3 ms·

>the US suggested that huawei might be implementing backdoors in their product out of the box, is not the same thing as the US security agency actively searchin

>the US suggested that huawei might be implementing backdoors in their product out of the box, is not the same thing as the US security agency actively searching for exploits for the product. The US has also been adding hardware backdoors by intercepting mail as it travels across US friendly territories. Furthermore, the US backdoored RSA's RNG 'out of the box', and reports suggest it has backdoored other things 'out of the box'. The argument as I understood it was this, US: "China valves its 'dominance of cyberspace' over the security of both itself and the community of nations, therefore using hardware produced in China will probably make everyone, including the US, less safe". It is a good argument in general form and it addresses an important need for security because this sort of gear is used in nuclear power plants, air defense grids, hydroelectric dams, etc (note that Hardware backdoors have covert radios for bridging airgaps). These backdoors, even if not exploited by the Chinese, could fall into arbitrary hands[1] and cause significant economic damage. EDIT: People are downvoting this comment. As downvoting is your right please continue to do so but feedback is welcome. I care about understanding this issue and I want to know why you disagree with my comment. 1: http://en.wikipedia.org/wiki/Transnational_organized_crime http://en.wikipedia.org/wiki/Transnational_organized_crime

alexeisadeski3 13y ago
There's just an important distinction that you're missing. If the NSA is intercepting devices and bugging them, then it doesn't really matter which brand you buy - you're being targeted as an individual. Order a Huawei phone and they'll (presumably) try to intercept and compromise it. Country of origin doesn't really matter, because (presumably) the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices. The reason to avoid Huawei (according to some US gov't sources, evidently) is that Chinese security services may have compromised the company's structure itself; thus all products they create may have backdoors/trojans already in them. These two situations aren't even in the same universe.
- Fede_V 13y ago
  Ok - what about the NSA paying RSA 10 million dollars to use a flawed algorithm for encryption that they had a backdoor for?
- EthanHeilman 13y ago
  >the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices. We have substantial evidence that the NSA is doing this exactly this, in your words "compromising the company producing the device". For example in the case of RSA being paid to use Dual_EC_DRBG[1] or with the unspecified encryption chips that have been backdoored according to the Snowden documents[2]. >These two situations aren't even in the same universe. From a policy standpoint it might be the same universe. We ban the use of chemical weapons in all circumstances, despite their effectiveness, because we believe the world is a better place without them. Given the threat that hardware backdoors, either installed at the factory or during shipping, pose to both security and global trade there is an argument that such actions are off-limits. It was the public position of the US that the US did not do such actions but that China did. It appears that was PR. 1: http://arstechnica.com/security/2013/12/report-nsa-paid-rsa-to-make-flawed-crypto-algorithm-the-default/ http://arstechnica.com/security/2013/12/report-nsa-paid-rsa-... 2: "(TS//SI//REL TO USA, FVEY) Complete enable for [REDACTED] encryption chips used in Virtual Private Network and Web encryption devices [CCP_00009]" - (U) COMPUTER NETWORK OPERATIONS (U) SIGINT ENABLING http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=2& http://www.nytimes.com/interactive/2013/09/05/us/documents-r...

alexeisadeski3 13y ago

There's just an important distinction that you're missing. If the NSA is intercepting devices and bugging them, then it doesn't really matter which brand you buy - you're being targeted as an individual. Order a Huawei phone and they'll (presumably) try to intercept and compromise it. Country of origin doesn't really matter, because (presumably) the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices. The reason to avoid Huawei (according to some US gov't sources, evidently) is that Chinese security services may have compromised the company's structure itself; thus all products they create may have backdoors/trojans already in them. These two situations aren't even in the same universe.

Fede_V 13y ago
Ok - what about the NSA paying RSA 10 million dollars to use a flawed algorithm for encryption that they had a backdoor for?
EthanHeilman 13y ago
>the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices. We have substantial evidence that the NSA is doing this exactly this, in your words "compromising the company producing the device". For example in the case of RSA being paid to use Dual_EC_DRBG[1] or with the unspecified encryption chips that have been backdoored according to the Snowden documents[2]. >These two situations aren't even in the same universe. From a policy standpoint it might be the same universe. We ban the use of chemical weapons in all circumstances, despite their effectiveness, because we believe the world is a better place without them. Given the threat that hardware backdoors, either installed at the factory or during shipping, pose to both security and global trade there is an argument that such actions are off-limits. It was the public position of the US that the US did not do such actions but that China did. It appears that was PR. 1: http://arstechnica.com/security/2013/12/report-nsa-paid-rsa-to-make-flawed-crypto-algorithm-the-default/ http://arstechnica.com/security/2013/12/report-nsa-paid-rsa-... 2: "(TS//SI//REL TO USA, FVEY) Complete enable for [REDACTED] encryption chips used in Virtual Private Network and Web encryption devices [CCP_00009]" - (U) COMPUTER NETWORK OPERATIONS (U) SIGINT ENABLING http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=2& http://www.nytimes.com/interactive/2013/09/05/us/documents-r...