It's as hard to imagine as the NSA's surveillance systems.

I.e., it's not.

The lesson of the Snowden leaks is clearly this: if it can be imagined, and it can be useful, and they have the budget, and it's remotely doable, then it's been done.

China almost certainly did this because they could. You only get one chance to do something like this, so you have to do it even if it risks losing the ability to do it in the future: if you never do it, then you never get the benefit, and if you do do it, you get to do it once, and once is better than never.

Like hiding cameras in Xerox machines: https://electricalstrategies.com/about/in-the-news/spies-in-...

Thank you so much. That was a wonderful read and I really enjoyed that.

It's not that you get one chance to do something like this, it's that there is one total chance to do something like this. After it's been discovered, it's much harder to do it again for everyone - so if you never do it, then you don't get the benefit and Russia or USA or someone else does that and gets the benefit and you still lose the ability to do it in the future.

The second generation chips mentioned in the Bloomberg article were fitted inside the plastic of the motherboard. I don't think it's a stretch to imagine that such chips might be really difficult to spot. And if they aren't the natural next step for a nation state is to build an xx billion dollar fab factory and produce smd "resistors" that contain one of these chips.

I think the real trick is a real covert channel that's hard to find both analytically and via stastics/machine learning. Which is stil high enough bw.

It's so hard to detect that I doubt they will never do it again.

The second generation chips mentioned in the Bloomberg article were fitted inside the plastic of the motherboard. I don't think it's a stretch to imagine that such chips might be really difficult to spot. And if they aren't the natural next step for a nation state is to build an xx billion dollar fab factory and produce smd "resistors" that contain one of these chips.

I think the real trick is a real covert channel that's hard to find both analytically and via stastics/machine learning.

Especially if you:

1) happen to be country that makes all electronics

2) Company with a lot of ties to your country is happen to be top server supplier

3) Companies that use these servers happen to work for DoD, CIA and all major points of interest.

I wonder if China is making all these cheap wifi chips (esp8266, esp32) etc as backdoors into US infrastructure.

No more Chinese phones for me either way. It's enough that Google knows everything about me, PLA doesn't have to.

What phones do not have Chinese components?

Not only that, which base stations don't have Chinese components?

But cpu, baseband, ram etc is certainly more serious consideration... And I don't see how you can get around that. Unless you plan to build a dumb phone around a Motorola 68k or something?

Ericsson for one.

Ericsson do most of their QA work in China at least.

Without components from China? Today?

And how could you use esp chips as "backdoors"? Maybe espressif made them because they thought there is a good market for low-cost SoC with good network stack?

I hope that is the case; the pessimist in me says the price/performance is too good to be true.

I hope esp8266 & so are not relevant enough to have a sofisticated backdoor built in.

It seems likely that the esp8266 chip family is being used in industrial automation. It's a very powerful yet cheap chip, making it practically ideal for adding covert spyware. I love it, yet it scares me. It's a little too amazing.

It's not at all hard to imagine, especially from a country who is so paranoid about backdoors from other country's operating systems that they have written their own:

https://en.wikipedia.org/wiki/Kylin_(operating_system)

This is a Linux distro, not "their own OS". Many countries all over the world have had government-subsidized Linux distro projects, at national, state and city government levels. It's something that happens pretty quickly whenever and whereever a large deployment happens (e.g. LiMux).

For that matter, many a CS faculty at many a university have actually created their own OS. Nothing too sensational either.

Pedantry aside, it is the reasoning behind building their own OS distro that is relevant here:

> In 2009, a report presented to the US-China Economic and Security Review Commission stated that the purpose of Kylin is to make Chinese computers impenetrable to competing countries in the cyberwarfare arena. The Washington Post reported that:

> China has developed more secure operating software for its tens of millions of computers and is already installing it on government and military systems, hoping to make Beijing’s networks impenetrable to U.S. military and intelligence agencies.

Sounds perfectly sensible, rather than "paranoid".

Paranoid like Germany, France, Spain, Austria, Venezuela, Thailand, Turkey, etc...?

They all have Linux distros, sponsored nationally.

https://en.wikipedia.org/wiki/Category:State-sponsored_Linux...

“You only look behind the door if you have stood there yourself.”

It would explain the bizarre hiring practices - plausibly relevant, but often in areas most devs just don't use day to day - that you could coach fellow agents to pass!

(I've never actually bothered interviewing with any of the above, maybe it's all entirely normal or you need to write your own self-balancing tree implementation regularly).

It's probably a lot easier to just blackmail or bribe existing employees, probably similar to how the supply chain hack worked.

The open questions seem to be:

- Is a legitimate news organization incompetent when it comes to a deeply technical investigation?

- Why are large publicly traded tech companies refuting the article to the point of potentially defrauding investors.

I don't think the power of international players and the maturity of their strategies plays into it very much. I think you can assume they are incredibly powerful/pervasive and still doubt Bloomberg.