Can You Trust Chinese Computer Equipment?

Here's a question that's been bothering me for quite some time! How do we know that the people who build our computer hardware or firmware aren't putting something into them to eavesdrop, track, or steal information? Is it just paranoia? Is it justified, because of the recent Google attacks?

I've heard stories of people getting free thumb drives from trade shows, basically "vendor trash", but they would have key loggers or viriuses on them. Users without thinking will just jam them into a USB port "because it's free storage" and they're infected, or being "watched".

Be careful out there.

Can You Trust Chinese Computer Equipment?: "Ian Lamont writes 'Suspicions about China slipping eavesdropping technology into computer exports have been around for years. But the recent spying attacks, attributed to China, on Google and other Internet companies have revived the hardware spying concerns. An IT World blogger suggests the gear can't be trusted, noting that it wouldn't be hard to add security holes to the firmware of Chinese-made USB memory sticks, computers, hard drives, and cameras. He also implies that running automatic checks for data of interest in the compromised gear would not be difficult.' The blog post mentions Ken Thompson's admission in 1983 that he had put a backdoor into the Unix C compiler; he laid out the details in the 1983 Turing Award lecture, Reflections On Trusting Trust: 'The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.'

Read more of this story at Slashdot.

"