Some Chinese Cities Require Government Routers for Stores

[TorontoBoy]

Certain Chinese cities (Qingdao, Chifang, Xiamen) are forcing any store that offers wifi to install government approved BiHu (translation "necessary tiger") routers. Business can be fined up to $18,600USD for non-compliance. There is no sign, yet, that this will spread to other Chinese cities.

These BHU routers in the past happen to have had security vulnerabilities.
-hidden users ids
-open SSH enabled by default
-javascript injection
-hardcoded root password

A simple sniffer would do the trick. Easy peasy.

[scmp.com...]
[theverge.com...]
[abacusnews.com...]
[securityaffairs.co...]

[lucy24]

security vulnerabilities

The list looks an awful lot like “Those aren’t bugs, they’re features”.

[bill]

So are the people and businesses in those areas raising a fuss, or do they just have to grin and bear it? I couldn't see international companies operating in those areas being very happy about using back-doored equipment.

[LifeinAsia]

If I were forced to do this, I'd just use my own router behind it.

In other words: Internet -> Chinese router -> my router -> my network

[TorontoBoy]

This is a government mandate, enforced by the police. I am sure there would be inspections of routers by the police. The fine is quite steep. It might be even cost effective to offer no wifi instead. Anyway, smartphone wifi is also monitored by the cell companies, all data freely available to the government.

There is nowhere to hide, obfuscate. There is no Tor in China, as the government cracked and blocks the system. VPN is outlawed, but loosely enforced. The Great Firewall is an example for all aspiring strongman countries.

One of the issues Trump might raise are some of the draconian Chinese cyber laws. Then the US asks their own companies to house all US data in the US. In a way China copied the US and Russia, then one upped.

[bill]

Sounds like there aren't many obvious ways around this. Given the number of devices in China I don't see how they could possibly enforce this, but requiring a specific router is a big step in that direction. Individuals could probably still skirt the regulations using things like local mesh networks, but normal internet use is getting tougher to use without their monitoring systems knowing what you do.

I like the idea of layered routers, but although your internal network may be opaque they'd still be able to see what you're doing on the net. Do the regulations specify that a setup like this is forbidden?

[TorontoBoy]

China already has neighbourhood commercial 'urban enforcement officers' [webmasterworld.com...] that monitor local shops. They have been in the news because they sometimes act like thugs. They are used to remove illegal vendors, or when China wishes to redevelop an area of the city and wants all people gone. They, however, are pretty unsophisticated and would probably be fooled by a layered router.
.
The fine is pretty high. Undercover police, which China has a lot of, would probably find it.
.
Regulations in China are rarely clearly defined. This allows the local police to use their discretion to enforce or not. In this case the requirement looks pretty well defined. Local police are well known to not enforce unless specifically prodded by higher ups. Let us hope that this is just another regulation that is on the books, but is essentially ignored. Like traffic rules.

[bill]

They would need to be somewhat knowledgeable and network savvy to detect everything. For example, I'm not sure how they would easily detect something like a Raspberry Pi Zero running as a wireless router and a private wireless network behind that. So I guess all hope is not lost.

[lucy24]

Just how easy is it to smuggle hardware into China? Or, in the alternative, to run an underground manufacturing operation?

[bill]

The electronics districts in large Japanese cites are overrun by Chinese tourists buying tons of electronics that are probably made in their home country, and bringing them back. It doesn't seem that they'd face too much difficulty given the volume they appear to procure.

[lucy24]

Ah, right. So it's analogous to {insert example A} or {insert example B} or {insert example C} in the US, where the amount being manufactured far exceeds the amount being lawfully sold or distributed. As long as the factories remain on good terms with the government--and the product they're making is permissible in some way, under some circumstances--all is good.

[TorontoBoy]

Some products made in China, usually foreign brands, are for export only, meaning that there is no legal way to purchase them within China without paying the export tax. If they are outside of China, it is therefore cheaper for Chinese people to buy foreign branded but made in China goods. How's that for a trade barrier.

Export only products are usually better quality, and often lower priced than bought within China.

[LifeinAsia]

Some products made in China, usually foreign brands, are for export only,

That was long the way it was done in Korea as well. I went to the major electronics market to buy some additional RAM for my computer and it was far more than I would have paid in the U.S. for the same chips (exact same except for the "export only" stamp).

[lucy24]

Export only products are usually better quality

My first thought--she said, dating herself, because this goes back before the EU existed--is “export quality” beer. This is, or was, stuff that couldn’t legally be sold as beer in its country of origin, but was made strictly for the US market.

What proportion of the Chinese population can afford to travel overseas? And will those export-only routers be strictly for personal use (if you’re out of the country, you’ve already seen things they don’t want you to see), or will they be set up in places where great numbers of other people can also benefit from them? Something tells me there is not a lot preventing local police from stepping behind the counter and physically looking at your setup.

[bill]

What proportion of the Chinese population can afford to travel overseas?

I'm not sure of the proportion, but the numbers are staggering in Japan. The first wave allowed into Japan were limited by income levels. Only the most wealthy were allowed to travel, and there were all of a sudden queues in front of luxury goods stores. Later when the more middle class were allowed into the country then the trend switched toward goods like baby formula, diapers, cosmetics, medicine and other consumer goods.

I haven't noticed anyone buying routers in bulk like they do with rice cookers and other home electronics, but that doesn't mean it's not happening. It certainly is possible.