U.S. to China: We Hacked Your Internet Gear We Told You Not to Hack

http://www.wired.com/wiredenterprise/2013/12/nsa-cisco-huawei-china/

by kercker • 13 years ago

131 63 13 years ago

wired.com

slashdotaccount• 13 years ago

You can download the documents from CryptoMe:

ANT Files (16.2M ZIP) : http://cryptome.org/2013/12/nsa-catalog.zip

QUANTUM Tasking (5.7M) - http://cryptome.org/2013/12/nsa-quantum-tasking.pdf

QUANTUM Theory (2.5M) - http://cryptome.org/2013/12/nsa-quantumtheory.pdf

streetnigga• 13 years ago

CrypTome, Mr President.

blazespin• 13 years ago

Why do you think the US was so concerned about buying gear from China? They just realized that since they're doing it, China is probably doing it as well.

Alphasite_• 13 years ago

Precisely this. I would be surprised if most people haven't realised this by now.

salient• 13 years ago

I've noticed this before. They start sounding the trumpet about some dangers, after they already do them themselves - like when they said that cyber-attacks should be considered acts of war because they can put infrastructures in danger, basically months before they launched Stuxnet against Iran, or when they started warning about cyber-attacks putting banks in danger, and then we found out this year that NSA can access bank accounts and even modify them.

So next time when they warn about some other danger, I think we can assume they've already done it themselves to others. As for the "IP stealing" that they keep accusing China of, it may be true, but NSA probably steals information from other corporations more than anyone, since they have access to everything, and I'm not so sure China does, too. Most of the world's Internet traffic goes through US, and they have access to that, and as we've seen to the private networks of the world's largest service companies, too, like Google, Yahoo and so on. They also have access to most of Europe's data through UK/Sweden cables. China doesn't have any of this, and could only dream of such access.

xdd• 13 years ago

television brain washed by George Bush? How exactly NSA can access to everything is a good thing?

moootPoint• 13 years ago

The liar's punishment is they can trust no one

bananacurve4• 13 years ago

The problem with liars is not that they lie, it's that sometimes they tell the truth.

fit2rule2• 13 years ago

It explains the NSA. Since they trust no one, they can lie to everyone.

Zaephyr• 13 years ago

Most people expect other people to behave as they do, so a person's expectation of others often says a lot about the individual.

bobjordan• 13 years ago

Time seems ripe for open source networking equipment movement. Can't trust closed source solutions.

beagle32• 13 years ago

That's a nice but naive sentiment. You can rest assured your hardware is similarly trojaned - whether it is your CPU, your Ethernet controller or your network switch. No, I do not have first hand knowledge about CPU trojaning by the NSA. But given everything else, I'd be surprised if they don't have access to the CPU itself.

fit2rule2• 13 years ago

So you think the NSA is going to destroy consumer computing, then?

asveikau• 13 years ago

What would the point be of intercepting shipments if the job is already done? Are you saying they are doing this work redundantly?

Also we don't know what percentage of shipments are intercepted. If this is the primary means of attack it seems a bit shy of "you can rest assured" that your hardware in particular is affected. (Or at this rate perhaps we can wait for the next revelation to show us. :P)

dnautics2• 13 years ago

Is it just me or does this seem to be a tortured argument - the US suggested that huawei might be implementing backdoors in their product out of the box, is not the same thing as the US security agency actively searching for exploits for the product. One is a collaborative effort to sell someone a defective product (could be fraud) the other is a adversarial effort that is a natural part of the security industry cycle.

EthanHeilman2• 13 years ago

the US suggested that huawei might be implementing backdoors in their product out of the box, is not the same thing as the US security agency actively searching for exploits for the product.

The US has also been adding hardware backdoors by intercepting mail as it travels across US friendly territories. Furthermore, the US backdoored RSA's RNG 'out of the box', and reports suggest it has backdoored other things 'out of the box'.

The argument as I understood it was this, US: "China valves its 'dominance of cyberspace' over the security of both itself and the community of nations, therefore using hardware produced in China will probably make everyone, including the US, less safe".

It is a good argument in general form and it addresses an important need for security because this sort of gear is used in nuclear power plants, air defense grids, hydroelectric dams, etc (note that Hardware backdoors have covert radios for bridging airgaps). These backdoors, even if not exploited by the Chinese, could fall into arbitrary hands[1] and cause significant economic damage.

EDIT: People are downvoting this comment. As downvoting is your right please continue to do so but feedback is welcome. I care about understanding this issue and I want to know why you disagree with my comment.

1: http://en.wikipedia.org/wiki/Transnational_organized_crime

alexeisadeski34• 13 years ago

There's just an important distinction that you're missing.

If the NSA is intercepting devices and bugging them, then it doesn't really matter which brand you buy - you're being targeted as an individual. Order a Huawei phone and they'll (presumably) try to intercept and compromise it. Country of origin doesn't really matter, because (presumably) the NSA isn't compromising the company producing the device, they're compromising the delivery chain which handles all (most) devices.

The reason to avoid Huawei (according to some US gov't sources, evidently) is that Chinese security services may have compromised the company's structure itself; thus all products they create may have backdoors/trojans already in them.

These two situations aren't even in the same universe.

gonvaled6• 13 years ago

Are you aware that the NSA is actively planting exploits into products by intercepting shipments? Your are not buying a Cisco product: you are buying a Cisco + NSA product, with a backdoor. Which is exactly the same as buying a Huawei product with a backdoor.

alexeisadeski34• 13 years ago

Did you even read his comment? Of course he's aware - it's forms the premise of his entire position.

dnautics2• 13 years ago

yes, and one should be outraged by that. I would not have posted my comment if that was the parallel made in the OP, but by my reading that is not what the article stated.

TheCondor• 13 years ago

There is another degree of freedom in that equation, Cisco.

The Chinese networking gear has become shockingly good. performance per dollar and performance per watt they are extremely competitive with Cisco, especially in the higher end. I couldn't talk to gateway routers but their switches also have accurate documentation. Ciscos biggest edge is institutional memory, a bunch of CCxx certifications, and they are assembled in America or owned by an American company or something like that which meant security.

Can any one tell a remotely interesting story as to why Cisco wouldn't aid the NSA? I mean Apple, google, etc did..

pessimizer• 13 years ago

I can give you an interesting story about why they would:

http://www.salon.com/2011/06/06/cisco_law_enforcement/

Irishsteve• 13 years ago

The consistently frustrating thing about all these 'revelations' is that the US government allegedly do it only for national security concerns where as other nations does it for corporate espionage.

agsamek• 13 years ago

You would be sure that US is not doing this at all 1 year ago.

nabla9• 13 years ago

US spied French aerospace industry in 90's and there is no indication that they won't do it every time they feel US might get advantage from it.

nxbtch• 13 years ago

hey,guys. i am from china. I just wanna say, happy new year. and internet has not border.

bananacurve4• 13 years ago

Yes. Our governments may act like asses, but we don't have to. Happy New Year.

liuw• 13 years ago

Same to you. Happy new year.

a3n2• 13 years ago

Happy New Year.

brandon272• 13 years ago

Happy New Year!

gdy• 13 years ago

Happy New Year

gaius• 13 years ago

It's a good way to think about it, that the US is now in a Cold War with the entire rest of the world.

bananacurve4• 13 years ago

Not quite.

http://cphpost.dk/news/denmark-is-one-of-the-nsas-9-eyes.761...

a3n2• 13 years ago

Governments are "now in a Cold War with the [citizens of the] entire rest of the world."

Better?

mh_• 13 years ago

I guess at this point, its fair to ask all those previous commenters who were telling us: "It just doesn't work like that.. We were in the dept of defense.. you guys don't understand" to comment..

gonvaled6• 13 years ago

  In the U.S., military espionage is heroic and economic espionage is a crime. In China, the line is not that clear.

Let me say this: BULLSHIT, a thousand times.

Who says this? Any of the companies who have been lying to their customers? Any of the government agencies which have not explained anything about the NSA activities (not that they would know what is going on)? Any of the officials caught lying, one and again?

The US will not perform economic espionage as long as the US has a technological edge (which is probably not anymore the case in lots of areas).

Which brings us to an important observation: OCDE rules forbidding economic espionage are designed to keep the current technological status quo; any country is well advised to sign them to be accepted to the club, and immediately throw the rules to the garbage bin. Because we can be sure that any country capable of doing economic espionage has been doing it, is doing it, and will continue to do it, no matter the rules, no matter if they get caught, no matter the hypocrital public posturing of their leaders.

Those rules, and the whole "Intellectual Property" apparatus, is there for the suckers to respect them. The US, in particular, has never respected those rules.

wavefunction2• 13 years ago

One of my coworkers actually expressed this sentiment to me. He's generally a smart guy but I don't know how you get across how damaging this is to basic commerce.

The NSA is destroying the American technical industry piece by piece. How do we approach this existential crisis, when the folks behind the NSA apparently don't give a shit what damage they do to America?

adventured2• 13 years ago

The money is what matters politically. Interestingly in this case, while that's one of the most sickening aspects of US politics these days (the extreme dominance of money), it's also the one we can count on here. Enough damage - which seems to be a matter of time now - and a lot more companies will stand up and 'force' their politicians to dismantle the NSA's programs.

Either that or the military industrial complex has reached a point of scale where it's basically going to end up destroying itself by bleeding out the economy and the tax dollars required to fund such a massive beast.

I'd argue that there's no scenario in which the military industrial complex survives intact going forward, short of WW3. That's particularly fitting timing wise, as America has reached all sorts of crossroads in its path forward (huge generation changing issues on debt, education, standards of living, war, jobs).

edit:

Another thought - it's also going to self-cripple the military by eroding the US technology sector (capital seeds tech companies in other countries instead of the US as a response, so more technology is created outside the US in the future, in a downward spiral, potentially depriving the NSA and military of all sorts of technology and access). The relative US technology lead has been a massive competitive advantage for the military for a century.

clavalle2• 13 years ago

Here's the thing:

Every country that CAN collect data IS collecting data.

If they are manufacturing anything that can be hacked to collect data and they can feasibly get away with it (read: there is no independent oversight), you can bet it is being done.

Germany is no different than France is no different from the US is no different than China etc. etc.

The only difference is they haven't had their Snowdens come out of the woodwork yet.

I can guarantee the US intelligence apparatus is right now trying to figure out how to out a few of these foreign programs so that the US does not look quite so bad in comparison without causing a diplomatic meltdown.

Fede_V2• 13 years ago

Is there any possible justification under 'national security' for wiretapping Merkel or the president of Brazil?

Unless people think that Merkel is secretly in cahoots with some kind of extremist group, it's obvious that this kind of spying is done exclusively to get an economical edge when negotiating treaties.

doug11235• 13 years ago

Are you serious? National security != fighting terrorists. From Wikipedia for the lazy.

National security is the requirement to maintain the survival of the state through the use of economic power, diplomacy, power projection and political power. The concept developed mostly in the United States after World War II. Initially focusing on military might, it now encompasses a broad range of facets, all of which impinge on the non military or economic security of the nation and the values espoused by the national society. Accordingly, in order to possess national security, a nation needs to possess economic security, energy security, environmental security, etc. Security threats involve not only conventional foes such as other nation-states but also non-state actors such as violent non-state actors, narcotic cartels, multinational corporations and non-governmental organisations; some authorities include natural disasters and events causing severe environmental damage in this category.

fforw2• 13 years ago

The US will not perform economic espionage as long as the US has a technological edge

Spying on the head of the EU-anti-monopoly investigations against Microsoft and Google is already industrial espionage.

noibl• 13 years ago

Who says this?

Since you jogged my memory, here's one person who has said it: Richard Clarke, U.S. National Coordinator for Security, Infrastructure Protection, and Counter-terrorism 1992-2003 - https://news.ycombinator.com/item?id=3769442

we can be sure that any country capable of doing economic espionage has been doing it, is doing it, and will continue to do it, no matter the rules, no matter if they get caught, no matter the hypocrital public posturing of their leaders.

Why can we be sure of this? Simply from a rudimentary game-theoretic analysis? Isolated incidents of industrial spying aren't enough to show that this activity is as ubiquitous and inevitable as you say it must be.

gonvaled6• 13 years ago

It is not only from a theoretical standpoint: rules get broken, whenever it seems convenient, there are resources to break them, and there is an advantage to be obtained to break them. From an outside observer, the rules get broken randomly: rules get broken continuosly, sometimes more, sometimes less. Would you deny that?

But the important point is that there is absolutely no consequence of breaking the rules. Will the US be kicked out from the OCDE? Will they be sanctioned? The mere idea is laughable.

The only pressure possible is money: we need to put pressure on the US economy to change its ways.

Not that we will ever believe them again ...

throwwit• 13 years ago

Continuously stock piling exploits cannot lead to any desired end game. It's probably beneficial there's some deflating of all this stuff.

ck2• 13 years ago

Messing with the manufacturing base for maybe 80% of all USA non-food goods is probably a very bad idea.

Sure we can open source our router software for review but what if their hacks are right in the chips being made in China.

Don't US fighter jets and bombers use some electronics made in China too?

askar_yu• 13 years ago

It's important to note that during the USG vs Huawei discussions there were no actual proofs brought by the USG about the allegations it pressed on Huawei. Huawei even wrote an open letter just two years ago asking for investigation and denying all the allegations http://www.huawei.com/ilink/en/about-huawei/newsroom/press-r...

Later on Huawei testified before the US House http://www.youtube.com/watch?v=ApQjSCUpt4s

To my knowledge, no response has been made by USG justifying the allegations it was making when it was openly called by Huawei. Given all of this, I find it ironic the comments here such as "backdoors in Huawei's devices" are taken for granted. Now with the latest leaks exposing hacking by the USG itself the tone of the conversation (including the comments in HN) has not changed. What am I missing?

The only noticeable change seems was the decreased tone of the US media (CNN alikes) who used to shout extremely loud that 'Those Chinese are hacking our systems!'. At the very least frequency of such news got decreased ever since the leaks.

U.S. to China: We Hacked Your Internet Gear We Told You Not to Hack

Related Stories