4 ms·

With this scale of access to the network infrastructure[1], I'd be worried about them injecting drive-by downloads of browser exploits which install trust for a

With this scale of access to the network infrastructure[1], I'd be worried about them injecting drive-by downloads of browser exploits which install trust for a root certificate controlled by the government. Once in place, MITM attacks on https are possible. The tricky bit would be telling apart requests from compromised machines and uncompromised ones. (attempting to MITM the latter will cause the browser to start jumping up and down, potentially raising suspicion) Even more scary is the thought experiment that Microsoft might cooperate with the Tunisian government and allow installing trust for such a root certificate via the windows update mechanism. (I have no evidence that this actually happens, it just seems a convenient vector) [1] They're under no time pressure and can transparently proxy every single TCP connection and IP packet if they so desire. They control DNS.

wladimir 16y ago
If you want scary, what about bribing Intel and AMD to include 'propietrary instructions' for your government?
- pmjordan 16y ago
  Seems a little far-fetched and overly complicated for carrying out a practical attack.
  - wladimir 16y ago
    Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already. Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.
    - pmjordan 16y ago
      You'd still need some kind of software support to trigger the exploit. At which point you may as well go with a software-only attack.
      - wladimir 16y ago
        Naah, if it's simply a few added instructions I agree with you. But let's think in a wider scope (disclaimer: this is not my idea, I remember reading about it a long time ago): what if a certain cryptographic "magic code" at the beginning of a memory page would trigger the execution of arbitrary code embedded in that page? Such a thing could be triggered over the network, wireless through bluetooth/wifi, or by specially crafted images on a webpage, or whatever creative technique you can think of. It'd effectively give the govt instant root access to any device with the affected CPUs.
        stcredzero 16y ago
        Stuff like this would be easy to hide in the guise of "Hardware DRM."
        wladimir 16y ago
        Yes, I guess on-processor DRM and any kind of virtualisation (will the real hypervisor please stand up?) are prime suspects for this kind of thing. But they are also the most obvious, it could be cramped into everything. It'd be mighty interesting to tear apart / scan / reverse engineer some modern CPUs like they did with the 6502. Then again, these beasts are so complex that's similar to looking for a needle in a galaxy-sized haystack.

wladimir 16y ago

If you want scary, what about bribing Intel and AMD to include 'propietrary instructions' for your government?

pmjordan 16y ago
Seems a little far-fetched and overly complicated for carrying out a practical attack.
- wladimir 16y ago
  Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already. Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.
  - pmjordan 16y ago
    You'd still need some kind of software support to trigger the exploit. At which point you may as well go with a software-only attack.
    - wladimir 16y ago
      Naah, if it's simply a few added instructions I agree with you. But let's think in a wider scope (disclaimer: this is not my idea, I remember reading about it a long time ago): what if a certain cryptographic "magic code" at the beginning of a memory page would trigger the execution of arbitrary code embedded in that page? Such a thing could be triggered over the network, wireless through bluetooth/wifi, or by specially crafted images on a webpage, or whatever creative technique you can think of. It'd effectively give the govt instant root access to any device with the affected CPUs.
      - stcredzero 16y ago
        Stuff like this would be easy to hide in the guise of "Hardware DRM."
        wladimir 16y ago
        Yes, I guess on-processor DRM and any kind of virtualisation (will the real hypervisor please stand up?) are prime suspects for this kind of thing. But they are also the most obvious, it could be cramped into everything. It'd be mighty interesting to tear apart / scan / reverse engineer some modern CPUs like they did with the 6502. Then again, these beasts are so complex that's similar to looking for a needle in a galaxy-sized haystack.