US distrust of Huawei linked in part to malicious software update in 2012 Suspicions about the integrity of Huawei products among US government officials can be attributed in part to a 2012 incident involving a Huawei software update that compromised the network of a major Australian telecom company with malicious code, according to a report published by Bloomberg. The report, based on interviews …
"You really should dig into the funders and purpose of that propaganda outfit"
What nefarious parties are funding Bellingcat?
Bellingcat has published a lot of findings about Flight MH17, Syrian chemical warfare, the poisoning of Skripals and/or Alexei Navalny, and more - which ones do you deem propaganda - and why? Please elaborate.
I don’t wish to be disrespectful in any way, but I feel that your questions may be answered if you actually did what I recommended.
And by the way, I did not say that their sources of funding were nefarious. Your own investigation should clarify this misunderstanding.
Bon week-end.
"I don’t wish to be disrespectful in any way, but I feel that your questions may be answered if you actually did what I recommended."
Sorry, I'm not a journalist. Surely you can come up with couple respectable news sites with the smoking gun.
I'm not going to spend hours to dig into this, since you obviously have done. Wikipedia and Bellingcat site lists philantropists, charities and organisations like "Dutch Postcode Lottery". Sounds pretty harmless to me.
"And by the way, I did not say that their sources of funding were nefarious."
Well, perhaps not nefarious per se but you're clearly alluding that there is something very fishy with the funders.
Also, I'd really like to hear your thoughts about those Bellingcat cases: Skripals, downing of MH17 etc. Which ones are propaganda?
@Sandtitz
I don't doubt that they have also published articles about, let's say, American spies planting spyware in routers? I assume you would have mentioned it if you had?
Did they also publish articles about American "extraordinary rendition"? I assume they did but I never got around to reading same.
And there is that Guantanamo thing. Human rights be damned.
Got to love Americans way of thinking. "Everyone and everything from another nation is bad, but us Americans are holier than thou".
yeah, right
It has a name: American exceptionalism.
The amount of downvotes on the op is telling. Mainstream media portrays Bellingcat as legitimate and so it is for the mainstream followers.
If they care to dig around even the slightest, they'd find out what is the function of Bellingcat. It is no secret that its function is to act as an arm if the IC, saying things that they themselves cannot. A propaganda outlet.
"The amount of downvotes on the op is telling"
It's only telling of the rational requirement to provide evidence of assertions. Assertions that were then clarified and shown to be bogus in as much as Bellingcat was accused of being silent on subjects in the public domain more than a decade before they were even founded.
You 55 Savushkina street clowns really are a joke.
You can bleat "Bellingcat is propaganda" all over the internet anonymously, all you clowns actually convince anyone is that Bellingcats intelligence is a serious threat to 3rd world Russia.
Their work is exceptional, their funding is transparent and their founders history has absolutely nothing to do with the intelligence community, no matter how many fake profile bleat their rubbish oline.
"I don't doubt that they have also published articles about, let's say, American spies planting spyware in routers? I assume you would have mentioned it if you had?
Did they also publish articles about American "extraordinary rendition"? I assume they did but I never got around to reading same.
And there is that Guantanamo thing. Human rights be damned."
Isn't all that common knowledge and well documented now? Why would Bellingcat use their finite resources to spend time with the spyware in Ciscos which was detailed by other media companies before Bellingcat itself existed?
Also, just about everybody in the planet knows that USA brought scores of "illegal combatants" (their definition) to Gitmo even before that. I don't remembed the US government denying point blank any knowledge or taking part in those as Russia did with MH17, Donetsk or the Novichok cases.
"Got to love Americans way of thinking. "Everyone and everything from another nation is bad, but us Americans are holier than thou"."
Perhaps that is so. But what's that got to do with Bellingcat?
Here's a recent summary of some of Bellingcat's work:
https://caitlinjohnstone.com/2018/04/30/war-propaganda-firm-bellingcat-continues-lying-about-syria/
I don't doubt that they do "good stuff" too, but that makes it easier to hide the disinformation/misinformation when required.
Consent manufacturing go brrrr.....
Not everyone, just the clowns pushing paid propagandist rubbish like Beeley or Johnstone. Particularly to attack someone like Bellingcat.
That link is utter garbage full of idiotic kremlin lies, spouted by a known asset of 3rd world Russia's propaganda organs.
All that rubbish convinces us is that Bellingcat is accurate enough to upset 3rd world Russia.
It looks like you are stating that they are a dodgy propaganda outfit because some of their funding is from the US govt and they have not published stories that attack the US
... except on the home page I see
"US Soldiers Expose Nuclear Weapons Secrets Via Flashcard Apps"
which cannot be called flattering.
No, you provide your evidence and references, if you are an expert.
This is a standard method / trick used by various virulent political parties and conspiracy theorists. The argument goes that if you disagree with them, then you should be able to spout chapter and verse of references to support your view. But in their case they will not say, X and Y because of this and this reference, because in that way they can easily be refuted.
Their aim here is to get you to provide references to the negative and then pick and argue for you to provide more against a particular part that they identify as incorrect.
The second objective is to get the less credulous to search for 'bellingcat is bad' and then start digging through the latrine of conspiracy theories.
And yet it is the Trump family, whose original wealth was seeded by brothels (1), that has co-invested with China (2) and whose Chinese trade mark requests were granted in record time (3). Go figure.
(1) https://www.bloomberg.com/features/2016-trump-family-fortune/
(2) https://www.nytimes.com/2018/05/15/world/asia/trump-hotel-china-indonesia.html
(3) https://www.forbes.com/sites/tommybeer/2020/09/22/ivankas-trademark-requests-were-fast-tracked-in-china-after-trump-was-elected/?sh=61aef7ed1d60
I doubt that Huawei would insert any phone tap code into their switches -- its far too obvious -- but I wouidln't be surprised to discover it had statistics generation and the ability to filter specified traffic and copy it to a selected port. This is common practice and if it were badly implemented then it might look like a 'tap' to the uninitiated (and paranoid). In the right hands this could be blown up into a full scale spy scare but at an engineering level it ranks with leaving a Telnet port open with a default password.
When you start dealing with "the security services" and their media sidekicks you meet people who are long on paranoia and often very short on technical expertise. They're good at dropping dark hints but they never actually come out and say exactly what they mean. So we'll get the "In 2012 such and such kit was discovered with spyware in it" but you'll never get any actual details about what/why/how. Occasionally something leaks out that's too obvious to obscure (like the Telnet port) but the usual material is innuendo and "I'd like to tell you but I'd have to kill you" type nonsense.
As for Bellingcat, the "citizen investigator", its funded from grants from various foundations and charities. All very kosher until you look at who's funding the funders. Its largely assumed that its a mouthpiece for the usual intelligence agencies, its another of those "sources have said" type things where you want to disseminate material but you don't want it to be attributable.
"Lawful intercept" is a thing, and has been a thing for decades.
Here is a Cisco overview (though from 2008):
https://www.cisco.com/c/en/us/td/docs/routers/10000/10008/feature/guides/lawful_intercept/10LIovr.html
So Huawei will have had the REQUIREMENT to have something similar in any high-end routers.
Whether they built any nefarious ones in? Personally I doubt it - I'd bet on sloppy code or significant misunderstandings.
" its another of those "sources have said" type things"
So you 55 Savushkina street clowns haven't even bothered looking at the site you're trying to slander?
They are all about the evidence. Hard evidence, open sourced. They never rely on "sources have said" type rubbish you lying propagandist tit.
Not surprising in context;- 3rd world Russia spends less per head on education than the South American average.
This secret spy-chip stuff is pretty scary but it takes a lot of people to make a secret spy-chip, and a lot of people to build it into a system, and a lot of people to actually build and deploy code to use the things, and a lot of people who actually spend their working lives looking for it not to notice the unusual traffic.
If there was really a problem, then by now I'd have expected to see [b]somebody[/b] say in the Register's comments on the stories to have said "Yeah, I did this and that for them." or "I saw that, then, in these."
I've installed a lot of Supermicro systems, and I've seen a lot of unusual traffic sending keystrokes to China. But all of that traffic has been easily attributable to compromised Windows boxes - which are much easier to communicate with, and, I dare say, more numerous and accessible than any secret spy-chip. Plus you don't have to compromise any harware, all you have to do is wait until the MD starts the WiFi connection wizard on his new laptop.
Colour me unpersuaded until we see some real evidence.
"Yeah, I did this and that for them." or "I saw that, then, in these."
Seriously, in Chinese controlled agents and equipment?
"until we see some real evidence."
I doubt you wiould be convinced by any amount of evidence.
It is all too common for Westerners, usually Americans, to be so paranoid about their own governments that they have no concept of what true dictatorships and control really are, and the actions those countries take against the West.
You forgot the main one - US politicians get backhanders from US companies - in this case to keep selling overpriced US made equipment instead of the cheaper and better made kit from China.
The whole "block Huawei" mess has been to protect the profits of US networking companies such as Cisco.
The USA - the country with the best government money can buy !!!
Icon for what should happen to corrupt politicians ===========>
of course, by your direct comparison, there's no corruption at all in China, no dirty dealings in international commerce and technology... Just the happy hard-working, regular & normal insane cult of totalitarian neo-fascism and gargantuan human rights abuses..?
Reply to teacakes - Where did I say that there is no corruption in China ?
Any nation that is large enough that the bulk of the population never sees the politicians except on TV or other media always ends up with corrupt politicians. At least the ones with "President for Life" are being a bit more open about it !!!
The US has corruption built in to its electoral system - for all federal offices (and many state offices) the amount of money that has to be spent in advertising to get elected exceeds the total salary from the office. This requires the candidates to have wealthy sponsors to have any hope of success and they have to please their sponsors by bending legislation in their favor and/or arranging government contracts to go to firms they control.
"The whole "block Huawei" mess has been to protect the profits of US networking companies such as Cisco"
Guess where Cisco kit is assembled...
The start of the serial number used to be an indication where it was assembled, so FTX was Texas, JMX was Mexico, FCZ was the Czech Republic. Now the majority is assembled in China, hopefully from 100% genuine Cisco designed/specified part (with 'grey imports' all bets are off)
It was rumoured the primary reason the five eyes agencies didn't like Huawei, was because Huawei refused to incorporate backdoors for them.
So the main "risk" was the inability for five eyes to spy if Huawei tech was implemented. Everyone else asked how high when they were asked how to jump.
the HCSEC said that Huawei cant produce decent code in the first place, so if there is a hole in it, it's there for everyone, not just china.
the Main problem the US have is that they have no capable RAN equipment provider and Huawei's kit is cheaper, more advanced and on way better terms than anything provided by others.
Also, they have a cheek saying that the Chinese government can compel Chinese companies to do stuff, they just passed a law that forces US companies to turn over information they hold wheresoever held if they say so.
Also, they have a cheek saying that the Chinese government can compel Chinese companies to do stuff, they just passed a law that forces US companies to turn over information they hold wheresoever held if they say so.
I wouldn't expect the Chinese government to use any US made network gear for obvious reasons.
I wouldn't expect the US government to use any Chinese made network gear for obvious reasons.
"... And given the ways in which China has tilted its market toward local firms, it might be fair to say turnabout is fair play, if anyone were actually concerned about fair play."
Unfortunately nobodies going to stop the spooks from spooking. At best, the spooks might be whipped for not doing more defensive work because they're having too much fun attacking. Good luck with that.
I have great respect for some aspects of China (which doesn't include their surveillance state, etc.). One of those aspects is to engage in Globalism while at the same time balancing that with building a self sufficient base in food, manufacturing, and technology, which is a form of risk management.
The US and the UK in particular have taken the opposite course, engaging in Globalism while disassembling through outsourcing and importing vital parts of their economies. Financial services, entertainment, pharmaceuticals, medical "industry", top end "intellectual property", software and software services, importing and selling of consumer products, those business of are doing fine. But that does not make a balanced economy, and the huge number of people working in unstable service jobs (e.g., shifting and selling imported goods, contract labor), is a sign of that.
That's why I think selective "protectionism" (within a sphere of like minded nations) is a healthy thing, even though it "threatens" the status quo. It is counter productive to always couch it in anti-China language (which carries significant risk), when the real driver is need for economic self-improvement and risk management.
"The update appeared legitimate, but it contained malicious code that worked much like a digital wiretap, reprogramming the infected equipment to record all the communications passing through it before sending the data to China, [the sources] said,"
That could be spyware although I've seen code like that in the past where systems send user information back to enable debugging and performance verification. Had they included a typical "user licensing" text that stated that Huawei was working the same way as Google email or Google Drive then this would have been a complete non-issue.
Am I infected? No, I'm using Google (LOL).
. . so essentially they're confirming that WHOAAAHWEEE was complicit, had no choice, which now it comes as no suprise as to why a lot of nation states dropped the kit like it was hot. Can you really blame potential customers from looking at AU and US findings, then running away at speed?
The chip we never saw that was supposed to be a Bejing backdoor into Huawei equipment has now been replaced by this supposed technical spying excuse.
And I note that this report comes, once again, from Bloomberg, the guys that were not capable of giving any supporting evidence of their previous attemp at scandal.
Why should it be any different this time around ? And why continue beating this drum, Bloomberg ? Who needs additional justification ?
The deed is done, Huawei is out. Whether or not people believed it is now immaterial. You can stop flogging that dead horse.
"record all the communications passing through it before sending the data to China"
The above comment also says something about their hardware, it must be exceptional, the amount of processing power and local storage in the switches must be massive to be able to take all the data passing over the backplane and store it for sending later.
The issue isn't the 'intercept' per se, but the "record all the communications" and then after some unspecified length of time (recording), "sending the data to China".
Reading between the lines, it is quite plausible for the Oz spooks to have received an "anonymous" tip-off that caused them to look at Optus in some specific way, at just the right time to catch the 'malware' in the act and start hares running before it 'cleverly' deleted itself leaving no trace.
Given Stuxnet, Kaspersky et al. and what we know from Snowden, namely, the NSA had penetrated Huawei's (China-based) network; it would be potentially possible for it to have some 'control' over an 'official' update and China located end-point for some malware to send traffic to and for that traffic not to cause delivery failure messages.
Yes, this is conspiracy theory territory, but given what we know there is nothing that discounts this reading as the wild imagining of a nutter...
This whole story sounds not too dissimilar to what happened with Vodafone Greece in 2004/2005, I wonder if Opus had been using Ericsson equipment how different the world would be.
Perhaps it just shows how put out various three letter agencies can be when their sig-int is comprimised or when they aren't the only ones doing the comprimising.
That one was a bit different. The guy there was patching PLEX in real time. That was altogether more ballsy. but I guess the basic principle stands, sneaking in, covering your tracks, doing something bad, sneaking out.
I know a couple of the Ercisson guys who investigated that years later and they are still amazed at how clever it was, and it was the most pure coincidence it was discovered.
In cas you're interested, there was an excellent presentation from hack in the box on this:
https://www.youtube.com/watch?v=xCU47bJoLho&t=236s
Reads like a spy thriller.
After several days, the snooping code reportedly deleted itself, but Australia's intelligence services decided China's intelligence services were responsible, "having infiltrated the ranks of Huawei technicians who helped maintain the equipment and pushed the update to the telecom’s systems."
How convenient that the evidence has mysteriously disappeared 'itself'.
Even more mysterious as Optus denies the event took place;
"........says that Optus, a division of Singapore Telecommunications Ltd., had its systems compromised through a malicious update in 2012 – a claim the company disputes."
But hey "Trust us" - "We are collectively the honourable American and Australian Intelligence services and have no reason to not tell the truth"
Here's an interesting article: https://strategypage.com/htmw/htecm/articles/20211219.aspx
Recently Western Internet security researchers discovered how some countries can use Huawei phone software to monitor and censor journalists of the government via a commonly used router accessory called middlebox hardware. Using special middlebox software supplied by Huawei, nations can quietly censor user access to certain subjects or identifying such users and secretly pass on offending messages to someone else.
"Everything that criticizes China is US propaganda!" Only serves to make you sound too weak minded to counter the facts. But that's pretty common for sneering ad-homiems.
There's a variety of sites commenting on the story, and the original Co-authors were Valentin Weber and Vasilis Ververis, PhD candidates at the University of Oxford and Humboldt University of Berlin respectively.
If someone has a copy of the code in the update, either the malicious code is there or it's not. I'm thinking it probably is or the claims being made wouldn't be made. So instead of "we deny that" maybe Huawei could instead say "We admit the malicious code is there, but we didn't put it there." Which could potentially be true. I mistrust U.S 3-letter agencies in the strongest terms. The formerly illustrious FBI has become one long-running joke and they are far from the worst.
Closed source depends on vendor trust. Which is foolish, regardless of where your vendor is headquartered.
Open source is not just about the ability to modify or repurpose, but your ability to audit. Whether you, personally, do audit the code is less important than the possibility.
As a telecoms engineer with decades in the industry, just a couple of points to add, without getting too contentious hopefully.
Telecoms equipment is like a lot of other equipment, it comes down to 3 key points - performance, trust and cost. The Ericssons and Nokias of this world strike a (somewhat lopsided) balance of all 3 - they do cost significantly more than Huawei, but they receive no subsidies. With Huawei, the equation works a little differently, the cost is unbelievable, but they ask you to wind back a bit on the trust as a consequence. The performance, just for completeness is pretty much the same across all of them, sorry Huawei lovers, 4G is 4G, 5G is 5G, it isn't miraculously better from any one particular vendor.
Now to the points made - John Suffolk is very misleading in what he says. Sure, you cant just put in any old software, but I have worked on a number of deployment projects where the core networking guys from Huawei often looked like they'd been partying all weekend. Not making much sense and eyes glowing red. All of this was from a lack of sleep. They were literally exhausted. They said they'd been loading patches from HQ in the dead of night, and could I please not tell the operator (I was working for Huawei myself at the time) - I kept quiet on it, but it seems, that if the operator didn't know, then indeed any software *could* be loaded. That this breaks every rule in the book goes without saying. Normally patches are tested on the model network against the build currently in deployment and then loaded on to production once verified. This wasn't exactly followed here.
It is an open secret in our community that you're only as safe as the last patch you loaded. And patches are loaded with a degree of regularity, often around every month or so, give or take. So there is means and opportunity there, I'll stay out of saying there is motive as this is more around the technical merits of "can this be done and can it acheive the nefarious ends that it is accused of" - the answer is yes, it can.
"https://mronline.org/"
What a front page. You outed yourself for something like this?
- Ten Marxist classics for Xmas
- Chávez the Radical
- The Maidan massacre in Ukraine
- Watch “Marx is Back”, Episode 1
- Marxism and STS
- Revisiting Marx
Remember this article from Bloomberg? Turned out to be unsubstantiated as well.
A trade war dressed up as subversion.
Does Your Motherboard Have a Secret Chinese Spy Chip?
A Bloomberg news story claiming that China has been secretly planting a spy chip in server motherboards used by US companies has prompted a rush by security researchers to try and find it, amid denials from the companies affected.
October 5, 2018
"Huawei is not on trial..."
That's indeed the point. Cisco's lobbyists and their colleagues have been lobbying Congress against Huawei for years, not without success, with unsupported allegations about backdoors in Huawei kit. They were particularly successful with this while tRump was in the White House and got enough pols of both sides to drink their Kool Aid. An enormous commercial success for Cisco and other "Western" companies.
BTW, Mr Google informs me that "Cisco has manufacturing facilities in Asia, China, Eastern Europe, Latin America, North America, and Western Europe."
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
