3 ms·

The problem is the NSA has shown itself to be indiscriminate in its targeting for other methods of info gathering. So trusting them to 'use responsibly' is a bi

The problem is the NSA has shown itself to be indiscriminate in its targeting for other methods of info gathering. So trusting them to 'use responsibly' is a bit like trusting a bunch of teenagers to 'use responsibly' with a case of beer and the parents away.

rdl 13y ago
This operation as described leaves enough of a physical record that it couldn't be used universally. I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. It's a lot easier to do this at design/manufacture than en-route.
- obstacle1 13y ago
  >I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. No reason the 'upgrades' couldn't be firm/hardware. Just upthread a bunch of people complain about "customs" delays when ordering computers, one person for > 30 days. That is way, way more than enough time. Yes, easier at manufacture. No, not necessary at manufacture. Yes, possible en-route. Also why would you be more concerned about China doing the same? edit: and also the problem wouldn't be using the technique 'universally', as in doing it to every machine. The problem would be giving an org like the NSA full control over deciding who to target, incl. US citizens. That is, being indiscriminate in terms of completely disregarding domestic laws, protections, etc., rather than being indiscriminate in terms of spamming loaded chips in every box.
  - rdl 13y ago
    You might like to know that I'm giving a talk at 30c3 in about 4.5h which will specifically address this threat (using remote-verifiable seals). http://events.ccc.de/congress/2013/Fahrplan/events/5600.html http://events.ccc.de/congress/2013/Fahrplan/events/5600.html
- sneak 13y ago
  The article doesn't specify if the backdoors installed en route are hardware or firmware/software.
  - rdl 13y ago
    Doesn't matter. It still requires someone being paid <$100k/yr to pull a package off the line and deal with it. If this happened in substantially greater volume than already happens for drug/child porn/money laundering cases, it would be at risk of exposure.

rdl 13y ago

This operation as described leaves enough of a physical record that it couldn't be used universally. I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. It's a lot easier to do this at design/manufacture than en-route.

obstacle1 13y ago
>I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. No reason the 'upgrades' couldn't be firm/hardware. Just upthread a bunch of people complain about "customs" delays when ordering computers, one person for > 30 days. That is way, way more than enough time. Yes, easier at manufacture. No, not necessary at manufacture. Yes, possible en-route. Also why would you be more concerned about China doing the same? edit: and also the problem wouldn't be using the technique 'universally', as in doing it to every machine. The problem would be giving an org like the NSA full control over deciding who to target, incl. US citizens. That is, being indiscriminate in terms of completely disregarding domestic laws, protections, etc., rather than being indiscriminate in terms of spamming loaded chips in every box.
- rdl 13y ago
  You might like to know that I'm giving a talk at 30c3 in about 4.5h which will specifically address this threat (using remote-verifiable seals). http://events.ccc.de/congress/2013/Fahrplan/events/5600.html http://events.ccc.de/congress/2013/Fahrplan/events/5600.html
sneak 13y ago
The article doesn't specify if the backdoors installed en route are hardware or firmware/software.
- rdl 13y ago
  Doesn't matter. It still requires someone being paid <$100k/yr to pull a package off the line and deal with it. If this happened in substantially greater volume than already happens for drug/child porn/money laundering cases, it would be at risk of exposure.