10 ms·
N.S.A. Devises Radio Pathway Into Computers
- staunch 13y agoThis sounds like a non-issue to me. Any person on this site could create little USB devices for stealing data. It's nothing special or new. I thought I was going to hear that they're light years beyond Tempest[1] or something. Feels good to finally hear an NSA story that doesn't depress me. 1. http://en.wikipedia.org/wiki/Tempest_(codename) http://en.wikipedia.org/wiki/Tempest_(codename)
- conductor 13y agoIt can be inserted by a manufacturer, as mentioned in the article. A little chip (inside the motherboard/CPU/hard disk/graphic card) with a radio module that can receive radio signals and write the received data directly into hard disk and/or RAM or read bytes from the hard disk and/or RAM and/or graphic card and transmit it back.
- unclebucknasty 13y agoInterestingly, this would also seem to have the potential to defeat encryption, since it directly accesses working memory. This is why I have always been cautious about those who advocate personal cryptography as a privacy solution. We need clear laws, first and foremost, to reign them in. Otherwise, we are effectively saying that if they can get it (i.e. decrypt it), it is fair game. Cat-and-mouse is not a game we want to play with the NSA.
- eru 13y agoLaws are not going to protect people from the NSA. Especially laws that only apply to a miniscule fraction of the population (ie the fraction of the population that lives in the USA). Spy agencies are a global menace.
- unclebucknasty 13y agoOf course laws will protect us. They are actually our only real hope. With the right laws, Snowden is a whistleblower with due protection. There is no debate as to whether he is a "traitor" or who broke the law, and the entire dynamic is changed here. Either we are a nation of laws or we are not. Laws are what constrain our government and what confer and protect all of our rights. Why should this be any different? Why should we suddenly abandon law here in favor of some (inevitably inadequate) technical scheme? It is naive to believe otherwise and it is more naive (catastrophic) to advocate a model wherein we do not rely on laws, but instead our personal capabilities to protect our rights from our own government. Advocating encryption over laws is just one example of that. Protecting ourselves from the government with tech is a tempting, freedom-figthting technologist's fantasy. We cannot even duly protect ourselves from zero-day exploits. Why on earth would we abandon the law and position ourselves to play cat-and-mouse with the U.S. government?
- ds9 13y agoBetter laws, and official respect for them, would be the better solution if we had that option. But how do we get there? Has such a scenario ever effectively protected citizens from government in the real world? And what are we supposed to do in the meantime? "We cannot even duly protect ourselves from zero-day exploits" - well that's definitional, isn't it? It's hardly a reason to give up on trying to protect communications from "big brother".
- unclebucknasty 13y ago>Has such a scenario ever effectively protected citizens from government in the real world? Of course it has, unless you believe that all of our rights in the U.S. are a sham, and are routinely violated in private by our government. No, it's not perfect and it never will be as long as humans are involved. But, there have to be definitions of right and wrong with associated penalties--in other words, laws. >well that's definitional, isn't it? That's my point. These things still exist. The fact that we continue to battle one-off hackers, groups, etc. and frequently lose should give us pause to consider whether this is really the cat-and-mouse posture we want to assume with the U.S. government. >It's hardly a reason to give up on trying to protect communications from "big brother". I don't have anything against taking prudent measures to protect our privacy in general. But, this idea that technical solutions will ultimately protect us from "big brother" is pure folly. Without the law on our side, we will lose.
- lancewiggs 13y agoI imagine the widgets transmit and receive over multiple spectrums, bouncing the spectrum around as they do. I wonder if technology now can tweak and coordinate the multiple existing radios (Wifi, bluetooth, GSM/CDMA/3G/4G etc) on phones and computers to deliver the same result. Is that possible? Would that require changes in silicon or could it be done with baseband software changes or even above that? I have no idea frankly.
- pirateking 13y agoThat's really interesting - radio spectrum steganography. I would think that compromise of the software network stack would be enough for such an attack.
- nitrogen 13y agoI imagine the widgets transmit and receive over multiple spectrums I seem to recall a strong opposition by the government to the development of consumer ultra-wideband radios. I wonder if this was part of the reason. Either way, it looks like some applications of UWB are available now, though, such as wireless HDMI.
- deleted 13y ago[deleted]
- venomsnake 13y agoAny party that will make good airgap will make sure they are faradey caged too.
- supersystem 13y agoWell, prepare to get depressed I guess... (TOP SECRET etc.) http://upload.wikimedia.org/wikipedia/commons/8/85/NSA_COTTONMOUTH-I.jpg http://upload.wikimedia.org/wikipedia/commons/8/85/NSA_COTTO... http://en.wikipedia.org/wiki/NSA_ANT_catalog http://en.wikipedia.org/wiki/NSA_ANT_catalog
- danso 13y agoGiven that the NSA's mission is to do surveillance against foreign targets ("There is no evidence that the N.S.A. has implanted its software or used its radio frequency technology inside the United States.")...the techniques described here actually seem to be in line of what you imagine the NSA is supposed to be doing. At least it's surveillance that requires them to have a physical targeted presence, rather than just drinking from the telecommunications firehose.
- oceanplexian 13y ago> The technology, which has been used by the agency since at least 2008, relies on a covert channel of radio waves that can be transmitted from tiny circuit boards and USB cards Obviously if someone has physical access to a machine it can be compromised. Replace "USB Cards" with "USB WiFi stick" and you've achieved the same thing. This is just FUD. Machines that are air-gapped from the Internet with tight physical security are as secure as ever.
- falcolas 13y agoIt seems to me you missed the "can be inserted by the manufacturer" portion of the article. Doesn't require physical access, just that they purchase a compromised machine.
- acousticcoupler 13y agoAlso secured facilities generally monitor for things like unauthorized WiFi access points and clients.
- todayiamme 13y agoI do understand that it is now the status quo to disavow everything the NSA is, but foreign intelligence gathering is their mission and releasing these details simply doesn't help the cause of fixing the NSA's less savoury incursions. While arguably any foreign intelligence agency of note isn't going to be caught off guard by these leaks, leaking these details does offer political ammunition to the very people who stand to gain from the expansion of the NSA's mission into civilian data gathering. It helps to make the case that the leaks aren't such a good thing after all and are compromising the intelligence gathering apparatus of the US of A. Add a bit of spin and you can quickly use this to get back to business as usual and people will actually support them as now it'll become a matter of identity instead of what it should be - a surgical exploration of a cancer afflicting a nation state.
- ProAm 13y agoThis is what happens when you screw up at the magnitude the NSA has, EVERYTHING will be released and scrutinized for the foreseeable future. Right or wrong they made the bed they now have to sleep in.
- privong 13y agoPlus, the assumption that they're only using their surveillance technologies against foreign powers is now known to (often) be a false assumption. So it's not immediately clear which systems are only being used against foreign powers, so one wouldn't even know what might be held back (if one were to take the position that things only affecting espionage against other nations should be kept quiet).
- unclebucknasty 13y agoExactly. The entire argument rests on the idea that we are certain that the NSA is trustworthy and is using its powers judiciously against, not only foreign powers, but those that pose a security risk. That assertion is exactly what is in question (for good reason). I think some people see the NSA as fundamentally good and trustworthy, but perhaps exercising a little bad judgment and/or overreach. Others see their breach of trust as reason for grave concern and a flagrant abuse of power that merits our consideration that it may be the tip of an iceberg inadvertently revealed by a rogue agency. Where people fall on that continuum probably drives their responses to subsequent revelations more than anything.
- vxxzy 13y agoTransmit as far as "EIGHT Miles". Does anyone know what type of power this would take? I imagine if they used a less noisy frequency combined with sensitive receiving equipment, it would not take much. I used to play with CB radios which has a cap at 4W, with a good antenna, one could transmit 7+ miles in good situations.
- privong 13y agoThere's at least two things that limit the range of this system, compared to the CB radio you mention: - less power available via USB - less impressive antenna
- bigiain 13y agoIt's a pretty much meaningless number without also talking about the antenna used both at the transmit and receive end. Carefully aimed high gain antennas can easily get that sort of range with power in the tens of milliwatt range. I've seen 100mW hobby-grade FPV gear doing 5+km with an omni directional antenna on the transmitter and only a high gain directional antenna at the receive end. With sophisticated enough gear at the recieve end, and an intentionally-aimed high-gain antenna at the transmitter, I'd bet getting 8 miles on single-digit mW of transmit power would be do-able. (Note that 4Watts of 27Meg CB radio is well known for getting ionospheric "skip" and connecting over literally thousands of miles given the right conditions.)
- mparlane 13y agoCould it be via powerlines? edit: I know the article mentions wireless, but it might not be true after all
- plorg 13y agoI suppose it's possible, but if I were the NSA I wouldn't bet on getting a signal past the neighborhood distribution transformer. There's often enough disturbance on a building-wide circuit to cause problems with powerline networking. Your 42" LCD TV probably has enough power-conditioning circuitry to interfere with network signals.
- deleted 13y ago
- Theodores 13y agoSounds like an update to The Thing: http://en.wikipedia.org/wiki/Thing_(listening_device) http://en.wikipedia.org/wiki/Thing_(listening_device)
- rl3 13y ago"In most cases, the radio frequency hardware must be physically inserted by a spy, a manufacturer or an unwitting user." [emphasis added]
- wmf 13y agoUS manufacturers sold pre-bugged equipment to the eastern bloc during the cold war, so why not now?
- VladRussian2 13y agoToday it is just a well publicly known feature of modern Intel CPU (officially it is stated to be disabled on some CPUs :) http://www.realvnc.com/products/viewerplus/ http://www.realvnc.com/products/viewerplus/ "Computers with particular Intel® Core™ vPro™ processors enjoy the benefit of a VNC-compatible Server embedded directly onto the chip, enabling permanent remote access and control. A RealVNC collaboration with Intel's ground-breaking hardware has produced VNC Viewer Plus, able to connect even if the computer is powered off, or has no functioning operating system."
- nl 13y agowell publicly known feature I sure didn't know about it, and wish I did. I'd love to be able to use it! Is there any easy way to make this work (and to check if your computer supports it)?
- simcop2387 13y agoThis has some more info, no idea how much it applies to current tech. http://blog.michael.kuron-germany.de/2011/10/using-intel-amts-vnc-server/ http://blog.michael.kuron-germany.de/2011/10/using-intel-amt... EDIT: and some more current stats http://software.intel.com/en-us/blogs/2012/04/23/intelr-vpro-technology-release-80-processor-requirements http://software.intel.com/en-us/blogs/2012/04/23/intelr-vpro...
- __pThrow 13y agoI have to admit I was disappointed these seem to require radio transmitters be added to the device. Was sort of hoping to discover there were little antennas built into Intel processors or nvidia video cards. However, I now know more about what DARPA's littlest flying robots will be doing, especially the ones already described as little more than chips with wings.
- vonnik 13y agoThe only thing that's more disappointing than the NSA spying is the NYT sitting on this scoop for more than a year, and letting Der Spiegel break it. Only slightly less amazing is that Der Spiegel and Jacob Applebaum were talking about this more than two weeks ago, and the NYT diddled until now. Incredible. https://www.youtube.com/watch?v=vILAlhwUgIU https://www.youtube.com/watch?v=vILAlhwUgIU
- supersystem 13y agoI'm more disappointed that very few on HN seemes to have been paying attention.
- vonnik 13y agoI agree. It was also really bad timing. No news organization should break anything major between X-mas and New Years. People are offline...
- yincrash 13y agoYup. Here's the article version: http://www.spiegel.de/international/world/nsa-secret-toolbox-ant-unit-offers-spy-gadgets-for-every-need-a-941006.html http://www.spiegel.de/international/world/nsa-secret-toolbox...
- deleted 13y ago[deleted]
- PythonicAlpha 13y ago"We do not use foreign intelligence capabilities to steal the trade secrets of foreign companies" Nobody with an unspoiled mind and following the news last year will believe this bullshit. If there is anything, people all over the world (also in the US) should have learned: Statements from people of some federal US organisations can not be believed at all -- in many cases the complete opposite is true.
- nitrogen 13y agoThere are plenty of weasel words in that sentence. Ample opportunity to tell the truth by using unintuitive definitions of terms.
- jjh42 13y agoThe NSA lost all credibility for their claim not to be stealing for commercial advantage when they were caught spying on Brazil's Petrobras (government owned oil company). It is simply not credible to claim this spying was for the prevention of terrorism.
- xanth 13y agoSo now one needs to run BSD, air gaped and in a Faraday cage to be 'secure'... So now what does one do with it
- dijit 13y agoevery day the movie 'Enemy of the State' looks more believable.
- deleted 13y ago[deleted]
- codex 13y agoThis is another example of how Snowden has compromised national security by leaking secret information that has nothing to do with American metadata and everything to do with the NSA's charter and legal mission.
- daenz 13y agoMaybe it's Snowden, maybe it isn't. It has been suggested by the reporters of this information that the Snowden name may be used as a cover for other NSA leakers.
- detcader 13y agoExcept if we actually put this story into context of how the US government does things, we realize that if this technique of spying isn't already being used on US citizens, it soon will be. Drones, wire-tapping, and infectious state-created spyware came home from the War on Terror, what makes you think this practice won't? Of course, neither of us can prove anything either way, but context is necessary before making analyses like yours
- samstave 13y agoAny thought that the NSA is adding to our national security is a delusion. How about a shift in your thinking: Instead f "securing" ourselves through trillions in weapons and intel BS - why not work toward creating a better world through better systems and people? How many Norwegian terrorists have there been? Fuck the NSA.
- PythonicAlpha 13y ago>Any thought that the NSA is adding to our national security is a delusion. Adding more security will make our life less and less secure. Anybody who believes, such things will stop terrorism, is just dreaming.
- vanattab 13y ago>How many Norwegian terrorists have there been? At least two since 2011. http://www.dailymail.co.uk/news/article-2467047/Terror-suspect-Kenyan-mall-shooting-revealed-Chelsea-fan-Norway.html http://www.dailymail.co.uk/news/article-2467047/Terror-suspe... http://en.m.wikipedia.org/wiki/Anders_Behring_Breivik http://en.m.wikipedia.org/wiki/Anders_Behring_Breivik
- zerny 13y agobadBIOS and now this. Sigh.
- arlyle-leth 13y agoThis reminds me of a lunatic I was talking to in Best Buy some 12 years ago. He claimed that he knew about, was aware of, and involved with a government program/technology where they could plug in a device to a computer and immediately gain access to all current computers at the time. It was bullshit then, and it is bullshit now. Yes there are such things as side channel timing attacks against secure chips, but it isn't going to work with a fucking usb device plugged in outside of the metal cage that is a pc case. This article is F.U.D. NSA? Come get me if you think you really can.
- ShirtlessRod 13y agoMy favorite part: "The technology, which the agency has used since at least 2008, relies on a covert channel of radio waves that can be transmitted from tiny circuit boards and USB cards inserted surreptitiously into the computers." Oh, so they only need physical access to the machine, and then they can do stuff to it? It's like magic!
- lazyjones 13y agoSo, any chances of finding such a device out in the wild? Suggestions for detecting the most likely used type of radio transmissions? How can they transmit over 5Km with USB power and no antenna?
- XorNot 13y agoUnder the right conditions you can send radio messages around the world on as little as 5 watts. You gotta remember that there's two sides to any radio system: the transmitter and the receiver, and both determine what you can do. After all, with the right antenna on one side, you can use wi-fi over a distance of miles.
- notastartup 13y agooh man when does this stop? these guys are clearly breaking the law all in the name of "keeping us safe from terrorists". This needs to be stopped. All the perpetrators of this program must be brought to justice with a court that adheres to the principals of democracy and freedom.
- higherpurpose 13y agoThis article feels like NSA bait to me. It's like NYT is trying to make NSA look good.
- beloch 13y agoWell, I suppose it's time for the tin-foil-hat crowd to turn their computer cases into a Faraday cages then! Of course, these NSA gizmos might plug into ground and detect radio-induced current fluctuations. Given how many computer cases are metal, this might be the obvious way to go actually. So... Faraday cage and a really expensive ground conditioner?
- f_salmon 13y ago> Richard A. Clarke, an official in the Clinton and Bush administrations who served as one of the five members of the advisory panel, explained the group’s reasoning in an email last week, saying that “it is more important that we defend ourselves than that we attack others.” Pretty frightening that such things apparently still need to be said.
- NKCSS 13y agoI remember an article on here a while back of a well known security or cryptology researcher that had a machine get re-infected by unknown malware time and time again without a network connection, who also observed radio waves and thought that was the iv...
- igravious 13y agoWas it this? https://news.ycombinator.com/item?id=6646936 https://news.ycombinator.com/item?id=6646936 "Mysterious Mac and PC malware that jumps airgaps?"
- TempleOSV2 13y agoStoopit nigger. He's making so people don't know God. LOL This probably does not make God happy. Stoopit nigger. God says... you're_no_fun no_way_dude Give_me_praise Japan bizarre I_give_up ROFLMAO atheist depressing by_the_way don't_have_a_cow oops glam I_hate_when_that_happens I_don't_care you_don't_say awful services sing after_a_break I_give_up climate end fight
- snambi 13y agovery good use of tax payer money!