14 ms·
Did this Tor developer become a victim of NSA's laptop interception program?
- jhgg 13y agoI'm a bit confused here. On the bottom right, it says that the package contained a replacement keyboard, and not an actual laptop.
- ljd 13y agoBut when that keyboard gets plugged into the motherboard of the laptop, it'll have an opportunity to install malware in the form of device drivers.
- mschuster91 13y agoWorse: laptop keyboards are usually connected to a special embedded firmware (IIRC on my Clevo laptop it's called EC, short for embedded controller), which handles the FN+x key combos like LCD brightness, volume control, keyboard backlight (Lenovo!), WiFi/BT/cellphone-data connectivity, webcam enabling (!) and other detailed functions. Now, if this EC chip is vulnerable, a malicious keyboard can have direct DMA access (just like FireWire controllers, EC is usually connected to the main PCI bus)... no need for drivers here.
- maxjus 13y ago>direct DMA access Direct direct memory access access?
- jrockway 13y agoFinanced with a withdrawal from the ATM machine, of course.
- dfox 13y agoLaptop keyboards are directly connected to embedded controller primarily because they are completely passive switch matrices (and EC includes - often directly in hardware - logic for scanning keyboard matrix), so there is nothing meaningful to exploit on the EC side. Also connecting EC directly to some PCI bus does not make much sense from both system design and cost perspectives. Usual place to connect EC to is LPC, which is explicitly designed for such devices (things on motherboard like serial/parallel/game ports, TPM, FDC, keyboard controller/EC, BIOS flash and various ). Random review of datasheets found by google seems to indicate that chips that are only embedded controllers and do not contain additional ISA based peripherals (like ISA DMA controller itself) tend to not even implement the pin required for LPC DMA/bus master transactions (as it is not required for anything in normal operation).
- mschuster91 13y agoHold a second, BIOS flash? /me smells #badBIOS
- csmithuk 13y agoAs per my other post, the keyboard is most likely a PS2 keyboard interface (physical or emulated) connected to a simple PS2/LPC(ISA) bus interface inside the EC. It will literally deliver an IRQ to that bus (IRQ 1) at which point the EC has to suck down a character from the keyboard buffer and do something with it. It's not clever, can't use DMA and generally is the dumbest thing in the entire machine. If they somehow manage to work around it I'd eat a box of lightbulbs. It's hard enough to coerce it to work to start with. Source: I used to design embedded PC kit from the board level.
- mschuster91 13y agoThanks for the clarification! But one question remains: how does the EC control stuff like the bluetooth radio and webcams? They're USB devices to the OS, so in theory there should be a USB hub inside the EC?
- csmithuk 13y agoNot necessarily. It may only have power control function. If you pull a USB device out it's the same as turning it off in theory and vice versa. It's probably just turning the device off or setting it into standby mode. edit to add: some Intel south bridges have integrated EC which makes things a little uncertain.
- ghughes 13y agoI don't believe HIDs have the ability to install arbitrary drivers. Windows will try to identify the device and locate the driver via Windows Update, or use a generic HID driver. Or the OEM may have preinstalled drivers. In any case, a malicious keyboard can simulate keypresses and pwn your machine that way. No evil driver needed.
- busterarm 13y agoIf a laptops FN keys work in BIOS/UEFI, does it even matter? See other post about embedded firmware and DMA.
- tlrobinson 13y agoIn any case, a malicious keyboard can simulate keypresses and pwn your machine that way. No evil driver needed. Indeed: https://hakshop.myshopify.com/collections/usb-rubber-ducky/products/usb-rubber-ducky-deluxe https://hakshop.myshopify.com/collections/usb-rubber-ducky/p...
- csmithuk 13y agoActually no. The keyboard is still an old fashioned PS2 device on the majority of laptops. It connects to the LPC bus (low pin count - similar to ISA) via a PS2/ISA bridge in the embedded controller. It's just like in an oooooold AT PC. There is no possibility for it to deliver anything but keystrokes. It doesn't go anywhere near the USB stack and can't inject devices or play with the HID drivers. Connection-wise it looks like this: http://i.imgur.com/ayFybSd.png http://i.imgur.com/ayFybSd.png Keystrokes can be dangerous on their own but engineering a solution to this that assumes the correct state of the machine and can operate software is unlikely simply due to the margin of error.
- Geee 13y agoThe keyboard can be modified, for example, with SURLYSPAWN, a 'Keystroke monitor technology that can be used on remote computers that are not internet connected'. It's probably one of the most used NSA devices, being cheap($30) and easily installable. http://upload.wikimedia.org/wikipedia/commons/f/fc/NSA_SURLYSPAWN.jpg http://upload.wikimedia.org/wikipedia/commons/f/fc/NSA_SURLY... http://en.wikipedia.org/wiki/NSA_ANT_catalog http://en.wikipedia.org/wiki/NSA_ANT_catalog
- CraigJPerry 13y agoI suppose it's possible this could just be a fox's paw on the part of the shipping company.
- DerekL 13y agoA few months ago, I ordered some RAM from Crucial. They used UPS Mail Innovation, a service by UPS that mails packages for you. I got my package, but the tracker showed it getting delivered to another address on the other side of the country. So maybe there's a bug somewhere in the USPS system that shows you the tracking of the wrong package?
- busterarm 13y agoIt's kind of hard for a computer to misread 98122 as 2230* / 2231*.
- deleted 13y ago[deleted]
- ghughes 13y agoNever attribute to malice that which is adequately explained by opaque logistics.
- slashdotaccount 13y agoNever say never. NSA intercepting its target's purchases to install spyware is very much possible.
- ghughes 13y agoIt's possible, but there is no evidence suggesting that is what happened here. The overwhelming likelihood is that the package simply took an unusual route due to factors that are unknown to us. For this story to be true, it would require a level of incompetence that is orders of magnitude beyond that which we have previously seen from the NSA.
- raverbashing 13y agoI don't get the "installing malware" part. Every PC comes with malware already installed by most manufacturers. (Yes, if I have to spend time removing bloated stuff it's malware, I don't care if it's an "antivirus demo" or something like that) Now, if it's a hardware detail, this is more interesting.
- trauco 13y agoNot all malware can be removed the way you remove that antivirus demo. From the Der Spiegel article[1]: > Take, for example, when they intercept shipping deliveries. If a target person, agency or company orders a new computer or related accessories, for example, TAO can divert the shipping delivery to its own secret workshops. The NSA calls this method interdiction. At these so-called "load stations," agents carefully open the package in order to load malware onto the electronics, or even install hardware components that can provide backdoor access for the intelligence agencies. All subsequent steps can then be conducted from the comfort of a remote computer. Naturally, if they also load a keyboard logger or whatever, no amount of formatting that new laptop would help. [1] http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969-3.html http://www.spiegel.de/international/world/the-nsa-uses-power...
- guiambros 13y agoWhat about changing your BIOS to intercept keystrokes? Or hacking the hard drive firmware, so they would have the master key for your encrypted disk next time you cross the border? A lot more effective than any other software-based solution. A few years ago we'd say this is all crazy conspiracy theory. Nowadays this this is just NSA's business as usual tactics [1]. [1] http://news.cnet.com/8301-1009_3-57616334-83/nsa-reportedly-planted-spyware-on-electronics-equipment/ http://news.cnet.com/8301-1009_3-57616334-83/nsa-reportedly-...
- yuhong 13y ago(Yes, if I have to spend time removing bloated stuff it's malware, I don't care if it's an "antivirus demo" or something like that) I don't like this, there is a reason there are different terms.
- rwg 13y agoHEY, KIDS! Do YOU know what time it is?! [wild audience applause] THAT'S RIGHT, it's time for WHICH IS MORE LIKELY?! [intro music] Today on Which is More Likely?, we're looking at a replacement Lenovo Thinkpad keyboard that was shipped to Alexandria, Virginia, instead of Seattle, Washington. What a blunder! [slide whistle sound effect] Now put your thinking caps on and ponder, WHICH IS MORE LIKELY?! • The largest intelligence agency on the planet, recently outed by Snowden's leaked documents for operating a multi-decade worldwide dragnet that secretly gathered communications on hundreds of millions of people, was too incompetent to have the US Postal Service display tracking information that hides the fact they're modifying a laptop keyboard in order to somehow spy on a Tor developer. ORRRRRRRRRR! • The third-party seller who uses Amazon to accept orders screwed up and gave Amazon the wrong tracking number. That's all we have time for on today's episode of Which is More Likely? Don't change the channel! Up next is a BRAND NEW episode of Godwin's Law and Order! Good night from Hollywood! [outro music]
- mverwijs 13y agoThe sad sad thing is, though, that in the '90s we made these jokes about surveillance cameras, internet taps, government-written-viruses, etc..etc... Seemed funny then, too.
- tptacek 13y agoNo we did not. This is perhaps the most annoying meme to have come out of the Wikileaks and Snowden disclosures. Nobody working in technology laughed about dragnet surveillance or cryptanalysis capabilities or trojan horses. The 1990s was the era of Clipper and Echelon. People did not assume in the 1990s that the intelligence community was benign or disconnected. All you have to do is read _Applied Cryptography_ to see a sober, expansive concern about NSA surveillance. And Schneier's writing was far more carefully considered than, say, Usenet. For fuck's sake, the most popular show on television centered on government conspiracies. The millenials did not invent distrust of the government.
- deleted 13y ago[deleted]
- mikeash 13y agoThe obvious explanation here is that the USPS fucked up. As the tweet says, you'd think the NSA program would be more subtle. Further, there isn't much in the way of intelligence presence in Alexandria. So what's more likely: that the NSA does this program in a secret location that's still right next to all the non-secret stuff, and they can't cover up the tracking data, or that the USPS accidentally sent a package to the wrong place? Edit: I want to emphasize how incredibly stupid the article is when analyzing the tracking data. Key quote: "From Dulles, it moved another four times around the military and intelligence belt in suburban Washington DC, finally landing in Alexandria at 11:03 am on January 23." First of all, there is nothing significant to Dulles. It's the largest airport in the area, and this makes it the arrival point for any packages coming in by air. 90% of my packages have a "Dulles, VA" tracking entry on them by the time they get to me. Second, it didn't move "four times". It went from Dulles to a carrier facility in Alexandria, then it went out for delivery and got delivered. That's two moves. And how many times do you expect it to move? That's how air-based package delivery works. It goes to an airport. Then it goes to a local sorting facility. Then it goes out for delivery. Third, the phrase "military and intelligence belt" is ridiculous. Especially so when the only two locations involved are Dulles and Alexandria, neither of which has much in the way of either military nor intelligence. The article tries way too hard to make its case, and uses a great deal of purple prose to state what comes down to, "the package got delivered to Alexandria, VA which is close to a lot of government agencies". That would actually be more convincing than the insanity they wrote, although still not very convincing. But at least it would be honest.
- chmars 13y agoMishaps happen. Intelligence agencies in particular have a long history of mishaps (and incompetence), probably due to the lack of oversight …
- mikeash 13y agoOf course, and I'm not saying they don't. I'm just saying, which is more likely? I'd wager the USPS screws up a lot more often that the NSA.
- maerF0x0 13y agoBuy a new boxed computer with cash from a local supplier. I doubt the NSA has installed something on every single computer.
- rcthompson 13y agoNot every computer, just a random subset of them.
- TacticalCoder 13y agoSome OS developers are sufficiently concerned that CPUs are NSA-modified to not trust, say, Intel's rdrand instruction anymore! It may very well be that every single Linux system running on a recent or semi-recent CPU has a rdrand instruction returning a number "nullyfying" (from the NSA's point of view) the previous entropy sources XOR'ing. You may call me "paranoid" but... Many people who were categorized as paranoids years ago turned out actually to be very, very far from the truth and not anywhere near paranoid enough. I also remember a SNAFU years ago where a Windows version was compiled with some symbols left on and people started noticing variable named things like: "NSA_KEY". And, of course, lots of PR ensued and there was nothing to see and there were very reasonable explanation as to why there were NSA specific things in Windows. Contrarily to you I believe it is very likely that most Windows and Apple OSes are backdoored by the NSA and I believe it's far from impossible that several piece of hardware are also backdoored. I also think it's not impossible that several network cards have "kill switches" where a certain packet combination bricks the card . There have been weird reports out there from people seeing really strange things making such a possibility not science-fiction.
- polymathist 13y agoCan we get a source for that SNAFU claim? If true I would be very interested to read more about it.
- mikeash 13y agoWikipedia actually has a pretty lengthy article about it: http://en.wikipedia.org/wiki/Nsakey http://en.wikipedia.org/wiki/Nsakey
- notastartup 13y agoSo let me get this logic: NSA contractor reveals mass surveillance on population Independent journalists reporting on the topic has their home broken into Independent article reports on NSA modifying laptops bound for "terrorists" Tor developer notices laptop shipping traversing through the opposite direction Tor developer is concerned and suspicious The same people who didn't care about having their freedom to privacy breached claiming ITS CLEARLY A SHIPPING ERROR LOL.
- atmosx 13y agoAnd famous security analysts are ALWAYS on that side of crowd, isn't that weird?????
- DangerousPie 13y agoYou only phrase your headline as a question if the answer is No, but you really want it to be Yes.
- mikeash 13y agoIt fits. The answer is almost certainly No (an honest mistake is far more likely, and nefarious activity wouldn't look like this anyway), and you can tell from the way they write (e.g. vastly exaggerating the import of the tracking info) that they deeply want this to be true.
- aragot 13y agoDid they _actually_ write an article with a tweet as the _only_ evidence?
- mikeash 13y agoIf there's more evidence, they sure haven't mentioned it.
- krapp 13y agoClearly, absence of evidence is evidence of conspiracy, and evidence to the contrary is propaganda. It's the only way to know for sure.
- mikeash 13y agoI give it about 50/50 odds that a followup article shows up along the lines of, "they received the laptop and the tracking info for this package shows it coming straight from the warehouse nearby and this is clearly evidence that the NSA is screwing with USPS tracking data."
- krapp 13y agoThe site which posted this article wouldn't bother posting an article contradicting it.
- peterwoo 13y agoNo. http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines
- GigabyteCoin 13y agofwiw I recently had a large, professional shipment company state that my product had been delivered to the new town over, albeit to the same street address I had ordered it to. The product was in my po box, but the shipping company claimed it wad delivered to another adjacent town. Never attribute to malice that which is adequately explained by stupidity.
- theboss 13y agoITT, people who have never been to DC. Dulles is one of the main airports everything flys into for DC. As for as I know, it is the biggest. Dulles has a lot of government contractors and big companies in the area, but that's about it. What would be suspicious is if it went from Dulles to Langley, from Langley to Ft. Meade, from Ft. Meade to Quantico, and from Quantico to Alexandria....but Dulles to Alexandria is really standard. edit: It isn't like it got back on a plane and went back to Seattle to be delivered to this girl. It looks like they straight delivered it to the wrong city. The government has pretty good OpSec when it comes to things like this. You think they would straight up route her package through Ft. Meade if they were planning to install malware on her computer?
- mikeash 13y agoYep, the last few lines of the package tracking could have come from about 90% of the packages I had delivered to my house in the past few years, until I moved out of Alexandria.
- deleted 13y ago[deleted]
- kriro 13y agoI hope this was not posted before the keyboard arrived. Should be easy enough to have it taken apart by an expert and see if anything is fishy (and to check if tracking numbers match). If it was posted before...why would you do that.
- polack 13y agoLooks like she posted it before... Either way I would cut her access to the Tor project.
- jrockway 13y agoBugs in software are so uncommon these days that I always assume any malfunctions are due to government interference. A human making a mistake while programming or using a computer? Not bloody likely. The government trying to infect my laptop with malware contained in a replacement keyboard? That's the only possible explanation!
- blowski 13y agoI'm inclined to believe that this is a mistake - "extraordinary claims require extraordinary evidence" and all that. ...However, since hypothetically this could happen, how could it be prevented? Would there be some unbreakable way for a manufacturer to tell you if the keyboard had been tampered with? I was thinking of those silver foils that are now put over a lot of food items so that crazies can't put stuff in them in the supermarket. I appreciate wrapping it in plastic probably wouldn't be enough to defeat the security services, but you get the idea.
- hoboerectus 13y agoThat would be a very ordinary rendition.
- EricBurnett 13y agoAll this speculation about what any TLA's may or may not have done seems fruitless to me. If the keyboard seems legitimately suspect, send it to someone to do a teardown or plug it in and capture communications, and find out. That way we'll learn something concrete, and not reinforce this 'NSA of doooooom' crowd mentality.
- aragot 13y agoNonsense. Every single piece on those laptops already leaks more than a teabag, every protocol does more information broadcasting than the BBC, why would they have it shipped to the headquarters? NSA's job is to bug computers before they even enter Amazon.
- atmosx 13y agoThe reason we're discussing this, is because of the laptop's/keyboard's owner: A TOR developer. If this was uncle Joe no one would even care, because probably his Facebook data is all that matters anyway.
- NN88 13y agoThe amount of apologetic in this thread is hilarious. Do you all expect to see "SECRET NSA WAREHOUSE" on the packing slip?
- atmosx 13y agoApparently, they do. Until Snowden releases something along the lines of "List with 1.500 gadgets that Amazon released that were bugged". Then suddenly we'll be like "Oh Jeez, I thought but it but I never really believed...". The thing is "Would the NSA wanna bug a TOR developer's computer"? and the answer is "Damn, sure!". So it's not as far fetched as many here believe imho - and NO there are not many better ways than this, I can't think of any.
- logn 13y agoExactly. This is why many people in tech weren't that surprised by Snowden's leaks and were slightly relieved just to see all the suspicions verified. But most people seem to need a powerpoint explicitly stating what's going on before they believe it. Prior leaks from NSA defectors without hard proof had almost no recognition by the public. Even full in-depth exclusives from Washington Post didn't seem to affect people.
- viraptor 13y agoAs much as I'd like to believe that they did mess up the interception reporting (if they really do interception like that), I've seen enough crazy tracking reports that I wouldn't be surprised if it was just a stupid mistake. Just googling for "funny delivery tracking route" for example will give you things like: - 4 times over the ocean - http://i696.photobucket.com/albums/vv325/oneupmanship34/Fg0eg.png?t=1265425500 http://i696.photobucket.com/albums/vv325/oneupmanship34/Fg0e... - let's send it to Canada, 3 times - http://i30.photobucket.com/albums/c325/duffer987/UPSFTD_zps68aae690.jpg http://i30.photobucket.com/albums/c325/duffer987/UPSFTD_zps6... - Germany, HK, Germany, HK, ... - http://laforge.gnumonks.org/fun/dhl-hk-leipzig-hk-leipzig-hk.jpg http://laforge.gnumonks.org/fun/dhl-hk-leipzig-hk-leipzig-hk... Getting a strange route within one country is probably an improvement compared to those...
- tzs 13y agoWhen I read the headline, and the comments here before reading the article, I was expecting to see tracking data that went from the seller to the buyer with a mysterious stop near the NSA. Then I read the article. The tacking data shows a delivery to a destination near the NSA. Does anyone here seriously think that the mechanism the NSA uses if they want to tamper with a laptop on the way to simply change the destination address to be the NSA? And that no one has noticed this before? If they are intercepting and modifying domestic shipments, the mechanism would be something that is executed AT the shipping carrier facilities or possibly during the final delivery, and would be completely transparent to outside observers, including both the sender and the receiver of the package. Watch the "Modern Marvels" episode on package delivery for a look at how the automated package movement systems work at the major hubs, and you'll see how a package could be diverted for special treatment and then re-inserted into the system transparently, with most workers at the facility having no idea something special is going on. The best chance at detecting this from outside would probably be to look at next day delivery orders on items that would be the most time consuming to modify, to see if those are more likely to miss their delivery deadline. The idea is that with such a tight schedule, the chances are higher than an interception will blow the delivery schedule. For items ordered with two day or longer shipment, the delay in modifying the item could be made up by upgrading it to one day delivery in the system when it is re-inserted. That's why observing one day delivery items is the best bet.
- fnordfnordfnord 13y ago>Does anyone here seriously think that the mechanism the NSA uses if they want to tamper with a laptop on the way to simply change the destination address to be the NSA? And that no one has noticed this before? No that doesn't pass the giggle test. If it has anything at all to do with the NSA, it's a blunder.
- kevinchen 13y agoGenuinely curious about the Modern Marvels episode. Do you remember the exact name or season? I couldn't find it on iTunes.
- 13y ago
- linuxhansl 13y agoWhether this actually happened or not is not the point. The point is that there is now speculation (and in fact a, albeit remote, possibility) that this could have been the reason. The loss of trust in the Government is what makes this a story.
- fnordfnordfnord 13y agoI find the loss of trust in the gov't encouraging. Healthy skepticism would be better, but distrust is better than nothing.
- nova22033 13y agoI live in Ashburn, VA. I've had a package routed through Ashburn, GA. Someone got confused between Washington(the state) and Washington(DC)...? Occam's razor people...
- ZanyProgrammer 13y agoSo, Alexandria, VA and Seattle, WA are spelled the same?
- ufmace 13y agoI wonder what she's going to do with the keyboard when she gets it. Send it back and buy one locally? Examine it in detail for bugs/weirdness, and then use it normally? Connect it to a spare laptop, and use it to do searches for the weirdest porn you can think of?
- mirkozlojic 13y agoNerds need pr0n :)
- VonGuard 13y agoWhy would the NSA fuck with a TOR developer, when the federal government contributes a great deal of TOR code and actually runs exit nodes as a matter of research?
- fnordfnordfnord 13y ago>Why would the NSA fuck with a TOR developer, Why wouldn't they? At the very least a TOR developer might find themselves in the same room with interesting people. > when the federal government contributes a great deal of TOR code The US gov isn't a single monolithic entity with a singular purpose and every person working in lock-step. > and actually runs exit nodes as a matter of research? I wouldn't trust a gov't run TOR node. It may be fine for dissidents in uninteresting countries, but not for anyone who wants to keep their privacy safe from the US gov't.
- Smegger 13y agobecause it is two different divisions of the government that don't get along. And while the NSA may have the power to fuck with a Civilian TOR dev, if they were to start hacking Navy Intelligence they would get in a world of trouble.
- brianbarker 13y agoSo buy your laptop from the store, not online? Guess this is good news for Best Buy, not so much for Newegg.
- deleted 13y ago[deleted]
- Buge 13y agoReally stupid move to post this on twitter before getting it. Should have just taken a screenshot then waited for it to show up. Then post the screenshot and have people analyze the keyboard. By posting before getting the package, the NSA could see the Twitter post and give a non-modified one instead.
- streetnigga 13y agoThe real story here is a small segment of productive coders rightfully feel themselves focus of nation sized actors that threaten their work. ... Also the large segment around them that still feel dismissive about their now confirmed fears.
- mirkozlojic 13y agoIsn't it obvious this is some kind of weird reverse-psychology ? They can always call catch 22 , or they need not to , we can only guess . But it's kind of obvious this happened to dismiss the fact they ARE doing this on regular basis .