Report: NSA intercepting laptops ordered online, installing spyware

As far as I can tell, what's needed is: (a) an open source BIOS, (b) coupled with some physical BIOS chip reader. And the chip reader needs to be cheap enough for us to assemble ourselves; we can't really trust some company to make it for us, because the company could be coerced into subverting it or it could be subverted in transit after we order it. So it seems like we need an open source blueprint of a BIOS chip reader that's cheap and easy enough for anyone to make themselves. (A tall order, to be sure.)

(a) is a requirement because if the BIOS is closed source, then there's no way to know whether it's backdoored. (b) is a requirement because if it's impossible for an external device to obtain a memory dump of the ROM, then we won't be able to verify that the open source BIOS hasn't been subverted. And it has to be a memory dump obtained by an external device; we certainly can't trust a BIOS to verify its own integrity. Hence a separate, physical device is going to be a necessary and standard security requirement for the first time in the history of the open source community's security practices.[1]

So when we build a new computer, the first step is to order the parts. (Note: the parts may be subverted by an adversary in transit.)

Then we'd either (1) order the parts for the open source BIOS verifier device, or (2) order the fully assembled BIOS verifier from some trusted company. As I said before, (2) is a dangerous idea because an adversary can simply intercept your packages in transit and subvert the verifier. So this whole process is unfortunately going to be so much of a pain in the ass that few people are going to want to do it. But a painful option is better than no option.

Now, the packages for your new computer arrive, along with the components for the BIOS verifier. You assemble the computer and the verifier. Then you boot from a bootdisc which is designed to replace your motherboard's BIOS with the open source one.

At this point -- and this is the part I'm unclear about -- the verifier somehow needs to be able to obtain a dump of the motherboard's ROM containing the BIOS. Then the verifier calculates the checksum of the dump, and you can finally verify that the checksum matches the expected one (the expected checksum would be published on the open source BIOS's website alongside each of its download links).

If all of these steps are followed, then we are safe. Otherwise no one can be sure they're safe, not even Colin. (I'm hoping if I mention often enough that Colin's security practices can be defeated by this, then people will realize the magnitude of the danger facing us.)

I'm sad because there's almost no way to turn this idea into a company. All companies (especially US companies) are constantly coerced or subverted by governments. So it's unlikely that the steps I've outlined will ever be widely adopted. But without these steps, there's no way to trust any of our security measures. This BIOS malware technique must have been one of the NSA's most lucrative and powerful, because nobody has yet even bothered to care about verifying BIOS integrity at the hardware level.

[1] - It's interesting to consider the question: Have even our most paranoid and trusted figureheads like Stallman ever verified the integrity of their computer's BIOS? Or did they simply trust that their Yeelong Lemote laptop BIOS wasn't subverted in transit after they ordered it? I'd bet the latter, because I've never heard of an external tool that can obtain a memory dump of a laptop motherboard's ROM, though I'd love to be wrong about that.

EDIT: And now this submission has been totally buried off the frontpage. So no one will even read this. Awesome. http://hnrankings.info/6983099/

No reason the 'upgrades' couldn't be firm/hardware. Just upthread a bunch of people complain about "customs" delays when ordering computers, one person for > 30 days. That is way, way more than enough time. Yes, easier at manufacture. No, not necessary at manufacture. Yes, possible en-route.

Also why would you be more concerned about China doing the same?

edit: and also the problem wouldn't be using the technique 'universally', as in doing it to every machine. The problem would be giving an org like the NSA full control over deciding who to target, incl. US citizens. That is, being indiscriminate in terms of completely disregarding domestic laws, protections, etc., rather than being indiscriminate in terms of spamming loaded chips in every box.