down to, "Huawei devices have telnet installed"), but no actual evidence of backdoors has come to light yet. This is despite the fact that Huawei has been under an extraordinary level of scrutiny for years. British intelligence was given extensive access to Huawei's hardware and code, as a condition of Huawei equipment being installed in the UK. We know from Snowden that the NSA hacked into Huawei HQ, but there's no indication that they found any evidence of backdoors. And despite running a global campaign to convince/pressure other countries not to use Huawei, the US hasn't publicly unveiled any evidence of Huawei backdoors. British officials have even admitted that the UK's decision to ban Huawei was based on pressure from the US, not evidence of wrongdoing.[0,1] This all makes me think that the US, UK et al. don't actually have proof of backdoors. 0. https://www.theguardian.com/technology/2020/jul/18/pressure-from-trump-led-to-5g-ban-britain-tells-huawei https://www.theguardian.com/technology/2020/jul/18/pressure-... 1. https://www.euractiv.com/section/politics/short_news/uk-banned-huawei-because-us-told-us-to-former-minister/ https://www.euractiv.com/section/politics/short_news/uk-bann...
- bombas 3y ago
  Great post. Seeing similar with TikTok and DJI FUD
croes 3y ago
Proven? Did they ever show any evidence? I hear that claim pretty often but have never seen any proof unlike in Cisco hardware.

Huawei stuff is proven to be compromised, just not by NSA, instead by China.

bigger_inside 3y ago

a CIA claim isn't "proof". I've never seen anything to prove it, just imperialist hysterics

bhouston 3y ago
It is fair to think that if the CIA is compromising US companies, then China is likely doing the same to Chinese companies. To assume otherwise is wishful thinking.

MaKey 3y ago

Where is the proof?

kube-system 3y ago
Chinese law requires Huawei to cooperate with their intelligence agencies.
- DiogenesKynikos 3y ago
  That doesn't prove anything. You're just saying that Huawei could theoretically be compromised, but the above commenter asked for evidence.
  - kube-system 3y ago
    They are compromised in terms of governance, and their legal environment is the proof of this. Nobody has ever claimed that Huawei devices have backdoors. The issue is that the supply chain is compromised by legal means, not the hardware or software currently being shipped has technical vulnerabilities.
    - DiogenesKynikos 3y ago
      > Nobody has ever claimed that Huawei devices have backdoors. Just a few comments up in this thread, someone claimed definitively that Huawei equipment has been proven to be compromised, meaning backdoored. > They are compromised in terms of governance We don't have any known examples of Huawei being forced by the Chinese government to compromise its equipment. This is still a wholly theoretical discussion. In contrast, we know that the US government has inserted backdoors into American (and not just American) equipment, and is able to secretly compel companies to comply with US spying.
    - lmm 3y ago
      If you're using that non-standard definition of "compromised" then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised. I'd love it if people actually stuck to some principles and stopped buying from any of these countries. But using that legal situation as a reason to single out China/Huawei is bullshit.
      - kube-system 3y ago
        "compromised" might be a word used by the tech community to refer specifically to technical compromises, but the word means something much more broad outside of tech forums. > then anything substantially made in the US, Australia, South Korea, Israel or Kazakhstan (non-exhaustive list) should be considered compromised. Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other.
        lmm 3y ago
        > Not really, because many of those countries you listed have mutual treaties of cooperation and are not hostile to each other. Doesn't seem to stop them from taking immensely hostile actions, e.g. the US spying on Merkel's emails, or helping killers and rapists who work for them evade arrest in "allied" countries. Governments are large and complex and have many competing interests. Why would/should one trust any of the ones I mentioned more than the government of China?
- Aachen 3y ago
  As does the USA, so we shouldn't be using Windows or Yubico either, or virtually any other software/hardware from any other vendor because there's few countries that let you do illegal-over-there things without having a mechanism to force you It's a "pick your poison" situation, not a "they've got national security letters and so you can't trust them" one
  - kube-system 3y ago
    This is why security is not a "one size fits all" exercise. The first thing you must do is define your threat model. The reason the Chinese government doesn't want to build their telecom system on Cisco hardware is the same exact reason the USG doesn't want to do the same with Huawei hardware. Because neither government is delusional enough to think that parts/service/updates wouldn't be immediately sanctioned in times of war. The US and China are already sanctioning each other's tech. The risk of building critical infrastructure on it is obvious.
    - DiogenesKynikos 3y ago
      > The US and China are already sanctioning each other's tech. It's not symmetrical. Since Trump, the US has been extraordinarily aggressive in its use of sanctions against Chinese companies, whereas China has been very reluctant to retaliate directly. The US has sanctioned hundreds of Chinese tech companies. China has only recently begun to retaliate in kind, but has so far only sanctioned a few US companies (Micron is the only prominent example that comes to mind).
      - kube-system 3y ago
        It isn't. And I didn't say it was. But the current state isn't the ultimate risk that is being considered. The ultimate risk is war, under which both the US and China would invoke defense powers to compel industry to act in their respective nations' interest, and would apply wide sanctions.
        DiogenesKynikos 3y ago
HideousKojima 3y ago
Since the Snowden leaks (and honestly since long before) it's been safe to assume that if a nation state has the means and motive to commit <insert form of illegal surveillance here>, then they will.

ElectricalUnion 3y ago

If anything, you probably need several layers of different, non-aligned country vendors to have some Swiss cheese model security. So some Huawei stuff, somewhere, as long as it isn't only Huawei stuff.

J_Shelby_J 3y ago
lmao it's like using a multi-hop VPN to hop through multiple jurisdictions, but in your own home!
arecurrence 3y ago
This is a great idea in that they’ll likely also patch their stuff when they discover the other team has exploited it.
phatfish 3y ago
Network designs i have seen often include this for much the same reason. A perimeter firewall is from one vendor and an internal firewall is from another. If there is a security issue with one device the other should not be effected in the same way.
slt2021 3y ago
checkpoint firewall (Israel), PAN/fortinet firewall (US), and huawei firewall (china) daisy chained - should keep each other in sync and provide defense in depth :D

rakoo 3y ago

China is way less dangerous to me than the NSA

Aaronstotle 3y ago
How is the NSA personally dangerous to you?
- lcnPylGDnU4H9OF 3y ago
  Compared to any TLAs in China, the NSA is far more likely to take action against a US citizen for a thing that citizen chose to say. It's likely there's a low amount of actual danger but it's greater than that of what China poses.
- MSFT_Edging 3y ago
  If you live in the US, you're under US federal jurisdiction. Unless you're regularly traveling to China or unearthing info that can seriously harm China, they're not going to send anyone after you. I rather be spied on by a foreign government than my own.
- deleted 3y ago
  [deleted]
- rakoo 3y ago
  As a non US citizen living in a western country, the NSA has no qualms analyzing everything I do/say/think, including in my activism, and tell on me to the government of my country.

tristor 3y ago

[flagged]

NorwegianDude 3y ago
That's not proof, that's just an accusation. Huawei even offered up source access to customers as a way to prove that they didn't do that. Not saying they don't do such things, but the evidence is lacking.
RockRobotRock 3y ago
[flagged]
- tristor 3y ago
  I'd usually agree, except when it comes to saying anything critical of China on the Internet, my statement is very true. The wumao is a real thing, and they're pervasive within online tech.
  - RockRobotRock 3y ago
    Well your comment isn't greyed out or flagged, so they must be on vacation today :)
  - airgapstopgap 3y ago
    I wonder if you have enough self-awareness to notice why your behavior here might be considered bizarre. No, people who point out that your government routinely and brazenly backdoors equipment and software everyone uses (or rather, has forced upon them to use), while Chinese actions of this sort are evidenced to a lesser extent, and so the onus in justifying the use of that country's products is on the US at least as much as on China, are mostly not "wumao", nor whataboutists, nor anything of the sort. They're making an entirely sound argument an unbiased person would make given the context, you're just using those mind-killing political notions to dismiss a topic that offends your patriotic sensibilities. Wumaos are low-paid grunts and sincere idiots who disingenuously downvote, report and post irrelevant nonsense regarding racist imperialist AmeriKKKa or legitimate Chinese clay/territorial waters/6000 years of peaceful history. This is very easy to see. You're free to suspect any interlocutor as being one, of course, but if that's your only retort, you'd do better not stooping to the level of an undeniable propagandist and instead conceding the object-level issue – or keeping silent.

NorwegianDude 3y ago

Isn't that just the US speaking in order to get more control? How is it proven? I've never seen any evidence of that, but there has been much evidence that the US does what they blames others of doing, like this and Cisco. At this point it seems the US is accusing others for doing bad things because that's what they themselves do. Huawei was growing really fast, threatening both Apple and Google. Then the US said it was not safe while trying to sabotage both smart phone sales and mobile networks sales. The US pressured allied countries to not choose Huawei for 5G, and didn't let companies work with them. Huawei was also willing to compromise by giving network operators acces to source code. Is Huawei bad? I don't know, and I've yet to see any evidence. Does the US do exactly what they are accusing other for? Yes, that has been proven multiple times. We live in a day where we talk about privacy and security, while giving large corporations full control over our iOS and Android devices. How useful is e.g. E2E encryption really when the os itself has a direct connection to the mothership?

BlueTemplar 3y ago
China has a LOT to gain from industrial espionage, is extremely well known for its industrial espionage, and also happens to effectively own EU telecoms (the 5G thing was like a decade too late). It would be astounding if they didn't take advantage of this.
HardlyCurious 3y ago
There is ample evidence of China's intentions and capability to install backdoors. Everything made in China or a heavily influenced Chinese country should be assumed to be compromised, even if 'proven' otherwise. Chances are we just haven't found the backdoor yet.
- lmm 3y ago
  Sure - but all that is equally true of the US.
  - HardlyCurious 3y ago
    True of the US yes. Equally? I probably wouldn't say that. The US govt doesn't have the same control over media the the Chinese govt has. So they have to work harder to keep things out of public view. The US also has to massage the way they work to be somewhat within the bounds of the constitution.

throwaway67743 3y ago

It was never proven to be compromised though. GCHQ concluded after many years that they were sloppy, not malicious. All of the fear mongering by the US is what gave everyone the impression they were compromised.

DiogenesKynikos 3y ago

To my knowledge, no proof has actually been publicly presented for this claim. There have been a few stories that didn't pan out (like the one that boiled down to, "Huawei devices have telnet installed"), but no actual evidence of backdoors has come to light yet. This is despite the fact that Huawei has been under an extraordinary level of scrutiny for years. British intelligence was given extensive access to Huawei's hardware and code, as a condition of Huawei equipment being installed in the UK. We know from Snowden that the NSA hacked into Huawei HQ, but there's no indication that they found any evidence of backdoors. And despite running a global campaign to convince/pressure other countries not to use Huawei, the US hasn't publicly unveiled any evidence of Huawei backdoors. British officials have even admitted that the UK's decision to ban Huawei was based on pressure from the US, not evidence of wrongdoing.[0,1] This all makes me think that the US, UK et al. don't actually have proof of backdoors. 0. https://www.theguardian.com/technology/2020/jul/18/pressure-from-trump-led-to-5g-ban-britain-tells-huawei https://www.theguardian.com/technology/2020/jul/18/pressure-... 1. https://www.euractiv.com/section/politics/short_news/uk-banned-huawei-because-us-told-us-to-former-minister/ https://www.euractiv.com/section/politics/short_news/uk-bann...

bombas 3y ago
Great post. Seeing similar with TikTok and DJI FUD

croes 3y ago

Proven? Did they ever show any evidence? I hear that claim pretty often but have never seen any proof unlike in Cisco hardware.