Chinese-made port cranes in US included 'backdoor' modems, House report says

https://therecord.media/port-cranes-china-modems-republican-house-report

by josephcsible • 2 years ago

28 16 2 years ago

This is just embarrassing on multiple counts. No equipment from adversary countries should be allowed in American infrastructure. I wonder what sort of attacks are possible using such a modem, but maybe it doesn’t matter - they may find creative ways to disrupt operations like disabling the crane remotely.

It’s interesting to see the tactics used by the crane manufacturer, ZPMC, to pressure port customers into accepting modems and arbitrary remote access, as detailed on page 29 (different prices, warranty issues). Also interesting is page 30, which highlights issues with using companies that we might normally trust, like ABB from Germany, because they in turn have a partnership with the offending Chinese company, ZPMC.

What I’m taking away is that we have been complacent in managing risks from countries like China, and need to take an aggressive security minded approach to managing possible vulnerabilities and attacks.

SapporoChris• 2 years ago

"No equipment from adversary countries should be allowed in American infrastructure." Seems like an extreme take. Wouldn't it be better to accept the best equipment that has passed audit regardless of origin?

pylua• 2 years ago

Where there is a will there is a way. No amount of audit has an acceptable error tolerance for critical infrastructure here.

mensetmanusman• 2 years ago

Yes for allies, no for adversaries.

pestatije• 2 years ago

ABB is not from Germany...what else in ur comment is bs?

blackeyeblitzar2• 2 years ago

Sorry ABB from Sweden/Switzerland. It was one of the competing crane companies in the report, Liebherr, that has factories in Germany.

beardyw• 2 years ago

Technicians at the ports understood them to be for diagnostic purposes, the report said.

A storm in a teacup.

mlekoszek• 2 years ago

What prevents them from being repurposed?

more_corn• 2 years ago

“Invest billions of dollars in new cranes” Or maybe remove the fucking modems?

deeth_starr_v• 2 years ago

Because someone is making money

gary_0• 2 years ago

Then the next set of cranes you buy hides the modems better. It's the same fundamental truth that allows the Thompson hack: You can't trust what you can't trust.

gruez• 2 years ago

or the modems they found were decoys, and there are better hidden ones deep inside.

hindsightbias• 2 years ago

Is there such a thing as modems or routers not filled with Chinese chips and blobs?

rolph• 2 years ago

this should be up front and center as example next time unrequired, undesired connectivity comes up for consideration

jdboyd• 2 years ago

If I sold equipment like that, it would probably include such modems by default and I would change support prices and warranty if I had to leave it out for a customer. They are too useful for diagnosing customer issues and a small price to add for something costing many thousands of dollars, so I can only imagine how much more valuable for something in the millions.

Chinese-made port cranes in US included 'backdoor' modems, House report says

Related Stories