5 ms·

He's suing to get them back and for compensation for having to "temporarily" replace them, but even if he wins he probably shouldn't trust either device in the

He's suing to get them back and for compensation for having to "temporarily" replace them, but even if he wins he probably shouldn't trust either device in the future (possibly more so for the laptop).

rahuldottech 7y ago
Eh, wipe disk (or install a new one), re-install OS, and if you're super paranoid then re-flash BIOS and you should be good to go.
- justinclift 7y ago
  That's literally useless for government sponsored persistent malware.
  - Spare_account 7y ago
    Can you expand on this? I'm curious and a little Googling didn't yield much
    - andromeduck 7y ago
      Snowden revealed that the government is capable of planting malware in peripheral firmware. So you can have a hacked bios/EFI, system controller, security chip, hard drive, SSD, GPU, WiFi/networking card/chip that is virtually impossible to detect from the main OS.
      - lixtra 7y ago
        Yes, if determined the government agencies have tremendous capabilities. But will they use it at a large scale, i.e. against an arbitrary lawyer?
        pooya13 7y ago
        I’m thinking maybe this guy was flagged because he is a lawyer and might have sensitive information on a person of interest.
    - lixtra 7y ago
      I think we simply don’t know in this case. But if a super sophisticated approach is used, they could just as well catch and prepare your computer before you receive it i.e. if you ordered it by mail.
      - justinclift 7y ago
        Apparently that's already been happening for years: https://www.theatlantic.com/technology/archive/2013/12/nsa-intercepts-laptops-purchased-online-install-malware/356548/ https://www.theatlantic.com/technology/archive/2013/12/nsa-i... Seems like a one-size-fits-all approach leaves gaps in targeting, so something a bit more Tailored for the others make sense.
    - snazz 7y ago
      Maybe they put a keylogging device between the keyboard ribbon cable and the motherboard? Say this device exfiltrates keypresses via a radio and a government agency, knowing where you work or live, can then pick up the data wirelessly. It’s a bit sci-fi, but well within the resources of any of these governments.
      - ultrarunner 7y ago
        Security goes beyond technical means. Sometimes it also involves keeping an eye out for flower delivery vans.
    - fao_ 7y ago
      Some russian hackers at DEFCON a few years back handed out power cables that leaked data via the hotel's power system. I've also heard of altered USB-C power cables being used to exflitrate data, and a software-altered USB port used as a radio wire
    - pooya13 7y ago
      If the bios is corrupt it can corrupt the OS. So that the OS does not really flash it. Or there might be a hardware exploit that makes it look like the bios is being flashed while keeping the corruption or one that injects the corruption after each bios flash. In general if the HW has been modified it would be really hard to detect the exploit.
    - justinclift 7y ago
      Many of the more technically advanced governments create and/or buy malware which is able to persist in places other than just your hard drive and BIOS. As it seems you're new to the idea, look into APTs for a general understanding of how persistent threats can be useful when they're embedded into a target: https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat The mechanisms for persisting outside of HDD/SSD data areas and the BIOS can vary. There are a lot of support chips in computers and peripherals. For example, Intels AMT (supposed to secure PCs) has been shown by researchers to be a useful place to put malware. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... I'm not personally sure if there's active malware using that vector yet, it's just an example. But it also wouldn't be even slightly surprising. Does that help? :)
  - deleted 7y ago
    [deleted]
gruez 7y ago
>he probably shouldn't trust either device in the future (possibly more so for the laptop). Seems risky for the government to put any firmware/hardware implants on those devices. The user is naturally going to be suspicious of it because the government had unrestricted access for days/weeks. So there's a high chance that the user might not even use it or will send it to an expert for analysis. If discovered, it's going to look extra bad for the government because there's no doubt that they did it.
- mattnewton 7y ago
  Suspicious, sure, but most users aren’t equipped to do that kind of diagnosis, and many won’t be able to afford new devices, and maybe it will look even worse for the government but I am certain absolutely nothing bad will happen to the people who added the malware.
  - ryacko 7y ago
    $30 smartphones exist.
  - chopin 7y ago
    But in this case the EFF would love to do a forensic examination.
- dontbenebby 7y ago
  Or if the implant was software based, they could release the code so it can be flagged in antivirus / the hole patched.
jtms 7y ago
Call me paranoid, but i'd be putting those devices into a heavy duty shredder if I got them back.
- nine_k 7y ago
  Why — security researchers would gladly buy them for a nonzero sum.
  - zulln 7y ago
    That would mean giving away your private data you had on the device to security researchers as well though. While I would want to have such device analysed, I am not sure I am fine with that compromise.
    - jedberg 7y ago
      Nah, you wipe the drive and then give it to them, so they can check for firmware hacks.

rahuldottech 7y ago

Eh, wipe disk (or install a new one), re-install OS, and if you're super paranoid then re-flash BIOS and you should be good to go.

justinclift 7y ago
That's literally useless for government sponsored persistent malware.
- Spare_account 7y ago
  Can you expand on this? I'm curious and a little Googling didn't yield much
  - andromeduck 7y ago
    Snowden revealed that the government is capable of planting malware in peripheral firmware. So you can have a hacked bios/EFI, system controller, security chip, hard drive, SSD, GPU, WiFi/networking card/chip that is virtually impossible to detect from the main OS.
    - lixtra 7y ago
      Yes, if determined the government agencies have tremendous capabilities. But will they use it at a large scale, i.e. against an arbitrary lawyer?
      - pooya13 7y ago
        I’m thinking maybe this guy was flagged because he is a lawyer and might have sensitive information on a person of interest.
  - lixtra 7y ago
    I think we simply don’t know in this case. But if a super sophisticated approach is used, they could just as well catch and prepare your computer before you receive it i.e. if you ordered it by mail.
    - justinclift 7y ago
      Apparently that's already been happening for years: https://www.theatlantic.com/technology/archive/2013/12/nsa-intercepts-laptops-purchased-online-install-malware/356548/ https://www.theatlantic.com/technology/archive/2013/12/nsa-i... Seems like a one-size-fits-all approach leaves gaps in targeting, so something a bit more Tailored for the others make sense.
  - snazz 7y ago
    Maybe they put a keylogging device between the keyboard ribbon cable and the motherboard? Say this device exfiltrates keypresses via a radio and a government agency, knowing where you work or live, can then pick up the data wirelessly. It’s a bit sci-fi, but well within the resources of any of these governments.
    - ultrarunner 7y ago
      Security goes beyond technical means. Sometimes it also involves keeping an eye out for flower delivery vans.
  - fao_ 7y ago
    Some russian hackers at DEFCON a few years back handed out power cables that leaked data via the hotel's power system. I've also heard of altered USB-C power cables being used to exflitrate data, and a software-altered USB port used as a radio wire
  - pooya13 7y ago
    If the bios is corrupt it can corrupt the OS. So that the OS does not really flash it. Or there might be a hardware exploit that makes it look like the bios is being flashed while keeping the corruption or one that injects the corruption after each bios flash. In general if the HW has been modified it would be really hard to detect the exploit.
  - justinclift 7y ago
    Many of the more technically advanced governments create and/or buy malware which is able to persist in places other than just your hard drive and BIOS. As it seems you're new to the idea, look into APTs for a general understanding of how persistent threats can be useful when they're embedded into a target: https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat The mechanisms for persisting outside of HDD/SSD data areas and the BIOS can vary. There are a lot of support chips in computers and peripherals. For example, Intels AMT (supposed to secure PCs) has been shown by researchers to be a useful place to put malware. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... I'm not personally sure if there's active malware using that vector yet, it's just an example. But it also wouldn't be even slightly surprising. Does that help? :)
- deleted 7y ago
  [deleted]

gruez 7y ago

>he probably shouldn't trust either device in the future (possibly more so for the laptop). Seems risky for the government to put any firmware/hardware implants on those devices. The user is naturally going to be suspicious of it because the government had unrestricted access for days/weeks. So there's a high chance that the user might not even use it or will send it to an expert for analysis. If discovered, it's going to look extra bad for the government because there's no doubt that they did it.

mattnewton 7y ago
Suspicious, sure, but most users aren’t equipped to do that kind of diagnosis, and many won’t be able to afford new devices, and maybe it will look even worse for the government but I am certain absolutely nothing bad will happen to the people who added the malware.
- ryacko 7y ago
  $30 smartphones exist.
- chopin 7y ago
  But in this case the EFF would love to do a forensic examination.
dontbenebby 7y ago
Or if the implant was software based, they could release the code so it can be flagged in antivirus / the hole patched.

jtms 7y ago

Call me paranoid, but i'd be putting those devices into a heavy duty shredder if I got them back.

nine_k 7y ago
Why — security researchers would gladly buy them for a nonzero sum.
- zulln 7y ago
  That would mean giving away your private data you had on the device to security researchers as well though. While I would want to have such device analysed, I am not sure I am fine with that compromise.
  - jedberg 7y ago
    Nah, you wipe the drive and then give it to them, so they can check for firmware hacks.