5 ms·

Even Joe Average should be acknowledged that clean reinstallation after getting new hardware is a good practice. Ed: BTW, does somebody know how to audit your

by zebra 13y ago

Even Joe Average should be acknowledged that clean reinstallation after getting new hardware is a good practice. Ed: BTW, does somebody know how to audit your laptop in its current state?

vsviridov 13y ago
Well, with current practice you don't even get OS recovery CDs anymore. You probably get a "Recovery Partition" with preconfigured OS image. And OEM windows license might not allow you to install from elsewhere and re-use your license.
mgurlitz 13y ago
The linked article on Der Spiegel has a section on what they call "persistence:" The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO)... The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer's motherboard that is the first thing to load when a computer is turned on... This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this "Persistence" and believe this approach has provided them with the possibility of permanent access. http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns...
- zebra 13y ago
  My bad - I didn't read Der Spiegel article.
- sillysaurus2 13y ago
  This is probably one of the most important problems of our generation to solve (as hackers, not philanthropists) and it's sort of amazing that it's hardly known, let alone discussed. I've brought it up before and it seems like everyone's reaction is that it's not worth worrying about. But there are adversaries besides the NSA, such as malware. And since userspace programs can upgrade your BIOS, then therefore it's possible to write a viruses to infect your BIOS exactly as described here. If the BIOS security model is even slightly broken, then malware will find a way into it, and security is hard to do perfectly. Why are we trusting proprietary motherboard manufacturers not to have backdoors in their closed-source systems? The answer is probably because we have little choice in the matter. Thus we're giving up a basic right: for us to have faith in our security practices. If, say, Colin Percival's careful security habits can simply be circumvented by his motherboard, then none of us are safe. We need an open source motherboard for people who care about protecting themselves from this kind of thing. Or at least an open source BIOS. But it's an insidious problem, because once a BIOS is infected, it controls everything that may ever replace the BIOS. Therefore it's almost impossible to detect if your BIOS has been "man in the middle'd," and hence even an open source BIOS may not be enough. I don't have a good solution, but this is a terribly important problem to solve.
  - harshreality 13y ago
    Can the bios chips/eeproms be replaced on a running computer? Can you remove the bios chip, put it in a different (running) computer, use flashrom to read it, put it back, use flashrom to read it again, and compare the two? Either the virus doesn't hide itself (on calls to read from the bios nvram), and it will be visible on comparison with a pristine (if you have one) copy of the same bios, or it does hide itself and it will be visible on comparison to itself once put in a running machine that didn't boot from the contaminated code, right?
    - userbinator 13y ago
      Yes, this used to be how you flashed a BIOS for a bricked motherboard, when BIOS chips used to be socketed: boot the good board, pull the BIOS chip (while it's running), put the bad/blank one in the socket, and flash, then power everything off again and put the good one back.
obstacle1 13y ago
From the article: >The latest report, this time via Der Spiegel and based on internal NSA documents, reveals that the NSA, in conjunction with the CIA and FBI, has begun intercepting laptops purchased online in order to install (quite literal) spyware and even hardware ... Agents divert shipments to secret warehouses ... install the software and/or hardware ... So if they're installing hardware/firmware that is something a clean reinstallation won't fix. Probably should have titled the submission software/hardware.
padmanabhan01 13y ago
Seriously? Why on earth should Joe Average be made to clean reinstall OS after buying a new hardware?
- cleverjake 13y ago
  no one said 'be made'. He said the average joe should acknowledge that it is a good idea. Previously I have suggested other people reinstall to get rid of bloatware installed by the vendor.
  - padmanabhan01 13y ago
    //He said the average joe should acknowledge that it is a good idea I'd rather have average Joe ignore and boycott vendors that install bloatware and make the vendors realize that's a bad idea..

by zebra 13y ago

Even Joe Average should be acknowledged that clean reinstallation after getting new hardware is a good practice. Ed: BTW, does somebody know how to audit your laptop in its current state?

vsviridov 13y ago

Well, with current practice you don't even get OS recovery CDs anymore. You probably get a "Recovery Partition" with preconfigured OS image. And OEM windows license might not allow you to install from elsewhere and re-use your license.

mgurlitz 13y ago

The linked article on Der Spiegel has a section on what they call "persistence:" The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO)... The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer's motherboard that is the first thing to load when a computer is turned on... This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this "Persistence" and believe this approach has provided them with the possibility of permanent access. http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns...

zebra 13y ago
My bad - I didn't read Der Spiegel article.
sillysaurus2 13y ago
This is probably one of the most important problems of our generation to solve (as hackers, not philanthropists) and it's sort of amazing that it's hardly known, let alone discussed. I've brought it up before and it seems like everyone's reaction is that it's not worth worrying about. But there are adversaries besides the NSA, such as malware. And since userspace programs can upgrade your BIOS, then therefore it's possible to write a viruses to infect your BIOS exactly as described here. If the BIOS security model is even slightly broken, then malware will find a way into it, and security is hard to do perfectly. Why are we trusting proprietary motherboard manufacturers not to have backdoors in their closed-source systems? The answer is probably because we have little choice in the matter. Thus we're giving up a basic right: for us to have faith in our security practices. If, say, Colin Percival's careful security habits can simply be circumvented by his motherboard, then none of us are safe. We need an open source motherboard for people who care about protecting themselves from this kind of thing. Or at least an open source BIOS. But it's an insidious problem, because once a BIOS is infected, it controls everything that may ever replace the BIOS. Therefore it's almost impossible to detect if your BIOS has been "man in the middle'd," and hence even an open source BIOS may not be enough. I don't have a good solution, but this is a terribly important problem to solve.
- harshreality 13y ago
  Can the bios chips/eeproms be replaced on a running computer? Can you remove the bios chip, put it in a different (running) computer, use flashrom to read it, put it back, use flashrom to read it again, and compare the two? Either the virus doesn't hide itself (on calls to read from the bios nvram), and it will be visible on comparison with a pristine (if you have one) copy of the same bios, or it does hide itself and it will be visible on comparison to itself once put in a running machine that didn't boot from the contaminated code, right?
  - userbinator 13y ago
    Yes, this used to be how you flashed a BIOS for a bricked motherboard, when BIOS chips used to be socketed: boot the good board, pull the BIOS chip (while it's running), put the bad/blank one in the socket, and flash, then power everything off again and put the good one back.

obstacle1 13y ago

From the article: >The latest report, this time via Der Spiegel and based on internal NSA documents, reveals that the NSA, in conjunction with the CIA and FBI, has begun intercepting laptops purchased online in order to install (quite literal) spyware and even hardware ... Agents divert shipments to secret warehouses ... install the software and/or hardware ... So if they're installing hardware/firmware that is something a clean reinstallation won't fix. Probably should have titled the submission software/hardware.

padmanabhan01 13y ago

Seriously? Why on earth should Joe Average be made to clean reinstall OS after buying a new hardware?

cleverjake 13y ago
no one said 'be made'. He said the average joe should acknowledge that it is a good idea. Previously I have suggested other people reinstall to get rid of bloatware installed by the vendor.
- padmanabhan01 13y ago
  //He said the average joe should acknowledge that it is a good idea I'd rather have average Joe ignore and boycott vendors that install bloatware and make the vendors realize that's a bad idea..