Hacker News Reader

Comment by JediPig | Hacker News Reader

20 years ago, china hide 2nd network card that was in listener mode, transmitting documents at random times, mostly peek. This was at a research company. How it was discovered. We put a card on listening/prem mode and mirror everything for that subnet the printer was on. I thought I screwed it up with the double mirror/traffic.

when investigating why the issue, we found nothing wrong with the config, only when we plugged it to another network, we discovered it was something on the network. We narrow it down quickly to the printer. We told head of security (we were hired for an audit ) and it soon became known it was stealing trade secrets and sending them overseas.

that was 20 years ago, and till this day, I remember anytime someone says china doesn't steal technology... I remember this printer. this was done at the state level and was caught.

View on HN

It's fair play to act like any gov is doing this.

E.G: Microsoft being American (and them being part of PRISM), I just assume the OS has a backdoor for the US gov. Now with Windows 10 heavy telemetry, it's even easier.

I work for a client doing chips for credit cards. Did you know they are now full blown computers that can run a light version of Java (Java Card) ? The company is building their own hardware and software, and just to get to a conference room, you need biometric access + badge + pin code. Pretty sure they send data to my country agencies in some way despite having to trick the banking system to do so for them.

Same from any software, server/cloud hosting or hardware. If it comes from a specific country, this country is most probably using it for intelligence. It doesn't even need to be on a network now, because there is so much interactivity with all devices. And eventually, one will be.

It's pretty absurd to both sides something like this. Do you have evidence that the US government is doing this on computers it sells overseas, or is this just magical speculation?

I heard your type of argument about the US mass spying before Snowden, and surprise, we were not conspirationists after all.

So call that educated magical speculation.

Well, but correct me if I'm wrong, the Snowden leak included nothing like this. Instead it included a lot of things that would be a lot easier to do if Google/Microsoft ect just gave them access. The very fact they had to do everything else is at least evidence that don't have direct access

It's just different use cases. Backdoors are more useful for targetted operations or specific data exfiltration, while plugging yourself to back bones is more useful for mass surveillance.

I don't even see why it's controversial to hold this opinion. Reading some comments, people seems to feel offended we could think that from the USA.

If anything, the USA are, with Russia and China, among the countries anybody in Europe like me would suspect the most about pulling things like this. The CIA and NSA have a terrible reputation, and the track record to support it.

We are talking about a country that went to war while lying about WMD against the UN vote, made money with south american cocaine while organizing coup after coup, elected Bush and Trump yet punished Chelsea Manning. A country that is still under the temporary 9/11 Patriot act, it used to mass spy on its entire population.

Of course I'm assuming the worse from them.

And yes, it's fair.

Actually, even if I were proven to be completely wrong in 10 years, it still would have been fair.

But I'm not even assuming that only from the US, but basically from any gov, including mine. Because history taught us that's what power does.

It's sane to be suspicious of people in power. Necessary for democracy, even.

But, and this is where the equivalency annoys me. You could literally end up in jail for saying some of these things about China in China. You could just as well talked about abuses of women and the me to movement, but the reason that hasn't happened in China may well be not that there men are somehow better behaved, but that they appear to have put a women who did come out with an accusation under house arrest until she agreed to stop talking about it. Yes the US has done and doubtless continues to do bad things, part of that comes just from having power which the US has had for a long time, part of that comes from truly bad people ect. But the Snowden leak happened in the US. US newspapers reported on it. College professors talked to their class about it. You can talk about it on this US hosted and owned website. None of that is true in China, right? So yes I am more skeptical of the US doing shady business when a large percentage of US citizens object to shady business and can talk about it than I am of China doing shady stuff when they've built their internet to insulate their government from as much criticism as possible

Yes, cancer is worse than diabetes.

Not the point.

The point of my comment is: I assume any gov to have such backdoor if they can.

Well, but we can assume with different probabilities. For sure there are people in every government who would if they could, but the fact that the US has mechanisms to expose this sort of thing and lots of people in individual companies who feel like you and there are still no stories of this, that is evidence that it isn't happening at least not at any sort of scale

> It's just different use cases.

That's a hand-wavy redirection that isn't relevant to the issue at hand, which is that:

There is no evidence of the US (and, in fact, many other large countries, with exceptions for e.g. Israel) installing backdoors and breaking into computers in order to steal intellectual property.

There is ample evidence of China doing exactly that, against a variety of targets (not just the US - they've taken things from Japan and the EU, among many others).

I wouldn't be surprised if every nation with a functioning Internet connection tries to put the hac on whatever they can.

But that's not the topic under discussions - the topic is stealing and commercializing IP, for which there is tons of evidence for China doing, and accusations of e.g. the Five-Eyes doing it are rampant speculation with absolutely no evidence included.

Yes, that includes your comment.

I never said I had evidence, I said it was fair play to speculate all gov do the same, given they lack of morale and fire power.

Which it is.

I suppose it's true that you said "speculate", because one can speculate that the sky is green when you're not looking - speculation doesn't necessarily have anything to do with reality. Fair enough.

People have a hard time admitting that what Snowden/Assange revealed about the US is much more damning, from infected servers to keyloggers built into USB cables.

I find China is useful as a mirror to the US. If they are doing something problematic, it's highly likely the US gov is too but just hasn't disclosed it to the public.

> I find China is useful as a mirror to the US. If they are doing something problematic, it's highly likely the US gov is too but just hasn't disclosed it to the public.

You think the US is engaging in systematic genocide? I'm guessing not. If so, you should consider why you would say something so ridiculously out of step with reality.

Well, let's count how many people the USA killed with 2 wars in Irak, one in Afghanistan, one in Vietnam and countless operations in South America. Or how they mostly put non white people in a privatized prison system that then exploit them. Or how their police is so peaceful and close to the population the entire country had a debate about de-funding it.

Sure, China is worse, but it does make a useful mirror. Like Russia was a useful one during the cold war.

Seems my reply was possibly too on the nose of got flagged. Hopefully, you read it before it was removed.

*and

The first DDG result, there are many.

https://www.infoworld.com/article/2608141/snowden--the-nsa-p...

I'm a Brazilian, the NSA has been caught breaking Microsoft products on our largest companies for industrial spying too.

Around the time of the snowden leaks we learned that the NSA was installing backdoors on Cisco firewalls bound for foreign countries.

https://en.wikipedia.org/wiki/Cisco_Systems#Firewall_backdoo...

"A document included in the trove of National Security Agency files released with Glenn Greenwald's book No Place to Hide details how the agency's Tailored Access Operations (TAO) unit and other NSA employees intercept servers, routers and other network gear being shipped to organizations targeted for surveillance and install covert firmware onto them before they are delivered. These Trojan horse systems were described by an NSA manager as being "some of the most productive operations in TAO because they pre-position access points into hard target networks around the world."

Where's the part where the US steals and then commercializes Chinese IP?

My original comment doesn't focus on the stealing IP part, only on the backdooring part.

Not precisely the same thing, but even more insidious (or brilliant, depending on who you ask):

> Operation Rubicon (German: Operation Rubikon), until the late 1980s called Operation Thesaurus, was a secret operation by the West German Federal Intelligence Service (BND) and the U.S. Central Intelligence Agency (CIA), lasting from 1970 to 1993 and 2018, respectively, to gather communication intelligence of encrypted government communications of other countries.[1][2] This was accomplished through the sale of manipulated encryption technology (CX-52) from Swiss-based Crypto AG, which was secretly owned and influenced by the two services from 1970 onwards.[1] In a comprehensive CIA historical account of the operation leaked in early 2020, it was referred to as the "intelligence coup of the century" in a Washington Post article.

https://en.wikipedia.org/wiki/Operation_Rubicon_(Crypto_AG)

It’s not “fair play” to equate your assumptions and personal conspiracies to thousands of documented cases of state sponsored IP theft.

Yeah, I read those kind of comments before.

But then again, we got a PRISM, XKeyscore or NSO Pegasus coming out of the box every other year. So I stand by "fair play" to qualify my assumptions.

> Yeah, I read those kind of comments before.

Just pointing it out: this is a really sneaky way to avoid providing any sort of evidence for your claims whatsoever.

But to address your claim: security and cyber attack stuff are not remotely comparable to IP theft. You'll have to do better than literally pull claims out of thin air.

And, exactly none of those incidents you mentioned have anything to do with IP theft. Your own examples demonstrate a consistent pattern of no IP theft.

I don't need evidence since from the beginning I'm insisting that it's my own assumption.

That's how assumptions work.

And I'm not focused at all on the IP theft, only on the backdooring.

People just started to focus on IP and the USA after the fact, because americans think the USA and money are the center of the world and see it everywhere even when they are not the main point of the conversation, but just examples.

> anytime someone says china doesn't steal technology

Does anyone believe that any non-CCP actors are disputing China’s ongoing, massive, organized trade secret theft?

I do. Highly effective propaganda has associated the facts around Chinese trade secret stealing with claims of racism and general xenophobia. As a result, now you have plenty of individuals all over the world whose moral compass pushes them to ignore the facts around trade secret stealing and even go dispute them in online conversations.

Explain further, please. Your response doesn't answer the question; I can't decide if it's deliberate obfuscation through scary words or an complete misunderstanding of what is being asked.

Just go on to reddit, and you'll find lots of people defending China against what they think is a smear campaign. Lots of these people appear to be young westerners who have bought into China's propaganda.

To look beyond the rhetoric, we can see how smart rich people are acting in their self interest, (presumably the profit motive generally trumps identity politics) and there are very very numerous cases of avoiding ip leakage to PRC while being very comfortable with RoC, challenging the racial or xenophobic explanation in your post.

China is using the US’s Christian sensibilities (charity, forgiveness, etc) against them.

I don't know that it's Christian sensibilities so much as a political view extremely susceptible to this sort of shrewd manipulation. As the person you're responding to said, the smoke screen is to cast criticism of China as racist or xenophobic. They even have a term, "baizuo", to mock this concept: https://en.wikipedia.org/wiki/Baizuo

In general you're right though. They are very successful at using weaknesses against us.

This is true. Growing up in an immigrant community (and as a minority myself), I would always hear people mock how open and trusting Americans were and how Americans were easily cheated. Anything involving the honor code would usually be violated.

Printers are a huge attack vector that often go unnoticed by less competent IT folk. This is one reason why I try to avoid hardware from mainland companies like lenovo. Not that you can avoid it entirely but I try.

Why was the printer connected to the public internet? A DMZ subnet would have prevented this vector of attack.

That doesn't feel like a reasonable response... How's anormal person supposed to know what DMZ subnet would means?

A normal person wouldn't, but there should be someone on a company's IT staff who does.

>> 20 years ago, china hide 2nd network card that was in listener mode, transmitting documents at random times, mostly peek. This was at a research company.

> Why was the printer connected to the public internet? A DMZ subnet would have prevented this vector of attack.

Aren't most network printers connected to office networks with public internet access? I sounds like this printer was making outgoing connections, and I doubt many people/companies go through the trouble of specially blocking those from printers.

You'd have to be especially security conscious and paranoid (especially 20 years ago!), to be operating under the assumption that your own equipment is working against you.

It doesn’t take long as a system administrator to become certain that printers are working against you. By and large they have user hostile hardware and software.

> By and large they have user hostile hardware and software.

Eh, typical "user hostile hardware and software" is not even in the same league as exfiltrating your data to an adversary.

I’ve found this is true for everything but brother printers. I’ll never buy another brand again.

The Brother color laser printer I purchased 7-8 years ago was the best printer purchase I ever made. I barely print, and the toner doesn't dry up the way inkjet ink does. It just sits there, ready for the occasional print job. No BS software required.

Thank you and the parent. I’ll try this path in the future.

20 years ago I would have expected that most printers were connected to a parallel or serial port on a PC and any network printing functions would be handled by the PC. But then I think, wait, that was the year 2002 (which seems like yesterday when I say it) so maybe printers with direct network connections were pretty common then. My sense of the passage of time has really gotten compressed as I get older.

I don't think I have ever seen a major US office building where the printers were on an isolated network. They are usually on the same network as the workstations, but sometimes on the server network, so the print server can connect directly to them.

And to be honest, (I have been out of it for a few years now) I have yet to see a company block OUTGOING access on a DMZ.

Actually it's pretty common nowadays to have printers on an isolated VLAN. The only way "onto" that network is through a central printing management server that handles billing/accounting and job release duties.

You see it often in Universities, but also in larger businesses where you want to stop someone from accidentally printing 5000 copies instead of 50, or having print jobs stack up on top of each other in the output tray (think HR/sensitive information being scooped up by accident.)

At my work the printers are on their own isolated network. Print servers act as the bridge between the networks. Basically they were not trustworthy enough to be on the same LAN as the workstations.

If it was a multi-function printer with email capability, then yes it would need to have internet access. Or because it was 20 years ago and printers being hacked was a very low security concern.

Use a mail relay instead of directly connecting to the internet.

Did you report them to the CIA?

Reply on news.ycombinator.com