News for hackers. Stuff that matters.
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by gutnor on Thursday October 04, 2018 @11:28AM (#18140781)
Another problem is anti-tampering measure is applied before the initial tampering check have been applied. Anyway, that wouldn't solve everything considering that if the chip itself is tampered with, that's undetectable short of an electron microscope analysis and even that wouldn't solve the problem of backdoor in the original chip design.

As you say, that's un-winnable. The only way to really build trust is the capacity to sue your manufacturer to oblivion - I mean the real oblivion (destruction of shareholder value) with criminal charge for the company officers, not the lame single digit percent of a single year of profit with a discount if you settle.

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by pjc50 on Thursday October 04, 2018 @11:30AM (#18140796)
> the real oblivion (destruction of shareholder value) with criminal charge for the company officers

This very rarely happens even if people have got killed. Also, good luck suing a Chinese company in China.

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by malandrew on Thursday October 04, 2018 @11:43AM (#18140927)
I reckon this could be addressed with contractual guarantees in exchange for doing business in the first place. Make it a contractual requirement that the supplier agree to adjudication in the United States in the case of security related concerns or other tampering with the final product or with the designs. They could still refuse if something happens, but I reckon at that point you can just work to shut them out entirely from the US market.

At this point, I think it's fair to establish an industry watchdog group that works as a clearinghouse for knowing all the American companies sourcing parts from the PRC and which companies they source from. This watchdog organization would be responsible for blacklisting suppliers from the entire US market if they don't agree to adjudicate in the US or if they fail to meet that contractual obligation).

This won't bankrupt them outright, but it will sever them from the US and if this watchdog group expands to aid non-US companies, could help shut them out of the entire global market.

I would also require registration of all top executives of these corporations so that you would make the punishment sticky if they moved to other companies. Overall, you've got to set a high punitive cost to non-compliance and non-cooperation.

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by pjc50 on Thursday October 04, 2018 @11:49AM (#18140981)
You can't lock China out of the market without diplomatic implications. Even assuming you managed to get a purely private boycott of China together without somehow violating anti-trust law, by the time it started making a serious dent in the market the Chinese government would have started making representations to the US State Department. Where it goes from there is anyone's guess.

(Ironically the other direction prevails in regard to Israel: there are anti-boycott laws! https://www.lrb.co.uk/v40/n14/amjad-iraqi/short-cuts )