5 ms·

> Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices. Sorry but this is merely

> Vulnerabilities have nothing to do with country of manufacture. They have always been due to manufacturers' crap security practices. Sorry but this is merely a convenient excuse. Source: I have hard evidence of a Chinese IoT device where crap security practices were later leveraged by the same company to inject exploit code. It's called plausible deniability and it's foolish to tell me it's a coincidence. You're not going to convince me that a foreign state actor pressuring a company to include a backdoor wouldn't disguise it as a "whoopsie, our crap code lol" as opposed to adding in the open with a disclaimer on it. It's all closed source firmware. Even the GPL packages from most consumer router vendors are loaded with binary blobs. Tell me I should trust it.

cowpig 7mo ago
What was the company, and what did they inject?
- 0xy 7mo ago
  TP-Link https://nvd.nist.gov/vuln/detail/CVE-2023-1389 https://nvd.nist.gov/vuln/detail/CVE-2023-1389
  - crote 7mo ago
    That's only proof of the vulnerability. Where's the proof of it being misused by the vendor?
gobins 7mo ago
Are you saying that other manufacturers don't do this?
- longislandguido 7mo ago
  Are you asking me if I have the master list of naughty and nice router manufacturers? No, I don't have it but you may check with Santa Claus.
- cjk 7mo ago
  If US manufacturers (or manufacturers in allied countries) do this, legal avenues exist to hold those manufacturers accountable. Not so with China. (That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)
  - mindslight 7mo ago
    > legal avenues exist to hold those manufacturers accountable Oh, sweet summer child. Disclaiming these possible avenues of liability is the main goal of clickwrap "terms of service".
  - pyrale 7mo ago
    The Snowden leak showed that Cisco routers had been altered to enable surveillance [1]. Whether or not the manufacturer is complicit, or how the alteration is performed is ultimately irrelevant to the end user. Ultimately, the only people that got in legal trouble for this were Snowden and people who provided service to him. [1]: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
    - b112 7mo ago
      Actually it's entirely relevant how, in the context of this conversation. Here, we're discussing product as shipped, not product intercepted and modified. We're discussing if products are shipped secure or not. The Snowden disclosures are important, but not relevant in this case.
      - dcrazy 7mo ago
        It is absolutely relevant. It is completely within the realm of feasibility that a foreign nation state would pressure a manufacturer in their jurisdiction to include a backdoor, or simply insert it themselves. Routers are in every home and office in the country, and can be leveraged for immense attacks. It’s a hugely attractive target, and it’s a reasonable security policy to try to limit our exposure to this threat. And it would absolutely make sense for adversaries to avoid buying U.S. made routers for exactly the same reason. Unfortunately this administration is generating more adversaries by the day.
mindslight 7mo ago
And who hasn't seen American software companies where crap security practices are later leveraged by the same company to run exploits? It's of course always phrased in Orwellian terms of business practices, terms of service, "security", etc but we can still call a spade a spade.
- m3047 7mo ago
  One dog's exploit is another's Clippy. I've certainly seen companies downgrade security generally when they deploy (and enable by default) new features. Start with web browsers. Ads in software you paid for. Always on app telemetry. Cloud backups. Cloud-compute assisted "desktop" tools. Sorry, out of time.
hrmtst93837 7mo ago
[flagged]
hrmtst93837 7mo ago
[flagged]
hrmtst93837 7mo ago
[flagged]
hnielsen123 7mo ago
Sure, but this also bans pretty much all routers made by American companies too, since they're not fully assembled in the US. So I'm not sure that explanation fits.
ranger_danger 7mo ago
And I have evidence of domestic devices being intentionally nerfed, backdoors added on purpose, backdoors added by hackers, AND backdoors secretly added by the government itself. Banning foreign-made devices will not stop any of that.

cowpig 7mo ago

What was the company, and what did they inject?

0xy 7mo ago
TP-Link https://nvd.nist.gov/vuln/detail/CVE-2023-1389 https://nvd.nist.gov/vuln/detail/CVE-2023-1389
- crote 7mo ago
  That's only proof of the vulnerability. Where's the proof of it being misused by the vendor?

gobins 7mo ago

Are you saying that other manufacturers don't do this?

longislandguido 7mo ago
Are you asking me if I have the master list of naughty and nice router manufacturers? No, I don't have it but you may check with Santa Claus.
cjk 7mo ago
If US manufacturers (or manufacturers in allied countries) do this, legal avenues exist to hold those manufacturers accountable. Not so with China. (That is not to say that the FCC change will move the needle on the underlying issue of router security; as some of the ancestor comments have said, lax security practices are common industry-wide, irrespective of country of development/manufacture.)
- mindslight 7mo ago
  > legal avenues exist to hold those manufacturers accountable Oh, sweet summer child. Disclaiming these possible avenues of liability is the main goal of clickwrap "terms of service".
- pyrale 7mo ago
  The Snowden leak showed that Cisco routers had been altered to enable surveillance [1]. Whether or not the manufacturer is complicit, or how the alteration is performed is ultimately irrelevant to the end user. Ultimately, the only people that got in legal trouble for this were Snowden and people who provided service to him. [1]: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
  - b112 7mo ago
    Actually it's entirely relevant how, in the context of this conversation. Here, we're discussing product as shipped, not product intercepted and modified. We're discussing if products are shipped secure or not. The Snowden disclosures are important, but not relevant in this case.
    - dcrazy 7mo ago
      It is absolutely relevant. It is completely within the realm of feasibility that a foreign nation state would pressure a manufacturer in their jurisdiction to include a backdoor, or simply insert it themselves. Routers are in every home and office in the country, and can be leveraged for immense attacks. It’s a hugely attractive target, and it’s a reasonable security policy to try to limit our exposure to this threat. And it would absolutely make sense for adversaries to avoid buying U.S. made routers for exactly the same reason. Unfortunately this administration is generating more adversaries by the day.

mindslight 7mo ago

And who hasn't seen American software companies where crap security practices are later leveraged by the same company to run exploits? It's of course always phrased in Orwellian terms of business practices, terms of service, "security", etc but we can still call a spade a spade.

m3047 7mo ago
One dog's exploit is another's Clippy. I've certainly seen companies downgrade security generally when they deploy (and enable by default) new features. Start with web browsers. Ads in software you paid for. Always on app telemetry. Cloud backups. Cloud-compute assisted "desktop" tools. Sorry, out of time.

hrmtst93837 7mo ago

[flagged]

hrmtst93837 7mo ago

[flagged]

hrmtst93837 7mo ago

[flagged]

hnielsen123 7mo ago

Sure, but this also bans pretty much all routers made by American companies too, since they're not fully assembled in the US. So I'm not sure that explanation fits.

ranger_danger 7mo ago

And I have evidence of domestic devices being intentionally nerfed, backdoors added on purpose, backdoors added by hackers, AND backdoors secretly added by the government itself. Banning foreign-made devices will not stop any of that.