The United States on Monday charged five Chinese military officers and accused them of hacking into American nuclear, metal and solar companies to steal trade secrets, ratcheting up tensions between the two world powers over cyber espionage.
Washington is playing the victim of cyber-espionage when in fact it is the world’s top intelligence power, a Chinese state-run newspaper has said in a sharply worded editorial after US authorities levelled criminal hacking charges at China’s army. “Regarding the issue of network security, the US is such a mincing rascal that we must stop developing any illusions about it,” wrote the Global Times, which is close to the ruling Communist party.
Meanwhile we learn from the Snowden affair that the US Government turned Silicon Valley into a surveillance partner. The second part of the United States of Secrets is to be broadcast by PBS tonight.
Increasingly industrial systems have their hardware and/or their control systems equipped, at the time of manufacture, with “backdoors” to allow remote access at some future time. Inevitably the “backdoors” are associated with embedded software very often with features to make it undetectable. These include power plants and their components, industrial control systems, access control systems, network appliances, surveillance systems, communication devices and even commercial aircraft.
In the US not only the software giants (Microsoft, Google, Apple, Facebook…), but even hardware manufacturers such as Boeing and GE and IBM and even automotive companies have been involved with installing “backdoors” and their associated software (malware) into their products. Many US companies have regularly utilised their security services for industrial espionage and it is not very surprising that they feel beholden. Intelligence agencies in the US and Australia and the UK are not permitted to use Chinese Lenovo hardware because they are suspected of containing hidden “backdoors”. Lenovo isn’t unique. Chinese firms accused of espionage in the past include Huawei and ZTE. Chinese government organisations in their turn are not permitted to use Microsoft products and Windows 8 is especially suspected for its many hidden, built-in vulnerabilities.
There is much active research in designing and hiding “backdoors” and in detecting and disabling them.
Hardware backdooring is practical, Jonathan Brossard, Blackhat Briefi ngs and Defcon Conferences, Las Vegas, 2012
(We) will demonstrate that permanent backdooring of hardware is practical. We have built a generi proof of concept malware for the Intel architecture, Rakshasa, capable of infecting more than a hundred dierent motherboards. The net effect of Rakshasa is to disable NX permanently…. resulting in permanent lowering of the security of the backdoored computer, even after complete erasing of hard disks and re-installation of a new operating system. We shall also demonstrate that preexisting work on …. subversions such as bootkiting and preboot authentication software, brute-force or faking can be embedded in Rakshasa with little effort.
Silencing Hardware Backdoors, Adam Waksman and Simha Sethumadhavan, SP ’11 Proceedings of the 2011 IEEE Symposium on Security and Privacy,Pages 49-63
Hardware components can contain hidden backdoors, which can be enabled with catastrophic effects or for ill-gotten profit. These backdoors can be inserted by a malicious insider on the design team or a third-party IP provider. In this paper, we propose techniques that allow us to build trustworthy hardware systems from components designed by untrusted designers or procured from untrusted third-party IP providers. We present the first solution for disabling digital, design-level hardware backdoors. The principle is that rather than try to discover the malicious logic in the design–an extremely hard problem–we make the backdoor design problem itself intractable to the attacker. The key idea is to scramble inputs that are supplied to the hardware units at runtime, making it infeasible for malicious components to acquire the information they need to perform malicious actions.
The US accusing China is a case of the pot calling the kettle black. But the black methods now surely being used by the Chinese were all invented first in the US and probably under State sponsorship.
There are many Big Brothers out there.
