3 ms·
I've personally analysed various Chinese CCTV firmware vendors and backdoors planted there were obvious, here's an example: https://github.com/zb3/tiandy-resear
by zb3 3y ago
I've personally analysed various Chinese CCTV firmware vendors and backdoors planted there were obvious, here's an example: https://github.com/zb3/tiandy-research https://github.com/zb3/tiandy-research, but a better example was XiongMai which actively tried to disguise the backdoor ("Ret" was normally used for replies in that protocol, but the backdoor op requires it set in the request, you can't explain this by incompetence)
Are vendors in the US or EU required to do crap like that while also being prohibited to admit it?
Of course services that collect the data "in the cloud" share that data with the government, but this is official and predictable.
- _heimdall 3y agoI expect it depends quite a bit on how specific of a definitions of "backdoors" we're talking about. Our main OSes, desktop and mobile, have quite a few backdoors though I couldn't speak to whether the government forced them to do it. Mobile phones, mobile networks, and most (if not all) of the internet trunk lines include backdoors for the government to use. Data collection isn't technically a backdoor, though functionally it is as it allows the government to do what they want to while dodging regulations for search warrants and similar. The Twitter files point to another backdoor, even if again not technically quite a software "backdoor". If we stick to the strict definition of a backdoor, the CCP very likely has more control over companies and does require software backdoors for the government to access. In a more general sense though, I at least wouldn't consider the US or the EU to be meaningfully better about the government having access to and control of tech in much the same way.
- vizzier 3y agohttps://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/XKeyscore https://en.wikipedia.org/wiki/XKeyscore https://en.wikipedia.org/wiki/2010s_global_surveillance_disclosures https://en.wikipedia.org/wiki/2010s_global_surveillance_disc... Its certainly not like we don't try.
- axus 3y agoMaybe the shoddy backdoors are an example of malicious compliance with the law? Probably not, they'd lose less sales if the backdoors were well hidden.
- zb3 3y agoThese are white-label though, you don't buy a "XiongMai" product, you buy a product that you think is made by your local manufacturer, except it has Chinese firmware inside..