5 ms·

3 - Don't use Windows. Remember this gem? https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Filling ports with glue is a pretty good i

3 - Don't use Windows. Remember this gem? https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Filling ports with glue is a pretty good idea. Clipping the leads might be necessary though; I'm not sure how well the glue will stick to metal. Edit; I'm told that the government uses hot glue. Another good suggestion that was in the news recently is to use nail polish to make your laptop tamper-evident. http://www.wired.com/2013/12/better-data-security-nail-polish/ http://www.wired.com/2013/12/better-data-security-nail-polis...

allegory 12y ago
They do indeed use hot glue and bolt the computers into cages. Then they buy monitors with built in USB hubs for keyboard and mouse and plug them in. To circumvent, remove mouse inert USB stick. No kidding. This was a tier 1 defense company and I was DV cleared.
- fabulist 12y ago
  Ouch. I was thinking, "What if you unplugged the monitor cable...?" but thats even worse. Still, when I was going to go on a tour of LANL (I decided it wasn't worth divulging my SSN, in case it was misplaced), they made it very clear that cell phones, USBs, etc. were not allowed; I'm not sure if I would have actually been searched, however. (Not that I was remotely tempted to push it.) That was a long time ago. Today you can get such tiny devices that theres no way they could find them. Perhaps you could modify the firmware on something like this, and swallow it; http://laughingsquid.com/wp-content/uploads/269902-sandisk-cruzer-fit.jpg http://laughingsquid.com/wp-content/uploads/269902-sandisk-c...
  - allegory 12y ago
    Definitely. I use one of those USB sticks in my car radio so it doesn't stick out. It is tiny. I was searched going in and out but you could easily stick one up your bum like a drug mule!
wmt 12y ago
So what OS should you use? I imagine Linux and OSX are also out of the question as they are also supported by the FinFisher.
- aruggirello 12y ago
  You're right but you can reasonably expect some security patches now that it's been published, at least in the Linux world. Hopefully Apple could follow. Until then, you might perhaps consider using *BSD.
  - at-fates-hands 12y ago
    FWIW: http://en.wikipedia.org/wiki/FinFisher#Detection http://en.wikipedia.org/wiki/FinFisher#Detection "According to announcements from ESET, FinFisher and FinSpy are detected by ESET antivirus software as "Win32/Belesak.D" trojan.[26][27]" Apple did patch its itunes player - 3 years after apparently knowing about it: http://krebsonsecurity.com/tag/finfisher/ http://krebsonsecurity.com/tag/finfisher/ "A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet the company waited more than 1,200 days to fix the flaw." But yes, I agree you should go with OpenBSD if you're worried about this: http://www.secpoint.com/Top-10-Most-Secure-Operating-Systems.html http://www.secpoint.com/Top-10-Most-Secure-Operating-Systems... "By default, [OpenBSD] is the most secure general purpose operating system out there. The proof in the pudding? The fact that it suffered only two remote attack vulnerabilities in the last decade serves as solid evidence of its stringent security and strict auditing policy. Moreover, OpenBSD lacks a large enough attack surface (care of running numerous web applications) for hackers to exploit."

allegory 12y ago

They do indeed use hot glue and bolt the computers into cages. Then they buy monitors with built in USB hubs for keyboard and mouse and plug them in. To circumvent, remove mouse inert USB stick. No kidding. This was a tier 1 defense company and I was DV cleared.

fabulist 12y ago
Ouch. I was thinking, "What if you unplugged the monitor cable...?" but thats even worse. Still, when I was going to go on a tour of LANL (I decided it wasn't worth divulging my SSN, in case it was misplaced), they made it very clear that cell phones, USBs, etc. were not allowed; I'm not sure if I would have actually been searched, however. (Not that I was remotely tempted to push it.) That was a long time ago. Today you can get such tiny devices that theres no way they could find them. Perhaps you could modify the firmware on something like this, and swallow it; http://laughingsquid.com/wp-content/uploads/269902-sandisk-cruzer-fit.jpg http://laughingsquid.com/wp-content/uploads/269902-sandisk-c...
- allegory 12y ago
  Definitely. I use one of those USB sticks in my car radio so it doesn't stick out. It is tiny. I was searched going in and out but you could easily stick one up your bum like a drug mule!

wmt 12y ago

So what OS should you use? I imagine Linux and OSX are also out of the question as they are also supported by the FinFisher.

aruggirello 12y ago
You're right but you can reasonably expect some security patches now that it's been published, at least in the Linux world. Hopefully Apple could follow. Until then, you might perhaps consider using *BSD.
- at-fates-hands 12y ago
  FWIW: http://en.wikipedia.org/wiki/FinFisher#Detection http://en.wikipedia.org/wiki/FinFisher#Detection "According to announcements from ESET, FinFisher and FinSpy are detected by ESET antivirus software as "Win32/Belesak.D" trojan.[26][27]" Apple did patch its itunes player - 3 years after apparently knowing about it: http://krebsonsecurity.com/tag/finfisher/ http://krebsonsecurity.com/tag/finfisher/ "A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet the company waited more than 1,200 days to fix the flaw." But yes, I agree you should go with OpenBSD if you're worried about this: http://www.secpoint.com/Top-10-Most-Secure-Operating-Systems.html http://www.secpoint.com/Top-10-Most-Secure-Operating-Systems... "By default, [OpenBSD] is the most secure general purpose operating system out there. The proof in the pudding? The fact that it suffered only two remote attack vulnerabilities in the last decade serves as solid evidence of its stringent security and strict auditing policy. Moreover, OpenBSD lacks a large enough attack surface (care of running numerous web applications) for hackers to exploit."