I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There’s Intel ME, AMD PSP, so there’s probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?
Every phone has a radio with remote root access controlled by a security key that is supposedly only in the hands of the manufacturer. A manufacturer that could be forced to give up that key, and forced not to tell anyone they had done so.
At least with a PC you can control the physical access to transmission, giving you a way to possibly audit before send, and physically control all input.
The reality is that any large scale communication network will be breached by the controlling government, or it will be shut down. If you want actually secure communication, you have to do it by broadcasting in the clear using an unbreakable cypher that’s been physically passed on.
‘They’ (I.e. government agencies/PPP) actively exploit weaknesses or institutionally create them. Personal favorite is the backdoors built into TETRA, which is used for mainly government purposes (law enforcement, emergency services). ETSI acts as a strawman for government interest and serves no cause other than that of its masters. That bugs me to no end because this does not serve any purpose.
https://www.zetter-zeroday.com/interview-with-the-etsi-standards/
We don’t.
We really really don’t.
Consider the attack that Israel carried out this fall by detonating walkie-talkies and pagers. This wasn’t just some illicit code in the firmware or hardware, they managed to hijack the supply chain and hide literal bombs in commercially-produced handheld devices!
Bottom line: If you do not directly control the production chain from chip design and fab to end-user software, you can never be sure.
40 years ago, the legendary Ken Thompsonand Dennis Ritchie accepted the Turing Award for creating Unix. Thompson’s acceptance speech Reflections on Trusting Trust pointed out this same fundamental security flaw.
I encourage everyone to read the article, and spread it as widely as possible. It is terrifying and accurate, nearly half a century later.
It’s not just back doors. All governments will have a group of people who’s job is to find security vulnerabilities in OS and use them to attack other nations.
If Wanacry rings a bell the you might be aware that the Eternal Blue exploit was the infection vector which was originally designed by the NSA and leaked by a hacking group. Only after the leak did the NSA tell Microsoft how it worked and it was patched.
https://en.wikipedia.org/wiki/Intel_Management_Engine
https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor
If I was a government intelligence agency I’d probably sell my soul to get access to these…
I get that they have legitimate use cases for corporations, but why are there virtually no consumer grade CPUs without that stuff ? Surely they would be less expensive and no one would miss the features on their home computers.
They do.
Didn’t national treasure Edward Snowden prove this?
AFIAK, his leaks showed that corporations are collaborating, and software could have backdoors. I don’t think they ever showed docs that reveal non-targeted hardware based surveillance. The common understanding post-snowden was, use Open Source OS and use Encryption and you’re safe, unless you are specifically targeted.
My question is asking about hardware-based mass surveillance.
Well, there is this time a few months ago where the Chinese government hacked AT&T and Verizon using the mandatory backdoors the US government left for wiretaps…
https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b
That’s the reason leaving backdoors is generally a really, really bad idea, because you don’t know who else can use them
Yeah, we don’t. It’s generally hard/impossible to prove the nonexistence of something. Same as with God. It’s unlikely, but we can’t prove he doesn’t exist with certainty.
Hardware backdoors are extremely expensive & taxes aren’t enough to cover it
I doubt that’s the case. We already had a good amount of government-sponsored hacking, worms like Stuxnet. The Israelis can make every pager explode. It has been debated if there’s surveillance in some networking equipment. I think it’d be quite affordable to put a few more lines of code into Intel ME and AMD’s equivalent. The hardware is already there.
If you honestly think that the exploding pagers where just standard pagers, and somehow made to explode by hacking them, your grasp of physics and technology could do with some improvement.
The pagers where packed with a small amount of explosive and remote detonation system and then fed into the Hamas group through a supply chain attack.
Sure, that basic physics knowledge was kind of implied in my comment. But yeah, my phrasing is misleading. They can’t make “every” pager explode. But they can make you end up with one with explosives inside. Most of these things are supply chain attacks. Could be targeted at someone and happen after manufacuring. Or you’d make the regular manufacturer include a backdoor. Or you’d do it like with the pagers and set up a whole fake manufacturer and sell them with a bomb inside. I suppose in that case it would be possible to detect it. But I’m not an expert on explosives.
Wasn’t that something Asange or Snowden blew the whistle on? That the CIA or NSA or something actually has backdoors in pretty much everything, along with all kinds of spyware floating around the net?
I think what more like Verizon and other carriers logging metadata. Google and Apple, in their server side services. And the government has physically tapped internet cables. HTTP was not widespead at the time, and corporations were (either forced, or willingly) co-operating with authorities for mass surveillance. Also, most devides had no encrption for data at rest. You know, that type of thing.
I don’t think the snowden leaks ever said anything about a hardware backdoor outside of targetted attacks (Correct me if I’m wrong). So it was widely understood post-snowden era that using an open source OS + encryption for both at rest and communications would be good enough for non-targeted attacks.
But my question asks if governments could be listening to everyone as a mass surveillance non-targeted attack, via hardware backdoors
If they listen to everyone, it would show up in some way, using power and bandwidth. Even using like steganography wouldn’t hide it very well IMO. One exception being windows ofc 😅 where they spy on you for sure already.
Wasn’t it that mega share guy (king dotcom or something) that figured out his PC was compromised because his ping skyrocketed on CS-GO?
There’s no way to check the whole thing, but you can totally pick a component and reverse engineer it, which is something people do quite a bit. When spying is found, it’s usually a private company doing it.
The NSA doesn’t care about your search history, but advertisers do. (and the government ever did, they’ll just call up google)
A few years ago they had rerouted shipments from Cisco to the NSA and then forward to the intended recipients. Not just a few parcels, but truckloads.
I’ve worked for the government. They had me managing 78 full AWS accounts for various departments. Me, 1 guy. And I had to explain basics of tech to everybody in charge of the cloud accounts.
Our gov can barely manage itself, let alone some next level tech on millions of devices and keep track of it all. They couldn’t even get me a new mouse without 2 forms, 1 online ticket, and 2 levels of approvals.
Yep but the capable agencies know what they want
Which government is this?
