7 ms·

No need to. For anybody who's read the Snowden leaks it's 100% plausible that the NSA owns society through hardware backdoors. Conclusion: We need 100% open-so

No need to. For anybody who's read the Snowden leaks it's 100% plausible that the NSA owns society through hardware backdoors. Conclusion: We need 100% open-source hardware ASAP if we're to become a sane society. Edit: Anyone remember the "Intel inside" trademark [0] which was supposed to add (marketing) value to any PC which was allowed to carry that label? Well, today it's clear that this label actually stands for "Intelligence community inside". [0] https://www.intel.com/content/www/us/en/trademarks/intel-inside.html https://www.intel.com/content/www/us/en/trademarks/intel-ins...

StreamBright 9y ago
Implying opensource cannot contain backdoors for years. https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a...
- jmnicolas 9y ago
  Yeah but at least you have a chance to find the backdoors.
  - StreamBright 9y ago
    It is possible find backdoors in closed source software. Check the Cisco story.
    - jmnicolas 9y ago
      Yeah but at least you have a better chance to find the backdoors. ;-)
- benevol 9y ago
  The open-source approach is our own chance to purge corruption in the technology layer. We may not yet have implemented the idea perfectly, but keep in mind the following: With every new player (government, company, user) joining the open-source approach, we get additional eyes on the code/hardware. Imagine all world governments using only open-source code/hardware: Given the current budgets at play, we would have 100% secure code/hardware in a matter of seconds - for everybody on the Planet. Why is this not happening? Because governments (currently) still do not fully represent the citizens' interests. They mainly represent their interests first (which is the protection and expansion of their power monopoly). This is called the principal-agent problem.
  - nfoz 9y ago
    Let's suppose that hardware is open-source. How do I know that my instance of the hardware is faithful to the spec? That my vendor didn't modify the hardware? Let's suppose that I have a 3D printer sophisticated enough to print open-source circuitboards. How do I trust my 3d printer? I think there's a hardware "trusting trust" problem; I can't imagine how your optimism could ever be realized. I hope I'm missing something!
    - SXX 9y ago
      There will always be trust related issues, but that doesnt mean we shouldnt improve overall situation. Currently its possible there are all kind of backdoors in: hardware itself, firmware, drivers, some of closed source software. If we would limit it only to hardware itself that would be huge win.
    - hdhzy 9y ago
      I think the parent doesn't mean that open source will cure all problems but that it will move the bar higher for malicious players. If the designs were published and it'd be possible for anyone to review and build such a thing then it's exponentially harder to hide something.
    - simias 9y ago
      You're not missing anything, it's just that with each added "hop" it becomes harder to implement a backdoor and have it undetected. Your futuristic 3D printer could be backdoored to recognize certain patterns and modify them sneakily but that would be pretty sophisticated and somebody validating thoroughly the output could detect the unexpected divergence. Designing a generic backdoor that would work on any CPU design without being obvious sounds very tricky indeed. It would also be very difficult to hide the code generating the backdoor if the software of the printer is open source itself. Then you'd have to insert inconspicuous code in the printer's driver which would have the very complex task of messing with the model to insert a backdoor in an arbitrary user-controlled design.
  - StreamBright 9y ago
    I am not sure if you understand the complexity of validating crypto or finding backdoors in software. It is possible to find bugs in closed source software and as the link I provided proves it is possible to "hide" backdoors in open source software. 100% secure? You must be joking. Since there is no code without bugs and certain percentage of bugs have security implications there is no 100% secure.
- ekianjo 9y ago
  If it's not open it's even less likely to be found in the first place. Do you have other options?
  - StreamBright 9y ago
    How many people were capable of spotting a backdoor in the standard[1]? Do you think that an average person can just look at a source code and spot any backdoor or security bug? 1. https://www.wired.com/images_blogs/threatlevel/2013/09/15-shumow.pdf https://www.wired.com/images_blogs/threatlevel/2013/09/15-sh...
    - deleteme12345 9y ago
      Doesn't have to be manual, despite kids being taught programming within the next generation. Automated fuzzing is a solution amongst others.
    - ekianjo 9y ago
      It does not have to be the average person. If it's open and if there is enough interest in the community, organizations can contract security professionals to audit the code. This has been done for several crypto projects even in recent history.
- gabuzome 9y ago
  Did they ever find backdoors, or are they still pure speculation?
youdontknowtho 9y ago
"sane society" My personal belief is that this is a little optimistic. There's a lot wrong with our society, and intel embedding Minix in the ME doesn't really rise to the top of current issues. I would really like an option that did not have binary blobs in the bios or CPU. That's tough, though...CPU's always have microcode fixes, don't they? So far, I think the best option for this kind of thing is the Raptor workstation with the Power7 CPU.
- benevol 9y ago
  > "sane society" > My personal belief is that this is a little optimistic. There's a lot wrong with our society, and intel embedding Minix in the ME doesn't really rise to the top of current issues. It's not optimistic. Society will change massively - in the good direction. We have still a lot of work ahead of us, and there will of course be pain along the way, but the Planet will become peaceful and clean again. And we are assisted in this process. How do I know? I've seen it.
  - youdontknowtho 9y ago
    Look, friend, I'm not trying to be argumentative to be a troll or anything. I get that you think that this is a super serious issue. I do to, but you have to admit that getting Minix and the ME out of PC CPU's won't really stop cops from shooting unarmed black men, or stop proliferation of cheap small arms in conflict zones, or the lack of clean water...I won't keep beating the drum. I'm also not an SJW or whatever. I'm just saying that things that can be very important to us...that we think will have a tremendous impact on the future...those things aren't universal issues. Maybe it's just my lack of understanding of where you are coming from to see how this would be a major component of getting to a peaceful and clean world. If so, I would like to hear more. Thanks.
agumonkey 9y ago
Well as Bill Binney said, what the NSA can tap into has no real relation to what they can do. They're mostly sucking funding with bad if not useless monitoring tools. Unless they're going after low hanging fruits (accessing some business information, not like avoiding terrorism)
gradschool 9y ago
In that case why didn't they remotely disable Snowden's laptop when he went on the run? My best guess is that the system isn't yet fully operational.
- kbart 9y ago
  What would NSA spooks have achieved besides confirming that hardware backdoor are real (to those remaining few who still doubt)? Snowden could have simply took out HDD, put in into the new machine and resume his operation.
  - gradschool 9y ago
    The ME has full control of the hardware and could have wiped the hard drive before bricking the machine. The NSA presumably would have preferred a bit of bad PR to actual classified information being leaked. A better argument would be that all laptops approved for use by NSA staff routinely have the HAP bit enabled.
    - kbart 9y ago
      I somehow suspect that Snowden was smart enough not to keep all eggs in a single basket. His laptop might as well has been mugged or stolen.
  - WillReplyfFood 9y ago
    My guess is that with insider knowledge and a good firewall, a no-updates policy you can prevent phoning into the backdoor for a while.
- Fnoord 9y ago
  > In that case why didn't they remotely disable Snowden's laptop when he went on the run? There are several possible answers to that question: 1) "Just because you're paranoid doesn't mean they're not after you." 2) Because the risk of getting this backdoor known would not be worth the cost. 3) Because Snowden's laptop was used with airgap. 4) Because at that point, the cat was already out of the bag (the journalists had the data on SDs).

StreamBright 9y ago

Implying opensource cannot contain backdoors for years. https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a...

jmnicolas 9y ago
Yeah but at least you have a chance to find the backdoors.
- StreamBright 9y ago
  It is possible find backdoors in closed source software. Check the Cisco story.
  - jmnicolas 9y ago
    Yeah but at least you have a better chance to find the backdoors. ;-)
benevol 9y ago
The open-source approach is our own chance to purge corruption in the technology layer. We may not yet have implemented the idea perfectly, but keep in mind the following: With every new player (government, company, user) joining the open-source approach, we get additional eyes on the code/hardware. Imagine all world governments using only open-source code/hardware: Given the current budgets at play, we would have 100% secure code/hardware in a matter of seconds - for everybody on the Planet. Why is this not happening? Because governments (currently) still do not fully represent the citizens' interests. They mainly represent their interests first (which is the protection and expansion of their power monopoly). This is called the principal-agent problem.
- nfoz 9y ago
  Let's suppose that hardware is open-source. How do I know that my instance of the hardware is faithful to the spec? That my vendor didn't modify the hardware? Let's suppose that I have a 3D printer sophisticated enough to print open-source circuitboards. How do I trust my 3d printer? I think there's a hardware "trusting trust" problem; I can't imagine how your optimism could ever be realized. I hope I'm missing something!
  - SXX 9y ago
    There will always be trust related issues, but that doesnt mean we shouldnt improve overall situation. Currently its possible there are all kind of backdoors in: hardware itself, firmware, drivers, some of closed source software. If we would limit it only to hardware itself that would be huge win.
  - hdhzy 9y ago
    I think the parent doesn't mean that open source will cure all problems but that it will move the bar higher for malicious players. If the designs were published and it'd be possible for anyone to review and build such a thing then it's exponentially harder to hide something.
  - simias 9y ago
    You're not missing anything, it's just that with each added "hop" it becomes harder to implement a backdoor and have it undetected. Your futuristic 3D printer could be backdoored to recognize certain patterns and modify them sneakily but that would be pretty sophisticated and somebody validating thoroughly the output could detect the unexpected divergence. Designing a generic backdoor that would work on any CPU design without being obvious sounds very tricky indeed. It would also be very difficult to hide the code generating the backdoor if the software of the printer is open source itself. Then you'd have to insert inconspicuous code in the printer's driver which would have the very complex task of messing with the model to insert a backdoor in an arbitrary user-controlled design.
- StreamBright 9y ago
  I am not sure if you understand the complexity of validating crypto or finding backdoors in software. It is possible to find bugs in closed source software and as the link I provided proves it is possible to "hide" backdoors in open source software. 100% secure? You must be joking. Since there is no code without bugs and certain percentage of bugs have security implications there is no 100% secure.
ekianjo 9y ago
If it's not open it's even less likely to be found in the first place. Do you have other options?
- StreamBright 9y ago
  How many people were capable of spotting a backdoor in the standard[1]? Do you think that an average person can just look at a source code and spot any backdoor or security bug? 1. https://www.wired.com/images_blogs/threatlevel/2013/09/15-shumow.pdf https://www.wired.com/images_blogs/threatlevel/2013/09/15-sh...
  - deleteme12345 9y ago
    Doesn't have to be manual, despite kids being taught programming within the next generation. Automated fuzzing is a solution amongst others.
  - ekianjo 9y ago
    It does not have to be the average person. If it's open and if there is enough interest in the community, organizations can contract security professionals to audit the code. This has been done for several crypto projects even in recent history.
gabuzome 9y ago
Did they ever find backdoors, or are they still pure speculation?

youdontknowtho 9y ago

"sane society" My personal belief is that this is a little optimistic. There's a lot wrong with our society, and intel embedding Minix in the ME doesn't really rise to the top of current issues. I would really like an option that did not have binary blobs in the bios or CPU. That's tough, though...CPU's always have microcode fixes, don't they? So far, I think the best option for this kind of thing is the Raptor workstation with the Power7 CPU.

benevol 9y ago
> "sane society" > My personal belief is that this is a little optimistic. There's a lot wrong with our society, and intel embedding Minix in the ME doesn't really rise to the top of current issues. It's not optimistic. Society will change massively - in the good direction. We have still a lot of work ahead of us, and there will of course be pain along the way, but the Planet will become peaceful and clean again. And we are assisted in this process. How do I know? I've seen it.
- youdontknowtho 9y ago
  Look, friend, I'm not trying to be argumentative to be a troll or anything. I get that you think that this is a super serious issue. I do to, but you have to admit that getting Minix and the ME out of PC CPU's won't really stop cops from shooting unarmed black men, or stop proliferation of cheap small arms in conflict zones, or the lack of clean water...I won't keep beating the drum. I'm also not an SJW or whatever. I'm just saying that things that can be very important to us...that we think will have a tremendous impact on the future...those things aren't universal issues. Maybe it's just my lack of understanding of where you are coming from to see how this would be a major component of getting to a peaceful and clean world. If so, I would like to hear more. Thanks.

agumonkey 9y ago

Well as Bill Binney said, what the NSA can tap into has no real relation to what they can do. They're mostly sucking funding with bad if not useless monitoring tools. Unless they're going after low hanging fruits (accessing some business information, not like avoiding terrorism)

gradschool 9y ago

In that case why didn't they remotely disable Snowden's laptop when he went on the run? My best guess is that the system isn't yet fully operational.

kbart 9y ago
What would NSA spooks have achieved besides confirming that hardware backdoor are real (to those remaining few who still doubt)? Snowden could have simply took out HDD, put in into the new machine and resume his operation.
- gradschool 9y ago
  The ME has full control of the hardware and could have wiped the hard drive before bricking the machine. The NSA presumably would have preferred a bit of bad PR to actual classified information being leaked. A better argument would be that all laptops approved for use by NSA staff routinely have the HAP bit enabled.
  - kbart 9y ago
    I somehow suspect that Snowden was smart enough not to keep all eggs in a single basket. His laptop might as well has been mugged or stolen.
- WillReplyfFood 9y ago
  My guess is that with insider knowledge and a good firewall, a no-updates policy you can prevent phoning into the backdoor for a while.
Fnoord 9y ago
> In that case why didn't they remotely disable Snowden's laptop when he went on the run? There are several possible answers to that question: 1) "Just because you're paranoid doesn't mean they're not after you." 2) Because the risk of getting this backdoor known would not be worth the cost. 3) Because Snowden's laptop was used with airgap. 4) Because at that point, the cat was already out of the bag (the journalists had the data on SDs).