Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

theintercept.com

Post reply on HN
Print view View original

111–120 of 134 posts

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#111

Post by tripletao »

jaclaz wrote: post #104
boomboomsubban wrote: post #103

Earlier quoted context omitted.

>Thesis: it is possible that someone may access your laptop without you knowing if you leave it unattended. This is known to be true, this experiment was about seeing if anyone would access this laptop. Which also addresses what you view as meaningless, real world scenarios are trying to avoid their laptop being compromised while the author was hoping that it would.

I know that it is true, it is actually a truism. The "experiment" has too few data points to be meaningful, and the proposed way to verify remains meaningless, two simple cases: 1) the evil maid simply makes a forensic image of the disk 2) a sector in the hard disk goes bad Case 1: there was an intrusion, all the data was stolen, but the hashes do not show that (false negative) Case 2: there was NOT any intrusion, bu…

A forensic image of the encrypted disk is useless (assuming strong passphrase, no bugs, etc.). The article is about the risk that an "evil maid" injects software/firmware into his laptop that presents the expected UI but secretly logs everything he types, and does something bad with that information later.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#112

Post by jlgaddis »

jensv wrote: post #38

"But given that current defenses against detecting processor-level backdoors wouldn’t spot their A2 attack, they argue that a new method is required: Specifically, they say that modern chips need to have a trusted component that constantly checks that programs haven’t been granted inappropriate operating-system-level privileges. Ensuring the security of that component, perhaps by building it in secure facilities or m…

It seems that you posted your comment on the wrong article.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#113

Post by wglb »

mirimir wrote: post #12

The best defense is being someone too uninteresting to bother. Once you're interesting so some resourceful adversary, it's very hard to avoid devices being hacked, and virtually impossible to determine if they've been hacked.

But you don't exactly know what the motives of the resourceful adversary are. You are likely to be attacked for reasons that you don't anticipate.

This is what I call "defense by presumed motive" and is flawed.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#114

Post by wpdev_63 »

The first company that makes a truly open source, security vetted computer will be very rich. When I say open source, I mean open source circuit design, bootloader, OS etc. The complete stack. The surveillance state is here and we need the tools to fight it!

Right now every national "security" agency(usa, china, uk) is racing to create a truly comprehensive suite of tools to monitor its citizens en masse[0][1]. Exploits for every router, iphone built in backdoor, etc. Pretty much anything that would give the government access to the most intimate details of your life. With the current political climate it's just going to get worst.

If you care about your privacy AND security, become informed and vote for privacy advocates. Visit fightforthefuture.org and eff.org to learn more.

DISCLAIMER: I am in no way affiliated with either of these foundations or their members.

[0]: https://www.theverge.com/2018/4/5/17203806/china-chinese-qin...

[1]: https://wikileaks.org/ciav7p1/

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#115

Post by mirimir »

tomcooks wrote: post #75
mrschwabe wrote: post #52

Earlier quoted context omitted.

Or not be a coward and be interesting, speak up, and not back down. If more of us do that than not then they will at least have a very difficult time in tracking us all.

While I agree with the meaning behind your post, I think that this attitude leads to self destruction in the current timeline. A much smarter approach in my opinion is to live on two separate layers: a secure private underground and an uninteresting public surface. This not only keeps the enemy content, it also keeps tracking low; any open confrontation will necessarily lead to harsher measures, which ultimately mean…

> A much smarter approach in my opinion is to live on two separate layers: a secure private underground and an uninteresting public surface.

Yes. And never connect layers. Mirimir has no meatspace contacts. Also, one can have more than two layers.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#117

Post by mirimir »

georgebarnett wrote: post #51
mirimir wrote: post #26

Earlier quoted context omitted.

Yes, it was Thunderbolt.[0] Firewire had the same issue. As does PCIe. But maybe USB 2.0 can be secured. If so, just fill other ports with epoxy. And use metal-flake nail polish to tamper protect seams. If USB isn't securable, give up, I guess. 0) https://news.ycombinator.com/item?id=12383130

That’s the great thing about USB-C - If you epoxy the ports, you now can’t charge.. sigh

Maybe have multiple batteries, and use a dumb charger?

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#119

Post by boomboomsubban »

jaclaz wrote: post #104
boomboomsubban wrote: post #103

Earlier quoted context omitted.

>Thesis: it is possible that someone may access your laptop without you knowing if you leave it unattended. This is known to be true, this experiment was about seeing if anyone would access this laptop. Which also addresses what you view as meaningless, real world scenarios are trying to avoid their laptop being compromised while the author was hoping that it would.

I know that it is true, it is actually a truism. The "experiment" has too few data points to be meaningful, and the proposed way to verify remains meaningless, two simple cases: 1) the evil maid simply makes a forensic image of the disk 2) a sector in the hard disk goes bad Case 1: there was an intrusion, all the data was stolen, but the hashes do not show that (false negative) Case 2: there was NOT any intrusion, bu…

>The "experiment" has too few data points to be meaningful, and the proposed way to verify remains meaningless, two simple cases:

This isn't science, we know this is possible and the "experiment" was to try and find examples of it happening.

A false negative is always assumed, it is impossible to know you haven't been compromised. A false positive is meaningless as finding a change is only the first step. You then need to analyze what the change is, and if you can't pin down what has been compromised you're just back to the default state of unaware.

This is a honeypot. If you leave your honeypot and return to an empty one, you're pretty sure a bear is around but can't do anything. If you find a bear with their paws in the pot, you don't need to run the experiment again to prove there's a bear.

Re: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked

#120

Post by SpaceEncroacher »

salawat wrote: post #84

I'm calling this a bad test in general. Let's be honest here. None of the more cutting edge attacks are going to be risked by attacking. as hard a target as this guy. The level of sophistication of attack the author is starting to reach is going to be reserved for state-level persons-of-interest. Espionage is a game of judging capabilities, and cracking some security researcher's laptop telegraphs to the rest of the…

Yeah, have fun, ball til you fall, go all out, maximize the moment - and give thanks.
Post reply on HN