3 ms·

> Now if you're implying there's some sort of bulk, indiscriminate implantation program, that would be news to pretty much every private sector security expert

by zdkl 9y ago

> Now if you're implying there's some sort of bulk, indiscriminate implantation program, that would be news to pretty much every private sector security expert on the planet. Are you sure? I thought it was widely accepted that you couldn't trust chinese hardware or most american firmware.

rl3 9y ago
Yes, I'm sure. Backdoors are not implants, they are vulnerabilities. Implants are the payloads that persistently infect target systems, surveil or modify the envrionment, and exfiltrate data. So unless you want to suggest the majority of consumer systems are actively compromised to the point of exfiltrating screen caps on a regular basis, my original point still stands. Even then, good luck conducting successful automated analysis on hidden messages made out of blocks in Minecraft. Reconstructing game state as it went across the wire would be easier than making sense of screenshots in that scenario.
- zdkl 9y ago
  Does ECHELON ring a bell to you? I don't believe every computing device ever is exfilling the amount of data you describe, but I'd be very very surprised if it weren't an option for nation level actors at the flick of a switch. Screw minecraft, all I need is access to your USB/ethernet controllers and that's not remotely difficult. I believe your threat model is flawed if you don't assume any existing known vulnerability isn't being at least passively used to surveil remote systems.
  - rl3 9y ago
    From one of my previous replies: "I was describing measures that would likely foil automated bulk analysis." Nothing you just said is relevant in that context. Yes, obviously anything can be easily compromised if it's targeted. I said as much in the very same post. Automated bulk analysis exists to find targets in the first place.
    - zdkl 9y ago
      I think you're vastly overestimating how complicated it is to do what I'm talking about at scale, but whatever.
      - rl3 9y ago
        From a technical perspective it might not be that hard given the depth of existing capabilities, but from a risk standpoint it would probably be a terrible idea. Recall Stuxnet and some of its successors were partially reverse engineered, and just recently Intel's Management Engine is being torn apart.
        zdkl 9y ago
        I agree about the risk. But we're drifting in a direction where that risk is becoming lesser and lesser. Most users simply couldn't give a crap and we're gonna pay for the loss of accountability at some point

by zdkl 9y ago

rl3 9y ago

Yes, I'm sure. Backdoors are not implants, they are vulnerabilities. Implants are the payloads that persistently infect target systems, surveil or modify the envrionment, and exfiltrate data. So unless you want to suggest the majority of consumer systems are actively compromised to the point of exfiltrating screen caps on a regular basis, my original point still stands. Even then, good luck conducting successful automated analysis on hidden messages made out of blocks in Minecraft. Reconstructing game state as it went across the wire would be easier than making sense of screenshots in that scenario.

zdkl 9y ago
Does ECHELON ring a bell to you? I don't believe every computing device ever is exfilling the amount of data you describe, but I'd be very very surprised if it weren't an option for nation level actors at the flick of a switch. Screw minecraft, all I need is access to your USB/ethernet controllers and that's not remotely difficult. I believe your threat model is flawed if you don't assume any existing known vulnerability isn't being at least passively used to surveil remote systems.
- rl3 9y ago
  From one of my previous replies: "I was describing measures that would likely foil automated bulk analysis." Nothing you just said is relevant in that context. Yes, obviously anything can be easily compromised if it's targeted. I said as much in the very same post. Automated bulk analysis exists to find targets in the first place.
  - zdkl 9y ago
    I think you're vastly overestimating how complicated it is to do what I'm talking about at scale, but whatever.
    - rl3 9y ago
      From a technical perspective it might not be that hard given the depth of existing capabilities, but from a risk standpoint it would probably be a terrible idea. Recall Stuxnet and some of its successors were partially reverse engineered, and just recently Intel's Management Engine is being torn apart.
      - zdkl 9y ago
        I agree about the risk. But we're drifting in a direction where that risk is becoming lesser and lesser. Most users simply couldn't give a crap and we're gonna pay for the loss of accountability at some point