16 ms·

The funny thing is that this is effectively a keylogger that does not run any code on the CPU while it is running. I already knew it, but this just reinforced

The funny thing is that this is effectively a keylogger that does not run any code on the CPU while it is running. I already knew it, but this just reinforced how terribly vulnerable pretty much every computer system is. Makes me think ransomware/hacks are going to get a lot worse, and I can’t see how the situation can be improved, at least for quite some time.

matheusmoreira 5y ago
Just make companies liable for any damage caused by their crappy products. Make them pay billions in damages every time somebody gets hacked because of their negligence. Then they'll start caring about the quality of their software instead of treating it as a cost center.
- smcameron 5y ago
  Open source stuff would disappear.
  - sonograph 5y ago
    I disagree. FOSS and commercially licensed (and sold) software with EULAs are two very different things, and can be distinguished in whatever legal language implements these theoretical liabilities
  - swiley 5y ago
    Open source is the only stuff that doesn't reliably leave gaping wholes laying around for years because anyone can pay to have them fixed.
    - kaba0 5y ago
      That’s simply false. I really love open-source but to even imply that it is not a ticking bomb of security is just naive.
  - Karunamon 5y ago
    Open source stuff is typically distributed with a massive all-caps warranty disclaimer. If it breaks, you get to keep both pieces.
  - matheusmoreira 5y ago
    Why? There's a world of difference between a rich corporation marketing and selling products to consumers and developers publishing some code on the web. It is obvious to me that society expects a lot more from the former.
- johncolanduoni 5y ago
  This isn’t a “crappy product”, unless you consider every product that allows users to provide their own firmware crappy.
- zionic 5y ago
  Imagine having your cryptocurrency wallet’s private key exfiltrated in this way. Hell, it wouldn’t surprise me if a few less than ethical NSA hackers are doing exactly that in their spare time.
  - Osiris 5y ago
    You should never type your seed phase on any computer. Hardware wallets will give you a randomized keymap for you to recover a seed phrase without using any of the real letters.
  - justshowpost 5y ago
    I read what NSA team was installing free internal modules to Cisco routers in their paid time.
- mschuster91 5y ago
  > Make them pay billions in damages every time somebody gets hacked because of their negligence. The downside is companies will lock down their hardware even more out of fear of getting sued. It's utterly amazing this person managed to get custom firmware executing on the WiFi chip... stuff like Intel's or AMD's microcode is digitally signed (and iirc, also encrypted) instead of using a plain old XOR checksum, and I'd argue the world is off a lot less safe as a result.
  - Teever 5y ago
    This natural desire to cut corners by locking down devices will be mitigated by right to repair laws. With that said, it always irks me when someone suggests regulation as a solution to misconduct by large corporations and someone chimes in "But they'll just misbehave in some other way." If the entity that is misbehaving has changed the way that they're misbehaving in response to your regulation that means that your regulations worked and that you merely need to continue regulating the offender.
    - SilverRed 5y ago
      Right to repair will not allow us to flash custom firmware on wifi cards. At best it will allow us to buy a new wifi card for when the old one breaks.
  - matheusmoreira 5y ago
    Just make it illegal to lock down hardware as well. Now they can't cut corners anymore and will have to actually develop good software. Just keep making their "clever" workarounds illegal every single time until the desired outcome is achieved. They should have literally no choice other than to make a good product.
    - mschuster91 5y ago
      > Just make it illegal to lock down hardware as well. Now they can't cut corners anymore and will have to actually develop good software. Sadly that one won't ever happen, the copyright mafia will do everything they can to prevent that. Just look at how Netflix is locking down people on rooted devices.
- joe_the_user 5y ago
  The implication that software providers should be liable seems to reappear eternally here and remains misguided. Even when we're essentially discussing hardware here. Software is the perhaps that area where "good" or "crappy" is most undetermined. A given piece of software can be bullet-proof today and a catastrophic hole can appear tomorrow. And even if the producer releases an update, there's no guarantee it will be picked-up. Overall situation is that what's needed is standards of software use for those companies which actually do damage. Without standards, your use of "crappy" is meaningless.
  - gnopgnip 5y ago
    This is how malpractice qorks in every other injury. It isn't just about damage being caused by the software, but if there was a violation of the reasonble standard of care
    - Quekid5 5y ago
      Exactly. Us engineering types tend to underestimate how much intent and judgment matters when it comes to matters of malpractice (and similar) laws.
  - matheusmoreira 5y ago
    > A given piece of software can be bullet-proof today and a catastrophic hole can appear tomorrow. Sometimes you do everything you can and things still go wrong. That's okay. What happens in practice is totally different though. Gross negligence is endemic in the technology industry. Most companies out there simply don't give a shit. Their negligence is deliberate, calculated and pre-meditated. They know exactly how much damage they're causing and they don't care because caring costs money. > Without standards, your use of "crappy" is meaningless. It's not meaningless at all. For example, nearly every laptop manufacturer I've ever seen has delivered to me software that is unambiguously bad. This opinion is not controversial at all. You just need to fire up some manufacturer app to see just how incredibly bad they are. I've posted about that here many times and people explained to me that the software is garbage because hardware companies literally don't care about it. They see it as just additional costs to be eliminated and as a result we get products which are total crap. My laptop came with a driver that intercepts my keystrokes and sends signals to the keyboard so that it can light up the LEDs under the keys I pressed. What caused an insane design like this to even come into existence is beyond me, no doubt it came down to saving a few cents in manufacturing. I replaced this functionality with free software and I'm not sure if I even want to know whether there are any vulnerabilities in that driver.
1vuio0pswjnm7 5y ago
"... and I can't see how the situation can be improved, at least for quite some time." I can. But no one is going to listen to either of us, so what does it matter. Here is how I would start to improve the situation. Disconnect untrusted computers from the internet. In other words the only computer that is allowed to access the internet directly is a computer that has all the properties desired for adequate security. Those properties could be things like the hardware being repairable, having an open BIOS and the bootloader and OS being open source and able to be compiled from source by the user easily. Call this computer a "gateway" if you like, or call it a "firewall", or call it whatever you want to call it. The esential point is that it is the one computer you believe you can best understand and control. I would be willing to bet any amount of money that just disconnecting all Windows computers from the internet, i.e., no direct connection, would result in a dramatic drop in security problems. Keyloggers are not very useful on a mass scale if they cannot transfer the keystrokes over the internet. There was a time when not all computers had unfettered direct access to the internet. They worked just fine. Maybe even better than ones today that are incessantly trying to connect to some server.
- est31 5y ago
  Most popular Linux distros are in many ways more vulnerable than Windows. Microsoft employs actual security engineers for Windows. To give one example, X11 is still in wide use. The secure Linux distros are all of the locked down kind, like Chrome OS and Android. The reason why we aren't seeing widespread desktop Linux malware campaigns is because almost nobody uses desktop Linux. The year of the Linux desktop, whenever it will be, will be followed by the year of the Linux desktop malware. I love open source and free software, but it's not inherently more secure.
  - iratewizard 5y ago
    Linux is still under 2% of the market share for anyone wondering.
    - GekkePrutser 5y ago
      Market share for desktops of course ;)
userbinator 5y ago
For some reason, I can't interpret your comment in any other way than security-paranoia FUD that's advocating for completely-locked-down user-hostile computers (or maybe I should say "devices"...) under the total control of Big Tech, because that's the narrative they've been using more and more to justify it.
- jcims 5y ago
  Some folks are going to be more personally exposed to the current state of things than others.
- gricardo99 5y ago
  That's rather cynical, but to clarify, my comment is rooted in the understanding (illustrated by OP in some excellent examples) that all of our digital infrastructure, from browsers down to silicon, are born from tight engineering schedules, "ship it" mentality, a focus on "ROI", and not necessarily security. Even if there were more focus on security, OPs article is fantastic at showing a sliver of this complexity, and the daunting task it is to understand the inter-relationship and consequences of many individual design choices, across a litany of components and libraries, over many decades and teams. As a first step, I'd like to see some tough laws that hold companies liable for data leaks. Once it becomes a major liability to be the source of a data leak, most companies won't bother collecting PII, and will make it a point to ensure it's not stored on their systems. Nonetheless, systems will always have vulnerabilities and be exploited. This is at least worrisome from many, if not terrifying, and that should not be automatically interpreted as "security-paranoia FUD".
dheera 5y ago
Bluetooth is a dumpster fire of vulnerabilities already. Where I live it's not too hard to wardrive around the block playing funny noises into random peoples' bluetooth speakers and headphones inside their homes. Don't use Bluetooth keyboards, period.
- marderfarker2 5y ago
  I think that’s a feature, not a vulnerability:
ploxiln 5y ago
Someone would have to load this firmware onto your devices, either with local physical access or remote root access to your system. Are you suggesting it should be impossible for anyone to modify the firmware on their peripherals/NICs/etc, or else the world will end or similar? Is it only safe to allow us iPads?
- SV_BubbleTime 5y ago
  >Is it only safe to allow us iPads? Of course not. But, the meat of the discussion is that everyone agrees it IS safe to use iPads. So, is there a practical middle ground?
- gricardo99 5y ago
  I'm pointing out my conclusion: nothing is safe... yikes! And no, I'm not worried that because of this article anyone can keylog my stuff. It's the realization from OPs summary that there are many attack vectors, and vulnerabilities hiding in and between layers and components. iPads are no different in that respect. Seriously, how do we get passed the current state of zero-days and major vulnerabilities cropping up on the reg? Some ideas from other commenters here aren't entirely convincing to me: require open source, require software standards (both of which would need to apply to hardware/silicon as well). I'm honestly looking for some thoughts on how to build a more secure digital future (Links to articles or studies are welcome).
  - ploxiln 5y ago
    Use less software. But really, I think some perspective is needed on what is "safe". Is riding in a car "safe"? Is eating food from the supermarket "safe"? Can you ABSOLUTELY GUARANTEE that it's IMPOSSIBLE to screw it up? How did my parents survive for 60 years under these UNSAFE conditions? I think electronic devices can be pretty damn safe, even without totally locked-down firmware and secure-boot. They can be flashed with low-level firmware at the hardware level (SPI or JTAG or similar), then boot trusted install media, wipe the mass storage and install fresh. Then, keep it minimal, keep it under control. Don't install and use 20k components/libraries which you are not familiar with and of which hundreds want to update every other day. At least, be familiar with all the processes and daemons running. Either you should know why they're there, or they should not be there. You don't need a firewall if no process is listening for connections (and if you need a firewall to block it, why are you running it ?!) Just run less junk.
fsflover 5y ago
> and I can’t see how the situation can be improved, at least for quite some time. It can be improved if we support companies selling computers with FLOSS firmware and disabling Intel ME.

matheusmoreira 5y ago

Just make companies liable for any damage caused by their crappy products. Make them pay billions in damages every time somebody gets hacked because of their negligence. Then they'll start caring about the quality of their software instead of treating it as a cost center.

smcameron 5y ago
Open source stuff would disappear.
- sonograph 5y ago
  I disagree. FOSS and commercially licensed (and sold) software with EULAs are two very different things, and can be distinguished in whatever legal language implements these theoretical liabilities
- swiley 5y ago
  Open source is the only stuff that doesn't reliably leave gaping wholes laying around for years because anyone can pay to have them fixed.
  - kaba0 5y ago
    That’s simply false. I really love open-source but to even imply that it is not a ticking bomb of security is just naive.
- Karunamon 5y ago
  Open source stuff is typically distributed with a massive all-caps warranty disclaimer. If it breaks, you get to keep both pieces.
- matheusmoreira 5y ago
  Why? There's a world of difference between a rich corporation marketing and selling products to consumers and developers publishing some code on the web. It is obvious to me that society expects a lot more from the former.
johncolanduoni 5y ago
This isn’t a “crappy product”, unless you consider every product that allows users to provide their own firmware crappy.
zionic 5y ago
Imagine having your cryptocurrency wallet’s private key exfiltrated in this way. Hell, it wouldn’t surprise me if a few less than ethical NSA hackers are doing exactly that in their spare time.
- Osiris 5y ago
  You should never type your seed phase on any computer. Hardware wallets will give you a randomized keymap for you to recover a seed phrase without using any of the real letters.
- justshowpost 5y ago
  I read what NSA team was installing free internal modules to Cisco routers in their paid time.
mschuster91 5y ago
> Make them pay billions in damages every time somebody gets hacked because of their negligence. The downside is companies will lock down their hardware even more out of fear of getting sued. It's utterly amazing this person managed to get custom firmware executing on the WiFi chip... stuff like Intel's or AMD's microcode is digitally signed (and iirc, also encrypted) instead of using a plain old XOR checksum, and I'd argue the world is off a lot less safe as a result.
- Teever 5y ago
  This natural desire to cut corners by locking down devices will be mitigated by right to repair laws. With that said, it always irks me when someone suggests regulation as a solution to misconduct by large corporations and someone chimes in "But they'll just misbehave in some other way." If the entity that is misbehaving has changed the way that they're misbehaving in response to your regulation that means that your regulations worked and that you merely need to continue regulating the offender.
  - SilverRed 5y ago
    Right to repair will not allow us to flash custom firmware on wifi cards. At best it will allow us to buy a new wifi card for when the old one breaks.
- matheusmoreira 5y ago
  Just make it illegal to lock down hardware as well. Now they can't cut corners anymore and will have to actually develop good software. Just keep making their "clever" workarounds illegal every single time until the desired outcome is achieved. They should have literally no choice other than to make a good product.
  - mschuster91 5y ago
    > Just make it illegal to lock down hardware as well. Now they can't cut corners anymore and will have to actually develop good software. Sadly that one won't ever happen, the copyright mafia will do everything they can to prevent that. Just look at how Netflix is locking down people on rooted devices.
joe_the_user 5y ago
The implication that software providers should be liable seems to reappear eternally here and remains misguided. Even when we're essentially discussing hardware here. Software is the perhaps that area where "good" or "crappy" is most undetermined. A given piece of software can be bullet-proof today and a catastrophic hole can appear tomorrow. And even if the producer releases an update, there's no guarantee it will be picked-up. Overall situation is that what's needed is standards of software use for those companies which actually do damage. Without standards, your use of "crappy" is meaningless.
- gnopgnip 5y ago
  This is how malpractice qorks in every other injury. It isn't just about damage being caused by the software, but if there was a violation of the reasonble standard of care
  - Quekid5 5y ago
    Exactly. Us engineering types tend to underestimate how much intent and judgment matters when it comes to matters of malpractice (and similar) laws.
- matheusmoreira 5y ago
  > A given piece of software can be bullet-proof today and a catastrophic hole can appear tomorrow. Sometimes you do everything you can and things still go wrong. That's okay. What happens in practice is totally different though. Gross negligence is endemic in the technology industry. Most companies out there simply don't give a shit. Their negligence is deliberate, calculated and pre-meditated. They know exactly how much damage they're causing and they don't care because caring costs money. > Without standards, your use of "crappy" is meaningless. It's not meaningless at all. For example, nearly every laptop manufacturer I've ever seen has delivered to me software that is unambiguously bad. This opinion is not controversial at all. You just need to fire up some manufacturer app to see just how incredibly bad they are. I've posted about that here many times and people explained to me that the software is garbage because hardware companies literally don't care about it. They see it as just additional costs to be eliminated and as a result we get products which are total crap. My laptop came with a driver that intercepts my keystrokes and sends signals to the keyboard so that it can light up the LEDs under the keys I pressed. What caused an insane design like this to even come into existence is beyond me, no doubt it came down to saving a few cents in manufacturing. I replaced this functionality with free software and I'm not sure if I even want to know whether there are any vulnerabilities in that driver.

1vuio0pswjnm7 5y ago

"... and I can't see how the situation can be improved, at least for quite some time." I can. But no one is going to listen to either of us, so what does it matter. Here is how I would start to improve the situation. Disconnect untrusted computers from the internet. In other words the only computer that is allowed to access the internet directly is a computer that has all the properties desired for adequate security. Those properties could be things like the hardware being repairable, having an open BIOS and the bootloader and OS being open source and able to be compiled from source by the user easily. Call this computer a "gateway" if you like, or call it a "firewall", or call it whatever you want to call it. The esential point is that it is the one computer you believe you can best understand and control. I would be willing to bet any amount of money that just disconnecting all Windows computers from the internet, i.e., no direct connection, would result in a dramatic drop in security problems. Keyloggers are not very useful on a mass scale if they cannot transfer the keystrokes over the internet. There was a time when not all computers had unfettered direct access to the internet. They worked just fine. Maybe even better than ones today that are incessantly trying to connect to some server.

est31 5y ago
Most popular Linux distros are in many ways more vulnerable than Windows. Microsoft employs actual security engineers for Windows. To give one example, X11 is still in wide use. The secure Linux distros are all of the locked down kind, like Chrome OS and Android. The reason why we aren't seeing widespread desktop Linux malware campaigns is because almost nobody uses desktop Linux. The year of the Linux desktop, whenever it will be, will be followed by the year of the Linux desktop malware. I love open source and free software, but it's not inherently more secure.
- iratewizard 5y ago
  Linux is still under 2% of the market share for anyone wondering.
  - GekkePrutser 5y ago
    Market share for desktops of course ;)

userbinator 5y ago

For some reason, I can't interpret your comment in any other way than security-paranoia FUD that's advocating for completely-locked-down user-hostile computers (or maybe I should say "devices"...) under the total control of Big Tech, because that's the narrative they've been using more and more to justify it.

jcims 5y ago
Some folks are going to be more personally exposed to the current state of things than others.
gricardo99 5y ago
That's rather cynical, but to clarify, my comment is rooted in the understanding (illustrated by OP in some excellent examples) that all of our digital infrastructure, from browsers down to silicon, are born from tight engineering schedules, "ship it" mentality, a focus on "ROI", and not necessarily security. Even if there were more focus on security, OPs article is fantastic at showing a sliver of this complexity, and the daunting task it is to understand the inter-relationship and consequences of many individual design choices, across a litany of components and libraries, over many decades and teams. As a first step, I'd like to see some tough laws that hold companies liable for data leaks. Once it becomes a major liability to be the source of a data leak, most companies won't bother collecting PII, and will make it a point to ensure it's not stored on their systems. Nonetheless, systems will always have vulnerabilities and be exploited. This is at least worrisome from many, if not terrifying, and that should not be automatically interpreted as "security-paranoia FUD".

dheera 5y ago

Bluetooth is a dumpster fire of vulnerabilities already. Where I live it's not too hard to wardrive around the block playing funny noises into random peoples' bluetooth speakers and headphones inside their homes. Don't use Bluetooth keyboards, period.

marderfarker2 5y ago
I think that’s a feature, not a vulnerability:

ploxiln 5y ago

Someone would have to load this firmware onto your devices, either with local physical access or remote root access to your system. Are you suggesting it should be impossible for anyone to modify the firmware on their peripherals/NICs/etc, or else the world will end or similar? Is it only safe to allow us iPads?

SV_BubbleTime 5y ago
>Is it only safe to allow us iPads? Of course not. But, the meat of the discussion is that everyone agrees it IS safe to use iPads. So, is there a practical middle ground?
gricardo99 5y ago
I'm pointing out my conclusion: nothing is safe... yikes! And no, I'm not worried that because of this article anyone can keylog my stuff. It's the realization from OPs summary that there are many attack vectors, and vulnerabilities hiding in and between layers and components. iPads are no different in that respect. Seriously, how do we get passed the current state of zero-days and major vulnerabilities cropping up on the reg? Some ideas from other commenters here aren't entirely convincing to me: require open source, require software standards (both of which would need to apply to hardware/silicon as well). I'm honestly looking for some thoughts on how to build a more secure digital future (Links to articles or studies are welcome).
- ploxiln 5y ago
  Use less software. But really, I think some perspective is needed on what is "safe". Is riding in a car "safe"? Is eating food from the supermarket "safe"? Can you ABSOLUTELY GUARANTEE that it's IMPOSSIBLE to screw it up? How did my parents survive for 60 years under these UNSAFE conditions? I think electronic devices can be pretty damn safe, even without totally locked-down firmware and secure-boot. They can be flashed with low-level firmware at the hardware level (SPI or JTAG or similar), then boot trusted install media, wipe the mass storage and install fresh. Then, keep it minimal, keep it under control. Don't install and use 20k components/libraries which you are not familiar with and of which hundreds want to update every other day. At least, be familiar with all the processes and daemons running. Either you should know why they're there, or they should not be there. You don't need a firewall if no process is listening for connections (and if you need a firewall to block it, why are you running it ?!) Just run less junk.

fsflover 5y ago

> and I can’t see how the situation can be improved, at least for quite some time. It can be improved if we support companies selling computers with FLOSS firmware and disabling Intel ME.