Hacker News Reader

Comment by mark_l_watson | Hacker News Reader

A little off topic: I think multiple countries should join together to co-sponsor security evaluation labs to check Cisco, Huawei, and all telecom companies. These labs should get access to hardware design, software, etc. This can be done in a way that mostly protects individual company’s intellectual property.

I suspect that the top telecom tech companies would go along with this idea, to get vetted, if it would help increase their business. Right now there are two European and one Chinese company who can ship 5G gear. I would like all 5G, and older gear also, to be vetted by international security labs.

View on HN

> This /cannot/ be done in a way that mostly protects individual company’s intellectual property /from spilling into other countries hands/

Fixed.

Sort of like UN weapons inspects?

I like that. If we are using vocabulary like Cyber Warfare, Cyber Attacks, and even now seeing actual bombs blowing up buildings as a retaliation of a cyber attack, then why not. Who would be the Scott Ritter of the cyber world? Although, the only people that I'd trust to understand the equipment are the exact people I wouldn't trust with my equipment! ;-)

That's a very good idea. We do it for sensitive stuff like nukes, maybe we should start regarding vital telecoms and networking stuff the same way.

good idea but it sounds like a highly expensive affair

Yeah, the problem is that unlike the EU and US companies, Huawei is just the institutional arm of a communist dictatorship regime masked as a company.

And CIA seeded companies aren't?

USA is not a communist country, big difference. With political administration changes, also do foreign policy opinions change, along with whatever CIA has to do with foreign sovereignties. One USA regime pardons Manning, another jails him/her. One USA regime bombs Syria, another doesnt. Also, CIA seeded companies are just a few and none of the big ones. Palantir and Oculus are their biggest, not sure Oculus can spy on foreign countries but ok.

Yeah it's just a coincidence that Cisco can't seem to quit shipping hardcoded root backdoors to their routers...

https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...

I know right? If you ship horrible security flaws so often, eventually no one will think they're intentional :D

Honestly you could probably do it without engineers knowing about it simply by cutting QA and red team budgets.

I'm not saying I think that's what happens at Cisco. Having worked at large companies that actively try to ship secure products, and having observed (as a paying end user) the general terrible-ness of networking hardware, that it is more plausible that they're just not being careful - I want to say incompetent by that is likely unfair to the majority of engineers there.

Of course nothing says that various gov. agencies in many countries aren't auditing the equipment themselves and making use of flaws without publicizing them.

There's screwing up and having bugs.

And then there's leaving in five separate root logins in just in the first half of 2018. Like, come on.

the problem with that statement though is that's also what happens with every internet attached device people buy. At this point I would be surprised if an off the shelf IoT/IoS device didn't have at least one root login and RCE via a command line passed in a url.

I'm talking about the big iron that provides core infrastructure to corporate intranets, and the Internet at large. Comparing that to fly by night IoT shovelware is a bit disingenuous, IMO.

But look at the industry - "Big iron" (Cisco, network solutions?, juniper, dynalink ...) have all had these issues, over and over and over again.

Given the lack of subtlety and the wide spread existence of these same exploits/backdoors/bugs indicates there's a level of care that is missing in engineering of these devices that makes it plausible that this is by ignorance rather than malice.

You know who's big iron routers haven't had the issue of continuously appearing explicit backdoors? Huawei.

So your entire argument that when US does it is okay is based on

1. US administration may change and might outlaw whatever unholy thing CIA is doing today; 2. CIA does it at a smaller scale, seeding smaller companies;

So it's okay? Fascinating.

I am saying having the US do it is less frightening than China doing it. The Chinese government is still, after all, a communist dictatorship censoring everything. Their internet is more censored than Iran’s. This same Chinese government killed 30 million people during the revolution.

You are overestimating the oversight the rest of the Feds have on the CIA.

"How the CIA made Google"

https://medium.com/insurge-intelligence/how-the-cia-made-goo...

It doesn't mean big companies are not in bed with the defenses industry/CIA. We have plenty of cases we know about and we also know you guys spy the on allies too. Even if the argument is all super powers do it, international vetting is a good way to put pressure on. If all countries join in, the money and influence is there.

Just realized: even if this happened, few, if any, revelations would make it to the public.

It ultimately comes down to trust. For example, if the Chinese president decided to make a law that they can't demand data from Chinese companies any more, it's not like Trump would roll this back. Similar to Snowden, do you still trust our government isn't spying on us anymore?

Reply on news.ycombinator.com