5 ms·

The question is if any of that equipment can still be trusted.

by zyxley 11y ago

kabdib 11y ago
It'd be interesting to closely examine that equipment now (look for intrusions, take firmware dumps, etc.). Especially any outlier chips, like the radio. Maybe he can get Apple to help :-)
striking 11y ago
Why trust it when you can sell it to someone else and buy equivalent equipment? Then the FBI will be knocking down someone else's door.
vinceguidry 11y ago
Inspect it for hardware modifications, and, assuming there are none, perform a factory reset and you're good. The amount of engineering the Feds would have to do to ensure a hack evades those two safeguards is prohibitive.
- ranman 11y ago
  Agreed; people overestimate the technological expertise of the U.S. Govt. -- in my anecdotal experience they're laughably behind.
  - illivah 11y ago
    I would assume it all depends on who in the government touched it. "The government" is a lot of people that don't share much expertise. Some of them have shown a lot of expertise however, and a will to use it maliciously.
  - burnte 11y ago
    Isn't that what we thought before Snowden showed us the NSA reprogramming firmware? I know that I said it was being blown out of proportion when the Snowden leaks started, and boy was I wrong.
    - fit2rule 11y ago
      Snowden showed us that the 5-eyes countries are actively producing and marketing - in their own secret organizations with secret, anti-democratic agreements - massive-scale spy and intrusion technologies. Anti-democratic, freedom-defeating agreements for the purpose of total information control over human civilization. Massive-scale, actually: full-spectrum. There are no aspects of modern technology infrastructure that are off the table in these realms: all systems are targets. Planet-wide. So, its not just that the NSA will be reprogramming firmware or putting key sniffers in your macbook or writing 0-day exploits. Its that they'll listen to everything, anywhere along the wire, as they see fit.
    - ranman 11y ago
      Even the things Snowden revealed required various industries to cooperate with the NSA. They weren't doing it on their own. Most portions of it were even designed and maintained by contractors! The people that work for these agencies are not savants... The people who work for the contractors however... They're terrifying. The NSA, FBI, etc. are red herrings -- look at MITRE, Booze Allen (consulting), etc.
  - fit2rule 11y ago
    Actually being ignorant of the reality - which is that the upper echelon of "the US Gov't/MilComplex" has had capabilities far, far in advance of modern civil technology, for long enough now that it is a principle governor of the scene - is also one way that the condition persists. Fact: NSA/et al. have a complete catalog of devices they can easily implant in any consumer/corporate/civil/military computing device. There is a veritable market within these spook agencies, as customers of each other, such that reaching for a phone-book sized volume of catalogs is where the implant selection process starts .. There is also much evidence that our CPU's are designed for intrusion in the first place. This is the scarier scenario: it doesn't matter how secret you think you are, if you didn't make your own CPU, there's a back door.
  - vinceguidry 11y ago
    "Behind" would assume there's someone else out there that's ahead. The state of the art of device security just isn't there yet for these kinds of compromises to be available to just any cop or agency. Now, assuredly there's people out there that support field operations that could study the individual device and then exploit it given X number of days. To go from there to assume that USG can undetectably compromise most, or even a large enough subset of devices, is paranoid. The scale of that problem is much larger. USG focuses on backdooring crypto for this reason. Much easier to compromise a few algorithms than it is to backdoor every device.
- throwaway2048 11y ago
  this is dangerously misleading advice, firmware exploits are known to exist and have been used by the USG on targets of interest.
  - vinceguidry 11y ago
    Reset the firmware too. Also, just because they have people that can compromise individual devices in the context of a field operation doesn't mean those people are available for regular law enforcement ops, any more than you could get an NFL coach to head up your son's kiddie league team. The scale of engineering is totally different.
    - throwaway2048 11y ago
      how do you propose knowing the firmware is reset? The firmware tells you? Documents have shown the NSA takes active interest in privacy and security advocacy groups, the EFF sounds right in their ballpark.
- kabdib 11y ago
  If they've already done the engineering it's not a big cost. For all we know, this kind of thing is nearly COTS in the FBI/NSA/CIA/TLA world. The question becomes: do they let one of their toys fall directly in to the hands of a security researcher? They would be stupid to do that. On the other hand, some agencies better than others . . .
  - vinceguidry 11y ago
    They would have to do it for all commercially-available devices. Why would they pick the one device you have to compromise and leave out all the others. You'd need a special government department with maybe a hundred employees taking every device coming out commercially and figuring out durable, undetectable compromises, where it's not even a given that it's really possible to do so on them. If you're insinuating they do this already, then don't you think that would have been the very first bomb dropped by Snowden? Snowden had access to everything. You don't spin up a department like that overnight, it takes years before the department will work well enough to rely on in different situations.
    - throwaway2048 11y ago
      Snowden very much did release information about model standarized intrusion techniques based around firmware exploitation with physical access.
      - vinceguidry 11y ago
        Obviously they investigated it. But there's a big difference between exploring at how it could be done and actually producing and distributing real exploits that could be used by Joe Shmoe, federal agent.

The question is if any of that equipment can still be trusted.

by zyxley 11y ago

The question is if any of that equipment can still be trusted.

It'd be interesting to closely examine that equipment now (look for intrusions, take firmware dumps, etc.). Especially any outlier chips, like the radio. Maybe he can get Apple to help :-)

striking 11y ago

Why trust it when you can sell it to someone else and buy equivalent equipment? Then the FBI will be knocking down someone else's door.

vinceguidry 11y ago

Inspect it for hardware modifications, and, assuming there are none, perform a factory reset and you're good. The amount of engineering the Feds would have to do to ensure a hack evades those two safeguards is prohibitive.

ranman 11y ago
Agreed; people overestimate the technological expertise of the U.S. Govt. -- in my anecdotal experience they're laughably behind.
- illivah 11y ago
  I would assume it all depends on who in the government touched it. "The government" is a lot of people that don't share much expertise. Some of them have shown a lot of expertise however, and a will to use it maliciously.
- burnte 11y ago
  Isn't that what we thought before Snowden showed us the NSA reprogramming firmware? I know that I said it was being blown out of proportion when the Snowden leaks started, and boy was I wrong.
  - fit2rule 11y ago
    Snowden showed us that the 5-eyes countries are actively producing and marketing - in their own secret organizations with secret, anti-democratic agreements - massive-scale spy and intrusion technologies. Anti-democratic, freedom-defeating agreements for the purpose of total information control over human civilization. Massive-scale, actually: full-spectrum. There are no aspects of modern technology infrastructure that are off the table in these realms: all systems are targets. Planet-wide. So, its not just that the NSA will be reprogramming firmware or putting key sniffers in your macbook or writing 0-day exploits. Its that they'll listen to everything, anywhere along the wire, as they see fit.
  - ranman 11y ago
    Even the things Snowden revealed required various industries to cooperate with the NSA. They weren't doing it on their own. Most portions of it were even designed and maintained by contractors! The people that work for these agencies are not savants... The people who work for the contractors however... They're terrifying. The NSA, FBI, etc. are red herrings -- look at MITRE, Booze Allen (consulting), etc.
- fit2rule 11y ago
  Actually being ignorant of the reality - which is that the upper echelon of "the US Gov't/MilComplex" has had capabilities far, far in advance of modern civil technology, for long enough now that it is a principle governor of the scene - is also one way that the condition persists. Fact: NSA/et al. have a complete catalog of devices they can easily implant in any consumer/corporate/civil/military computing device. There is a veritable market within these spook agencies, as customers of each other, such that reaching for a phone-book sized volume of catalogs is where the implant selection process starts .. There is also much evidence that our CPU's are designed for intrusion in the first place. This is the scarier scenario: it doesn't matter how secret you think you are, if you didn't make your own CPU, there's a back door.
- vinceguidry 11y ago
  "Behind" would assume there's someone else out there that's ahead. The state of the art of device security just isn't there yet for these kinds of compromises to be available to just any cop or agency. Now, assuredly there's people out there that support field operations that could study the individual device and then exploit it given X number of days. To go from there to assume that USG can undetectably compromise most, or even a large enough subset of devices, is paranoid. The scale of that problem is much larger. USG focuses on backdooring crypto for this reason. Much easier to compromise a few algorithms than it is to backdoor every device.
throwaway2048 11y ago
this is dangerously misleading advice, firmware exploits are known to exist and have been used by the USG on targets of interest.
- vinceguidry 11y ago
  Reset the firmware too. Also, just because they have people that can compromise individual devices in the context of a field operation doesn't mean those people are available for regular law enforcement ops, any more than you could get an NFL coach to head up your son's kiddie league team. The scale of engineering is totally different.
  - throwaway2048 11y ago
    how do you propose knowing the firmware is reset? The firmware tells you? Documents have shown the NSA takes active interest in privacy and security advocacy groups, the EFF sounds right in their ballpark.
kabdib 11y ago
If they've already done the engineering it's not a big cost. For all we know, this kind of thing is nearly COTS in the FBI/NSA/CIA/TLA world. The question becomes: do they let one of their toys fall directly in to the hands of a security researcher? They would be stupid to do that. On the other hand, some agencies better than others . . .
- vinceguidry 11y ago
  They would have to do it for all commercially-available devices. Why would they pick the one device you have to compromise and leave out all the others. You'd need a special government department with maybe a hundred employees taking every device coming out commercially and figuring out durable, undetectable compromises, where it's not even a given that it's really possible to do so on them. If you're insinuating they do this already, then don't you think that would have been the very first bomb dropped by Snowden? Snowden had access to everything. You don't spin up a department like that overnight, it takes years before the department will work well enough to rely on in different situations.
  - throwaway2048 11y ago
    Snowden very much did release information about model standarized intrusion techniques based around firmware exploitation with physical access.
    - vinceguidry 11y ago
      Obviously they investigated it. But there's a big difference between exploring at how it could be done and actually producing and distributing real exploits that could be used by Joe Shmoe, federal agent.