Report: NSA intercepting laptops ordered online, installing spyware

Even Joe Average should be acknowledged that clean reinstallation after getting new hardware is a good practice.

Ed: BTW, does somebody know how to audit your laptop in its current state?

The linked article on Der Spiegel has a section on what they call "persistence:"

The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO)... The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer's motherboard that is the first thing to load when a computer is turned on... This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this "Persistence" and believe this approach has provided them with the possibility of permanent access.

http://www.spiegel.de/international/world/catalog-reveals-ns...

Maybe it would've been better for this news to have been broken a month or two ago, for maximum financial impact.

In all seriousness, one has to wonder how shipments get diverted, and how easily this process can be taken advantage of. Surely the companies handling these "special" shipments are made aware of details on a need-to-know basis (eg: super-secret gov. employee is going to be taking the shipment for an hour, don't ask why and don't tell anyone), but are they able to verify that their handlers are who they say they are?

Would you trust a shipping company based in China? Why would you trust an American one any more than a Chinese one?

Seriously? Why on earth should Joe Average be made to clean reinstall OS after buying a new hardware?

This is probably one of the most important problems of our generation to solve (as hackers, not philanthropists) and it's sort of amazing that it's hardly known, let alone discussed. I've brought it up before and it seems like everyone's reaction is that it's not worth worrying about. But there are adversaries besides the NSA, such as malware. And since userspace programs can upgrade your BIOS, then therefore it's possible to write a viruses to infect your BIOS exactly as described here. If the BIOS security model is even slightly broken, then malware will find a way into it, and security is hard to do perfectly. Why are we trusting proprietary motherboard manufacturers not to have backdoors in their closed-source systems? The answer is probably because we have little choice in the matter. Thus we're giving up a basic right: for us to have faith in our security practices. If, say, Colin Percival's careful security habits can simply be circumvented by his motherboard, then none of us are safe.

We need an open source motherboard for people who care about protecting themselves from this kind of thing. Or at least an open source BIOS. But it's an insidious problem, because once a BIOS is infected, it controls everything that may ever replace the BIOS. Therefore it's almost impossible to detect if your BIOS has been "man in the middle'd," and hence even an open source BIOS may not be enough.

I don't have a good solution, but this is a terribly important problem to solve.