News for hackers. Stuff that matters.
Re:ESP32/ESP8266 Wi-Fi Attacks by nabla9 on Tuesday September 03, 2019 @03:42PM (#20870359)
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary

This is false. In most western countries governments cant force HW makers to add backdoor.

Re:ESP32/ESP8266 Wi-Fi Attacks by dv_dt on Tuesday September 03, 2019 @04:07PM (#20870631)
Portions of the US government have tried multiple times to make the addition of backdoors required via public force of law. They're still trying to promote it now. Short of that public requirement, they can ask & issue orders to not discuss the matter, tie it with defense orders, or imply the withholding of export or trade licenses, all contingent upon cooperation. In the end it looks pretty blurry between a request for cooperation and and order.

Even in China, they might not need to rely on explicit state security authority, just tie it up with state sponsored funding or other softer measures.

Re:ESP32/ESP8266 Wi-Fi Attacks by nabla9 on Tuesday September 03, 2019 @04:15PM (#20870714)
> they can ask & issue orders to not discuss the matter,

They can't do that.

Re:ESP32/ESP8266 Wi-Fi Attacks by dv_dt on Tuesday September 03, 2019 @04:19PM (#20870745)
Why not in the form of a National Security letter?

https://en.wikipedia.org/wiki/National_security_letter

Re:ESP32/ESP8266 Wi-Fi Attacks by nl on Tuesday September 03, 2019 @06:59PM (#20872173)
No, a national security letter can't do this.

It can only compel the release of collected metadata to agencies.

Re:ESP32/ESP8266 Wi-Fi Attacks by dv_dt on Tuesday September 03, 2019 @07:24PM (#20872391)
Are holes in security infrastructure required to collect metadata? Are keys, data that secures content - considered metadata? They're not content. Since you can't discuss the letters publicly, a claim could be that it is metadata, and compel keeping the request to collect it as such secret - similarly the fight from the silenced party, if there were any fight, could be out of public visibility.
Re:ESP32/ESP8266 Wi-Fi Attacks by nl on Wednesday September 04, 2019 @02:57AM (#20874642)
No they aren't. Read the Wikipedia page you linked to.

It's great that you can make claims like this based on zero evidence or even allegations, but there is no basis in fact for it.

What's more the number of 3rd party people that have to be involved in something like this make it virtually impossible that the national security letter structure could keep them all silent, especially since there are numerous foreign nationals in the supply chains.

Go read the huge amount of ACLU coverage of these, or the many articles linked, or the congressional testimony. There are no allegations that this mechanism is being used to do what you say.

Re:ESP32/ESP8266 Wi-Fi Attacks by jtc331 on Wednesday September 04, 2019 @08:09AM (#20876329)
Since when has the US government felt limited by its own laws? The naïveté here is incredible.

That doesn’t prove they have done it. But arguing they can’t is crazy.

Re:ESP32/ESP8266 Wi-Fi Attacks by tdhttt on Tuesday September 03, 2019 @05:06PM (#20871180)
Citation needed?
Re:ESP32/ESP8266 Wi-Fi Attacks by _jal on Tuesday September 03, 2019 @05:44PM (#20871506)
You seem to be making specific, narrow arguments to cast doubt on a much wider claim.

Care to state your belief about the relations between the TLAs and the larger networking and communications firms in the US?

Re:ESP32/ESP8266 Wi-Fi Attacks by nl on Wednesday September 04, 2019 @03:04AM (#20874667)
You seem to be making specific, narrow arguments to cast doubt on a much wider claim.

Not the OP, but I think that addressing specific parts of the claim is extremely important.

We've seen this around the PRISM program, where the allegations of support by tech companies were confused by their support for lawful law enforcment warrants (as opposed to the NSA's dragnet surveillance via PRISM). This confusion has reached the point where I saw a lecturer claiming Google helped the NSA collect data as part of PRISM, where the NSA's own slides[1] show the opposite[2].

[1] The famous "smiley slide" https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns... or https://slate.com/technology/2013/10/nsa-muscular-program-sp...

[2] https://arstechnica.com/information-technology/2013/11/googl...

Re:ESP32/ESP8266 Wi-Fi Attacks by stiray on Wednesday September 04, 2019 @12:32AM (#20874013)
Re:ESP32/ESP8266 Wi-Fi Attacks by jhayward on Tuesday September 03, 2019 @07:33PM (#20872460)
I would be interested in a review of applicable law which would limit the effect of a US FISA court order.

I'm not aware of anything that would prevent the court from ordering a vendor to implement features to effectuate surveillance ordered by the court.

Re:ESP32/ESP8266 Wi-Fi Attacks by dragonwriter on Tuesday September 03, 2019 @07:42PM (#20872531)
FISC/FISCR don't order surveillance, they permits it; the only compulsory powers they have are to limit the scope and conditions of the surveillance permitted, and that's binding on the government under FISA, which criminalizes certain surveillance unless authorized by FISC/FISCR.

And that's a pretty weak compulsion, since the people who are bound are the people who would ordinarily prosecute any federal crime, and they probably aren't interested in prosecuting themselves.

Re:ESP32/ESP8266 Wi-Fi Attacks by jhayward on Wednesday September 04, 2019 @09:04AM (#20876774)
FISA courts issue warrants, which are court orders. All US courts have the power of the writ which means they can issue further orders to effectuate an order or ruling. So a court can order a company to assist the government in the execution of a warrant. This is pretty long-settled law.

The fact that some government agent applies for the warrant does not alter the fact that the warrant, once granted, is an order nor does it remove the power of the writ for further orders to effectuate the warrant.

Re:ESP32/ESP8266 Wi-Fi Attacks by squarefoot on Tuesday September 03, 2019 @06:33PM (#20871946)
9/11 changed everything.