Regarding Chinese Chip Hack

[shahidt]

Hey folks, does anyone know whether Lenovo was affected by the Chinese Chip Hack? If so, how do we know which models were affected or whether we can detect it in our computers?

[TheForgottenKing]

Don't think we know at the moment. Going back to my IBMs anyway

[ajkula66]

Given that certain governments shadow-banned the use of ThinkPads years ago, I don't believe that any systems that are still in daily use should be regarded as safe...to refresh everyone's memory...

https://www.theverge.com/2013/7/30/4570 ... king-fears

No inside information here, just my $0.02...

[TonyJZX]

LOL that article.

It says that some countries havent banned Lenovo per se, rather they were either not up for contention or they wouldnt pass qualifications anyway... a soft ban.


Anyhow they were mainly using Dell or HPs when I was in.

[shahidt]

So, I was thinking of buying a used P50 sooner or later... I probably should not, right? I don't really work with Top Secret stuff, but as an IT consultant, I do have access to confidential client data, and I should probably not risk it, right?

[Thinkpad4by3]

So, I was thinking of buying a used P50 sooner or later... I probably should not, right? I don't really work with Top Secret stuff, but as an IT consultant, I do have access to confidential client data, and I should probably not risk it, right?

Eh, confidental data you will likely have will likely not be an issue. It isn't a super big deal right now. Now if you had nuclear launch codes that might be a different story. What is a Chinese hacker going to do with someone's address, go there? I honestly doubt they care. They want stuff like the launch codes.

[Cigarguy]

And yet the Russians gets a free pass and embraced by some.

I'm of the mindset that if any "state" wants my data they'll get it. There's nothing on any of my devices that are useful to anyone except for advertisers and spammers. I'd rather the Chinese, Russians, Canadian government have my shopping history than the likes of Google, MS, Walmart, etc.

[shawross]

If you want to buy a P50 then just buy it and I think the risk is overblown, TBH Unless you are doing IT work for heads of government or military suppliers.

I think network hacking or surveillance is more of a threat and by all governments not just the Chinese.

[TonyJZX]

The Russians get a free pass as there's many who would rather be on the side of the Russians than say a blue candidate. If they're helping me win then who cares. Further the Russians like to hack election nodes dont they?

As I said before, the Chinese are the least of your worries... they are after technology secrets. You have detailed plans of the F35? They want them.

Further the Chinese police have no jurisdiction here and they are unlikely to poison you or kill and dismember you on foreign soil... but hey the Chinese are the West's enemies I guess.

I worry more about the 'five eyes' as they are called.

These will sell you down the river if needed, even the friendly Canadians and New Zealanders...

[madicetea]

.... Unless you are doing IT work for heads of government or military suppliers.

If you are doing such an important work, that company that is contracted OR the (NATIONAL) government will provide you with their own device to use, and you'll be instructed to use it in a very specific way at the penalty of (something, something, and something else).

So if you don't have such a device or warning from your company, then don't worry and just use it normally. If you're really keen on security, start by making sure that you are using a password manager, a hardware token (Yubikey Nitrokey etc are popular), and IF you are really paranoid you could even check your devices have the CRACK WPA2 patch (actually a good idea) and your RSA version is updated to the version beyond the security issue (well, at this point I've just made a useless exercise in list creation).

[RealBlackStuff]

It's actually KRACK with a K.

.. according to the US Department of Homeland Security (DHS), the main affected vendors are Aruba, Cisco, Espressif Systems, Fortinet, the FreeBSD Project, HostAP, Intel, Juniper Networks, Microchip Technology, Red Hat, Samsung, various units of Toshiba and Ubiquiti Networks.

https://www.zdnet.com/article/here-is-e ... right-now/

[madicetea]

It's actually KRACK with a K.

.. according to the US Department of Homeland Security (DHS), the main affected vendors are Aruba, Cisco, Espressif Systems, Fortinet, the FreeBSD Project, HostAP, Intel, Juniper Networks, Microchip Technology, Red Hat, Samsung, various units of Toshiba and Ubiquiti Networks.

https://www.zdnet.com/article/here-is-e ... right-now/

That it was. Thanks for the correction.