The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by whatshisface on Thursday October 04, 2018 @10:45AM (#18140338)

Another implication of the parallel axis theorem is that the attacker could perfectly mimic every moment of inertia by shaving plastic. They wouldn't have to know which two axes were being tested because there are only three real numbers worth of information in the system to begin with (once center of mass and total mass have been dealt with.) In the whole MOI tensor there are only six free numbers which sounds like a reasonable number of parameters to fix by adding and removing small amounts of material.

What was this company doing in hiring an untrustworthy manufacturer to handle secure devices? That's playing a game you've lost from the start. Not every problem is technical!

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by pjc50 on Thursday October 04, 2018 @11:29AM (#18140786)

> What was this company doing in hiring an untrustworthy manufacturer to handle secure devices? That's playing a game you've lost from the start

You're assuming that there were feasible alternatives; from their comment below:

"wasn't our device. There was a big, reputable company behind the device. We were ordering a number of those and they would be shipped to us directly from China. ... Also, we were basically locked in due to the magnitude of investment in the software we have developed for the device. ... Fortunately this only lasted for few months until it was dealt with"

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by PurpleBoxDragon on Thursday October 04, 2018 @02:24PM (#18142292)

Business lesson to include a 'no China' if the hardware handles anything sensitive, with a large fee for violating it for the middle man servicing the contract.

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by gutnor on Thursday October 04, 2018 @11:28AM (#18140781)

Another problem is anti-tampering measure is applied before the initial tampering check have been applied. Anyway, that wouldn't solve everything considering that if the chip itself is tampered with, that's undetectable short of an electron microscope analysis and even that wouldn't solve the problem of backdoor in the original chip design.

As you say, that's un-winnable. The only way to really build trust is the capacity to sue your manufacturer to oblivion - I mean the real oblivion (destruction of shareholder value) with criminal charge for the company officers, not the lame single digit percent of a single year of profit with a discount if you settle.

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by pjc50 on Thursday October 04, 2018 @11:30AM (#18140796)

> the real oblivion (destruction of shareholder value) with criminal charge for the company officers

This very rarely happens even if people have got killed. Also, good luck suing a Chinese company in China.

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by malandrew on Thursday October 04, 2018 @11:43AM (#18140927)

I reckon this could be addressed with contractual guarantees in exchange for doing business in the first place. Make it a contractual requirement that the supplier agree to adjudication in the United States in the case of security related concerns or other tampering with the final product or with the designs. They could still refuse if something happens, but I reckon at that point you can just work to shut them out entirely from the US market.

At this point, I think it's fair to establish an industry watchdog group that works as a clearinghouse for knowing all the American companies sourcing parts from the PRC and which companies they source from. This watchdog organization would be responsible for blacklisting suppliers from the entire US market if they don't agree to adjudicate in the US or if they fail to meet that contractual obligation).

This won't bankrupt them outright, but it will sever them from the US and if this watchdog group expands to aid non-US companies, could help shut them out of the entire global market.

I would also require registration of all top executives of these corporations so that you would make the punishment sticky if they moved to other companies. Overall, you've got to set a high punitive cost to non-compliance and non-cooperation.

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by pjc50 on Thursday October 04, 2018 @11:49AM (#18140981)

You can't lock China out of the market without diplomatic implications. Even assuming you managed to get a purely private boycott of China together without somehow violating anti-trust law, by the time it started making a serious dent in the market the Chinese government would have started making representations to the US State Department. Where it goes from there is anyone's guess.

(Ironically the other direction prevails in regard to Israel: there are anti-boycott laws! https://www.lrb.co.uk/v40/n14/amjad-iraqi/short-cuts )

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by lmilcin on Thursday October 04, 2018 @11:02AM (#18140500)

I honestly did not know about that. I thought that if you move any mass (remove non zero mass and place it somewhere else) there must be at least one axis which you can use to detect the change in moment of inertia.

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by whatshisface on Thursday October 04, 2018 @12:15PM (#18141220)

If the mass had to all move to one other place this would be correct (the center of mass would have to change), but the attackers are able to move the mass to multiple other places.

[ Parent | on HN ]

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by ISL on Thursday October 04, 2018 @11:29AM (#18140783)

whatshisface is correct.

[ Parent | on HN ]