Lenovo: Companies working in China may have to install local backdoors | Hacker News Reader

Lenovo: Companies working in China may have to install local backdoors

theinquirer.net

177 pointsheidarb88 comments

Purism is working with coreboot to provide laptops where you can verify the integrity of firmware on your device, within the limits of Intel CPUs.

https://www.tomshardware.com/news/purism-heads-rootkit-tampe...

"Purism announced that, after almost a year of testing, it was able to successfully integrate the Heads firmware into its TPM-enabled and Coreboot-running Librem laptops. The open source firmware, which checks if someone has tampered with the laptops, allows users to freely inspect and customize the code. Purism also recently announced that all of its new Librem 13 and 15 laptops now include a TPM by default, so they all come with the Heads firmware by default, too."

Previously: Google on "Replacing exploit-ridden firmware with a Linux kernel", https://news.ycombinator.com/item?id=15579592

Intel microcode updates are encrypted and signed.

Yes, this is about open-source firmware vs OEM (e.g. Lenovo) closed-source firmware.

WAT?

Open-source firmware: https://coreboot.org

Purism/coreboot: https://puri.sm/posts/category/firmware/

> Does Lenovo put backdoors in if the Chinese government asks?

> "If they want backdoors globally? We don't provide them. If they want a backdoor in China, let's just say that every multinational in China does the same thing.

Even though not a direct answer, close enough. One could only hope to get a similar statement from Apple wrt iCloud so we aren't left with assumptions about lack of privacy.

iCloud in China has been hosted by a local licencee for a while. People who care about privacy are at least aware that the backend is no longer secure.

While we are on the topic, Windows 10 binary for Chinese government contracts are compiled by a third party company based in China so certain features could be added/removed at code level without directly giving away the source code. It may only be a matter of time before this practice permeates into retail and OEM markets.

How do I, as a US citizen, know that Apple isn't replicating my data to this Chinese datacenter?

I know you will say "you have to trust them", but therein lies the problem. There is no way for consumers to verify anything about their data.

Exactly why I simply cannot trust their supposed 'commitment to privacy'. How could you take it seriously when they are willing to play ball with this clear human rights issue? It's madness.

Short answer is we will never know for sure. There is no reason or incentive for Apple to duplicate your data and it certainly breaches an assortment of data protection laws. Nevertheless you data is always one error away from being sent all over the world. Recall the incident when Cloudflare leaked an unknown amount of information to the public, looks like they have suffered very little repercussion given the scope of the leak.

https://blog.cloudflare.com/incident-report-on-memory-leak-c...

On another note, if I get my data on the Chinese datacenter, does this mean my country's government is unable to extract this information from Apple?

If they send a notice to Apple for my data, will Apple refer them to China instead?

My brain's being a bit pedantic/dense about wording, so I want to clarify - are you saying that Windows 10 builds destined for Chinese governmental use are shipped to China in source form?

No. The source code is shipped to a system integrator based in China, vetted by both parties and under strict NDA, who then edit the code with required changes, compile and ship the binary to government users.

MS have, for a long time, allowed major customers to audit Windows source code on site but they are still forbidden from making copies. The whole setup is meant to avoid shipping source code directly.

Thanks for the insight.

I'm guessing the on-site/NDA combination is intended to prevent another Mainsoft (and all the other leaks...) from happening.

I wonder if I stand a chance of turning up a copy of Chinese-governmental Windows 10. Would be awesome.

Why does Microsoft not make those changes themselves? Does the Chinese government not want them to know what changes they want?

Well, obviously politics, burden of blame, and plausible deniability, and all that. Microsoft never made the changes themselves, they've no real idea what happened, they just sat in a corner of the room and glanced at the devs' screens once in a while to make sure they didn't look like they were stealing anything.

This is gravely concerning to me.

Privacy is a fundamental human right, and it's needed to fight unjust laws and practice civil disobedience in a safe and comfortable way.

If we had today's surveillance capabilities in the 70's, it would have been impossible for the LGBTQ community to achieve the societal acceptance they now have!

We need a fully open-source hardware ecosystem (with downloadable component blueprints, 3D-printing machines and local co-ops or gumtree-like marketplaces for obtaining free hardware), to bring much-needed democratisation to our society like the Internet did at the software / information access level.

We need a Linux of hardware.

Please support librecores. It's a small start. I think one thing we are missing is a Stallman of hardware. Some who is loud, willing to take a stand, and who has enough technical chops to back it all up.

> "Likewise, if there are countries that want to have access, and there are more countries than just China, you provide what they're asking."

Seems that it's kind of obvious and infuriating at the same time: companies that sell physical goods don't have much choice, they must meet country regulations for each country they want to sell.

Companies that don't sell physical goods don't have much choice too.

> A prototype search engine that Google is designing to meet the scrutiny of Chinese officials links users’ phone numbers to the searches they perform

> This report adds to earlier news, also broken by The Intercept about the search engine, codenamed “Dragonfly,” which eliminates from results a number of terms and topics, like freedom and democracy.

http://fortune.com/2018/09/14/google-china-search-engine-lin...

I think they have plenty of choice. They can say "no", tell these regressive regimes to go to hell, and simply not manufacture/sell their product there, where-ever "there" may be.

> They can say "no", tell these regressive regimes

The US has made pretty similar demands from Google and Twitter and Facebook not too long ago, in the context of "Russian election interference" and even before that on the basis of "terrorist radicalization".

The big difference here is that if the US demands it, it becomes the de-facto global standard. The results of this are subtle, but creeping. [0]

At this point, the aforementioned three are subcontracting a whole little industry of "content moderators" in places like Manila in the Philippines. Where hundreds of people do nothing but "moderate" social media content, they literally "okay" or "delete" videos and pictures on social media.

French channel ARTE made a really interesting, and quite creepy, documentary about it called "The Cleaners" [1]. Sadly it's only been available in French/German, and has been depublished by now, but an English version was shown at Sundance, so that should exist.

[0] https://motherboard.vice.com/en_us/article/wnxdv5/the-artist...

[1]https://www.arte.tv/de/videos/069881-000-A/im-schatten-der-n...

Do note, that based on those quotes it is not clear that backdoors requested by the US gov are not installed in the US. He just said they don't install any of them globally.

You're going to be spied on one way or another. I guess it's a matter of picking the side you want to make life easier for. The one you trust more with your data :).

How many times has Google or Facebook rejected a subpoena to turn over a user's data?

And then go to filtering the "fake news" out, saying "yes" to 'progressive' regimes? Because there is a strict difference between Good and Bad censorship and tracking, right?

If only business was really that simple. Apple manufactures all their devices in China. Even Google and Facebook are trying to get back to the Chinese market now.

People within the industry expect China to win the AI race by 2030 simply because they have a huge data source advantage which leads to better results. It was not a coincidence that Google significantly ramped up their data mining activities when they decided to switch from a "Mobile first" to an "AI first" company. Why do you think Google and Facebook are suddenly willing to bend over to the Chinese government demands just to establish their presence there?

"The Capitalist will sell us the Rope that we will hang them with."

If the cheap small mini-fabs to make your own chips to avoid backdoors eventually will become reality, they will be made in China, that's for sure.

The shareholders do not agree that that is an option.

I miss the early 90s and 2000s when governments were still struggling to understand what the internet was, rather than trying to control it.

Did that time ever really exist?

https://en.wikipedia.org/wiki/Clipper_chip

https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

I also remember writing some (naive) crypto tools as a kid and I had to report it to permit re-export from the US.

Also, the DMCA is from the nineties:

https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...

I concur that it's unlikely that time ever really existed, at least in the US.

After all, the internet came directly from the Department of Defense funded ARPANET. Before that, computers were so expensive and large that realistically only governments or large companies could fund even routine work with them.

I suppose all that's changed is now the average human is on the internet. I mean that literally, since it seems that we are about to cross the threshold of 50% of humanity using the internet (https://en.wikipedia.org/wiki/Global_Internet_usage).

So the things governments wish to do on the internet are more and in line with things that involve the population at large. For better or worse (mostly the latter, IMO) that involves lots of intelligence gathering, copyright enforcement, and national security work.

The ban on the export of cryptography strikes me as a great example of the US Government misunderstanding technology - I don't see how it's remotely possible for a ban on exporting ideas to affect bad actors in any way.

This is an example of you misunderstanding the US Government's motives for labeling crypto as a non-exportable weapon. ;)

If they had been able to keep it up, they would have. Unfortunately for them, practicality won over here once it began to threaten corporate profits.

And this is an example of a meta-misunderstanding that the motives for labeling crypto as non-exportable with clamorous pleas for backdoors to get the public frightened and then finally reassuringly concede to overwhelming defeat with the eventuality of the practical vision held by academia, industry, and especially prescient revolutionary anarchist-libertarians for ironclad strength of a ubiquitous crypto primitive monoculture praised for its open standards detailing specifically its applicability for hierarchical control, designed by a completely unbiased select group of security researchers whose proposals are judged to consensus, tweaked to optimal security parameters for the benefit of all with lovingly chosen constants that couldn't possibly be related to undisclosed attacks the previous standards that were replaced suffered from requiring update once a few undesirables got wind, who rightly espouse a fundamental belief in the professional exclusivity of implementation and analysis while making sure to mentor the next generation in extensive confidence with complexity conjectures based on buried assumptions, gently redirecting their pupils towards the future away from the glaring history of churned systems, compromised research, and perverse financial/legal/social incentives of keeping the ball rolling gently, are not just two sides of the same coin.

Wow those are interesting.

I'll need to do some digging on the UK government, to see what they were up to back then.

I remember the US federal govt. hired around 20 Unix sysadmins around 1984-1985 to monitor/archive IRC and newsfeeds (pre-WWW.)

"Roughly a third of his inventions are legal, a third are illegal, and the remainder are legal but will become illegal as soon as the legislatosaurus wakes up, smells the coffee, and panics."

-- Accelerando by Charles Stross (cstross around here), first part published in 2001

https://www.antipope.org/charlie/blog-static/fiction/acceler...

I remember in the 90's being unsure if I should be afraid of echelon or if it was just a conspiracy theory. It was very real.

https://en.wikipedia.org/wiki/ECHELON

Problem is they still don't understand what the internet is and want to control it

What? This was never the case. Especially china.

The internet was born from a Department of Defense project (ARPANET). The british, french, etc governments were also early internet players. Every major power understood the internet.

It's why china in the 90s/00s decided to create their own internet companies. It's why we have alibaba, baidu, tencent, etc. The same thing with russia. The same thing with south korea and japan.

This is not unique to China. New Zealand has the TICSA requirement that network operators must provide intercept capabilities to security agencies, and all network operator designs must be approved by security agencies before deployment.

I would imagine other five eyes countries have or soon will have similar requirements.

Wasn't there this announcement recently that the Five Eyes was "asking" vendors to provide backdoors voluntarily, or else?

And all the governments engaging in this kind of behavior are at the same time giving each other excuses, "because every one else is doing it, too". So if China does this, you can be sure other countries will point to China's example and require their own backdoors. Let's just hope all those backdoors are mutually incompatible.

Maybe this will finally make Apple rethink its manufacturing.

It can either be the bastion of freedom in consumer electronics, as it likes to brag, or not. Time to decide.

It doesn’t seem this would mske a diff: exports outside of China would not be affected (indifferent) imports into China would still require this regardless of mfg origin.

Their only option is to not sell in that market —which seems highly unlikely.

And apparently also confirmed that they’ve done it for other countries too, without providing any names.

Easier to make a list of countries that don’t want backdoors. It’s for the children you know, to stop those pesky evildoers.

Eventually you just won't be able to buy a trustworthy computer.

Eventually?

My hope is that eventually we would be able to buy a trustworthy computer.

To print all the chips on your own mini-fab - maybe. Eventually.

But your mini-fab might be backdoored and create chips with backdoors.

That's harder thing to do on every iteration down to the first principles. So in theory you maybe could do the hammer, which is made so as to specifically clog nails with a deviation of 5.2 degrees to the left, which leads to the light bulbs distortions in the chip designer room which eventually leads to particular backdoor in the chip he designed - but this is really hard.

Isn't this just the physical manifestation of "Trusting Trust" - the seminal paper on backdooring compilers?

It might be difficult, but who really inspects their own prints at a 100-micron resolution?

https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... - there's plenty of HN discussions to be found too.

The example in Trusting Trust was a very specific case: he modified the C compiler to replace a known bit of code in the login program. Along those same lines, you could possibly set up your minifab such that it inserts a backdoor into a particular RISC-V implementation. However, if I sat down and made my own chip, how would the fab figure out how to insert a backdoor? If you have code which can analyze a processor layout and seamlessly insert a backdoor, please come forward and collect your Turing Award.

"made my own chip"

You are aware that making a chip with any reasonable processing power either requires using existing designs, or teams of hundreds of people for several years, yes?

You're back to trusting trust. Or using toy computers.

In the traditional world of raw Verilog, gate-level tuning, verification systems with millions of lines of code and all that, that's true. By the way, those hundreds of people will need a bunch of million dollar tools, hardware and software. And a lawyers dealing with the license and patents, if you are going to sell your chips - and of course you are going to sell your chips in traditional hardware world, except you are DoD or NASA.

But maybe the hardware world is not have to be this way and this way only.

> No part of Kami need be trusted beside the formalization of low-level (Verilog-style) circuit descriptions; all other aspects have end-to-end correctness proofs checked by Coq. Hardware designs are broken into separately verified modules, reasoned about with a novel take on labeled transition systems. Furthermore, Coq provides a natural and expressive platform for metaprogramming, or building verified circuit generators, as for a memory caching system autogenerated for a particular shape of cache hierarchy, or a CPU generated given a number of concurrent cores as input.

> We have been developing a candidate official formal specification for RISC-V, which stands a good shot at being ratified soon as such by the RISC-V Foundation. The spec now includes virtual memory and is able to pass all the official RISC-V machine-code tests that aren't marked as specific to particular extensions. We should be able to boot Linux on the specification soon, running as a simulator.

> A verified processor exists providing all that functionality, though we are still working on debugging the specification, since the current version isn't quite able to boot an operating system (so the specification must be out-of-synch with software expectations somehow).

https://deepspec.org/entry/Project/Kami

You still extend trust - in this case to the RISC-V foundation. (We're not even scratching the surface on the fact that the Coq proofs do not, IIUC, cover side channels)

At some point, you have to trust somebody - "build from first principles" is really only available for extremely well-funded players.

Also: "the specification must be out-of-synch with software expectations somehow". I see the hardware world hasn't changed at all :)

That's why we are talking about cheap small mini-fabs instead of just placing the order to any Chinese fab. The mini-fabs would use open-source community-driven software which is easy to audit for backdoors. That's not easy, but the trend is toward that, for sure - e.g. pick and place systems driven by OpenPNP is a step in this direction.

More likely that the schematics will contain backdoors, that aren't easily understood to be backdoors. EDIT: have - contains

It could conceivably be done even below the schematic level, though I'm not sure how much room modern processes have for this sort of thing now that we're talking about how many atoms wide a transistor is. I've been told that there was a period of a few years in which a kind of "copy protection" proliferated in IC layouts. The layouts would be tweaked to exploit quirks of the originating company's fabrication process (e.g. a pattern might look like a diode but actually function as a resistor when fabricated), and this would sabotage attempts by other companies to clone the chip (at the time, Japanese and Soviet clones were major concerns).

The lower a level, the easier to add a backdoor, the harder to audit. To add the backdoor to the handwritten assembly code is much easier than to do this with (reasonably clean style) C, and both are easier than add it to Standard ML or Haskell code. The same is true with verified formal hardware description specifications, Verilog and lithographic mask.

So the path toward trustworthy computing, besides cheap fabs, is higher level tools, projects like Kami and CakeML, proof checking, automatic verification and synthesis.

Interesting choice of language there:

"we don't put in backdoors [...] we follow the ethics"

but then

"if there are countries that want to have access [...] you provide what they're asking"

No, Mr. YY, it's you who's providing what "they" are asking, and that makes you evil, not me. ("Them" too, naturally.)

I'm sure they have plenty of examples to go by, all they need to do is consult Yahoo, Google or any of the telecoms for good strategies.

I guess on the plus side at least we know now that it is happening despite the lies the Federal government told us. I worry that as bad as it is for whistle blowers in the US what chance does China have?

Exactly. HN is great at armchair-quarterbacking the PRC but is too busy fawning over US tech corps to see the parallels.

> "Likewise, if there are countries that want to have access, and there are more countries than just China, you provide what they're asking."

So..the US as well? The UK? I wonder who else is "asking".

They are just stealing the concept from US (lawful intercept/CALEA)..

May?

It's just now getting official.

Deleted comment

We've reverted it from “Lenovo CTO confirms local backdoors in products”.

Meanwhile in the US we also have a long history of monitoring internet traffic, installing backdoors and allowing private third-parties to filter what we see online.

Where do we get off critiquing the PRC? We should clean our own house first.

This is not a case of either/or. It's a case of both/and. We should criticize both the PRC and the US.

Last I checked, in the EU or the USA you don't disappear in the middle of the night never to be seen again because you are:

-follower of different religion

-saying the word "democracy"

-critisizing a politician/the government

so yes, first things first.

> In 2014, former CIA and NSA director Michael Hayden said in a public debate, “We kill people based on metadata.”

> According to multiple reports and leaks, death-by-metadata could be triggered, without even knowing the target’s name, if too many derogatory checks appear on their profile.

> “Armed military aged males” exhibiting suspicious behavior in the wrong place can become targets, as can someone “seen to be giving out orders.” Such mathematics-based assassinations have come to be known as “signature strikes.”

Source: https://www.rollingstone.com/politics/politics-features/how-...

Really, does HN deserve that kind of idiotic post?

You can walk around China an say "democracy" all day. You think they don't report on eg elections in the US on TV there? People in China complain about the government and laws all day.

There is a lot wrong with China that they deserve to be called out for, but what's your goal with a post like that? Show the world that you don't have a clue about anything besides tech? It boggles my mind how many people happily buy any FUD that helps them painting a simple black and white image of the world just so they can feel good about their own country.

True. It would be a more accurate post if it listed "having a watch set to the wrong time zone" instead (mentioned in the HRW report).

It is unfortunate that there is a lot of misinformation about China out there. Winnie the Pooh isn't banned. The social credit system apparently isn't like how it's commonly reported in the West. But I also chafe at the suggestion that China is little worse than the US on these points. There are few countries on earth that have more control over their population and shape the way they think than China.

https://www.hrw.org/report/2018/09/09/eradicating-ideologica...

> Really, does HN deserve that kind of idiotic post?

https://news.ycombinator.com/newsguidelines.html

Edit: specifically:

> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."

I don't know about the democracy part but he also mentioned religion and their ethnic cleansing of Muslims seems pretty bad from what I've read.

Was McCarthyism really that long ago?

You're moving the goalposts with a strawman. We are no better than anyone else when it comes to information privacy, which is the thrust of this article.

I'm trying to be as objective as possible. I've never been to China, but I've been to other communist country and the truth is I saw a lot of happy citizens there. While we can sit here and criticize other countries all day, but does it really matter if their own people are living happily there? We can argue and fight all day for the best policies, best technologies, best business ideas, etc. but at the end of the day what everyone is really looking for is just happiness. You can have the most money in the world and still be miserable, our world is already full of those people.

We do, but this is at a different, unprecedented scaled. As China vies for world hegemony, our future may look very bleak if China's Orwellian views are imposed at a global level.

I disagree, really. There are very close ties between Microsoft and intelligence agencies. ISPs and intelligence agencies. Device manufacturers and intelligence agencies. It's naive to not think that nearly every single device sold in the US has the government's fingers in it. And naive to think that every single communication isn't be logged by someone.

> As China vies for world hegemony

China is not going to export their political system beyond the HK and Taiwan, unlike the US.

> the country intervening in most foreign elections is the United States with 81 interventions, from 1946 to 2000

You forget China's intervention in the Korean War/North Korea. They've also annexed Tibet and killed/arrested dissidents since the 50s.

It's a case of which is the lesser evil. US's style of "imposing" democracy (and toppling it and replacing the government with puppets when it become socialist and/or unfavorable for US corporations) or Chinese totalitarianism.

> You forget China's intervention in the Korean War/North Korea.

Unlike the USA? So if China came along bombing the shit out of mexico, you'd expect the US to sit on their hands?

> They've also annexed Tibet

Annexed is hardly the right word. Tibet was part of China for centuries, they regained power after a brief period of independence. It's well within reasonable to disapprove of that, but putting it like China just conquered that totally different country that it had no relations with before is just wrong.

Same with Taiwan. To China it's a province where the government has been taken over by separatists, so why should they just give it up? Western media conveniently never mentions this so again in the minds of people Taiwan is just this country that has existed forever and is now attacked by the evil Chinese. Just pull up a list of countries which do and don't regard Taiwan as its own sovereign country and not part of China.

Are they telling me other companies in the West are not doing this and only Lenovo in China does it? I would find that hard to believe. You see, the reality is once your opponent has made the move first in an attempt to gain a competitive advantage, no matter how unethical that move is, you are forced to do the same or even more. If not you'll be quickly left so far behind and won't ever have the chance to come back in the race. Despite whatever anyone has told you, that's how the real world works. Our companies may not readily admit what they're doing but in reality they have little choices. It's similar to countries that don't possess nuclear weapons are always second class in the world's power order. The time limit to join first class was gone a long time ago and it will never come back.

Reply on news.ycombinator.com