India, China Try Import Regulations As Security Tools 108
An anonymous reader writes "The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government. The EU doesn't seem to like it, but if I were in their position I'd want the same thing."
China's biggest neighbor goes further; another anonymous reader writes "Telco equipment from China could have spyware that gives access to telcom networks in India. The Indian government has officially told mobile operators not to import any equipment manufactured by Chinese vendors, including Huawei and ZTE. The ban order follows concerns raised by the Home Ministry that telecom equipment from some countries could have spyware or malware that gives intelligence agencies across the border access to telecom networks in India. The biggest gainers from the move could be Ericsson, Nokia, and Siemens, which have been losing market share to aggressive Chinese equipment-makers in India."
The only encryption algorithms worth a damn (Score:5, Insightful)
What a novel concept (Score:5, Insightful)
Re:The only encryption algorithms worth a damn (Score:4, Insightful)
Re: (Score:2, Insightful)
Regardless of whether that's why they want to view it or not, the net effect is that only robust algorithms will be exported to China. Everybody can get the code to GPG, but that doesn't make the keys invalid.
Re: (Score:3, Insightful)
The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations. Why should this be any different? There are expert groups in China who will find vulnerabilities in the systems and then, instead of having to have trojanised equipment from their own vendors, they will be able to attack the other vendor's equipment just as well.
What's really funny is that India is stopping buying Chinese made teleco equipment w
Re:The only encryption algorithms worth a damn (Score:5, Interesting)
No, it's actually quote logical. You see, for Western countries, China is a nominally communist "bad guy" that conveniently serves as an example of what the opposite of their idea of "freedom" would be. In practice, they're too distant for this to cause any change in behaviour, and buying their cheap products seems to keep the plebs happy. OTOH, India and China are highly populous nuclear armed mega-countries that share a disputed land border (see Arunachal Pradesh) - that warrants a degree of caution when dealing with each other.
Google's using WIndows code ? (Score:1)
The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations.
Come again?
You mean Google is running on Microsoft Windows' code ???
No, I ain't trying to be funny. I just can not put the 2 and 2 together.
Having Windows code is one thing, cracking Google is another thing altogether.
Re: (Score:2)
Google's services aren't running on windows, but their office staff are and that's where the point of entry was... Once you start keylogging workstations it doesn't really matter how secure other servers are.
Re: (Score:2)
However the Chinese also have the source code to Linux, BSD, Solaris etc but they still targeted windows.
Re: (Score:2)
The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations.
What does one thing have to do with the other? What have you been smoking?
Why should this be any different? There are expert groups in China who will find vulnerabilities in the systems and then, instead of having to have trojanised equipment from their own vendors, they will be able to attack the other vendor's equipment just as well.
Great, so let's make all encryption algorithms secret. Security through obscurity has worked sooooo well in the past...
What's really funny is that India is stopping buying Chinese made teleco equipment whilst other countries like the US; also great friends of China (when will you stop blocking their discipline against the rebel province of Taiwan???) still continue to buy Chinese.
Can India afford that, or are they just bluffing? And why do you think it's your job to "block" a sovereign country on an internal issue? Would you like the Chinese to "block" you if California wanted to become independent? Mind your own fucking business!
The fact that you were modded 5+ Insigthful for this craz
Re: (Score:2)
What does one thing have to do with the other? What have you been smoking?
The break in to google was based on a windows / IE vulnerability which was otherwise unknown. Looking through articles about it it's pretty clear it ends up as "state actors" from China. In other words, exactly they people MS gave source code access to.
Great, so let's make all encryption algorithms secret. Security through obscurity has worked sooooo well in the past...
Or how about using one of the standard open source well studied implementations? What's wrong is the idea of giving the source code to China and leaving all other users in the dark.
Can India afford that, or are they just bluffing?
The can't afford not to. China and India are in a state of more or less co
Re: (Score:2)
Oh dear, the second logical fallacy of the day. That I've noticed.
The article (not that I've read it) does not imply this ; the most that the article implies is that the only firmware algorithms that will be accepted by China will be those that it's code reviewer(s) think are robust. And there is no guarantee that the reviewers will be competent for this task (this is not to
Re: (Score:2)
Re: (Score:2)
Re:The only encryption algorithms worth a damn (Score:4, Funny)
Hey, MD5 was perfectly fine until your type started investigating it.
See, we've had Quantum Encryption for a while now!
Re: (Score:3, Insightful)
If only the State governments were that smart. Who the hell knows what's inside the Diebold voting machines? When working with the Defense Department we're expected to provide all the code for review.
Re: (Score:3, Funny)
Karl Rove.
Re:The only encryption algorithms worth a damn (Score:4, Funny)
Re: (Score:3, Funny)
Re: (Score:2, Troll)
Ahh... So Karl Rove works for Obama, and Pelosi, and Reid... check.
Re: (Score:2)
Re: (Score:2, Informative)
It's often overlooked that GSM development started in 1982. At that time computing power was a fraction of what it is now and DSPs, rather than dedicated logic used in today's chipsets, would be used for the first implementations of this new technology. Mobile phones are also very power sensitive devices - battery life is very important.
So given these pressures, some corners had to be cut to make the system workable on the available
Re: (Score:2)
I'm not disputing your premise, but adding a rider- sending your source code to somebody who has no intention of telling you about the holes they found (and might be planning to abuse them instead) won't help you or your other customer
Re: (Score:3, Funny)
You mean like PGP that will now be made by Symantec?
http://it.slashdot.org/article.pl?sid=10/04/29/1552249 [slashdot.org]
Re: (Score:3, Interesting)
Not just backdoors, i have seen implementations of encryption with serious weaknesses...
I saw a commercial encryption product which used an off the shelf 128-bit AES implementation (and their marketing literature made a big point of saying it used AES), but due to the way it derived a key from your entered passphrase there were only 2^21 possible keys making it trivially easy to brute force.
Another package i saw used OpenSSL to handle encryption, which seems sensible - use a known good set of algorithms...
Trust (Score:4, Insightful)
I can't blame the Chinese government for wanting to have the encryption information
Re:Trust (Score:5, Insightful)
I'm just reminded of the old security-oriented definition of Trust: the person you trust is the person who can break your security. It's a perfectly healthy attitude to trust people (/businesses/nations) as little as possible when the security of your data is at risk. In arena of IT security, we need less "trust" and more "verify".
Re: (Score:2)
This seems like a natural progression down the line of diminishing trust between countries. It's not very surprising, especially since the Chinese government *may* have been 'supportive' of some of the China/Google hacking. It appears the downside of possibly endorsing or supporting security breaches is other people/countries/etc will suspect you of it from that point on.
You might also consider that if they are spying on their own citizens via spyware installed by the manufacturer (at government insistence), they realize fully well that it can be done to them via software or equipment from sources not under their control. No need to invoke the Google hacking - that was just a sloppy fiasco. The government hacking "bay of pigs", if you will.
Re: (Score:1, Insightful)
Nobody wins when no one trusts each other.
It certainly helps maintain some diversity, which is otherwise all but killed off by globalization. Without diversity, there's no competition.
Re: (Score:3, Interesting)
I could just as well see it as a progression reflecting increasing levels of economic interdependence. Granted, economic interdependence isn't quite the same thing as trust - it's more substantial; it's trust expressed through actions.
Re: (Score:2, Insightful)
I can't blame the Chinese government for wanting to have the encryption information ... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.
What about the domestic producers of encryption equipment? Don't they stand to gain a little through sales to their government, whether it be India, China, or the U.S.A.?
For my part, I don't understand why any government trusts producers of other countries for their critically sensitive information. In the U.S., we know that our "friends", like Israel, engage in espionage, and I'm pretty sure we spy on them (although I have no evidence to back it up other than fuzzy recollections of news articles
Re: (Score:1, Insightful)
How do I know that a U.S.-produced item doesn't have a back door for NSA to use?
Always assume that it does. If you are wrong, good. If you are right, you are prepared.
Re: (Score:2)
Domestic publishers could insert backdoors too... The government should be demanding source code for review in all cases, and verifying that the devices they get are actually running the source they've seen.
Re:Trust (Score:5, Insightful)
Au contraire, when it comes to security, everyone wins when no one trusts each other.
The chinese move, at least, is long overdue. No one should ever trust a device whose source code is secret.
Actually, there *are* winners ... (Score:1)
I can't blame the Chinese government for wanting to have the encryption information ... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.
But there *are* winners !
In the case of India not importing Chinese equipments, the Japanese, European, Korean, and American companies suddenly become the de facto winners.
Copying (Score:5, Insightful)
If you're going to give your source code to the Chinese, you know for certain they will copy it and never buy a product from you again.
Re:Copying (Score:5, Funny)
Re:Copying (Score:5, Funny)
Re: (Score:3, Funny)
That one sucks. I prefer "Ginuwine Sisqó Router" because its Web interface has lots of thongs and double entendres.
Bollocks. My Honour Brand Enlightened Crisco router also makes our fried chicken taste less greasy. It's true! I took the paper towel test!
The missus loves it.
Re:Copying (Score:5, Interesting)
For that matter, how the heck does giving someone the source code (controlling software, drivers, encryption, backup algorithms, etc) equate with giving them blueprints for your hardware?
Mindless Chinabashing at its best.
Re: (Score:2, Informative)
China has a very bad track record when it comes to copyright protection and the production of knock-off products. It is true that software is only part of a product, but there's no need to make it any easier for them.
Chinabashing it may be, but mindless it sadly is not.
Ahhh, Globalization... (Score:2)
... will your wonders never cease?
What's the point exactly? (Score:5, Insightful)
Re:What's the point exactly? (Score:4, Insightful)
It should be common sense that you have to verify that the source code you were given actually compiles to a bit-identical executable in order for the exercise to mean anything at all.
Re:What's the point exactly? (Score:4, Insightful)
Re: (Score:2, Informative)
Nope. Signed files are designed so that you can extract the original data minus the signature and calculate a hash on it. Otherwise you could never check the signature.
And since you can extract the original data, you can compare it to your own build.
Signing does not provide a backdoor.
some projects embed a timestamp of the build (Score:3, Informative)
It's hard to test a linux kernel build for instance, because it embeds the time of the kernel build (and other information) into the kernel binary itself.
Re: (Score:2)
Sino-Indian War impact on decisions? (Score:1)
I wonder how the fact that India and China went to war [wikipedia.org] in 1962 impacts these decisions. They also still share a disputed border.
Would not surprise me if this influences how the Indian government feels about their telecoms using equipment from ZTE or Huawei.
Timing of Indian ban - just in time for 3G auction (Score:4, Insightful)
Yes, India is, like, right now [bbc.co.uk] in the process of auctioning 3G licenses. This will really bring benefits to Ericsson and Nokia Siemens.
China good, India bad (Score:3, Funny)
I think China's move makes sense - they just want to check and make sure there is no backdoor in your code/algo. As an earlier post said "Good encryption does not rely on obfuscation of code and processes." They trust what the users want to encrypt, just making sure the devices are not leaking the info to uninvited parties.
As for India, this is very bad. They are just paranoid. This sets up a very bad example. They are scaring off all the business partners and hence the opportunities. Think if you are a vendor, how can you be sure that they would never do the same thing to you one day?
Re: (Score:1, Insightful)
I would recommend every government, company or institution to use especially network devices only, if they can review and then compile the code themselves which is to be run in the device.
So as to avoid Trojan Boot Loaders within their networks.
big bussines is all about politics (Score:2, Insightful)
But isn't this strange? They put a ban because chinese "could have spyware or malware" in their equipment. Isn't this like putting someone in jail because he might do something bad in the future?
Here is my conspiracy theory: big companies export corruptions in the developing countries (this is a fact). Some companies could just not compete with the c
Re: (Score:3, Insightful)
but Indian goverment is not buying the stuff. It's the telecom operators that buy it and use it to sell services to regular citizens. The goverment could buy trusted equipment for their needs.
The teleco stuff is the stuff you will use to call for help and communicate during a war. Since the idea of total war [wikipedia.org] it has been clear that your civilian infrastructure may be targeted in war. The idea of something which lets your opposition remotely disable most of your industrial capacity is crazy. That's what Chinese exchanges represent for India.
Re: (Score:2)
Why is it strange? I'm pretty sure the FDA does something quite similar to this. You can't sell a medicine made of undisclosed components.
Re: (Score:2)
When checking that a medicine is not poisonous, what you'd do is to look at what's in it. It's much easier to check a list of ingredients, and test those if necessary, than to check it against every harmful substance known.
In the same way, when checking a program for malicious content, it's best to look at the source code. How
Re: (Score:1)
Again, we are not talking about the same thing.
Re: (Score:2)
The article says "including smart cards, firewall and routers".
So, how exactly is a router not a 24/7 internet connected machine, or require physical access to use it?
"biggest neighbor"? (Score:2, Informative)
This really can be a problem (Score:5, Interesting)
One project we had worked on was encrypted cell phones for gov use. Our customers were only interested in a solution that was top to bottom US made from cleared companies. The chipset, OS, drivers, etc, were all built in the US, so there was no issue of "back doors"
I also heard rumors at one point about some contractor actually finding mal-ware type SW embedded in the firmware of Lenovo laptops that could sort of call home to momma. I've never seen Lenovo boxes around after that.
I think these issues are going to be bigger than just a single point in the infrastructure chain. With so much cyber activity going on, I think many countries are going to face the same sort of issue India is trying to prevent.
Re: (Score:2)
TFA doesn't say that (Score:2, Informative)
First off, TFA article doesn't mention source code; second, it quite explicitly says 'details are murky' and it is unclear what the PRC is asking for. At least as far as the article goes, that is what is said.
Second, to some comments: Other countries already have various schemes in place for reviewing code (which doesn't preclude flaws or backdoors, intentional or not, from being included in compiled / embedded code...)
India is saying what other countries fear, but since they are in China's backyard and v
Comment removed (Score:3, Insightful)
Re:The future... (Score:5, Interesting)
see conditions begin to favor agile, much smaller businesses that can efficiently produce most important things at home
I tend to disagree; while conditions may differ elsewhere, our Supreme Court's transformation of corporations into super-citizens will in fact encourage corporations to become ever bigger so as to ever better afford the purchase of both political advertising and politicians. Given enough political control, a corporation can simply and effectively modify the rules of the game to make "doing business" prohibitively expensive or complex unless you are already of sufficient size.
And they will do that; the important thing to remember is that our corporations have grown themselves to the size that they are now for the competitive advantage that size provides in the pursuit of profit; they do not, in fact, like competition, and size provides more and better opportunities to eliminate competition.
lolll...ask Wal*Mart.
Actually it's security as an import regulation (Score:4, Interesting)
Re: (Score:2)
I definitely agree with you, but I'd take it one step farther.
By issuing this as a security restriction they are completely circumventing the WTO, which would otherwise slap them with export tariffs.
Re: (Score:3, Insightful)
The headline suggests that China is using import rules to bolster security. I think it is the other way round. They are using the demand for source code as a barrier to trade to (unfairly) help domestic firms. Not very many overseas firms are going to provide source code, leaving the market open to Chinese firms.
I would agree with you if you didn't say "(unfairly)".
Access to source code is a legitimate security concern. Fair trade doesn't mean that you can't set high standards if foreign providers can't reach them.
Re: (Score:2)
same thing happened in manufacturing... (Score:3, Insightful)
in the 80's and 90's American manufacturers gave away their technology to the Chinese to get a piece of the huge Chinese market. This allowed the Chinese to modernize their manufacturing technology by decades in a few years. Then instead of opening their markets, China flooded the world markets and decimated the foreign competition.
One might hope managers of corporations would learn from the past...
Awesome! (Score:2)
Go India! Everyone should ban electronics made in China given China's general proclivity towards industrial espionage.
I hate to say it but I agree with China (Score:2)
I think ALL governments should behave this way. If government is to take its own data security seriously, the boxes they use should not be "black boxes." For commercial business this should also be a rule but so far, business trusts closed source software and devices running on closed source software... well, not all businesses... not Ernie Ball ... not London Stock Exchange... but most businesses.
At some level, we have to trust technology though... seriously, I don't know what's in the Linux kernel. I
Re: (Score:1)
India's isn't about Trust. (Score:4, Interesting)
I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.
It probably has more to do with keeping knock off China phones off the markets to keep the big corps happy. In India, there is rampant import of Chinese knockoff phones. An HTC becomes a HIC. They add a little line at the bottom and cut the price from $400 to $50. I kid you not. Quality control is an issue, but if you have the right connections, that won't be a problem. The phone is from the same factory that makes the name brand, its the same materials, same machines, and same people. Just the 3rd shift of lineman and it doesn't go through QC before shipment.
So for sometime, the India government has been pressured to put a stop to this import. They haven't been very successful but that doesn't mean they don't look like they are trying. Exactly how do you stop 50 individually owned stores stuffed into an area the size of a CVS from selling the same stuff to a population that creates a massive amount of demand but isn't willing to pay like credit based Americans are. Not to mention your enforcement divisions are willing to look the other way for a dollar of that $50 sale. Additionally, the worst offenders are the politicians and those connected to them.
Re: (Score:1)
I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.
sadly true for many state governments.
but i think the government at the center is not that corrupt. this really is a security concern. the problem is that we don't have the kind of expertise to review each device individually for secret, kill-switch, call-home chips.
on the other hand china requiring source code won't do much about security, since it is easier to incorporate a tiny chip. imo, this is simply about not having to develop their own software.
Politics (Score:1)
More then anything, India is probably retaliating for China teaming up with Pakistan on nuclear technology.
I'm with India (Score:2)
I picked up a lovely dirt-cheap Chinese wireless card a month ago (Tenda from Jaycar in Oz for those interested).
Upon installation, the windows kept losing focus - type-type-type.. wtf (clicked back into the window).
Thought I'd watch the network traffic a bit, and sure enough; type-type-type.. window loses focus... network traffic spikes a smidgen...
Chinese vendors... (Score:2)
So India is worried about backdoors in products from China, but is not worried about backdoors being present in products from other countries?
They should be worried about any proprietary products from any country... China isn't the only country that might want to spy on India.
Will they recompile to check ? (Score:2)
All of this is a lot of work and will take a lot of time, who is going to pay for it ?
If they don't recompile it then the
Re: (Score:3, Insightful)