5 ms·

> suggesting some Chinese shitbox PC off AliExpress as the ideal platform to run it on? How reasonable do you think it is to be this automatically suspicious

> suggesting some Chinese shitbox PC off AliExpress as the ideal platform to run it on? How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide, but it's implausible that a Chinese intelligence agency would indiscriminately deploy an attack that made use of a compromised Intel Management Engine firmware signing key to put firmware rootkits in cheap hardware sold to individual consumers. On an embedded system like the OpenWRT Two where the entire BOM of the system will be public and the OS has full control over the raw flash memory, a purely software-based supply chain attack would be extremely difficult, and a hardware-based supply chain attack would be expensive. Do you think an intelligence agency would really bother with this for a device that is mostly going to be shipping to nerdy hobbyists? There's more to a threat model than just recognizing that an attack may be technically feasible.

donnachangstein 2y ago
> How reasonable do you think it is to be this automatically suspicious of any computer coming from China? Based on their track record? Pretty fucking reasonable. I would say that most probably isn't malicious collaboration with the CCP, rather sheer incompetence. Shipping secure anything just isn't part of their culture. Read a comment on HN the other day from someone that evaluated Huawei hardware for a telco and swore it was so full of holes to be unusable. The ingrained extreme cheapness of Chinese culture doesn't help. Security is viewed as a luxury - why waste time and money on it when that could be better spent elsewhere? That said, the incompetence gives them plausible deniability when the intelligence agencies take advantage to exploit the holes for their own use.
- wtallis 2y ago
  What kind of security vulnerabilities do you think an incompetent PC OEM is going to accidentally introduce to a barebones PC that's basically shipping an Intel reference platform and no SSD? Or that GL.iNet might be able to introduce to a system where OpenWRT is assembling the firmware image that gets flashed to the board, and if there are any closed-source components they'd be coming from Mediatek and not developed by GL.iNet? Shipping telco hardware with a massive bespoke software stack implementing an impossibly-complex pile of standards is very different from what we're talking about here.
  - coderatlarge 2y ago
    I’ve reluctantly come to the view that Apple is the best bet for a consumer to get a somewhat reasonable (price notwithstanding) compromise between hardware vertical integration and software that offers substantial bug bounties and large market incentives to not allow bad vulnerabilities to sit for too long. With deep enough pockets to hang tough if needed in various situations.
    - throwaway48476 2y ago
      Apple also ships bloated buggy software with a massive TCB that makes it almost trivially easy for state actors to break in.
      - coderatlarge 2y ago
        I completely agree about the buggy bloated software but all I’m saying is that it’s the best bet compared to actual consumer alternatives which are generally a frankenmix of the lowest cost components sourced from the lowest cost vendor with minimum effort spent to ensure and maintain any semblance of security.
  - throwaway48476 2y ago
    STH has reviewed Chinese PCs that come preloaded with malware. My MSI motherboard force installs Nahimic by default. Not technically malware but the same mechanism exists for malware.
    - wtallis 2y ago
      Do you think any of that is relevant to the case of buying a barebones PC that doesn't include SSD or RAM, then adding those components yourself and installing a non-Windows OS? If your MSI motherboard is installing Nahimic without an internet connection, it is doing so through a mechanism where the installer is made available to the OS in an ACPI table that Windows checks. That check can be disabled with a registry key to prevent such software from being re-installed, and the motherboard may have a BIOS option to disable the anti-feature (though the registry key method is generally more effective, since BIOS settings often get reset to defaults).
- xvilka 2y ago
  > Read a comment on HN the other day from someone that evaluated Huawei hardware for a telco and swore it was so full of holes to be unusable. Do you have a link? Would be nice to know more technical details.
  - close04 2y ago
    Someone evaluated Huawei hardware for many telcos years ago and a lot of them decided the equipment is not only usable, it’s the best choice. So which ones were the incompetents or shills?
    - Uvix 2y ago
      They’re not mutually exclusive - as you said, that was years ago, enshittification could well have set in.
  - donnachangstein 2y ago
    https://news.ycombinator.com/item?id=43343233 https://news.ycombinator.com/item?id=43343233 https://news.ycombinator.com/item?id=43342304 https://news.ycombinator.com/item?id=43342304
- calcifer 2y ago
  > I would say that most probably isn't malicious collaboration with the CCP, rather sheer incompetence. As opposed to the US, where it's the other way around [1]. You prefer that? [1] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
  - CartwheelLinux 2y ago
    Not only this, but most US companies do not really have any incentive to focus on security. On HN there is an echo chamber with the shunning of companies who have experienced incompetence based breaches. Your average consumer does not know (beyond the news cycle) or generally even really care. I think you can even look at FBI and NSA public service announcements and guides about consumer electronics security as a sort of ''shit this industry stuff is pretty bad we need to think about our goal differently,'' with regards to them trying to pick up some of the security slack that US companies shit out with their products.
    - sethhochberg 2y ago
      The various 3-letter-agencies really are incentivized to help government and industry be legitimately secure against anything short of the sophisticated attacks they themselves can orchestrate When you’ve got the sort of reach and resources they have, it does you no good if script kiddies or unsophisticated attacks are causing problems and you don’t need the easily preventable attack vectors they’d use.
- ThinkBeat 2y ago
  Do you have source links to this and how it compares to the US own practice of doing it?
- misiek08 2y ago
  Im curious how you are currently writing those comments. Other than most of the hardware is made in CN or TW, there is not so much records targeting normal people. Also you get good hardware cheap, it just works and helps us going forward. Enterprise crap from companies like Intel (especially their server disks) are nightmare for years now and last Juniper and Cisco hardcore bugs in software causing soft-drops without any metrics rising on-device - good luck with that. I’m more than happy using CN stuff than imaginary safer and better US crap.
  - donnachangstein 2y ago
    As someone who was personally a victim of the 1-2 punch of vulnerable HW and unquestionable malware that took advantage of said vulnerability from the same vendor (and I have the pcaps to prove it), I have sworn off CN garbage forever, I don't care if I have to pay 3x the price. No one stops you from doing so, just know you will probably be part of a botnet sooner or later.
    - wtallis 2y ago
      If you have proof, then why wouldn't you name and shame the vendor in question, or at least be less vague about what kind of product you're talking about? Talking about how you determined that you were being attacked through a combination of hardware and software vulnerabilities would be way more interesting and appropriate for this forum than generic anti-China complaints.
josteink 2y ago
> How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide The problem seems to be that this firmware doesn’t really get updated once the machine is sold. That’s legitimate criticism for a security-critical network component.
- wtallis 2y ago
  It's not ideal, but it's not a deal-breaker for every use case. The kind of firmware you get on a barebones industrial-oriented miniPC style router from China doesn't have much potential for a remotely-exploitable vulnerability. Most of the NICs aren't even going to be touched by the boot firmware. The user-supplied OS can take care of applying CPU microcode updates. If the PC doesn't ship with a rootkit already present in the firmware, it's pretty hard for the firmware to be a security problem unless it's secondary to a security vulnerability in the OpenWRT or pfSense software. Running an up-to-date OpenWRT or pfSense on a normal PC hardware platform with outdated UEFI firmware is still a big step up in security compared to running factory firmware+OS on a cheap consumer wireless router.
- Brian_K_White 2y ago
  I would say that there is no special value to firmware updates when you have no visibility into or control over the authors of the updates. We need adversarial competitive firmware that comes from different sources the same as we have for software. I know why we don't have that. It doesn't change the fact that that is what we need.
486sx33 2y ago
VERY reasonable , if not a total piece of crap with fake copied hardware, a security nightmare with hardware level integrated spyware. Don’t bother importing. They should start seizing these at the port

donnachangstein 2y ago

> How reasonable do you think it is to be this automatically suspicious of any computer coming from China? Based on their track record? Pretty fucking reasonable. I would say that most probably isn't malicious collaboration with the CCP, rather sheer incompetence. Shipping secure anything just isn't part of their culture. Read a comment on HN the other day from someone that evaluated Huawei hardware for a telco and swore it was so full of holes to be unusable. The ingrained extreme cheapness of Chinese culture doesn't help. Security is viewed as a luxury - why waste time and money on it when that could be better spent elsewhere? That said, the incompetence gives them plausible deniability when the intelligence agencies take advantage to exploit the holes for their own use.

wtallis 2y ago
What kind of security vulnerabilities do you think an incompetent PC OEM is going to accidentally introduce to a barebones PC that's basically shipping an Intel reference platform and no SSD? Or that GL.iNet might be able to introduce to a system where OpenWRT is assembling the firmware image that gets flashed to the board, and if there are any closed-source components they'd be coming from Mediatek and not developed by GL.iNet? Shipping telco hardware with a massive bespoke software stack implementing an impossibly-complex pile of standards is very different from what we're talking about here.
- coderatlarge 2y ago
  I’ve reluctantly come to the view that Apple is the best bet for a consumer to get a somewhat reasonable (price notwithstanding) compromise between hardware vertical integration and software that offers substantial bug bounties and large market incentives to not allow bad vulnerabilities to sit for too long. With deep enough pockets to hang tough if needed in various situations.
  - throwaway48476 2y ago
    Apple also ships bloated buggy software with a massive TCB that makes it almost trivially easy for state actors to break in.
    - coderatlarge 2y ago
      I completely agree about the buggy bloated software but all I’m saying is that it’s the best bet compared to actual consumer alternatives which are generally a frankenmix of the lowest cost components sourced from the lowest cost vendor with minimum effort spent to ensure and maintain any semblance of security.
- throwaway48476 2y ago
  STH has reviewed Chinese PCs that come preloaded with malware. My MSI motherboard force installs Nahimic by default. Not technically malware but the same mechanism exists for malware.
  - wtallis 2y ago
    Do you think any of that is relevant to the case of buying a barebones PC that doesn't include SSD or RAM, then adding those components yourself and installing a non-Windows OS? If your MSI motherboard is installing Nahimic without an internet connection, it is doing so through a mechanism where the installer is made available to the OS in an ACPI table that Windows checks. That check can be disabled with a registry key to prevent such software from being re-installed, and the motherboard may have a BIOS option to disable the anti-feature (though the registry key method is generally more effective, since BIOS settings often get reset to defaults).
xvilka 2y ago
> Read a comment on HN the other day from someone that evaluated Huawei hardware for a telco and swore it was so full of holes to be unusable. Do you have a link? Would be nice to know more technical details.
- close04 2y ago
  Someone evaluated Huawei hardware for many telcos years ago and a lot of them decided the equipment is not only usable, it’s the best choice. So which ones were the incompetents or shills?
  - Uvix 2y ago
    They’re not mutually exclusive - as you said, that was years ago, enshittification could well have set in.
- donnachangstein 2y ago
  https://news.ycombinator.com/item?id=43343233 https://news.ycombinator.com/item?id=43343233 https://news.ycombinator.com/item?id=43342304 https://news.ycombinator.com/item?id=43342304
calcifer 2y ago
> I would say that most probably isn't malicious collaboration with the CCP, rather sheer incompetence. As opposed to the US, where it's the other way around [1]. You prefer that? [1] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- CartwheelLinux 2y ago
  Not only this, but most US companies do not really have any incentive to focus on security. On HN there is an echo chamber with the shunning of companies who have experienced incompetence based breaches. Your average consumer does not know (beyond the news cycle) or generally even really care. I think you can even look at FBI and NSA public service announcements and guides about consumer electronics security as a sort of ''shit this industry stuff is pretty bad we need to think about our goal differently,'' with regards to them trying to pick up some of the security slack that US companies shit out with their products.
  - sethhochberg 2y ago
    The various 3-letter-agencies really are incentivized to help government and industry be legitimately secure against anything short of the sophisticated attacks they themselves can orchestrate When you’ve got the sort of reach and resources they have, it does you no good if script kiddies or unsophisticated attacks are causing problems and you don’t need the easily preventable attack vectors they’d use.
ThinkBeat 2y ago
Do you have source links to this and how it compares to the US own practice of doing it?
misiek08 2y ago
Im curious how you are currently writing those comments. Other than most of the hardware is made in CN or TW, there is not so much records targeting normal people. Also you get good hardware cheap, it just works and helps us going forward. Enterprise crap from companies like Intel (especially their server disks) are nightmare for years now and last Juniper and Cisco hardcore bugs in software causing soft-drops without any metrics rising on-device - good luck with that. I’m more than happy using CN stuff than imaginary safer and better US crap.
- donnachangstein 2y ago
  As someone who was personally a victim of the 1-2 punch of vulnerable HW and unquestionable malware that took advantage of said vulnerability from the same vendor (and I have the pcaps to prove it), I have sworn off CN garbage forever, I don't care if I have to pay 3x the price. No one stops you from doing so, just know you will probably be part of a botnet sooner or later.
  - wtallis 2y ago
    If you have proof, then why wouldn't you name and shame the vendor in question, or at least be less vague about what kind of product you're talking about? Talking about how you determined that you were being attacked through a combination of hardware and software vulnerabilities would be way more interesting and appropriate for this forum than generic anti-China complaints.

josteink 2y ago

> How reasonable do you think it is to be this automatically suspicious of any computer coming from China? A generic low-cost barebones Intel PC certainly has plenty of space for compromised firmware to hide The problem seems to be that this firmware doesn’t really get updated once the machine is sold. That’s legitimate criticism for a security-critical network component.

wtallis 2y ago
It's not ideal, but it's not a deal-breaker for every use case. The kind of firmware you get on a barebones industrial-oriented miniPC style router from China doesn't have much potential for a remotely-exploitable vulnerability. Most of the NICs aren't even going to be touched by the boot firmware. The user-supplied OS can take care of applying CPU microcode updates. If the PC doesn't ship with a rootkit already present in the firmware, it's pretty hard for the firmware to be a security problem unless it's secondary to a security vulnerability in the OpenWRT or pfSense software. Running an up-to-date OpenWRT or pfSense on a normal PC hardware platform with outdated UEFI firmware is still a big step up in security compared to running factory firmware+OS on a cheap consumer wireless router.
Brian_K_White 2y ago
I would say that there is no special value to firmware updates when you have no visibility into or control over the authors of the updates. We need adversarial competitive firmware that comes from different sources the same as we have for software. I know why we don't have that. It doesn't change the fact that that is what we need.

486sx33 2y ago

VERY reasonable , if not a total piece of crap with fake copied hardware, a security nightmare with hardware level integrated spyware. Don’t bother importing. They should start seizing these at the port