[163679] in North American Network Operators' Group
Re: huawei
daemon@ATHENA.MIT.EDU (Scott Helms)
Thu Jun 13 22:12:07 2013
In-Reply-To: <CAAAwwbVvLO6V1t47Ho661a5dRGhZzHsN_fCBqyHt5hLh5qoUxw@mail.gmail.com>
Date: Thu, 13 Jun 2013 22:11:37 -0400
From: Scott Helms <khelms@zcorum.com>
To: Jimmy Hess <mysidia@gmail.com>
Cc: NANOG <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Targeted how without an active C&C system?
On Jun 13, 2013 10:01 PM, "Jimmy Hess" <mysidia@gmail.com> wrote:
> On 6/13/13, Patrick W. Gilmore <patrick@ianai.net> wrote:
> > It should be trivial to prove to yourself the box is, or is not, doing
> > something evil if you actually try.
>
> What if it's not doing anything evil 99% of the time... after all
> 90%+ of traffic may be of no interest to a potential adversary, but
> there is a backdoor mechanism that allows "targetted evilness" to be
> enabled?
>
> Sniffing on a targetted IP address can be disguised as "legitimate"
> return traffic, to a connection actually initiated from the "backdoor
> data interaction point" to some other web server, creating a ruse..
>
> A low-bandwidth fabricated return flow on top of the legitimate
> return flow once every few months, or every few days is extremely
> likely to go unnoticed, on any network that has a significantly
> large amount of normal production traffic.
>
>
> > --
> > TTFN,
> > patrick
> --
> -JH
>
>
