full-disclosure - Re: Chinese backdoors "hidden in router firmware"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0d0d01c87f91$4cb69a00$e623ce00$@com>
Date: Thu, 6 Mar 2008 11:52:21 -0200
From: "Kurt Dillard" <kurtdillard@....com>
To: "'Untitled'" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Chinese backdoors "hidden in router firmware"

The assertions in the article and some of the comments in this thread sure
look racist and xenophobic to me. Why is it more risky that a product is
produced in China than if its made in Seattle, WA; Arlington, VA; Mexico
City; London; or Berlin? The Chinese may have the skill and motivation to do
this, but so does the USA, Russia, France, and most of the first world
countries. You read about China breaking into US government computers, what
you don't read about so much is the industrial espionage facilitated by
Israeli and European governments to help firms within their countries to
compete much less all of the spying the US does against the entire world.
The risk is there, the risk may be higher with certain products and specific
open source projects, but its there regardless of where the product is made.
On top of that, a very large portion of the designers, engineers, and
programmers for high-tech products made in the USA are foreign nationals.
Why would the Chinese government need to slip a back door into a router
where all they could do is pick up encrypted network traffic when instead
they could turn a kernel programmer at Apple, Sun, or Microsoft and get a
backdoor slipped into the encryption algorithms and the kernel itself?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/