5 ms·

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of t

by kabdib 8y ago

I'm imagining a "stealth" wifi controller on one of the custom chips, hung onto a pin connected to an internal antenna realized on an internal copper layer of the motherboard. If you used a non-standard frequency and protocol, who would know? You could probably get an okay transmit-only signal with fairly unremarkable on-chip hardware (say, a simple PCM) and something that didn't look too much like an antenna even if you X-ray'd the board. I'm guessing that a similarly stealthy receiver would be noticeable due to required external discrete components (e.g., amplifiers, filter networks). Plonking down a whole chip for "secret wifi" is likely overkill.

jws 8y ago
…something that didn't look too much like an antenna… The Raspberry Pi Zero W has a perfectly serviceable antenna which is simply a cavity formed between layers of copper and two tiny capacitors which look about like grains of salt. You can read more at https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna-design/ https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna... They are designed by some very clever Swedes. http://www.proant.se/en/news.htm http://www.proant.se/en/news.htm That second page shows the Raspberry Pi 3B+ whose antenna looks to be just a trace with the aforementioned grains of salt on it.
- monochromatic 8y ago
  Antenna design is total black magic. Intuition is useless here.
  - mmagin 8y ago
    No it's not, it just seems that way to the vast majority of us who haven't developed the proper intuition.
    - wallflower 8y ago
      Of course, there is the GA evolved antenna. https://en.wikipedia.org/wiki/Evolved_antenna https://en.wikipedia.org/wiki/Evolved_antenna
      - Terr_ 8y ago
        Slightly related, an FPGA circuit designed by a genetic algorithm which ended working due to analogue effects and hardware-specific magnetic flux interference. https://www.damninteresting.com/on-the-origin-of-circuits/ https://www.damninteresting.com/on-the-origin-of-circuits/
        Bromskloss 8y ago
        It makes you wonder if it would be useful to create a programmable circuit where such analogue effects are the intended working principle.
      - tim333 8y ago
        And the 'thing' device http://www.cryptomuseum.com/covert/bugs/thing/index.htm http://www.cryptomuseum.com/covert/bugs/thing/index.htm
      - WhitneyLand 8y ago
        For this or other successful genetic algorithms, it would seem clear you still can’t know if it’s an optimal design simply because in most cases the number of designs tested would be a small fraction of the possible designs. However, things like useful sound recognition being done with only a small number of logic gates (commenter below provided a nice article, thank you) make it hard to imagine doing much better. I wonder if the process can be shown theoretically to offer any help in guaranteeing minimum bounds w.r.t. the optimal case, even if can’t be fully proven to be optimal.
  - Kliment 8y ago
    Antenna design is not black magic. There are a few well-understood basic patterns and you parametrize those. Some of those look quite exciting and tuning the matching network is annoying if you've never done it before but typically you use a template for an antenna design and set the parameters to what gets you best simulation results, then prototype and measure and set the matching network to match your measurements. It's not magic, it's normal everyday engineering. Coming up with new fundamental antenna designs feels a bit black magicky to us lowly electronics people, but that's just because it's more applied physics than engineering. Here's an example of how new antenna pattern design is done: http://sci-hub.tw/https://www.sciencedirect.com/science/article/pii/S1434841117313006 http://sci-hub.tw/https://www.sciencedirect.com/science/arti...
shawn 8y ago
The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, you wouldn’t be able to notice anything wrong apart from a slightly reduced total bandwidth. The value of such a tool is that it can be installed remotely, with no physical presence. They also have all kinds of gadgets to defeat airgaps. IIRC one of them was a replacement keyboard that looks identical to the normal one, but provides the stealth wifi you mention. One way to get an idea of what the NSA is up to is to look at their job listings. They can fake everything else, but not those.
- cozzyd 8y ago
  Why wouldn't an organization fake their job postings to lead people astray? Like if the FSB started hiring string theorists or telekinesthetics positions to waste the NSA's time figuring out why they're doing that.
  - defen 8y ago
    > Like if the FSB started hiring string theorists or telekinesthetics positions to waste the NSA's time figuring out why they're doing that. They already did that: https://www.atlasobscura.com/articles/nikolai-khokhlov-kgb-paranormal https://www.atlasobscura.com/articles/nikolai-khokhlov-kgb-p...
- Cyph0n 8y ago
  > which operates just above the physical layer. So at the link layer? If so, what you described does not sound like an effective technique to exfiltrate data over the internet, unless the NSA also controls the LAN/internal network the target device is on. Why? Because any non-standard protocol data will be thrown out by the first switch or router on the path out of the target LAN. In other words, the exfiltrated data will not be forwarded on to the next router or switch, simply because the next router/switch will not have support for the NSA's custom protocol in its network stack.
01100011 8y ago
You could put the whole thing in a faraday cage and look at the emissions with a spectrum analyzer. There's probably a bunch of wide spectrum noise though, thanks to all those squarewaves running at various frequencies. If you were smart, you might try modulating one of those signals(sort of like the 'spread-spectrum' feature of many BIOSes, but with information doing the modulation and not just noise). You might be able to sneak other signals in amongst all the noise. Hell, spread spectrum signals can sit below the noise floor... I don't really think there's a way you could be 100% certain that the laptop wasn't exfiltrating data.
- meredydd 8y ago
  Transmitting radio waves with a spread-spectrum CPU clock, you say? Here's a project to turn the Raspberry Pi into an FM radio transmitter using this exact trick: http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspb...
cesarb 8y ago
You could use an already existing wire as an antenna. For instance, many cell phones use the headphone wire as the antenna to receive digital TV. On a laptop, there are several wires long enough to be used as an antenna. For an obvious example relevant to this article, the wires for the camera.

by kabdib 8y ago

jws 8y ago

…something that didn't look too much like an antenna… The Raspberry Pi Zero W has a perfectly serviceable antenna which is simply a cavity formed between layers of copper and two tiny capacitors which look about like grains of salt. You can read more at https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna-design/ https://www.raspberrypi.org/magpi/pi-zero-w-wireless-antenna... They are designed by some very clever Swedes. http://www.proant.se/en/news.htm http://www.proant.se/en/news.htm That second page shows the Raspberry Pi 3B+ whose antenna looks to be just a trace with the aforementioned grains of salt on it.

monochromatic 8y ago
Antenna design is total black magic. Intuition is useless here.
- mmagin 8y ago
  No it's not, it just seems that way to the vast majority of us who haven't developed the proper intuition.
  - wallflower 8y ago
    Of course, there is the GA evolved antenna. https://en.wikipedia.org/wiki/Evolved_antenna https://en.wikipedia.org/wiki/Evolved_antenna
    - Terr_ 8y ago
      Slightly related, an FPGA circuit designed by a genetic algorithm which ended working due to analogue effects and hardware-specific magnetic flux interference. https://www.damninteresting.com/on-the-origin-of-circuits/ https://www.damninteresting.com/on-the-origin-of-circuits/
      - Bromskloss 8y ago
        It makes you wonder if it would be useful to create a programmable circuit where such analogue effects are the intended working principle.
    - tim333 8y ago
      And the 'thing' device http://www.cryptomuseum.com/covert/bugs/thing/index.htm http://www.cryptomuseum.com/covert/bugs/thing/index.htm
    - WhitneyLand 8y ago
      For this or other successful genetic algorithms, it would seem clear you still can’t know if it’s an optimal design simply because in most cases the number of designs tested would be a small fraction of the possible designs. However, things like useful sound recognition being done with only a small number of logic gates (commenter below provided a nice article, thank you) make it hard to imagine doing much better. I wonder if the process can be shown theoretically to offer any help in guaranteeing minimum bounds w.r.t. the optimal case, even if can’t be fully proven to be optimal.
- Kliment 8y ago
  Antenna design is not black magic. There are a few well-understood basic patterns and you parametrize those. Some of those look quite exciting and tuning the matching network is annoying if you've never done it before but typically you use a template for an antenna design and set the parameters to what gets you best simulation results, then prototype and measure and set the matching network to match your measurements. It's not magic, it's normal everyday engineering. Coming up with new fundamental antenna designs feels a bit black magicky to us lowly electronics people, but that's just because it's more applied physics than engineering. Here's an example of how new antenna pattern design is done: http://sci-hub.tw/https://www.sciencedirect.com/science/article/pii/S1434841117313006 http://sci-hub.tw/https://www.sciencedirect.com/science/arti...

shawn 8y ago

The NSA developed their own networking protocol, separate from TCP or UDP, which operates just above the physical layer. The idea is that you rewrite the network card firmware so that there’s an NSA MITM running on it. The host computer never knows, because as far as the computer is concerned the network card is sending exactly the data you would expect. And even if you hook up network monitoring tools externally, you wouldn’t be able to notice anything wrong apart from a slightly reduced total bandwidth. The value of such a tool is that it can be installed remotely, with no physical presence. They also have all kinds of gadgets to defeat airgaps. IIRC one of them was a replacement keyboard that looks identical to the normal one, but provides the stealth wifi you mention. One way to get an idea of what the NSA is up to is to look at their job listings. They can fake everything else, but not those.

cozzyd 8y ago
Why wouldn't an organization fake their job postings to lead people astray? Like if the FSB started hiring string theorists or telekinesthetics positions to waste the NSA's time figuring out why they're doing that.
- defen 8y ago
  > Like if the FSB started hiring string theorists or telekinesthetics positions to waste the NSA's time figuring out why they're doing that. They already did that: https://www.atlasobscura.com/articles/nikolai-khokhlov-kgb-paranormal https://www.atlasobscura.com/articles/nikolai-khokhlov-kgb-p...
Cyph0n 8y ago
> which operates just above the physical layer. So at the link layer? If so, what you described does not sound like an effective technique to exfiltrate data over the internet, unless the NSA also controls the LAN/internal network the target device is on. Why? Because any non-standard protocol data will be thrown out by the first switch or router on the path out of the target LAN. In other words, the exfiltrated data will not be forwarded on to the next router or switch, simply because the next router/switch will not have support for the NSA's custom protocol in its network stack.

01100011 8y ago

You could put the whole thing in a faraday cage and look at the emissions with a spectrum analyzer. There's probably a bunch of wide spectrum noise though, thanks to all those squarewaves running at various frequencies. If you were smart, you might try modulating one of those signals(sort of like the 'spread-spectrum' feature of many BIOSes, but with information doing the modulation and not just noise). You might be able to sneak other signals in amongst all the noise. Hell, spread spectrum signals can sit below the noise floor... I don't really think there's a way you could be 100% certain that the laptop wasn't exfiltrating data.

meredydd 8y ago
Transmitting radio waves with a spread-spectrum CPU clock, you say? Here's a project to turn the Raspberry Pi into an FM radio transmitter using this exact trick: http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspb...

cesarb 8y ago

You could use an already existing wire as an antenna. For instance, many cell phones use the headphone wire as the antenna to receive digital TV. On a laptop, there are several wires long enough to be used as an antenna. For an obvious example relevant to this article, the wires for the camera.