I thought it was impossible to prove a negative, generally?
If there are n possibilities and you can prove that y are always true, then the n-y remaining are never true.
It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
61–70 of 134 posts
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#62Earlier quoted context omitted.
I tend to specify a fair amount of tin foil when buying a hat and I also suspect you are correct with this assertion: Tens of millions of laptops have been exposed to at least as much evil maid opportunity as the author's However, do you have a decent citation for that assertion?
Pure handwave. Let's call an "exposure" a one-way trip plus half the hotel stay. So the author's laptop got (3+5) * 2 = 16 exposures. Air passengers make about 3B trips per year. A laptop lasts about three years. I said "tens of millions", so if I'm right then we have at least 16 * 20M exposures on existing laptops. That would mean at least one passenger in 28 travels with a laptop and is as careless as the author wa…
The kind journalists at The Intercept are likely to be targeted by state actors, who might even be prepared to risk some zero days too?
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#63A simple thing to make evil maids job harder is to just apply plenty of instant glue. This way it takes much more effort to open the laptop or switch components. Also fill in ports you don’t need.
For practical security it is also important to have some physical things on the laptop body that allow you to identify your hardware. Otherwise somebody will just replace it with their own hardware to collect your password. Obviously pretty much anything can be replicated, but absolute security is anyways impossible to achieve so you can only try to make things harder for them.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#64I wonder if it’s practical to make a laptop suitcase where all external edges are touch sensitive? Have a serial number etched into each surface as well.
Edit-the case could have additional logic and wireless charging for power.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#65If you're a target of a major intelligence agency, I think that you have to assume that all of your computers are irretrievably compromised. From Vault 7, we know that the CIA has long developed implants to infect both the EFI and hard drive firmware that load before any potential code that could detect them. These could be made arbitrarily hard to detect without physically opening the computer and dumping these flas…
Most computers have an Embedded Controller (with integrated flash) that does a lot of motherboard/system specific stuff like power management, flashing leds and even scanning the keyboard matrix on laptops.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#66Hardware tampering is't performed on a mass scale. It's always a targeted attack.
What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#67Hardware tampering is't performed on a mass scale. It's always a targeted attack. What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target.
>What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target.
Preicsely. All the author had to do was use his best broken English and pretend to be a member of The Shadow Brokers.
The article would have been far more exciting had it involved speculating which three letter agency compromised the laptop the most, or the finer points of writing an article while being physically hunted by a snatch and grab team.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#68Hardware tampering is't performed on a mass scale. It's always a targeted attack. What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target.
He's a board member of the Freedom of the Press Foundation, a position also held by Edward Snowden and Daniel Ellsberg. Additionally, he has helped develop SecureDrop and various other tools to enable the anonymous spread of information. Finally, he works for The Intercept, an organization that has a history of receiving leaked information. Seems like a plausible target to me.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#69Hardware tampering is't performed on a mass scale. It's always a targeted attack. What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target.
> What the author actually forgot to do was to add some honey into the honeypot. I.e. become an attractive target. Preicsely. All the author had to do was use his best broken English and pretend to be a member of The Shadow Brokers. The article would have been far more exciting had it involved speculating which three letter agency compromised the laptop the most, or the finer points of writing an article while being…
>The article would've been far more exciting had it involved speculating which three letter agency compromised his laptop the most, rather than simply mulling over a bunch of "what if" scenarios.
If you would find this more exciting, there's no shortage of fiction already available on similar subjects. This article was about detailing the current risks, and the author's attempt to catch the attack in action. Not as exciting, but important information for people that may be at risk of a similar attack.
Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked
#70Earlier quoted context omitted.
That depends where in the design, manufacture, and provisioning stage this occurs, and by whom. It's quite possible Micah was looking at the wrong signifiers. (Difficult to prove, natch, but possible.)
Sure, it's possible. We know that the NSA intercepts machines for modification. And it's possible that hardware is generally backdoored. Maybe even by Chinese manufacturers. But what can one do, if everything is pwned? It's not practical to build machines from transistors etc. There are dreams of open-source hardware. But how could that even be done securely? The NSA can plant agents anywhere, in theory.
I wasn't addressing this. Only the first of your assumptions, that it is somehow possible to escape surveillance.
I'm increasingly of the view that it's not, at least not through individual action.
My interest is, for first strokes, painting an accurate picture of the landscape. Which means discarding inaccurate models and frames.
Among those: that laying low is possible, or a positive (that's precisely the objective of the Panopticon, and self-censorship abd -reegulation are the most efficient), or that individual rather than collective action is appropriate.
It also seems that surveillance itself faces various realities and economies, which can be directly attacked.