A certain large Asian company and leader in 5G infrastructure has recently been accused of being compromised by its authoritarian government. Aside from the fact that it's nearly impossible to audit closed-source hardware as free of backdoors, what theoretical risks are posed by such compromised infrastructure? (Note that I'm not referring to user devices like handsets but to infrastructure like cell base stations, routers, etc.)
The majority of Internet traffic is now encrypted end-to-end. And I'd imagine the rate of encryption is much higher in the Western countries that would be most concerned about compromised foreign technology. So I would assume that the actual content of most Internet communication would not be at risk (aside from SSL stripping types of attacks, which are already mitigated by HSTS). In that case, I assume the main theoretical vulnerabilities would lie in these areas:
- metadata (connection endpoint information)
- voice calls and SMS (at best, encrypted only between handset and base station)
- supply chain disruption or denial of service during a diplomatic dispute
What do you think?