32 ms·

We're lucky that we can still catch some of them now. The current status of closed CPUs running proprietary firmware talking with closed chipsets running propri

We're lucky that we can still catch some of them now. The current status of closed CPUs running proprietary firmware talking with closed chipsets running proprietary firmware blobs would make trivially easy to move the malware injection to the iron level for agencies funded by governments. Once they accomplish it, detecting their spyware using software, at any privilege level, will become impossible. I fear the scenario in which magic packets with a signature that turns off detection in network hardware (proprietary firmware) and interfaces (again, proprietary firmware) can directly instruct a system (proprietary firmware) unbeknownst to the user; it seems impossible today, however all it takes is having enough closed software and firmware so that a covert channel can be created from the CPU to the external world. Governments have enough funds and motivation to tell most network iron manufacturers to produce hardware according to some additional specifications.

f430 6y ago
not convinced. since its the CIA, I trust them they are doing it for a good cause.
- trampi 6y ago
  you forgot /s
  - f430 6y ago
    not needed. if this was FSB or PSB then...
2OEH8eoCRo0 6y ago
It's not impossible but it's complicated and the more complicated the harder to it is to keep secret. It's easier to just amass exploits for use when needed.
- DyslexicAtheist 6y ago
  right, that's why there is no need for all the elaborate schemes proposed by the shameful Bloomberg "Big Hack" conspiracy. Doing so would be a) stupid and b) cost a bomb. for plausible deniability and to be able to reuse the same attack vector over and over, it's cheaper to just intercept shipments and install/modify what they need: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... impossible to reproduce unless you have the exact same equipment.
kossTKR 6y ago
Why is this impossible today? Isn't this exactly what Intel's "Management Engine" and AMD's "Platform Security" is? Bonus question, does apples new MX chips have an equivalent backdoor?
- not_really 6y ago
  Curious, about your last question, seems like no one knows.
- tolbish 6y ago
  https://www.quora.com/Does-Apples-processor-or-any-other-hardware-have-backdoor-as-like-Intel-and-AMD-has https://www.quora.com/Does-Apples-processor-or-any-other-har...
- tgragnato 6y ago
  The equivalent of ME and PS in Apple’s ARM processors is the “Secure Enclave Processor”. https://www.theiphonewiki.com/wiki/Secure_Enclave_Processor https://www.theiphonewiki.com/wiki/Secure_Enclave_Processor
qlk1123 6y ago
If this is the case, then you only need to set a packet monitor between the computer and the ISP router to observe such magic packet. Or will you claim that all machines that are capable of such tasks are already compromised?
- squarefoot 6y ago
  Sorry for being a bit late for the reply, however just suppose that enough resources are used to "convince" hardware manufacturers to add a small code change to their firmware such as "if a packet contains this exact magic word, don't count it and pass it on along with the payload, and possibly send a copy to this other address, again without counting it" where "counting" means also not signaling it is going through the hardware: no management interface would see it, and LEDs on network hardware panels wouldnt even blink. In other words, to actually see that packet one would have to be on the other side. Admittedly it's absurdly complicated to do that at global level, but let's say someone in the right place manages to do that, the next level would be doing the same at iron level on computers, so that each subsystem can talk with others and the external world without administration tools noticing, because it's all done through a covert channel set up by closed software. That would be the perfect weapon to build pervasive surveillance that no security software at any privilege level, not even debuggers, would detect. The only way to find something fishy is going on would be to sniff inter-chip communications locally and set digital analyzers on network cables with appropriate software. Network analyzers could fail if they use the same network chipsets, as would do a normal packet monitor.

f430 6y ago

not convinced. since its the CIA, I trust them they are doing it for a good cause.

trampi 6y ago
you forgot /s
- f430 6y ago
  not needed. if this was FSB or PSB then...

2OEH8eoCRo0 6y ago

It's not impossible but it's complicated and the more complicated the harder to it is to keep secret. It's easier to just amass exploits for use when needed.

DyslexicAtheist 6y ago
right, that's why there is no need for all the elaborate schemes proposed by the shameful Bloomberg "Big Hack" conspiracy. Doing so would be a) stupid and b) cost a bomb. for plausible deniability and to be able to reuse the same attack vector over and over, it's cheaper to just intercept shipments and install/modify what they need: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... impossible to reproduce unless you have the exact same equipment.

kossTKR 6y ago

Why is this impossible today? Isn't this exactly what Intel's "Management Engine" and AMD's "Platform Security" is? Bonus question, does apples new MX chips have an equivalent backdoor?

not_really 6y ago
Curious, about your last question, seems like no one knows.
tolbish 6y ago
https://www.quora.com/Does-Apples-processor-or-any-other-hardware-have-backdoor-as-like-Intel-and-AMD-has https://www.quora.com/Does-Apples-processor-or-any-other-har...
tgragnato 6y ago
The equivalent of ME and PS in Apple’s ARM processors is the “Secure Enclave Processor”. https://www.theiphonewiki.com/wiki/Secure_Enclave_Processor https://www.theiphonewiki.com/wiki/Secure_Enclave_Processor

qlk1123 6y ago

If this is the case, then you only need to set a packet monitor between the computer and the ISP router to observe such magic packet. Or will you claim that all machines that are capable of such tasks are already compromised?

squarefoot 6y ago
Sorry for being a bit late for the reply, however just suppose that enough resources are used to "convince" hardware manufacturers to add a small code change to their firmware such as "if a packet contains this exact magic word, don't count it and pass it on along with the payload, and possibly send a copy to this other address, again without counting it" where "counting" means also not signaling it is going through the hardware: no management interface would see it, and LEDs on network hardware panels wouldnt even blink. In other words, to actually see that packet one would have to be on the other side. Admittedly it's absurdly complicated to do that at global level, but let's say someone in the right place manages to do that, the next level would be doing the same at iron level on computers, so that each subsystem can talk with others and the external world without administration tools noticing, because it's all done through a covert channel set up by closed software. That would be the perfect weapon to build pervasive surveillance that no security software at any privilege level, not even debuggers, would detect. The only way to find something fishy is going on would be to sniff inter-chip communications locally and set digital analyzers on network cables with appropriate software. Network analyzers could fail if they use the same network chipsets, as would do a normal packet monitor.