3 ms·

Seems like it should be straightforward to test it before jumping to conclusions and making accusations right? Get a clean "air-gap" computer, and see what's r

Seems like it should be straightforward to test it before jumping to conclusions and making accusations right? Get a clean "air-gap" computer, and see what's really on it.

AdamJacobMuller 8y ago
Testing doesn't actually tell you anything. Were I designing this fan, I would only activate the attack payload if the fan was connected X number of times, or after some specific date in the future to defeat this kind of analysis. I think you need to just tear one down and see what's connected. It should be trivial to identify if only the power connectors are hooked up, or if the data connectors are also hooked up.
- nodesocket 8y ago
  Unless I am missing something, even if the code has latent features, you should still be able to discover the "fan" in-fact has files and those files have code, which would be a red flag right? My point is that instead of doing any investigative journalist work; "journalist" just decided to take to Twitter and proclaim the fan as hostile. The lack of facts and reason over emotion is my frustration. A recurring theme lately.
  - mortdeus 8y ago
    If I was trying to attack somebody through this route, I wouldn't just release all of them containing malware. Rather, I would target 2 or 3 journalists who I wanted to monitor and hope that they wouldn't be wise enough to consider the security implications. Most fans would check out as being okay, which would lessen the suspicion. The only way you could definitively tell that these fans are compromised is to consequently check every fan out of the bunch.
systoll 8y ago
The article doesn't accuse anyone. Jeremy Bowers tweet comes close, but for the most part, the article and the people it quotes are just saying that it's not worth the risk. Testing it would be a major diversion for the journalists there. Some of them will probably be tested eventually, but they don't need the fans right now... or ever. So it makes sense to just not use them.

Seems like it should be straightforward to test it before jumping to conclusions and making accusations right? Get a clean "air-gap" computer, and see what's really on it.

AdamJacobMuller 8y ago

Testing doesn't actually tell you anything. Were I designing this fan, I would only activate the attack payload if the fan was connected X number of times, or after some specific date in the future to defeat this kind of analysis. I think you need to just tear one down and see what's connected. It should be trivial to identify if only the power connectors are hooked up, or if the data connectors are also hooked up.

nodesocket 8y ago
Unless I am missing something, even if the code has latent features, you should still be able to discover the "fan" in-fact has files and those files have code, which would be a red flag right? My point is that instead of doing any investigative journalist work; "journalist" just decided to take to Twitter and proclaim the fan as hostile. The lack of facts and reason over emotion is my frustration. A recurring theme lately.
- mortdeus 8y ago
  If I was trying to attack somebody through this route, I wouldn't just release all of them containing malware. Rather, I would target 2 or 3 journalists who I wanted to monitor and hope that they wouldn't be wise enough to consider the security implications. Most fans would check out as being okay, which would lessen the suspicion. The only way you could definitively tell that these fans are compromised is to consequently check every fan out of the bunch.

systoll 8y ago

The article doesn't accuse anyone. Jeremy Bowers tweet comes close, but for the most part, the article and the people it quotes are just saying that it's not worth the risk. Testing it would be a major diversion for the journalists there. Some of them will probably be tested eventually, but they don't need the fans right now... or ever. So it makes sense to just not use them.