I think the back doors are in the routers/modems/Wifi/BIOS etc!
This was and remains a big concern and suspicion involving the Chinese Huawei products; there seem to be connections between Huawei and the Chinese army that are not clearly spelled out.
Now, I certainly can't say that there are no back doors in BIOSes or some modems; I don't know that. That back doors exist in Windows has been documented since 1998, and routers are a trivially easy target in most cases; the dynamic routing protocol bgp can be exploited trivially based upon its normal operation.
What I can tell you is that I personally am involved in RF modem design and in in data routing/data compression/network management for satellite communications systems and, increasingly, backbone fiber connections. My products don't have back doors, at the behest of NSA or anyone else. Further, by nature of what it is I do, I am often monitoring traffic through our devices which are deployed at various locations around the world, including in some backbone locations. Usually this monitoring it taking place because we are tracking down a problem that one of our clients has reported, and they have given us access. Sometimes this involves packet-level analysis if our compression engine has been choking on something.
One thing I always watch for is either traffic originating within our devices or traffic entering our devices and not leaving. Either can occur, under specific conditions, and I want to know anytime such a thing DOES occur since only specific traffic should behave that way. Thus, defacto, I am watching for any spying that is occurring - either inbound or outbound.
I have never spotted anything. Thus, the hardware we employ is not compromised; it is not attempting any untoward communications.
Routers ARE easy targets, and any traffic can be captured and examined as it passes through a NOC (network operations center). You should assume that this IS happening and should take appropriate steps to safeguard yourself. To this end, you should encrypt EVERYTHING and, to the extent possible, you should avoid any commercial encryption products; only use open source encryption products. You should assume that any closed-source commercial encryption product has been compromised.
I myself browse exclusively through the TOR network - I am presently visiting this site via TOR. I also host a TOR relay, so most of the TOR traffic to/from this site is not mine - which enhances my anonymity, although I am sure the NSA knows that my IP is hosting a relay. I also encrypt emails to any recipients that support encryption, and even when I cannot encrypt, the email (POP and SMTP) traffic to/from my machine is encrypted to my email server (which is with my website hosting service and not my ISP).
People within the reach of the US government should treat this spying as an imminent and massive threat; information gathered by NSA is being shared with IRS, FBI, EPA, and local police agencies; this is known. The machinery of a tyranny is going quickly into place in the USA. People outside the reach of the US gov't may be annoyed but aren't facing any particular risk unless they're planning an attack on the US.
Posted: Nov 17th, '13, 20:33