Ask HN: Probability that Chinese intelligence backdoors consumer electronics?

by theoryofx on 4/2/2025, 4:34:11 PM with 7 comments
It seems kind of inevitable that we will discover that Chinese intelligence agencies have been spying on millions of people's homes, businesses, and government offices.

Their government is hostile to most Western countries, to some degree or another, and have the ability to intercept and control the products of every Chinese manufacturer without any legal recourse.

It seems obvious, or at least very likely, that Chinese intelligence agencies backdoor consumer electronics (TVs, routers, switches, wifi APs, ESP32s, air sensors, and the rest).

Maybe they're risk averse and only enable spying on specific devices (government workers, specific targets, and the like)?

Technically any device that supporters auto-updating could be backdoored at any time, for example with targeted firmware delivered to specific devices.

Maybe the NSA is on this and spends a lot of time reverse engineering consumer electronics but sadly I tend to doubt it.

Are there any independent security researchers that spend their time looking into this potentially massive problem?

  • by boznz on 4/2/2025, 6:18:02 PM

    For anything important, the manufacturer is going to have a way of getting root so enough front-doors exist already, and how well does that company protect its key?

    The bottom line is that if the answer to this question is important, assume yes, and for all threat actors.

  • by uberman on 4/2/2025, 4:42:18 PM

    Is the massive problem you see that the Chinese might be doing this or that the company that sold/gave you your device absolutely is?

  • by firefax on 4/2/2025, 4:48:35 PM

    >Maybe the NSA is on this and spends a lot of time reverse engineering consumer electronics but sadly I tend to doubt it.

    It's more likely the CIA[0] is exploiting consumer electronics that the NSA -- the Joshua Shulte trial cast a lot of light on the tools folks deploy locally.

    There's a LOT more of these exploits that need a human in the loop to deploy -- I'd be more worried about who you let near your electronics than where they were made.

    I don't think anyone is deliberately inserting backdoors, but existing business pressures lead to rushed, sloppy code which due to the nature of the internet of things is difficult or impossible to patch.

    While these devices may be manufactured in China, they are designed all over -- Korea, Taiwan, and of course, right here in the USA.

    Keep in mind how hard it is to avoid "showing your hand" if you have access to information -- even if "The Chinese" (or "The NSA" or any other entity) had some godlike ability to spy, you need a human analyst to listen to the interception. Perhaps a second to translate it. And then someone needs to decide what to do with it. Multiple that by soooo many interesting people having interesting conversations...

    I'd focus on things like using E2EE comms, MFA on your accounts, etc rather than some boogieman exploiting nation level tradecraft to own you in particular.

    https://en.wikipedia.org/wiki/Joshua_Schulte#Leaks_of_classi...