4 ms·
Chinese-made port cranes in US included 'backdoor' modems, House report says
- blackeyeblitzar 2y agoThis is just embarrassing on multiple counts. No equipment from adversary countries should be allowed in American infrastructure. I wonder what sort of attacks are possible using such a modem, but maybe it doesn’t matter - they may find creative ways to disrupt operations like disabling the crane remotely. It’s interesting to see the tactics used by the crane manufacturer, ZPMC, to pressure port customers into accepting modems and arbitrary remote access, as detailed on page 29 (different prices, warranty issues). Also interesting is page 30, which highlights issues with using companies that we might normally trust, like ABB from Germany, because they in turn have a partnership with the offending Chinese company, ZPMC. What I’m taking away is that we have been complacent in managing risks from countries like China, and need to take an aggressive security minded approach to managing possible vulnerabilities and attacks.
- SapporoChris 2y ago"No equipment from adversary countries should be allowed in American infrastructure." Seems like an extreme take. Wouldn't it be better to accept the best equipment that has passed audit regardless of origin?
- pylua 2y agoWhere there is a will there is a way. No amount of audit has an acceptable error tolerance for critical infrastructure here.
- mensetmanusman 2y agoYes for allies, no for adversaries.
- refulgentis 2y agoThis is a much finer and quickly shifting distinction than OP's contribution and flippant replies imply. Right off the top of my head, Phillipines.
- pestatije 2y agoABB is not from Germany...what else in ur comment is bs?
- blackeyeblitzar 2y agoSorry ABB from Sweden/Switzerland. It was one of the competing crane companies in the report, Liebherr, that has factories in Germany.
- beardyw 2y ago> Technicians at the ports understood them to be for diagnostic purposes, the report said. A storm in a teacup.
- mlekoszek 2y agoWhat prevents them from being repurposed?
- more_corn 2y ago“Invest billions of dollars in new cranes” Or maybe remove the fucking modems?
- deeth_starr_v 2y agoBecause someone is making money
- gary_0 2y agoThen the next set of cranes you buy hides the modems better. It's the same fundamental truth that allows the Thompson hack: You can't trust what you can't trust.
- gruez 2y agoor the modems they found were decoys, and there are better hidden ones deep inside.
- hindsightbias 2y agoIs there such a thing as modems or routers not filled with Chinese chips and blobs?
- rolph 2y agothis should be up front and center as example next time unrequired, undesired connectivity comes up for consideration
- jdboyd 2y agoIf I sold equipment like that, it would probably include such modems by default and I would change support prices and warranty if I had to leave it out for a customer. They are too useful for diagnosing customer issues and a small price to add for something costing many thousands of dollars, so I can only imagine how much more valuable for something in the millions.