Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

theintercept.com

Post reply on HN
Print view View original

11–20 of 134 posts

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#11

Post by tripletao »

gerdesj wrote: post #9
tripletao wrote: post #7

If you care about this, then put the laptop in a tamper-evident bag. Those are necessarily imperfect too; but there's work making tamper-evident seals to resist up to state-level attacks, since that's relevant in stuff like enforcement of nuclear weapons treaties. That succeeds to the extent that you can find a physical effect that's easy to create and measure, but hard to recreate deterministically. (In concept, dum…

Did he really suspect that malware was routinely getting installed by attackers with physical access to laptops during business travel? If yes, then why didn't someone notice it calling home or whatever? I doubt it but his job is to suspect all sorts of things. If you are going to attempt to quantify risk then some experimentation is in order rather than simple speculation. As to "notice it calling home", it is surpr…

Tens of millions of laptops have been exposed to at least as much evil maid opportunity as the author's. That's either a much stronger natural experiment than his artificial one, or the biggest sleeper attack in history. Like, the Israelis still had to blow up the centrifuge eventually...

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#13

Post by gerdesj »

Computers that support “secure boot” or “verified boot,” such as Chromebooks and Windows laptops with BitLocker, aren’t vulnerable to this. The BIOS can detect if the unencrypted part of your disk has been tampered with, and if it has, it will refuse to boot. MacBooks and laptops that run Linux could potentially be attacked in this way.

Really?

(Search terms used: "secure boot linux" and "secure boot macbook")

https://www.linuxjournal.com/content/take-control-your-pc-ue...

https://www.macworld.com/article/3246208/macs/how-apples-sta...

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#14

Post by gerdesj »

tripletao wrote: post #11
gerdesj wrote: post #9

Earlier quoted context omitted.

Did he really suspect that malware was routinely getting installed by attackers with physical access to laptops during business travel? If yes, then why didn't someone notice it calling home or whatever? I doubt it but his job is to suspect all sorts of things. If you are going to attempt to quantify risk then some experimentation is in order rather than simple speculation. As to "notice it calling home", it is surpr…

Tens of millions of laptops have been exposed to at least as much evil maid opportunity as the author's. That's either a much stronger natural experiment than his artificial one, or the biggest sleeper attack in history. Like, the Israelis still had to blow up the centrifuge eventually...

I tend to specify a fair amount of tin foil when buying a hat and I also suspect you are correct with this assertion:

Tens of millions of laptops have been exposed to at least as much evil maid opportunity as the author's

However, do you have a decent citation for that assertion?

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#15

Post by mirimir »

eat_veggies wrote: post #5
giancarlostoro wrote: post #4

I would think a fully encrypted OS partition would be harder to sneak a backdoor into? Now infecting everything before the OS boots is outside my scope of knowledge, but if you have your partition unencrypted it's definitely much much easier to hijack your OS with physical access.

Before your "real" encrypted partition boots, you must decrypt it, and the system that decrypts it isn't encrypted itself, because you must run it somehow. On most Linux setups, that system is the initramfs--if you've ever installed Arch or similar, this is what the `mkinitcpio` step generates--and if you peek in your boot partition, it'll probably be named something like `initramfs-linux.img`. The initramfs is a (of…

True.

But after doing a standard LUKS install, you can move /boot to an SD card. You can also backup the LUKS header to the SD card, and wipe it from the system.

Now the machine cannot be booted without the SD card. After restoring the LUKS header. And even if an adversary creates a new /boot on the machine, you can check for that, and nuke it before booting from the SD card.

If you're detained, you can just chew up the SD card and swallow it. Maybe a little hard on the teeth, but hey.

But of course, that SD card must never leave your body. Except that you probably want to hide copies somewhere. In case you lose it, or whatever.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#16

Post by cameldrv »

If you're a target of a major intelligence agency, I think that you have to assume that all of your computers are irretrievably compromised. From Vault 7, we know that the CIA has long developed implants to infect both the EFI and hard drive firmware that load before any potential code that could detect them. These could be made arbitrarily hard to detect without physically opening the computer and dumping these flash devices and comparing them against a known good image. Who knows what other embedded processors with a little bit of flash lurk in various peripherals in your laptop that they've figured out how to wheedle their way into... If the flash is integrated into the microcontroller itself, there may not even be an easy way of reliably dumping its contents.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#17

Post by dredmorbius »

mirimir wrote: post #12

The best defense is being someone too uninteresting to bother. Once you're interesting so some resourceful adversary, it's very hard to avoid devices being hacked, and virtually impossible to determine if they've been hacked.

It's effectively feasible to monitor everyone, and to make determinations of interest after the fact.

So that's not a particularly viable option.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#18

Post by PuffinBlue »

mirimir wrote: post #15
eat_veggies wrote: post #5

Earlier quoted context omitted.

Before your "real" encrypted partition boots, you must decrypt it, and the system that decrypts it isn't encrypted itself, because you must run it somehow. On most Linux setups, that system is the initramfs--if you've ever installed Arch or similar, this is what the `mkinitcpio` step generates--and if you peek in your boot partition, it'll probably be named something like `initramfs-linux.img`. The initramfs is a (of…

True. But after doing a standard LUKS install, you can move /boot to an SD card. You can also backup the LUKS header to the SD card, and wipe it from the system. Now the machine cannot be booted without the SD card. After restoring the LUKS header. And even if an adversary creates a new /boot on the machine, you can check for that, and nuke it before booting from the SD card. If you're detained, you can just chew up…

So put malware in the BIOS itself, or one of the other chips or ROMs available.

I think I remember reading a story recently about Thunderbolt or maybe USB being connected to an Option ROM over PCIe (must have been Thunderbolt I guess) that allowed an attacker to simply plug in a USB stick and permanently and irrevocably pwn the system - right down to securing the flaw that allowed flashing of the ROM over the PCIe connection. I think the malware overwrote some bit that allowed any further writing, so even attaching physical chip flashing device to the ROM wouldn't clear the malware. The machine was effectively permanently compromised and could only be thrown away.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#19

Post by gerdesj »

Jedd wrote: post #10

I run a dual-boot Debian + Windows 7 laptop, but my default position is to assume the Windows partition is exploitable, so for secure activities I boot Debian. That boots using an unencrypted /boot partition, but everything else running on luks (one big partition, LVM'd down). I have a VeraCrypt partition which is for files that I want to work on from both operating systems. Works really well, crypted disks doesn't m…

A lightly paranoid setup might actually only boot from a removable USB disc or SD Card instead of from the fixed HDD. The removable disc is kept on a necklace or whatever. The HDD is totally encrypted. A seriously paranoid setup might include manufacturing your own USB thumb drives.

This: https://www.linuxjournal.com/content/take-control-your-pc-ue... will also help in keeping the evil maid (sexist) out.

As to your last assertion: you can't really prove it 100% but you could at least satisfy your risk assessment.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#20

Post by gerdesj »

emmab wrote: post #8

Why not put a bounty of bitcoins on your laptop? If it's large enough it becomes worth taking even though that will alert you.

I think you are advocating something like putting a diamond ring on view behind one of your house's windows.

If the ring gets stolen by someone breaking in via the window then you know it has gone but you do not know whether the thief say changed the locks in some way. Now they can come and go with impunity.

Post reply on HN