3 ms·
Wouldn't it be easiest to just backdoor all clients, everywhere? And ideally you'd even do some basic threat analysis at the device to save you some compute re
by javajosh 6y ago
Wouldn't it be easiest to just backdoor all clients, everywhere? And ideally you'd even do some basic threat analysis at the device to save you some compute resources.
- cheez 6y agoThat's what they did
- rurban 6y agoOn the hardware level in the most popular chips (Intel, AMD, Arm, Qualcomm baseband), and in various closed source OS. Of the good HW I don't see it in Power or Risc V yet.
- rvnx 6y agoYou mean "Popular software XX" auto-updating ? It's likely already operational ;) Silent updates are extremely dangerous. This is why you can see some Israelis, for example, refusing over-the-air updates on their phone while traveling.
- 6AA4FD 6y agoYou mean random Israeli citizens refuse OTA updates while abroad anywhere? Can you elaborate, I feel like I'm missing something important.
- lostcolony 6y agoCan't speak to the post, but, 'random Israeli citizens' likely are also "ex-military Israeli citizens" given the mandatory 2 year term for most of those who grow up there. So any OTA update concerns the military has are likely common social practice as well.
- 6AA4FD 6y agoI had forgotten about that. Thank you for the insight.
- AlexCoventry 6y agoDoes that mean the crypto used to authenticate the updates is compromised, or that the providers (app stores?) are? In either case, why is it safer in Israel?
- ip26 6y agoPerhaps a MITM attack by a foreign power.
- 6AA4FD 6y agoAny backdoor method I can think of has downsides that could be be compensated for by a cryptographic backdoor, but I'm sure they have invested a lot in backdoors and every level.
- Iolaum 6y agoHere's a technical description of such a backdoor found in the wild: https://medium.com/@topjohnwu/huaweis-undocumented-apis-a-backdoor-to-reinstall-google-services-c3a5dd71a7cd https://medium.com/@topjohnwu/huaweis-undocumented-apis-a-ba...
- pvg 6y agoHow would that be easier? It's a lot easier to passively observe communication than to actually change the communication infrastructure of parties you have no control over. That's more or less the premise on which the NSA is built.