Chinese-made port cranes in US included 'backdoor' modems, House report says

This is just embarrassing on multiple counts. No equipment from adversary countries should be allowed in American infrastructure. I wonder what sort of attacks are possible using such a modem, but maybe it doesn’t matter - they may find creative ways to disrupt operations like disabling the crane remotely.

It’s interesting to see the tactics used by the crane manufacturer, ZPMC, to pressure port customers into accepting modems and arbitrary remote access, as detailed on page 29 (different prices, warranty issues). Also interesting is page 30, which highlights issues with using companies that we might normally trust, like ABB from Germany, because they in turn have a partnership with the offending Chinese company, ZPMC.

What I’m taking away is that we have been complacent in managing risks from countries like China, and need to take an aggressive security minded approach to managing possible vulnerabilities and attacks.

If I sold equipment like that, it would probably include such modems by default and I would change support prices and warranty if I had to leave it out for a customer. They are too useful for diagnosing customer issues and a small price to add for something costing many thousands of dollars, so I can only imagine how much more valuable for something in the millions.

“Invest billions of dollars in new cranes” Or maybe remove the fucking modems?

this should be up front and center as example next time unrequired, undesired connectivity comes up for consideration

> Technicians at the ports understood them to be for diagnostic purposes, the report said.

A storm in a teacup.