Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did this Tor developer become a victim of NSA's laptop interception program?

privacysos.org

Post reply on HN
Print view View original

1–10 of 169 posts

Re: Did this Tor developer become a victim of NSA's laptop interception program?

#6

Post by ljd »

jhgg wrote: post #3

I'm a bit confused here. On the bottom right, it says that the package contained a replacement keyboard, and not an actual laptop.

But when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.

Re: Did this Tor developer become a victim of NSA's laptop interception program?

#7

Post by raverbashing »

I don't get the "installing malware" part.

Every PC comes with malware already installed by most manufacturers. (Yes, if I have to spend time removing bloated stuff it's malware, I don't care if it's an "antivirus demo" or something like that)

Now, if it's a hardware detail, this is more interesting.

Re: Did this Tor developer become a victim of NSA's laptop interception program?

#8

Post by mschuster91 »

ljd wrote: post #6
jhgg wrote: post #3

I'm a bit confused here. On the bottom right, it says that the package contained a replacement keyboard, and not an actual laptop.

But when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.

Worse: laptop keyboards are usually connected to a special embedded firmware (IIRC on my Clevo laptop it's called EC, short for embedded controller), which handles the FN+x key combos like LCD brightness, volume control, keyboard backlight (Lenovo!), WiFi/BT/cellphone-data connectivity, webcam enabling (!) and other detailed functions.

Now, if this EC chip is vulnerable, a malicious keyboard can have direct DMA access (just like FireWire controllers, EC is usually connected to the main PCI bus)... no need for drivers here.

Re: Did this Tor developer become a victim of NSA's laptop interception program?

#9

Post by rwg »

HEY, KIDS! Do YOU know what time it is?!

[wild audience applause]

THAT'S RIGHT, it's time for WHICH IS MORE LIKELY?!

[intro music]

Today on Which is More Likely?, we're looking at a replacement Lenovo Thinkpad keyboard that was shipped to Alexandria, Virginia, instead of Seattle, Washington. What a blunder! [slide whistle sound effect]

Now put your thinking caps on and ponder, WHICH IS MORE LIKELY?!

• The largest intelligence agency on the planet, recently outed by Snowden's leaked documents for operating a multi-decade worldwide dragnet that secretly gathered communications on hundreds of millions of people, was too incompetent to have the US Postal Service display tracking information that hides the fact they're modifying a laptop keyboard in order to somehow spy on a Tor developer.

ORRRRRRRRRR!

• The third-party seller who uses Amazon to accept orders screwed up and gave Amazon the wrong tracking number.

That's all we have time for on today's episode of Which is More Likely? Don't change the channel! Up next is a BRAND NEW episode of Godwin's Law and Order! Good night from Hollywood!

[outro music]

Re: Did this Tor developer become a victim of NSA's laptop interception program?

#10

Post by DerekL »

CraigJPerry wrote: post #2

I suppose it's possible this could just be a fox's paw on the part of the shipping company.

A few months ago, I ordered some RAM from Crucial. They used UPS Mail Innovation, a service by UPS that mails packages for you. I got my package, but the tracker showed it getting delivered to another address on the other side of the country. So maybe there's a bug somewhere in the USPS system that shows you the tracking of the wrong package?
Post reply on HN