31–40 of 265 posts
Yet somehow Russian / China are hacking the US left and right. If the NSA is so good, then at some point dont they have the responsibility to actively defend?
Does this mean running in a public cloud might actually be more secure? Or do we just have to assume that the NSA has their hardware in place in any cloud provider and that there actually is no security possible in the cloud?
The basic premise is false. > "Why did we never see it coming?" Many people saw it coming. I was warning about the possibility of dragnet surveillance, the existence of ECHELON, the use of the American security apparatus to steal trade secrets, the surveillance of non-American politicians, et al... For many, many years before Snowden. And I'm just some rando on the internet who follows the mainstream news! We were ca…
There were others before snowden, like: James bamford https://media.ccc.de/v/31c3_-_6600_-_en_-_saal_2_-_201412281... What snowden did was provide independently verifiable content and details of their activities. His leaks were outdates by half a decade by the time they were public too. Everyone sort of accepted the IC will do shady stuff to stop terrorists after 9/11 because "american lives" so it was a solid conspi…
Like life, technology always finds a way. Much of the talk back in the day was not based on reality because it was not based on what tech could practically do. The compute and storage weren’t there.
But it was pretty obvious by the late aughts that all the pieces for panopticon were coming together nicely. Tech finds a way.
Earlier quoted context omitted.
More scary is how people in tech circles still call you paranoid when you call Intel ME/AMD PSP a backdoor. >We are also always open for ideas but our focus is on firmware, BIOS, BUS or driver level attacks. Anyone on WiFi AC or up are backdoored right now by NSA. All of them are compromised, no doubt in my mind. All the LTE. All the x86 hardware on the market. All of it. If you aren't running fully free software, yo…
Can you provide some evidence for these claims?
Remember when the NSA tools were dumped with their secret Windows exploits? WannaCry? North Korea picked that up and launched ransomware attacks. That's the sort of thing that's going to happen again with the newly published Intel backdoors. Just wait and see. Tim Cook is 100% vindicated this week about not adding intentional iPhone backdoors.
The hiding of the malicious code in arm processors of ssds and in the BIOS seem like this is mainly targeted at people running their own hardware. Does this mean running in a public cloud might actually be more secure? Or do we just have to assume that the NSA has their hardware in place in any cloud provider and that there actually is no security possible in the cloud?
Earlier quoted context omitted.
Can you provide some evidence for these claims?
Snowden docs have been available for years. ShadowBrokers. Just this week a 20GB dump of private Intel source was dumped with backdoors included. It is beyond a reasonable doubt that x86 hardware has NSA backdoors in it. You're now sitting on a time bomb. Remember when the NSA tools were dumped with their secret Windows exploits? WannaCry? North Korea picked that up and launched ransomware attacks. That's the sort of…
The hiding of the malicious code in arm processors of ssds and in the BIOS seem like this is mainly targeted at people running their own hardware. Does this mean running in a public cloud might actually be more secure? Or do we just have to assume that the NSA has their hardware in place in any cloud provider and that there actually is no security possible in the cloud?
If that public Cloud is from an American company: obviously no. And whether you prefer some Chinese intelligence service having access to your data probably depends on what you want to do.
Earlier quoted context omitted.
What about Libreboot? Doesn't that allow booting x86 without binary blobs?
Yes, very old hardware that's no longer on the market. I don't consider that a solution. Eventually that pool of hardware dries up.
The exfiltration protocol described in the "misdirection" section has "Dated: 24 Feb 98" in the bottom right corner.
That it's being regarded as reasonably novel is a good measure of just how broken the collective security discussion is.
Just as broken as the PGP situation, thinking about it; in which case everything is operating as intended... moving on...