Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

theintercept.com

Post reply on HN
Print view View original

21–30 of 134 posts

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#21

Post by gerdesj »

cameldrv wrote: post #16

If you're a target of a major intelligence agency, I think that you have to assume that all of your computers are irretrievably compromised. From Vault 7, we know that the CIA has long developed implants to infect both the EFI and hard drive firmware that load before any potential code that could detect them. These could be made arbitrarily hard to detect without physically opening the computer and dumping these flas…

I think you are absolutely correct with your assessment. I recall Alan Cox (welsh bloke, big beard, Linux kernel hacker (well: simply hacker in general will do)) posting on G+ about someone booting enough Linux on a hard disc to get a prompt. No not the disc itself, off the firmware on the controller.

You may also like to consider that nearly all modern server systems have an iLO/iDRAC or whatever that can do all sorts of things, and at least one internal USB interface. PCs can have the Intel ME and other horrors. The best you can hope for is that it is only your local intel. agency that potentially have routine access to your system.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#22

Post by c22 »

gerdesj wrote: post #19
Jedd wrote: post #10

I run a dual-boot Debian + Windows 7 laptop, but my default position is to assume the Windows partition is exploitable, so for secure activities I boot Debian. That boots using an unencrypted /boot partition, but everything else running on luks (one big partition, LVM'd down). I have a VeraCrypt partition which is for files that I want to work on from both operating systems. Works really well, crypted disks doesn't m…

A lightly paranoid setup might actually only boot from a removable USB disc or SD Card instead of from the fixed HDD. The removable disc is kept on a necklace or whatever. The HDD is totally encrypted. A seriously paranoid setup might include manufacturing your own USB thumb drives. This: https://www.linuxjournal.com/content/take-control-your-pc-ue... will also help in keeping the evil maid (sexist) out. As to your l…

I do this with the ExpressCard slot on my ThinkPad, not because I'm paranoid but because I like to experiment with many OSs and it's easier to manage than messing with partitions and bootloaders. I appreciate how the ExpressCard SSDs don't stick out of the laptop at all. I keep all my user data on the internal drive though (encrypted), so my risk to unattended laptop hijinks isn't much mitigated.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#23

Post by emmab »

gerdesj wrote: post #20
emmab wrote: post #8

Why not put a bounty of bitcoins on your laptop? If it's large enough it becomes worth taking even though that will alert you.

I think you are advocating something like putting a diamond ring on view behind one of your house's windows. If the ring gets stolen by someone breaking in via the window then you know it has gone but you do not know whether the thief say changed the locks in some way. Now they can come and go with impunity.

Well if you're really paranoid that's the point where you get a new laptop.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#24

Post by orf »

tripletao wrote: post #7

If you care about this, then put the laptop in a tamper-evident bag. Those are necessarily imperfect too; but there's work making tamper-evident seals to resist up to state-level attacks, since that's relevant in stuff like enforcement of nuclear weapons treaties. That succeeds to the extent that you can find a physical effect that's easy to create and measure, but hard to recreate deterministically. (In concept, dum…

That won't help while crossing borders, who would want to open the bag without necessarily tampering with it.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#26

Post by mirimir »

PuffinBlue wrote: post #18
mirimir wrote: post #15

Earlier quoted context omitted.

True. But after doing a standard LUKS install, you can move /boot to an SD card. You can also backup the LUKS header to the SD card, and wipe it from the system. Now the machine cannot be booted without the SD card. After restoring the LUKS header. And even if an adversary creates a new /boot on the machine, you can check for that, and nuke it before booting from the SD card. If you're detained, you can just chew up…

So put malware in the BIOS itself, or one of the other chips or ROMs available. I think I remember reading a story recently about Thunderbolt or maybe USB being connected to an Option ROM over PCIe (must have been Thunderbolt I guess) that allowed an attacker to simply plug in a USB stick and permanently and irrevocably pwn the system - right down to securing the flaw that allowed flashing of the ROM over the PCIe co…

Yes, it was Thunderbolt.[0] Firewire had the same issue. As does PCIe. But maybe USB 2.0 can be secured. If so, just fill other ports with epoxy. And use metal-flake nail polish to tamper protect seams. If USB isn't securable, give up, I guess.

0) https://news.ycombinator.com/item?id=12383130

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#27

Post by mirimir »

dredmorbius wrote: post #17
mirimir wrote: post #12

The best defense is being someone too uninteresting to bother. Once you're interesting so some resourceful adversary, it's very hard to avoid devices being hacked, and virtually impossible to determine if they've been hacked.

It's effectively feasible to monitor everyone, and to make determinations of interest after the fact. So that's not a particularly viable option.

Monitor, sure. But I don't believe that anyone has enough resources to backdoor everyone's machines.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#28

Post by cbanek »

While this is focused on hardware and physical access, it would seem that it's the same for software. You don't know if someone has control over it remotely, through any number of means (browser, downloaded software, installed professional software with backdoors, software with unreleased vulnerabilities, etc.). Even airgapped machines can be compromised (Stuxnet, TEMPEST).

Even if you built all the binaries from scratch from the official repos, you'd still be at risk of security bugs like heartbleed, or a compromised compiler.

In the end, I think security is always a numbers game. Someone can always get to your protected resources, it's just a matter of how much the attacker wants it.

It's easier to attack a resource than defend it.

https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Heartbleed

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#29

Post by dredmorbius »

mirimir wrote: post #27
dredmorbius wrote: post #17

Earlier quoted context omitted.

It's effectively feasible to monitor everyone, and to make determinations of interest after the fact. So that's not a particularly viable option.

Monitor, sure. But I don't believe that anyone has enough resources to backdoor everyone's machines.

That depends where in the design, manufacture, and provisioning stage this occurs, and by whom. It's quite possible Micah was looking at the wrong signifiers.

(Difficult to prove, natch, but possible.)

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#30

Post by gerdesj »

c22 wrote: post #22
gerdesj wrote: post #19

Earlier quoted context omitted.

A lightly paranoid setup might actually only boot from a removable USB disc or SD Card instead of from the fixed HDD. The removable disc is kept on a necklace or whatever. The HDD is totally encrypted. A seriously paranoid setup might include manufacturing your own USB thumb drives. This: https://www.linuxjournal.com/content/take-control-your-pc-ue... will also help in keeping the evil maid (sexist) out. As to your l…

I do this with the ExpressCard slot on my ThinkPad, not because I'm paranoid but because I like to experiment with many OSs and it's easier to manage than messing with partitions and bootloaders. I appreciate how the ExpressCard SSDs don't stick out of the laptop at all. I keep all my user data on the internal drive though (encrypted), so my risk to unattended laptop hijinks isn't much mitigated.

Good skills mate.

So: Your user data is on the HDD and encrypted AND you use a removable disc to boot your machine AND you have a "something you know" (password)

That looks quite secure to me, provided you look after your removable disc and password. I'm not familiar with IBM gear - is ExpressCard a removable disc? I tried to read the WP page on it but got confused.

I have one of these for my laptop - Dell Inspiron 17. It runs Arch Linux. I don't trust it at all (I'm CREST accredited) but I still use it.

Post reply on HN