News for hackers. Stuff that matters.
Re:Uncovering the CIA's Crypto AG operation by dirtyid on Thursday March 05, 2020 @11:07PM (#22500916)
Australian PM basically confirmed this conspiracy theory recently, the main risk AU intelligence identified in Huawei hardware wasn't interception of intelligence by China* rather denial of access to networks with Huawei hardware which compromises intelligence sharing, i.e. it makes it harder for FVEY agencies to spy on each other's citizens. Also puts in perspective William Barrs' recent comment on buying controlling share in Ericsson or Nokia.

There's also the drama last year where US claimed Huawei technicians was helping Uganda and Zambia spy on political opponents. Political opponents being Washington friendly anti-establishment candidates, and helping being acceding to request for lawful interception duties as vendor. To be fair the technicians also helped used Israeli spyware to extract Whatsapp data. The TL;DR of the entire debacle being Chinese hardware actively undermines US foreign influence operations abroad.

*I surmise the reason US is having so much trouble producing convincing evidence of Huawei malfeasance is that China actually haven't exploited Huawei hardware because they don't want to risk damaging the brand's reputation. That's not to say China doesn't spy, of course they do. They just have the capability to do so without going through Huawei.

Re:Uncovering the CIA's Crypto AG operation by lern_too_spel on Thursday March 05, 2020 @11:20PM (#22500960)
Huawei has a reputation going back almost two decades. https://aragonresearch.com/cyber-war-flashback-remembering-t...
Re:Uncovering the CIA's Crypto AG operation by atoav on Friday March 06, 2020 @01:38AM (#22501431)
Still, given the extraordinary claims the proof on Huawei seems to be spread thin. I know they "theoretically could" surveill everything, but actual proof isn't really there (yet) afaik and this while there are parties with considerable interest to proof their wrongdoing.

Which leaves three explainations:

1. The chinese are so good the 5 eyes can't proof it

2. The 5 eyes can proof it but don't dare to for certain reasons (which wont stop independend researchers)

3. It doesn't actually happen (yet)

Meanwhile we've got tons of actual backdoors from the US side.

Re:Uncovering the CIA's Crypto AG operation by whatshisface on Friday March 06, 2020 @08:20AM (#22503299)
4. The 5 eyes have some evidence that somehow China is reading their communications, and they're scared sick but they can't catch them doing it.
Re:Uncovering the CIA's Crypto AG operation by csharptwdec19 on Friday March 06, 2020 @11:52AM (#22505093)
The PLA members being charged with the Equifax hack to me was a statement that they probably -do- know some things but do not wish the political turmoil that would result.
Re:Uncovering the CIA's Crypto AG operation by wahern on Friday March 06, 2020 @02:40PM (#22506555)
But what does that have to do with Huawei and 5G? The Equifax exfiltration exploited bugs in an internet-facing Java application. Likewise for previous incidents, such as the exfiltration of data from the Office of Personnel Management. In both those cases and others the U.S. government publicly fingered China. Publishing technical details wouldn't have created any additional political turmoil, and in fact some technical details were published.

The U.S. government could divulge credible information about a particular Huawei attack, especially if it were as pervasive as they seem to claim. I can think of many reasons why they wouldn't do this (e.g. exploits make more than just Huawei look bad, such as other American suppliers), but few that bolster their case against Huawei as a distinct threat to telecommunications security.

Rather, it seems their beef with Huawei is two-fold: 1) generalized national security interest in preventing China from dominating the telecommunications market (i.e. concern over relative tactical and strategic positions of China and U.S. SIGINT capabilities), and 2) protecting the profit margins of Qualcomm and other American suppliers.

Re:Uncovering the CIA's Crypto AG operation by dirtyid on Thursday March 05, 2020 @11:26PM (#22500987)
Huawei hacking to steal IP =/= Chinese government exploiting Huawei infrastructure to hack other nation states. The latter allegation has no credible public evidence.
Re:Uncovering the CIA's Crypto AG operation by redis_mlc on Friday March 06, 2020 @01:40AM (#22501441)
> The latter allegation has no credible public evidence.

I wish this "useful idiot" chatter would stop.

Their founder is former Chinese army.

There is a Defcon talk on how bad their security is on medium-sized devices.

With that as a starting point, why would you ever trust Huawei?

Re:Uncovering the CIA's Crypto AG operation by dirtyid on Friday March 06, 2020 @10:42AM (#22504408)
Lots of US companies founded and operated by former military. Ren was a technical researcher for that didn't hold military rank. He wasn't even eligible for CPC membership due to parental ties to KMT.

Also lots of devices with bad security and spaghetti code. Huawei is probably the most scrutinized vendor in the last decade, national and private investigators from a host of countries found nothing to suggest links to Chinese espionage. Hundreds of mobile operators with years of experience found nothing. NSA with access to Huawei internal networks found nothing. GCHQ with Huawei code to audit found nothing. The only people who claim to have evidence but steadfastly refuse to release any until recently is current US administration with Mike Pompeo leading the charge. Which turned out to be non specific claims about legally mandated lawful interception function, aka Vodaphone SSH tier of vapidness. Unsurprisingly, this has convinced no new countries, and the countries have firm banned Huawei all have exeptional dependence on US security and intelligence sharing. With all that as the starting point, why would you ever trust allegations?

Even straight from this article:

>So one other - there was another Swiss company at the time - Gretag is what it was called - that was trying to become a rival to Crypto. And the CIA and U.S. intelligence helped to sort of orchestrate smear campaigns around the world to spread disinformation that Gretag's devices couldn't be trusted; there were vulnerabilities in them.

The playbook hasn't changed. Neither have the interests. There's nothing wrong with US intelligence pursing self interest based purely on the fact that Chinese are security competitors despite complete lack of evidence. But the only useful idiots are people who believe the US smear campaign around Huawei blindly.

Re:Uncovering the CIA's Crypto AG operation by CyanBird on Tuesday March 10, 2020 @10:17PM (#22542313)
> Their founder is former Chinese army.

And like 70% of all Silicon Valley big firms have been founded with direct help from In-Q-Tel....

Re:Uncovering the CIA's Crypto AG operation by thulecitizen on Saturday March 07, 2020 @12:40PM (#22512823)
> why would you ever trust Huawei?

Why would you ever trust any US corporations?

Snowden, Intel Management Engine etc.

(Corporate) backdoors everywhere...

I think RISC-V, open hardware and OSS has to be the future.

Re:Uncovering the CIA's Crypto AG operation by CyanBird on Friday March 06, 2020 @04:03AM (#22502071)
Do you have a link to that Aus PM story so I can read further into it? It is fascinating
Re:Uncovering the CIA's Crypto AG operation by dirtyid on Friday March 06, 2020 @10:47AM (#22504469)
https://www.smh.com.au/world/europe/it-would-be-an-issue-mal...

>Malcolm Turnbull has warned Boris Johnson that allowing Chinese company Huawei to build Britain's 5G network would compromise the ability of the Five Eyes countries to collect and share intelligence.

>Mr Turnbull said the main risk the Australian security agencies had identified was not through potential Chinese interception of intelligence but by denial of access to the network.

If you follow the story closely, the intelligence community began to intervene loudly once US escalated to severing intelligence sharing if countries didn't ban all Huawei gear. To the point where you have UK firing defense minister over Huawei leak. Which is understandable, FVEY domestic security is built around hacking each other's citizens to get around domestic legislation and only NSA has access to western tech giants.