Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside a low-budget consumer hardware espionage implant

ha.cking.ch

Post reply on HN
Print view View original

51–60 of 98 posts

Re: Inside a low-budget consumer hardware espionage implant

#51

Post by Hasz »

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap.

Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger than 10mmx10mm in a couple of months for a few hundred, less if they already have a wire bonding machine and microscope.

For a state level actor, you can roll your own ASIC and just dump RF and microcontroller on one die. Package it up inside a USB flash drive controller IC, mark it with someone else's logo, and you've got a bug that you would only find by dissolving the chip in acid and looking at the die very carefully. It'll cost you a few million, but it's just not that much money when your R&D budget is 150M/y.

The weak part of all these systems is the constant GSM heartbeat, but even that is beatable.

Re: Inside a low-budget consumer hardware espionage implant

#53

Post by amenod »

Hasz wrote: post #51

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger th…

> The weak part of all these systems is the constant GSM heartbeat, but even that is beatable.

Curious: how do you beat that? Do you listen to other signals and try to transmit at the same time (if you must)?

Re: Inside a low-budget consumer hardware espionage implant

#54

Post by revelation »

Hasz wrote: post #51

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger th…

They would never design their own. That's why it says COTS (commercial off the shelf) all over the Snowden catalogs.

The deniability from a consumer hardware part is very important for something you expect an adversary to find and dismantle.

Re: Inside a low-budget consumer hardware espionage implant

#55

Post by jlouis »

Hasz wrote: post #51

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger th…

I feel part of the reason is that processors such as MT6261 are getting cheaper and cheaper. The marginal benefit of producing a simpler and smaller design is likely going to go away quickly.

It is the end-game for hardware. Software has already been gobbled up by language designs which are less and less hardware-near for the very same reason.

Re: Inside a low-budget consumer hardware espionage implant

#56

Post by Hasz »

amenod wrote: post #53
Hasz wrote: post #51

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger th…

> The weak part of all these systems is the constant GSM heartbeat, but even that is beatable. Curious: how do you beat that? Do you listen to other signals and try to transmit at the same time (if you must)?

You can broadcast on a timer, you can switch to a low frequency, low bandwidth transmitter, you can store locally and pick up the device later, etc. It all depends on the environment.

Re: Inside a low-budget consumer hardware espionage implant

#57

Post by MyDamnUser »

amenod wrote: post #52

Off topic, but still: is that a price of almost 2 EUR per minute of call? (to that stranger's phone - 3333333) I thought calls inside EU are price-limited? Or is this some really old post?

I found that odd too. I live in Denmark and i pay a fixed amount and can call as much as i want.

Re: Inside a low-budget consumer hardware espionage implant

#58

Post by khedoros1 »

jgalt212 wrote: post #37
pkaye wrote: post #23

Earlier quoted context omitted.

You can check the BIOS to see if there is an option to disable it.

The average user should not need to muck around with the BIOS.

The average user wants their phone to keep charging, even if they turn their computer off.

The non-average user should have no problem mucking around in BIOS settings.

Re: Inside a low-budget consumer hardware espionage implant

#59

Post by Hasz »

jlouis wrote: post #55
Hasz wrote: post #51

I wonder why they even bothered with such a high end processor like the MT6261. Get a bare die micro like the MSP430, and a bare die GSM chipset, and you're set. You'd have to dissolve your SIM card in acid and wire bond it to the PCB, but wire bonding machinery is pretty cheap. Realistically, this is stupid easy for a state-level actor. A good hardware hacker worth their salt could probably set up a bug no bigger th…

I feel part of the reason is that processors such as MT6261 are getting cheaper and cheaper. The marginal benefit of producing a simpler and smaller design is likely going to go away quickly. It is the end-game for hardware. Software has already been gobbled up by language designs which are less and less hardware-near for the very same reason.

I was thinking purely from a power consumption / die size / support stand point.

Not sure what the MT6261 quiescent current is, but I'd expect it to be in the 100s of uA. An MSP430 can get down to 0.1uA, which is much more difficult to detect.

If I had to guess, the MSP430 die is probably about 1/4 the size of the MT6261 die.

Most importantly, I can't find a MT6261 datasheet anywhere except for taobao. This just makes development harder.

Re: Inside a low-budget consumer hardware espionage implant

#60

Post by icelancer »

blunte wrote: post #7

This is obviously not good, but I'm not sure it is particularly useful for something "important". Any target of high value will be pursued and observed by trained humans with advanced tools. The amount of data collected, I suspect, would be less but more accurate. A device like this just lowers the bar (really low) on tracking. However, it increases the noise/inaccuracy. If combined with some key logger and other dev…

It's another layer of attack surface. You think attackers use just one bug? They use as many as they feasibly can to add redundancy and improve attack success rate.
Post reply on HN