Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Report: NSA intercepting laptops ordered online, installing spyware

forbes.com

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Report: NSA intercepting laptops ordered online, installing spyware

#51

Post by nitrogen »

kevingadd wrote: post #25
Yver wrote: post #17

And suddenly, people like Richman Stallman seem much less crazy when they ask for free (as in libre ) hardware, free BIOS, free everything.

Is 'free as in libre' hardware really any protection if the NSA intercepted your device at the border and planted undetectable MITM malware/hardware? Are you really gonna take the whole thing apart and check every chip for modifications?

The "free as in libre" part would make it much more difficult to create an undetectable MITM. You might have a much greater diversity of hardware, so they'd have to find and maintain more exploits. The full software/firmware stack would be verifiable by cryptographic signature. The hardware itself could be checked by looking for chips that don't match other units from the same lot, either visually or behaviorally, and even x-raying the components if necessary.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#52

Post by nitrogen »

sillysaurus2 wrote: post #32
harshreality wrote: post #19

Earlier quoted context omitted.

Can the bios chips/eeproms be replaced on a running computer? Can you remove the bios chip, put it in a different (running) computer, use flashrom to read it, put it back, use flashrom to read it again, and compare the two? Either the virus doesn't hide itself (on calls to read from the bios nvram), and it will be visible on comparison with a pristine (if you have one) copy of the same bios, or it does hide itself an…

I'm so glad someone is thinking about the problem of "how do we know our hardware hasn't been subverted?" It's hard, and there are many facets. As far as I can tell, what's needed is: (a) an open source BIOS, (b) coupled with some physical BIOS chip reader. And the chip reader needs to be cheap enough for us to assemble ourselves; we can't really trust some company to make it for us, because the company could be coer…

In light of https://news.ycombinator.com/item?id=6980058 and https://www.usenix.org/system/files/conference/woot12/woot12..., you also need a way of verifying that your BIOS chip is a dumb EEPROM or verifying its own micro-firmware.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#53

Post by ketralnis »

Houshalter wrote: post #41
ketralnis wrote: post #20

Earlier quoted context omitted.

> Why isn't anything being done Because you're not doing it. Nor him, nor her, nor I. Because somebody has to actually do it , not just muse that somebody else should do it.

Well what can we do except vote? Maybe right a few angry letters? There isn't really anything that I know I can do to help.

I don't pretend to know either.

Could it be changed by voting? This has presumably spanned more than one party's rule in any individual chamber and in practise, the party is the only choice.

Do letters work? I'm in Feinstein's district and she makes it pretty clear that she likes things the way they are.

Protest? Does that actually do anything? It's essentially asking someone to voluntarily cede power because "pretty please". Has anything actually been changed by a march in the last decade? I'm not actually sure I'd like a world where a mob's protest is a successful way to change things.

Revolt? I don't hate everything the US Government does and I do hate a higher percentage of what some other governments do, so I'd hate to replace this one with worse. We're already pretty far to the right of most other comparable nations. The last thing we need is a constitution written after privacy has been essentially written off. I also value my personal safety, selfish as that sounds.

So I wish I knew too. Wishing on the internet that somebody would do "something" about it sure isn't working, but I don't know what would.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#55

Post by userbinator »

sillysaurus2 wrote: post #32
harshreality wrote: post #19

Earlier quoted context omitted.

Can the bios chips/eeproms be replaced on a running computer? Can you remove the bios chip, put it in a different (running) computer, use flashrom to read it, put it back, use flashrom to read it again, and compare the two? Either the virus doesn't hide itself (on calls to read from the bios nvram), and it will be visible on comparison with a pristine (if you have one) copy of the same bios, or it does hide itself an…

I'm so glad someone is thinking about the problem of "how do we know our hardware hasn't been subverted?" It's hard, and there are many facets. As far as I can tell, what's needed is: (a) an open source BIOS, (b) coupled with some physical BIOS chip reader. And the chip reader needs to be cheap enough for us to assemble ourselves; we can't really trust some company to make it for us, because the company could be coer…

> coupled with some physical BIOS chip reader. And the chip reader needs to be cheap enough for us to assemble ourselves; we can't really trust some company to make it for us, because the company could be coerced into subverting it or it could be subverted in transit after we order it. So it seems like we need an open source blueprint of a BIOS chip reader that's cheap and easy enough for anyone to make themselves. (A tall order, to be sure.)

BIOS chips these days are almost invariably SPI serial interface, which means it is not difficult to make a bare-minimal "manual" one with a battery, a couple of LEDs, resistors, and switches. Just key in a read command by hand, then read out each bit as you pulse the clock line. Pretty hard to subvert something as simple as that, but the problem is how long it will take, so maybe you could do this just to verify the bits that comprise a "root of trust" and not the entire BIOS image.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#56

Post by notastartup »

ketralnis wrote: post #53
Houshalter wrote: post #41

Earlier quoted context omitted.

Well what can we do except vote? Maybe right a few angry letters? There isn't really anything that I know I can do to help.

I don't pretend to know either. Could it be changed by voting? This has presumably spanned more than one party's rule in any individual chamber and in practise, the party is the only choice. Do letters work? I'm in Feinstein's district and she makes it pretty clear that she likes things the way they are. Protest? Does that actually do anything? It's essentially asking someone to voluntarily cede power because "pretty…

I would get a petition going, but I'm not American.

Re: Report: NSA intercepting laptops ordered online, installing spyware

#57

Post by notastartup »

whyenot wrote: post #22

This is starting to get really bad. Why aren't there demonstrations in the streets? I tried to sound out my relatives over the holidays to see what they think about Snowden/NSA and nobody seems to care.

I actually had coworkers saying they didn't care and that it's necessary to keep terrorists away....

I realized how Hitler was able to rise to power so quickly, people just accept complete trust in authority, the all loving, the all caring and nurturing.

Just like herding cows telling each other everything's alright, we are still comfortable, enough grass to keep us going, owners seem nice. Refusing to believe they will all be slaughtered one day.

Post reply on HN