• 2 Posts
  • 20 Comments
Joined 1 year ago
cake
Cake day: July 9th, 2023

help-circle






  • Fears raised over ‘Chinese spy cranes’ in US ports

    There are concerns that the machines are effectively Trojan Horses for Beijing and could be used to sabotage sensitive logistics

    Unexplained communications equipment has been found in Chinese-made cranes in US ports that could be used for spying and potentially “devastate” the American economy, according to a new congressional investigation.

    The finding, first reported by The Wall Street Journal (WSJ), will stoke American concerns that the cranes are effectively Trojan Horses for Beijing to gain access to, or even sabotage, sensitive logistics.

    The probe by the House Committee on Homeland Security and the House select committee on China found over a dozen pre-installed cellular modems, that can be remotely accessed, in just one port.

    Many of the devices did not seem to have a clear function or were not documented in any contract between US ports and crane maker ZPMC, a Chinese state-owned company that accounts for nearly 80 per cent of ship-to-shore cranes in use in America, according to the WSJ.

    The modems were found “on more than one occasion” on the ZPMC cranes, a congressional aide said.

    “Our committees’ investigation found vulnerabilities in cranes at US ports that could allow the CCP [Chinese Communist Party] to not only undercut trade competitors through espionage, but disrupt supply chains and the movement of cargo, devastating our nation’s economy,” Mark Green, the Republican chair of the House Homeland Security Committee, told CNN.

    The Chinese government is “looking for every opportunity to collect valuable intelligence and position themselves to exploit vulnerabilities by systematically burrowing into America’s critical infrastructure,” he told the WSJ, adding that the US had overlooked the threat for too long.

    The Telegraph has contacted ZPMC for comment.

    ‘The new Huawei’

    A spokesman for the Chinese embassy in Washington DC said claims that Chinese-made cranes pose a security risk are “entirely paranoia.”

    The US investigation began last year amid Pentagon fears that sophisticated sensors on large ship-to-shore cranes could register and track containers, offering valuable information to Beijing about the movement of cargo supporting US military operations around the world.

    At the time, Bill Evanina, a former top US counterintelligence official, said: “Cranes can be the new Huawei.”

    “It’s the perfect combination of legitimate business that can also masquerade as clandestine intelligence collection,” he told the WSJ.

    In recent years, a handful of Chinese crane companies have grown into major players in the global automated ports industry, working with Microsoft and other companies to connect equipment and analyse data in real-time.






  • One of the problems with the cloud-polling integrations is that they will frequently poll the back-end APIs to get the current status of that device. A normal user might only open up the app once or twice a day and call the APIs, but these integrations will go 24/7 every 10s-5m. That can add up to a non-trivial amount of traffic. If there’s 100 users opening it up once a day, that’s not a lot of traffic, but 10 users polling every 1 minute is equivalent to 15k people doing something once a day.

    I actually saw one of my integrations I used defaulted to updating every 10 seconds. I decreased that because I didn’t want to draw attention to it.

    A business will look at their usage and ask why there’s more than expected traffic. They could be running their server on a potato. They could go back and support Matter, that costs money, requires skilled engineers, and cuts into profit margins.

    While it sucks, that is something they could point to in a court about “economic harm”.






  • Amazon corporate employees get RSUs which are stocks, not options. After the new hire RSUs go away, you end up with two vest dates a year and new comp offerings start the following year (so in 2024 you’ll see new money in 2025 plus a small base salary bump that goes in effect that month).

    Tech salaries are frequently stock based, but Amazon’s is unusual in that it’s only twice a year, and bumps start the following year, and they recently made the change to do 2 year offers instead of 3 years.



  • Attestation depends on a few things:

    1. The website has to choose to trust a given attestation provider. If Open Source Browser Attestation Provider X is known for freely handing out attestations then websites will just ignore them
    2. The browser’s self-attestation. This is tricky part to implement. I haven’t looked at the WEI spec to see how this works, but ultimately it depends on code running on your machine identifying when it’s been modified. In theory, you can modify the browser however you want, but it’s likely that this code will be thoroughly obfuscated and regularly changing to make it hard to reverse engineer. In addition, there are CPU level systems like Intel SGX that provide secure enclaves to run code and a remote entity can verify that the code that ran in SGX was the same code that the remote entity intended to run.

    If you’re on iOS or Android, there’s already strong OS level protections that a browser attestation can plugin to (like SafetyNet.)



  • It’s not generally a hardware problem. It’s a resourcing problem. Companies like GitHub will have complex software and architecture. IPv6 requires them to get a pool of IP addresses, come up with an IP address management strategy, make sure all hosts have IPv6 addresses meaning that now provisioning systems and tooling to management DNS has to plumb IPv6 addresses through too.

    Then the software stack has to support it. Maybe their fraud detection or auditing systems have to now support IPv6 which means changes to API schemas.

    None of this is a good reason why they shouldn’t do it, but I’ve had to make similar decisions at my job as a software engineer on what looks to be simple but actually requires changes across systems.