Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Report: NSA intercepting laptops ordered online, installing spyware

forbes.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Report: NSA intercepting laptops ordered online, installing spyware

#41

Post by Houshalter »

ketralnis wrote: post #20
notastartup wrote: post #18

I am so raging at news regarding NSA's rogue behavior. Why isn't anything being done about this serious breach of privacy, the freedom to be you, the pillars of democracy? It's like NSA is saying "Look at me fuckers we are above the law and you are just going to have to take it up the ass". Seriously? This is depressing, knowing that some asshole at the top is ordering all of these things and telling us to close your…

> Why isn't anything being done Because you're not doing it. Nor him, nor her, nor I. Because somebody has to actually do it , not just muse that somebody else should do it.

Well what can we do except vote? Maybe right a few angry letters? There isn't really anything that I know I can do to help.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#42

Post by sillysaurus2 »

userbinator wrote: post #24
sillysaurus2 wrote: post #10

Earlier quoted context omitted.

This is probably one of the most important problems of our generation to solve (as hackers, not philanthropists) and it's sort of amazing that it's hardly known, let alone discussed. I've brought it up before and it seems like everyone's reaction is that it's not worth worrying about. But there are adversaries besides the NSA, such as malware. And since userspace programs can upgrade your BIOS, then therefore it's po…

> Or at least an open source BIOS. http://www.coreboot.org/ I remember when most motherboards would have a physical BIOS write-protect switch, which would've prevented all software from modifying it. These days it's been eliminated from most if not all, for reasons of cost and "but it'll require the user to open the case to upgrade the BIOS!" -- and apparently, the automatic updating software for some laptops will up…

Unfortunately an open source BIOS isn't sufficient unless it's coupled with an external BIOS chip reader that can dump a motherboard's ROM and verify its checksum matches the expected checksum of a Coreboot BIOS.

I did a more extensive writeup here, and I'd love to get anyone's thoughts on it: https://news.ycombinator.com/item?id=6983405

Re: Report: NSA intercepting laptops ordered online, installing spyware

#43

Post by rdl »

sneak wrote: post #40
rdl wrote: post #37

Earlier quoted context omitted.

This operation as described leaves enough of a physical record that it couldn't be used universally. I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. It's a lot easier to do this at design/manufacture than en-route.

The article doesn't specify if the backdoors installed en route are hardware or firmware/software.

Doesn't matter. It still requires someone being paid <$100k/yr to pull a package off the line and deal with it. If this happened in substantially greater volume than already happens for drug/child porn/money laundering cases, it would be at risk of exposure.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#44

Post by felipe_albertao »

Yver wrote: post #17

And suddenly, people like Richman Stallman seem much less crazy when they ask for free (as in libre ) hardware, free BIOS, free everything.

For the record, rms uses a Lemote [1] computer, which uses a Loongson chip [1] designed from scratch by the Chinese Academy of Sciences.

Given the fact this computer is 100% Chinese design, it's unlikely that NSA is able to add any spyware or backdoor at the source.

[1] http://stallman.org/stallman-computing.html

[2] http://en.wikipedia.org/wiki/Loongson

Re: Report: NSA intercepting laptops ordered online, installing spyware

#45

Post by fragsworth »

This is just fucking outrageous. Is there no line they wouldn't cross?

Our only option, now, to protect ourselves, is a healthy amount of paranoia and knowledge of security.

We should now live by the following rule: If it's possible that the government could do something to spy on you, then they have probably done it.

Everything you type into a computer connected to the Internet, that you didn't build, must be assumed to be logged by the NSA.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#46

Post by teamgb »

throwaway_yy2Di wrote: post #12

Oh so that's why my Lenovo was held for "customs". Hope they at least removed the Chinese backdoors while they were installing the American ones. Look at me, I'm so clever using HTTPS and GnuPG and FOSS linux when my hardware RNG is key escrowed, my USB cable is transmitting, my factory BIOS has at least two nationalities of spyware, and Big Brother is watching me naked in 720p. So glad I'm not a journalist and have…

Lol.

There's definitely a business opportunity out there for someone to come up with DIY laptops, much like the way you can purchase parts from anybody to create your own desktop PC.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#47

Post by rdl »

obstacle1 wrote: post #38
rdl wrote: post #37

Earlier quoted context omitted.

This operation as described leaves enough of a physical record that it couldn't be used universally. I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. It's a lot easier to do this at design/manufacture than en-route.

>I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. No reason the 'upgrades' couldn't be firm/hardware. Just upthread a bunch of people complain about "customs" delays when ordering computers, one person for > 30 days. That is way, way more than enough time. Yes, easier at manufacture. No, not necessary at manufacture. Yes, possible en-route. Also why would yo…

You might like to know that I'm giving a talk at 30c3 in about 4.5h which will specifically address this threat (using remote-verifiable seals).

http://events.ccc.de/congress/2013/Fahrplan/events/5600.html

Re: Report: NSA intercepting laptops ordered online, installing spyware

#49

Post by blazespin »

throwaway_yy2Di wrote: post #12

Oh so that's why my Lenovo was held for "customs". Hope they at least removed the Chinese backdoors while they were installing the American ones. Look at me, I'm so clever using HTTPS and GnuPG and FOSS linux when my hardware RNG is key escrowed, my USB cable is transmitting, my factory BIOS has at least two nationalities of spyware, and Big Brother is watching me naked in 720p. So glad I'm not a journalist and have…

Yeah, the customs point is very interesting and worthy of upvote. I suspect they'd need a warrant to do this on an American (one would hope) but I highly doubt they'd need one to do this on anyone who ordered it from across the border.

Canadians (and Americans who talk to Canadians) in particular are probably highly vulnerable to this spying. Emailing Americans, calling Americans, ordering laptops from the US, etc. The NSA is probably free to tap/interdict all of those interactions without any kind of pre-approval or probable cause.

Bottom line: the NSA has done irreparable harm to global trust in dealing with the US(and, sadly, the US dealing with those outside their borders), be it communications or buying their products.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#50

Post by salient »

I thought the NSA wasn't "attacking domestic citizens"? They can't excuse this one away as an "error" anymore. NSA/Obama administration lied. Again. What a surprise.

And boy are these NSA stories flagged into oblivion or what? NSA/FBI psy-ops or just good ol' HN folks "getting bored" with the NSA abuses?

Post reply on HN