61–70 of 169 posts
Earlier quoted context omitted.
Mishaps happen. Intelligence agencies in particular have a long history of mishaps (and incompetence), probably due to the lack of oversight …
Of course, and I'm not saying they don't. I'm just saying, which is more likely? I'd wager the USPS screws up a lot more often that the NSA.
I'm a bit confused here. On the bottom right, it says that the package contained a replacement keyboard, and not an actual laptop.
But when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.
Connection-wise it looks like this:
http://i.imgur.com/ayFybSd.png
Keystrokes can be dangerous on their own but engineering a solution to this that assumes the correct state of the machine and can operate software is unlikely simply due to the margin of error.
If it was posted before...why would you do that.
Earlier quoted context omitted.
Yes, one part of what they do is in NJ/CA. Alexandria is where they're based. I'm not leaping to any conclusion; it just seems remotely possible and they're based there. You're the one saying there's nothing interesting in Alexandria. Given what the company researches, their history and mission, it seems like exactly the sort of place where this wild theory suggested by the OP could be a reality.
The headquarters of a company like this isn't interesting. Headquarters are administrative centers. It's not where you send a laptop to have a bug installed.
The people in that building are highly trusted whereas the NSA has good reason not to trust the brilliant geeks working for their contractors.
Earlier quoted context omitted.
I don't understand. Richard's point doesn't depend on an Amazon bug that transposes tracking codes. But your point does depend on the NSA redirecting packages to Alexandria in such a way that anyone who checked their order status would notice.
Why do you think NSA cares much about hiding their activities from you? I can tell you a story. Some years ago, back in Russia, as a [naive] kid, I've developed a surveillance system for Telrad telecom exchange [ultimately for FSB]. Do you think anyone cared to do that project in secrecy? I can give you the answer. Nope. As far as I understand NSA can legally intercept packages and can legally install undetectable su…
Earlier quoted context omitted.
The headquarters of a company like this isn't interesting. Headquarters are administrative centers. It's not where you send a laptop to have a bug installed.
A bug is only one of many possibilities for what they could want with that keyboard. The people in that building are highly trusted whereas the NSA has good reason not to trust the brilliant geeks working for their contractors.
Earlier quoted context omitted.
But when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.
Worse: laptop keyboards are usually connected to a special embedded firmware (IIRC on my Clevo laptop it's called EC, short for embedded controller), which handles the FN+x key combos like LCD brightness, volume control, keyboard backlight (Lenovo!), WiFi/BT/cellphone-data connectivity, webcam enabling (!) and other detailed functions. Now, if this EC chip is vulnerable, a malicious keyboard can have direct DMA acces…
Also connecting EC directly to some PCI bus does not make much sense from both system design and cost perspectives. Usual place to connect EC to is LPC, which is explicitly designed for such devices (things on motherboard like serial/parallel/game ports, TPM, FDC, keyboard controller/EC, BIOS flash and various ). Random review of datasheets found by google seems to indicate that chips that are only embedded controllers and do not contain additional ISA based peripherals (like ISA DMA controller itself) tend to not even implement the pin required for LPC DMA/bus master transactions (as it is not required for anything in normal operation).
Earlier quoted context omitted.
But when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.
Worse: laptop keyboards are usually connected to a special embedded firmware (IIRC on my Clevo laptop it's called EC, short for embedded controller), which handles the FN+x key combos like LCD brightness, volume control, keyboard backlight (Lenovo!), WiFi/BT/cellphone-data connectivity, webcam enabling (!) and other detailed functions. Now, if this EC chip is vulnerable, a malicious keyboard can have direct DMA acces…
It's not clever, can't use DMA and generally is the dumbest thing in the entire machine.
If they somehow manage to work around it I'd eat a box of lightbulbs. It's hard enough to coerce it to work to start with.
Source: I used to design embedded PC kit from the board level.
Earlier quoted context omitted.
A bug is only one of many possibilities for what they could want with that keyboard. The people in that building are highly trusted whereas the NSA has good reason not to trust the brilliant geeks working for their contractors.
Huh? Those people are contractors.
You're the NSA. Who do you trust more: A) (Perhaps the) CTO of a defense contractor that only works for you that you've had a 20 year working relationship with? B) The bright eyed young scientists working for that contractor in a building 3000 miles away?
Or put another way, despite the Snowden leak, I'll bet you any amount of money that the NSA is still in "really fucking tight" with Booz Allen Hamilton.
Or: duh OPSEC.
