Telcom devices usually come with telcom support contracts, where the support technicians have access to devices.
Once during an engagement we watched Huawei support staff do an SQL query that clearly was for national intelligence and not for support.
Once during an engagement we watched Huawei support staff do an SQL query that clearly was for national intelligence and not for support.
They weren't exploiting any sort of secret backdoors, but the normal support channel. They had legitimate accesses to the database. It's just the the subject of the query of the VLR's database was clearly a national security target and not normal support.
I mention this because everyone's threat model is hardware backdoors. I think their actual threat model should be that you can't buy such hardware anymore without a support contract from the vendor.
Um, nowhere in this thread do I imply that China is "evil". I mean, I think China's government is evil, but that's not an issue in this thread. I oppose U.S. backdoors with at least as much vigor.
