4 ms·

I suspect any modified hardware would be targeted, not every single computer. You probably shouldn't order a computer online if this is your threat model, and i

by clubm8 7y ago

I suspect any modified hardware would be targeted, not every single computer. You probably shouldn't order a computer online if this is your threat model, and instead pay for one off the shelf.

scotchio 7y ago
Was more curious to just HOW it's done / been done
- Spooky23 7y ago
  Some examples: https://www.zdnet.com/article/cisco-partners-sell-fake-routers-to-us-military/ https://www.zdnet.com/article/cisco-partners-sell-fake-route... https://www.schneier.com/blog/archives/2015/03/cisco_shipping_.html https://www.schneier.com/blog/archives/2015/03/cisco_shippin... https://photographylife.com/fake-memory-cards https://photographylife.com/fake-memory-cards
derefr 7y ago
> And instead pay for one off the shelf If a state actor is sufficiently motivated, even in a physical purchase, your computer will just get switched out for a bugged one at the cashier. Common OPSEC practice re: buying hardware (or anything you don’t want your name associated with, really), is to pay an unaffiliated proxy to buy it for you.
- dwighttk 7y ago
  If that's your threat model you aren't taking buying advice from HN.
- gruez 7y ago
  >your computer will just get switched out for a bugged one at the cashier. I doubt it. How would they swap it in time if you drove to a random Best buy, picked out a laptop (I think they still keep them in locked cages on the show floor), and kept eyes on it until checkout? Nevermind that they'll need surveillance on you 24/7 and have the exact model ready to go (or be able to plant the bug within minutes) to pull this off. It's much more feasible to only bug delivered/ordered equipment.
  - sct202 7y ago
    It seems really implausible to pull off without making a scene with a bunch of retail workers thinking you're trying to pull off some kind of scam/fraud.
  - codedokode 7y ago
    It might be easier to find a 0-day vulnerability in Intel ME and exploit it.

by clubm8 7y ago

I suspect any modified hardware would be targeted, not every single computer. You probably shouldn't order a computer online if this is your threat model, and instead pay for one off the shelf.

scotchio 7y ago

Was more curious to just HOW it's done / been done

Spooky23 7y ago
Some examples: https://www.zdnet.com/article/cisco-partners-sell-fake-routers-to-us-military/ https://www.zdnet.com/article/cisco-partners-sell-fake-route... https://www.schneier.com/blog/archives/2015/03/cisco_shipping_.html https://www.schneier.com/blog/archives/2015/03/cisco_shippin... https://photographylife.com/fake-memory-cards https://photographylife.com/fake-memory-cards

derefr 7y ago

> And instead pay for one off the shelf If a state actor is sufficiently motivated, even in a physical purchase, your computer will just get switched out for a bugged one at the cashier. Common OPSEC practice re: buying hardware (or anything you don’t want your name associated with, really), is to pay an unaffiliated proxy to buy it for you.

dwighttk 7y ago
If that's your threat model you aren't taking buying advice from HN.
gruez 7y ago
>your computer will just get switched out for a bugged one at the cashier. I doubt it. How would they swap it in time if you drove to a random Best buy, picked out a laptop (I think they still keep them in locked cages on the show floor), and kept eyes on it until checkout? Nevermind that they'll need surveillance on you 24/7 and have the exact model ready to go (or be able to plant the bug within minutes) to pull this off. It's much more feasible to only bug delivered/ordered equipment.
- sct202 7y ago
  It seems really implausible to pull off without making a scene with a bunch of retail workers thinking you're trying to pull off some kind of scam/fraud.
- codedokode 7y ago
  It might be easier to find a 0-day vulnerability in Intel ME and exploit it.