Hacker News Reader

Comment by grandalf | Hacker News Reader

Of all the attacks a nation state could do, surely finding a few talented people to get PhDs in the appropriate fields and go to work at Intel and collect a paycheck along with a nice stipend from the nation state is likely among the easiest.

View on HN

Why bother with employees - just go give money to intel to do this. Intel as a system is designed to produce chips that work a certain way, and my understanding is that said system is rather good at what it does, dedicating the time and energy of many rather smart people to making sure things work the way they're supposed to. Why risk throwing a monkey wrench into such a system when you can just point it in a different direction?

AT&T and Verizon don't have 'plant' employees. Much simpler - and legally, safer - to just give the bag of money straight to the corporation.

>Why bother with employees - just go give money to intel to do this.

Risk of refusal. Risk of intentional or unintentional leaks.

Plausible deniability goes a long way toward preventing a mass exodus from one's platform.

When you have the kind of money and influence that the NSA and CIA have, you probably do both.

As for other friendly and less-friendly nations, I'd be very surprised to learn that there weren't any other nations represented in the ranks of Intel engineers.

There's more than one country interested in pulling off these attacks. The US can say, "Do us this favor and we won't look too hard at your tax avoidance schemes," but China or Russia might have an easier time planting a few employees.

Probably easier to find an existing employee with financial problems and offer a duffel bag of cash to plug in a USB stick for 30 seconds.

This is like the opposite or corollary of the "$5 rubber hose" cryptography cracking device.

Did you mean the xkcd "crypto nerd" wrench, or is this a reference to something else?

E: ah, TIL. https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis

Better still, infect his USB stick without him knowing.

I'm not sure it's all that easy, since a) you can't know exactly how good someone is going to turn out to be (you can probably get close through), and b) you can't tell what Intel will be hiring for later, and c) to increase your odds you probably want more than a few people in this program to achieve at least a few people being hired in positions that are useful.

That said, the main hurdles seem to be managing people and funds, which government agencies seem pretty good at figuring out. So maybe not all that easy, but maybe not particularly hard either. The biggest problem might be keeping it secret, given the number of people that might need to be involved that are clandestinely working for a TLA but not as their main job and not steeped in the culture of secrecy.

Isn't it unlikely that an individual engineer (or even a handful) could effect a design level compromise on such a massive project as building a processor? Not only because of the managerial oversight they'd have to circumvent, but because of the overall system complexity. As sibs have pointed it, it would seem much more practical to just compromise Intel at a corporate/managerial level.

> Isn't it unlikely that an individual engineer (or even a handful) could effect a design level compromise on such a massive project as building a processor?

Yes, very unlikely. Something like the Intel Management Engine would be a much easier target.

Reply on news.ycombinator.com