Hacker News Reader

Comment by throwaway613834 | Hacker News Reader

It doesn't matter if it's visible or invisible. The point is, it cannot go undetected while being used:

- If it were to periodically "check in" with an external server to see if it needs to do any kind of spying -- admins would notice the network traffic.

- If it needed to be contacted externally to "initiate" any kind of spying at all, that would mean anyone behind a NAT would be safe, and furthermore, the the moment anybody notices such a thing, it would make the headlines and get blocked on networks, so this capability would need to be kept secret and turned off except for ultra-high-value targets... which most people do not view themselves as.

View on HN

You are not giving anywhere near enough credit to those who would be your adversary.

The NSA routinely intercepted Google internal traffic. Did Google, who are presumably running the most advanced network on the planet and staffed by people who don't suck, notice the intrusion? They did not; they got informed via PowerPoint.

While the sophistication of the attackers decreases as you move from NSA to random hackers, so does the sophistication of the network as you move from Google to mid-sized businesses.

> The NSA routinely intercepted Google internal traffic

How are these even similar? Did the NSA ever send traffic of their own on the Google network infrastructure? Citation needed if so, because I recall they merely listened in on existing traffic using external network equipment.

You assume it would be used for mass spying.

Not at all.

When you have something that good, you use it for specific targeting. You get a guy with a work laptop at home, you infect him, then you use the machine to get one closer to your objective. Slowly. With time between the events. Without being a beacon in the network.

Or you just use it to spy on a guy you suspect.

Or to get access to secrets of somebody you wanna black mail.

> You assume it would be used for mass spying. Not at all. When you have something that good, you use it for specific targeting.

Did you even read what I wrote? Specifically the last sentence?

Woops

"If it were to periodically "check in" with an external server to see if it needs to do any kind of spying -- admins would notice the network traffic."

Admins would use network dedicated hardware with network chipsets driven by closed source firmware. In a crazy but technically doable scenario, that closed source firmware could contain instructions to "send packets containing magic word X to address a.b.c.d" and not reporting or counting that traffic, even to applications opening the device in promiscuous mode, with all routers in between to obey the same instructions. Not a single byte would be reported, counted or sniffed unless someone sticks a digital analyzer on the network cable.

> Admins would use network dedicated hardware with network chipsets driven by closed source firmware.

No, I fully expect there are enough admins out there running dedicated hardware whose design & source code they have access to. That is sufficient.

Given that the ME has full access to the NIC, outbound traffic could be concealed onboard traffic that is already outbound. If the adversary has also compromised network routers, the traffic could be observed and decoded without explicitly being sent anywhere.

Similarly inbound control signals could be delivered by modifying inbound traffic that the ME observed and decided.

Depending on your throughput needs the signal could be delivered subtly by for example modifying the timing between packets in a way that would be very hard to identify as a signal.

I’m hoping the ME firmware Now gets dumped and studied closely. I’m betting there are some surprises in there

It's still possible to monitor that traffic, especially at the corporate firewall level, or use a Raspberry Pi, or use an old, pre-ME computer.

Until there is evidence, this is technically just a government conspiracy theory.

It isn't a conspiracy when the feared idea has been confirmed. There is a separate os running on the cpu to monitor and control each and every single one of new intel machines.

Right, but there's no confirmation of any remote access or spying going on.

Are you so sure about point 1?

Yes? I'm not claiming every single admin would notice it, I'm just saying some competent admins somewhere would notice it. I hope I'm not proven wrong, but I don't expect to wake up one morning and read "Breaking news: No admin has noticed this strange this IP traffic to Intel/NSA/whatever for the past decade".

I agree. No one has ever observed ME sending unexpected traffic. (Feel free, anyone, to point to a counter example.)

Reply on news.ycombinator.com