5 ms·
To expand on this, you should assume that basically any significant device or microprocessor you buy comes pre-compromised by one or more intelligence agencies,
by FFP999 3y ago
To expand on this, you should assume that basically any significant device or microprocessor you buy comes pre-compromised by one or more intelligence agencies, by the simple expedient of them asking manufacturers to put them in. Devices from US companies will be compromised by Five Eyes agencies, those from Chinese firms will have Ministry of State Security backdoors, etc.
- musha68k 3y agoOpen source / homebrew hardware will be the only way out of this.
- FFP999 3y agoOn a technical level, sure. In the bigger picture, I'm concerned that that is simply too esoteric an interest for it to have any significant impact.
- amelius 3y agoAnd tinfoil.
- gduplessy 3y agoIs it even possible to homebrew a modern computer chip?
- FFP999 3y agoI wanna say I read about some high schooler recently making _a_ microprocessor in his garage, but I'm guessing it's a very simple one, not what we would consider a modern design. Also I could be thinking of something else entirely so, before repeating this, you'll probably want to google it.
- narinxas 3y agono. and even if it were then are people whose job is to make sure it never really takes off. why? because power. what do do about it? get power. how to do that? dunno. If I told you then my own purported (and protracted) attempts would diminish. at least we don't get assasinated to death anymore..... ahahahaha (just our characters, andor career prospects, etc)
- dylan604 3y agoby modern do you mean just the capabilities of or include the size of as a requirement? If you accept that a DIY processor can be the size of a room and not be portable, then maybe???? Expecting a DIY to be miniaturized, then hellz to the naw
- dividuum 3y agoPrecursor (https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor) is interesting with its use of an FPGA.
- gduplessy 3y agoThat is pretty interesting, thank you!
- amelius 3y agoNope, even an EUV light source would be close to impossible.
- BobaFloutist 3y agoWould it not be easier to find the backdoor and use it to patch itself? Basically rooting the phone but on a firmware level?
- swader999 3y agoAirplane mode does work. I can put an emf meter up to my Android phone and nothing comes out of it. Same with the device off. But is it still recording for later transmission? Perhaps!
- dylan604 3y agoIf you're willing to believe anything can be put in passive mode, you'll absolutely drive yourself mad. There's no way to proove that a device is not listening passively, so of course people will say it is.
- mrcode007 3y agoAnything with an integrated circuit can be proven to be not operating based on power consumption or switching noise of the transistors in the device.
- theamk 3y agoModern microphones need input clock to operate, and are physically incapable of listening when the clock is absent. This gives a trivial way to detect of the device is listening passively, at least on the workbench.
- dylan604 3y agoI don't even know what the "mic needs a clock" means. I've never used a microphone that needed a clock. Making a mic that needs a clock just seems like a "WTF were they thinking" kind of thing. Can you elaborate on this concept of requiring a clock for a mic?
- theamk 3y agoThe keyword to search for is "digital mems", and of course we are talking individual parts to place on PCB, not the consumer device. Here is one random example: [0]. Somewhat expensive at $1 ea, but that's what you pay for US manufacturer. This microphones take 2.4 MHz clock and return PDM (pulse density modulation) signal. Does not seem very convinient for old-school analog electronic circuits, but it's pretty trivial to interface with any micro with pulse counter hardware. And presumably the audio won't have any hum or interference from nearby radio transmitters, which is especially useful in cell phones. [0] https://www.digikey.com/en/products/detail/cui-devices/CMM-4030DB-26354-TR/9748836 https://www.digikey.com/en/products/detail/cui-devices/CMM-4...
- Wowfunhappy 3y agoThe thing people always say about mandated backdoors is that they make devices less secure for everyone. Ie, if the government can get in, so can other bad actors. If this is true (and I generally believe this is is), and if basebands do indeed have backdoors for the government, why hasn't anyone found them? Why haven't we seen CVEs on this? Can anyone point to a published baseband CVE that smells like a government plant, rather than a well-intentioned accident?
- dylan604 3y agoIf we believe governments can convince hardware makers to add backdoors, why do we not believe governments can convince CVEs from being removed or not allowed?
- Wowfunhappy 3y agoBecause a lot of security research is done by individuals or small firms, and the NSA doesn't generally review disclosures. I find it hard to believe this wouldn't leak, at least in the western world.
- dylan604 3y agoAnd? I don't know the CVE process, so I'm honestly asking while you're not actually answering. Who controls the release of CVEs? Sure, individuals can report something as a vuln, but does the report automatically create a CVE? Or do the reports get verified and then "promoted" to CVE? If the latter, then there's absolutely a part in the process that can be subverted
- wepple 3y agoCVEs have absolutely nothing to do with finding out whether our devices are backdoored. CVEs come out of Mitre, but lots of countries have equivalent systems or tracking codes. Further, large companies are pre-allocated blocks of CVEs to use. But it’s irrelevant. The original position was that if govt are putting obvious remote access into devices, why has nobody ever seen and blogged or tweeted about it?
- pieresqi 3y ago[dead]
- reactordev 3y agoThis. Unless you flashed it yourself from code you compiled and analyzed yourself, or have a verified signature/hash, assume that it’s pre-compromised and the “agencies” have access to it. For 99.999% of us, this doesn’t matter outside of civil liberties or whatnot. For the 0.001%, you’re their target audience. Smile for your camera. Ask Kaspersky.
- fsflover 3y ago> For 99.999% of us, this doesn’t matter outside of civil liberties Civil liberties matter to everyone at some point.
- reactordev 3y agoI said outside of. Of course civil liberties matter to all.