5 ms·
Report: NSA intercepting laptops ordered online, installing spyware
- zebra 13y agoEven Joe Average should be acknowledged that clean reinstallation after getting new hardware is a good practice. Ed: BTW, does somebody know how to audit your laptop in its current state?
- vsviridov 13y agoWell, with current practice you don't even get OS recovery CDs anymore. You probably get a "Recovery Partition" with preconfigured OS image. And OEM windows license might not allow you to install from elsewhere and re-use your license.
- mgurlitz 13y agoThe linked article on Der Spiegel has a section on what they call "persistence:" The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO)... The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer's motherboard that is the first thing to load when a computer is turned on... This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this "Persistence" and believe this approach has provided them with the possibility of permanent access. http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns...
- zebra 13y agoMy bad - I didn't read Der Spiegel article.
- sillysaurus2 13y agoThis is probably one of the most important problems of our generation to solve (as hackers, not philanthropists) and it's sort of amazing that it's hardly known, let alone discussed. I've brought it up before and it seems like everyone's reaction is that it's not worth worrying about. But there are adversaries besides the NSA, such as malware. And since userspace programs can upgrade your BIOS, then therefore it's possible to write a viruses to infect your BIOS exactly as described here. If the BIOS security model is even slightly broken, then malware will find a way into it, and security is hard to do perfectly. Why are we trusting proprietary motherboard manufacturers not to have backdoors in their closed-source systems? The answer is probably because we have little choice in the matter. Thus we're giving up a basic right: for us to have faith in our security practices. If, say, Colin Percival's careful security habits can simply be circumvented by his motherboard, then none of us are safe. We need an open source motherboard for people who care about protecting themselves from this kind of thing. Or at least an open source BIOS. But it's an insidious problem, because once a BIOS is infected, it controls everything that may ever replace the BIOS. Therefore it's almost impossible to detect if your BIOS has been "man in the middle'd," and hence even an open source BIOS may not be enough. I don't have a good solution, but this is a terribly important problem to solve.
- harshreality 13y agoCan the bios chips/eeproms be replaced on a running computer? Can you remove the bios chip, put it in a different (running) computer, use flashrom to read it, put it back, use flashrom to read it again, and compare the two? Either the virus doesn't hide itself (on calls to read from the bios nvram), and it will be visible on comparison with a pristine (if you have one) copy of the same bios, or it does hide itself and it will be visible on comparison to itself once put in a running machine that didn't boot from the contaminated code, right?
- 13y ago
- obstacle1 13y agoFrom the article: >The latest report, this time via Der Spiegel and based on internal NSA documents, reveals that the NSA, in conjunction with the CIA and FBI, has begun intercepting laptops purchased online in order to install (quite literal) spyware and even hardware ... Agents divert shipments to secret warehouses ... install the software and/or hardware ... So if they're installing hardware/firmware that is something a clean reinstallation won't fix. Probably should have titled the submission software/hardware.
- padmanabhan01 13y agoSeriously? Why on earth should Joe Average be made to clean reinstall OS after buying a new hardware?
- cleverjake 13y agono one said 'be made'. He said the average joe should acknowledge that it is a good idea. Previously I have suggested other people reinstall to get rid of bloatware installed by the vendor.
- padmanabhan01 13y ago//He said the average joe should acknowledge that it is a good idea I'd rather have average Joe ignore and boycott vendors that install bloatware and make the vendors realize that's a bad idea..
- ihsw 13y agoMaybe it would've been better for this news to have been broken a month or two ago, for maximum financial impact. In all seriousness, one has to wonder how shipments get diverted, and how easily this process can be taken advantage of. Surely the companies handling these "special" shipments are made aware of details on a need-to-know basis (eg: super-secret gov. employee is going to be taking the shipment for an hour, don't ask why and don't tell anyone), but are they able to verify that their handlers are who they say they are? Would you trust a shipping company based in China? Why would you trust an American one any more than a Chinese one?
- rdl 13y agoThis capability already exists for counter drug and other interceptions. I'm sure it was FBI asking ups and fedex to hold a suspected drug shipment and let them look at it briefly; it is entirely possible no one at the shipper, and certainly not on the line, knew it was NSA. They might have said terrorism, too, but probably not. Maybe just "a law enforcement matter" with no questions asked.
- throwaway_yy2Di 13y agoOh so that's why my Lenovo was held for "customs". Hope they at least removed the Chinese backdoors while they were installing the American ones. Look at me, I'm so clever using HTTPS and GnuPG and FOSS linux when my hardware RNG is key escrowed, my USB cable is transmitting, my factory BIOS has at least two nationalities of spyware, and Big Brother is watching me naked in 720p. So glad I'm not a journalist and have an adequate physique.
- teamgb 13y agoLol. There's definitely a business opportunity out there for someone to come up with DIY laptops, much like the way you can purchase parts from anybody to create your own desktop PC.
- blazespin 13y agoYeah, the customs point is very interesting and worthy of upvote. I suspect they'd need a warrant to do this on an American (one would hope) but I highly doubt they'd need one to do this on anyone who ordered it from across the border. Canadians (and Americans who talk to Canadians) in particular are probably highly vulnerable to this spying. Emailing Americans, calling Americans, ordering laptops from the US, etc. The NSA is probably free to tap/interdict all of those interactions without any kind of pre-approval or probable cause. Bottom line: the NSA has done irreparable harm to global trust in dealing with the US(and, sadly, the US dealing with those outside their borders), be it communications or buying their products.
- redthrowaway 13y agoDoesn't this seem a little moustache-twirly, even for the NSA? I imagine the only way they'd actually expend the necessary man-hours on this is if they were intercepting hardware ordered by people who were already targets of interest. Now, that probably means Merkel should buy her laptops in-store, with cash, but this really doesn't seem like the sort of panopticon story we've been reading elsewhere. Unless, of course, they've managed to convince a judge to give them a warrant to compromise the Dell/etc factory image.
- geuis 13y agoMy suspension of disbelief is getting really close to breaking. Don't get me wrong, I'm fully against the entire NSA spying deal. But these "reports" just keep getting more and more outrageous. The problem is not that I don't think these things have been happening, but rather that the continuous slow leaking by news media is causing the next big reveal to be just more background noise. We need a big, sudden, destructive reveal that causes a lot of impact. Not the slow drizzle of 'this week in civil liberties violations'. Probably too late for this, sadly.
- kapitalx 13y agoIMHO the only reason the NSA leaks have been so effective in shaping public opinion is that it's a 'slow drizzle'. Otherwise they would have ended up like other wikileak mass dumps which are too overwhelming to absorb and are quickly forgotten.
- Houshalter 13y agoIt seems kind of silly that something has to literally be "new news" in order to be worth broadcasting or discussing, even if it hasn't before.
- deleted 13y ago[deleted]
- rdl 13y agoI don't think this operation is very unreasonable if highly targeted. If they did this to computers bought by Iran's nuclear program, or known watched mid level jihadis , the only problem I'd have would be I don't have enough money to buy an open bar for everyone involved. No one is arguing this was pervasive. The dangerous area IMO would be domestic law enforcement or political use (well , not so gray), and attacking innocent third parties with this to gain access to systems to attack actual bad guys. ( eg Belgacom)
- obstacle1 13y agoThe problem is the NSA has shown itself to be indiscriminate in its targeting for other methods of info gathering. So trusting them to 'use responsibly' is a bit like trusting a bunch of teenagers to 'use responsibly' with a case of beer and the parents away.
- linuxhansl 13y agoInteresting my Lenovo order just delayed by over 30 days. Not that I won't wipe it and put Linux on it anyway, but if the hardware or BIOS was tempered with I'd be none the wiser. (Not that I'd be worth effort, but anyway)
- leeoniya 13y agosame with my order (finally being delivered tomorrow), though i'm highly doubtful that they do this for all computers. prolly only ones for already-monitored targets. doing it for everyone is highly impractical and expensive.
- Yver 13y agoAnd suddenly, people like Richman Stallman seem much less crazy when they ask for free (as in libre) hardware, free BIOS, free everything.
- kevingadd 13y agoIs 'free as in libre' hardware really any protection if the NSA intercepted your device at the border and planted undetectable MITM malware/hardware? Are you really gonna take the whole thing apart and check every chip for modifications?
- fragsworth 13y agoNo. And Stallman (unfortunately) doesn't seem to focus too much on the security aspect of it. His focus is mostly on the freedom, as in ability to copy/modify/do-as-you-please aspect of it.
- nitrogen 13y agoThe "free as in libre" part would make it much more difficult to create an undetectable MITM. You might have a much greater diversity of hardware, so they'd have to find and maintain more exploits. The full software/firmware stack would be verifiable by cryptographic signature. The hardware itself could be checked by looking for chips that don't match other units from the same lot, either visually or behaviorally, and even x-raying the components if necessary.
- whyenot 13y agoAfter sitting through an embarrassingly awkward 2 1/2 hr talk by Richard Stallman at SJSU last month, I think he actually is a little... off. But that doesn't mean you shouldn't take his message to heart.
- bdamm 13y agoYou know, I'd actually be less outraged if the NSA's backdoors weren't so damn buggy.
- aegiso 13y ago
- notastartup 13y agoI am so raging at news regarding NSA's rogue behavior. Why isn't anything being done about this serious breach of privacy, the freedom to be you, the pillars of democracy? It's like NSA is saying "Look at me fuckers we are above the law and you are just going to have to take it up the ass". Seriously? This is depressing, knowing that some asshole at the top is ordering all of these things and telling us to close your eyes and say nothing while the ass fucking goes on. At least buy everyone dinner before you've decided to fuck them.
- ketralnis 13y ago> Why isn't anything being done Because you're not doing it. Nor him, nor her, nor I. Because somebody has to actually do it, not just muse that somebody else should do it.
- Houshalter 13y agoWell what can we do except vote? Maybe right a few angry letters? There isn't really anything that I know I can do to help.
- ketralnis 13y agoI don't pretend to know either. Could it be changed by voting? This has presumably spanned more than one party's rule in any individual chamber and in practise, the party is the only choice. Do letters work? I'm in Feinstein's district and she makes it pretty clear that she likes things the way they are. Protest? Does that actually do anything? It's essentially asking someone to voluntarily cede power because "pretty please". Has anything actually been changed by a march in the last decade? I'm not actually sure I'd like a world where a mob's protest is a successful way to change things. Revolt? I don't hate everything the US Government does and I do hate a higher percentage of what some other governments do, so I'd hate to replace this one with worse. We're already pretty far to the right of most other comparable nations. The last thing we need is a constitution written after privacy has been essentially written off. I also value my personal safety, selfish as that sounds. So I wish I knew too. Wishing on the internet that somebody would do "something" about it sure isn't working, but I don't know what would.
- whyenot 13y agoThis is starting to get really bad. Why aren't there demonstrations in the streets? I tried to sound out my relatives over the holidays to see what they think about Snowden/NSA and nobody seems to care.
- devanti 13y agoBecause the average person is short sited. They don't do anything (or don't realize how terrible it is) until it directly affects them.
- notastartup 13y agoI actually had coworkers saying they didn't care and that it's necessary to keep terrorists away.... I realized how Hitler was able to rise to power so quickly, people just accept complete trust in authority, the all loving, the all caring and nurturing. Just like herding cows telling each other everything's alright, we are still comfortable, enough grass to keep us going, owners seem nice. Refusing to believe they will all be slaughtered one day.
- bkoa 13y agoDoes anybody have the links to these internal documents on which this allegation is based?
- fragsworth 13y agoThis is just fucking outrageous. Is there no line they wouldn't cross? Our only option, now, to protect ourselves, is a healthy amount of paranoia and knowledge of security. We should now live by the following rule: If it's possible that the government could do something to spy on you, then they have probably done it. Everything you type into a computer connected to the Internet, that you didn't build, must be assumed to be logged by the NSA.
- zby 13y agoFor reference - discussion of the source article from Der Spiegel: https://news.ycombinator.com/item?id=6979239 https://news.ycombinator.com/item?id=6979239
- salient 13y agoI thought the NSA wasn't "attacking domestic citizens"? They can't excuse this one away as an "error" anymore. NSA/Obama administration lied. Again. What a surprise. And boy are these NSA stories flagged into oblivion or what? NSA/FBI psy-ops or just good ol' HN folks "getting bored" with the NSA abuses?
- Istof 13y agoI just figured why my laptop is transmitting on cellphone frequencies.