Hacker News Reader

Comment by jMyles | Hacker News Reader

Hmm. OK, I have two questions - maybe somebody here has answers:

1) "...these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras..."

This seems basically impossible to actually achieve in reality though, because there will still associated network traffic that can be sniffed, and will have been by now, right? I mean, it is plausible that somehow we all just failed to notice that our computers are sending video traffic to the NSA without our noticing it?

I can imagine this happening on phones, where the baseband chip is much harder to actually sniff. But through my LAN? I doubt that.

2) Let's imagine that this post is entirely true. Why do Intel and AMD do this? If it's not part of a grand conspiracy, then why? Clearly there are far easier and cheaper ways to achieve what they view as security that don't require such a crippling approach. What's the upside to them?

View on HN

I agree that if these things were by default constantly exfiltrating, say, webcam data, someone would have noticed. But their use is likely much more insidious.

Any keyboard event generates some kind of interrupt on x86, right ? Suppose this "ME" happens to record the last 64k keystrokes into a rolling buffer. Furthermore, suppose there is a very, very particular sequence of instructions that can be sent to retrieve this rolling buffer ? Boom. No more encryption (at least none that requires typing a key in from the kb).

Oh, you use binary keys ? Cool, intel has special x86 instructions for doing AES. I'm sure they wouldn't do anything like copy the, oh...KEYS, into the hypothetical rolling buffer, would they ? No, that would be "dishonest", and we all know everyone who makes computer hardware and software would never think of doing something so egregiously deceitful, don't we ?

The fact that the NSA has implants (from the various Snowden files) that do exactly this and exfiltrate over a network should tell us that this is not so far fetched. The bulk of the data volume is only used when the capability is being exploited. It would not be so hard to send out marker of exploitability over innocuous traffic (say tweaking an HTTP header) meant to be picked up by sniffing / MotS.

It's called covert channels. It could be done by flipping some unused/ignored bits in ip4/tcp headers in a stream of traffic that goes past a collection point.

But this is still easily visible with wireshark, right? Don't you think we'd have discovered this by now?

There are ways of doing it invisibly. Change timestamps in very subtle ways, Embed data in lossy media formats, etc.

If the code says "phone home if anywhere on the screen you see one of the following email addresses" then it won't show up in a normal security audit, unless you email one of those people during the audit. All the NSA has to do is make the phoning home rare enough that it's probabilisticly unlikely to be observed.

How would Wireshark reveal this kind of attack? If the management chip has direct hardware access, it can hide data in innocuous-looking packets that the host machine never sees. You would have to monitor both the packets that the OS thinks it's sending, and the packets actually received by the switch, and constantly compare them for mismatches. Given the performance cost, I find it hard to believe that anyone except the most paranoid organizations would actually do this.

And of course, if you block the obvious exfiltration methods, all you do is force the attacker to do something more creative. Like modulating inter-packet timings, or even sending data to a nearby radio receiver by using the system bus as an antenna.

> How would Wireshark reveal this kind of attack? If the management chip has direct hardware access, it can hide data in innocuous-looking packets that the host machine never sees.

Lots of organizations use various forms of intrusion detection. A network intrusion detection system (NIDS) would be an off-device system which monitors network traffic for suspicious or obviously malicious packets.

It's certainly no guarantee, but somewhere along the line someone probably would have noticed something if these systems were exfiltrating data via the network using something like IPv4 headers. Specifically, a quick look makes it look like Snort (an open source NIDS) may actually be distributed with rules to alert on IPv4 reserved bits being set.

You keep saying that "someone should have noticed something" but as the old adage goes, absence of evidence is not evidence of absence

What you seem to keep missing is that we know from the Snowden leaks that the capability already exists, and NSA has successfully used implants to do data exfil in the past.

"absence of evidence is not evidence of absence"

This isn't true. Absence of evidence is weak evidence of absence, and suggests that it's not the case.

Not disagreeing with anything else in your comment, but that quote completely defies Bayes 101.

Exfiltration of logged keystrokes and other data is possible through introducing network packet jitter by the ME. This is virtually undetectable.

https://events.ccc.de/congress/2013/Fahrplan/events/5380.htm...

He's not saying that all machines are actively doing any of that, or even that Intel/AMD/anybody have already developed code to do so. He's just pointing out that this chip exists, it has to capability to do what he's described, and there's nothing that we can currently do to stop it if we're using an affected machine, as we don't have any control over the code being run. As to why the companies would do this ... it wouldn't necessarily be them if they lost control of the signing keys. And you can't ignore the fact that the FBI just tried to get Apple to do something pretty damn similar.

> And you can't ignore the fact that the FBI just tried to get Apple to do something pretty damn similar.

I was very against the FBI's reasoning in the Apple case (and in fact, I'm against their existence generally).

But I don't think that bypassing an unlock retry limit is "pretty damn similar" morally, legally, or technologically to a solution that can arbitrarily execute code remotely, on demand, and with root privileges on nearly any PC and game console in the world.

Have to quite strongly disagree with you there. The FBI wanted Apple to create and sign software that they could forcibly push onto the phone in order to get it to do what they wanted it to do. In the recent case it was about bruteforcing a passcode, but the concept is identical regardless of the payload. It's exactly the same scenario Intel or AMD could be faced with. The entire Apple situation hinged on the fact that it was possible for Apple to comply, without that there would be no situation.

To your 1): there would indeed be network traffic, but how many people have a machine they can truly trust capturing and analysing enough of the traffic going in and out of their LAN? Unfortunately there are few, if any, machines we can truly trust.

But don't we only need a few to catch them once? And don't we have at least a few?

And remember that Intel AMT etc are targeted at the same kinds of large organizations.

> without our noticing it?

Nobody noticed the bad heartbeat packets being sent to openssl for a long time.

...but eventually, heartbleed was noticed. And covertly sending large amounts of multimedia content from a PC is far more conspicuous behavior.

> multimedia content

Obviously that's not what would be sent. A keylogger would be far more likely.

Re. 1 - depends what the data and the receiver looks like and what is your end goal. If you want to "phone home" over normal network, then sure, it's going to be obvious. But if you want to preserve all the generated private keys and just send them over RF on bootup using the chip itself as an antenna? That's in the easy territory.

Yeah, all the stuff we know from the Snowden leaks are "part of a grand conspiracy theory", I guess...at least according to you.

Well is it? Or isn't it? Why do you say, "according to [me]?"

Reply on news.ycombinator.com