Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

tech.firstlook.media

Post reply on HN
Print view View original

21–30 of 80 posts

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#21

Post by teh_klev »

monochromatic wrote: post #16
amagumori wrote: post #6

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

there’s no way to conclusively prove what you suggest. This article isn’t about proving that though, it’s about “hey I wonder what this chip is for.”

> This article isn’t about proving that though

Um the article kinda is:

... so we deemed this information reliable and immediately raised some critical questions: Is there a wireless chipset soldered onto the MacBook Air’s logic board that we didn’t know about? If so, is it not actually possible to properly air gap a MacBook Air?

And their methodology is a bit flawed. This made me shudder:

We took out the Air’s logic board to see if we could pry the chip off with a screwdriver. We quickly decided this was a bad idea. We also considered “disabling” the chip by drilling a few holes through it with a Dremel tool or by melting it a bit with a soldering iron.

Jeezo.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#22

Post by mmagin »

monochromatic wrote: post #18
jws wrote: post #5

Earlier quoted context omitted.

…something that didn't look too much like an antenna… The Raspberry Pi Zero W has a perfectly serviceable antenna which is simply a cavity formed between layers of copper and two tiny capacitors which look about like grains of salt. You can read more at https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna... They are designed by some very clever Swedes. http://www.proant.se/en/news.htm That second page shows…

Antenna design is total black magic. Intuition is useless here.

No it's not, it just seems that way to the vast majority of us who haven't developed the proper intuition.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#23

Post by simcop2387 »

amagumori wrote: post #6

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

This alone wouldn't be enough sure. But you can get more data to say that it isn't doing any RF by looking at the circuit board and looking for antennas, they've got some fairly distinct shapes to be able to radiate efficiently. Of course they could still be inefficient radiators on purpose to prevent them from being found, but that also then means that they'd have to be even closer to pick up the signal. You can take xrays of the board to confirm the construction matches the schematics you can find from various websites (i don't know them myself, but I know repair shops get them). You can then decap the chip to examine it for any intentional radiators, which you'd need at that scale to be able to get any signal out. All that combined with a metal case, and you're unlikely to sneak in a transmitter that way. It'd be far easier to compromise the wifi firmware which is a binary blob anyway, and just use it to dma data off main ram directly. It's already built to do it, and it's got antennas that are expected already.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#24

Post by Cyph0n »

shawn wrote: post #7
kabdib wrote: post #3

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if…

The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, yo…

> which operates just above the physical layer.

So at the link layer? If so, what you described does not sound like an effective technique to exfiltrate data over the internet, unless the NSA also controls the LAN/internal network the target device is on.

Why? Because any non-standard protocol data will be thrown out by the first switch or router on the path out of the target LAN. In other words, the exfiltrated data will not be forwarded on to the next router or switch, simply because the next router/switch will not have support for the NSA's custom protocol in its network stack.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#25

Post by shawn »

Cyph0n wrote: post #24
shawn wrote: post #7

Earlier quoted context omitted.

The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, yo…

> which operates just above the physical layer. So at the link layer? If so, what you described does not sound like an effective technique to exfiltrate data over the internet, unless the NSA also controls the LAN/internal network the target device is on. Why? Because any non-standard protocol data will be thrown out by the first switch or router on the path out of the target LAN. In other words, the exfiltrated data…

One thing the NSA is very good at is getting access to virtually every type of networking card. If they achieve access to a target, it's likely they control a path to it.

If the target is a wifi device, the custom protocol becomes doubly effective: Exfiltration is a matter of having a receiver anywhere in the vicinity. And that receiver can amplify the signal to blast it a few miles. There are tools to sweep the EM spectrum looking for anomalies like this, but they seem to be rare, for the moment.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#26

Post by garmaine »

monochromatic wrote: post #16
amagumori wrote: post #6

uhhh...how does this prove that the chip doesn't have radio functionality? they didn't figure out any information about the chip's actual functionality beyond its PCI device name, which would ostensibly not be "SUPER SECRET DATA EXFILTRATION RADIO FOR NSA". they just took it off, unplugged the wifi card, and then said "well, it doesn't connect to wifi networks now. must be fine".

there’s no way to conclusively prove what you suggest. This article isn’t about proving that though, it’s about “hey I wonder what this chip is for.”

Use an RF antenna to see if it is putting out any signal.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#27

Post by iancarroll »

garmaine wrote: post #26
monochromatic wrote: post #16

Earlier quoted context omitted.

there’s no way to conclusively prove what you suggest. This article isn’t about proving that though, it’s about “hey I wonder what this chip is for.”

Use an RF antenna to see if it is putting out any signal.

Could very well not tx until it receives a wake up message.

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#28

Post by PhasmaFelis »

teh_klev wrote: post #21
monochromatic wrote: post #16

Earlier quoted context omitted.

there’s no way to conclusively prove what you suggest. This article isn’t about proving that though, it’s about “hey I wonder what this chip is for.”

> This article isn’t about proving that though Um the article kinda is: ... so we deemed this information reliable and immediately raised some critical questions: Is there a wireless chipset soldered onto the MacBook Air’s logic board that we didn’t know about? If so, is it not actually possible to properly air gap a MacBook Air? And their methodology is a bit flawed. This made me shudder: We took out the Air’s logic…

You're judging their methodology by what they chose not to do?

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#29

Post by brianpan »

monochromatic wrote: post #17
userbinator wrote: post #8

We’re not sure exactly what the technicians did to remove the chip – heat gun, maybe? – but it came off cleanly and you wouldn’t notice it was missing unless you were specifically looking for it on the board. Almost certainly, or more precisely, a "hot air rework station". For someone with experience, it only takes a few minutes to remove and replace BGAs with one.

And on top of that, it’s just about the only way it can be done non-destructively.

I disagree. Hold my beer...

Re: Air Gapping a MacBook Air: The Great BCM15700A2 Mystery

#30

Post by wallflower »

mmagin wrote: post #22
monochromatic wrote: post #18

Earlier quoted context omitted.

Antenna design is total black magic. Intuition is useless here.

No it's not, it just seems that way to the vast majority of us who haven't developed the proper intuition.

Of course, there is the GA evolved antenna.

https://en.wikipedia.org/wiki/Evolved_antenna

Post reply on HN