Hacker News Reader

Comment by fencepost | Hacker News Reader

He's suing to get them back and for compensation for having to "temporarily" replace them, but even if he wins he probably shouldn't trust either device in the future (possibly more so for the laptop).

View on HN

>he probably shouldn't trust either device in the future (possibly more so for the laptop).

Seems risky for the government to put any firmware/hardware implants on those devices. The user is naturally going to be suspicious of it because the government had unrestricted access for days/weeks. So there's a high chance that the user might not even use it or will send it to an expert for analysis. If discovered, it's going to look extra bad for the government because there's no doubt that they did it.

Suspicious, sure, but most users aren’t equipped to do that kind of diagnosis, and many won’t be able to afford new devices, and maybe it will look even worse for the government but I am certain absolutely nothing bad will happen to the people who added the malware.

But in this case the EFF would love to do a forensic examination.

$30 smartphones exist.

Or if the implant was software based, they could release the code so it can be flagged in antivirus / the hole patched.

Call me paranoid, but i'd be putting those devices into a heavy duty shredder if I got them back.

Why — security researchers would gladly buy them for a nonzero sum.

That would mean giving away your private data you had on the device to security researchers as well though. While I would want to have such device analysed, I am not sure I am fine with that compromise.

Nah, you wipe the drive and then give it to them, so they can check for firmware hacks.

Eh, wipe disk (or install a new one), re-install OS, and if you're super paranoid then re-flash BIOS and you should be good to go.

That's literally useless for government sponsored persistent malware.

Can you expand on this? I'm curious and a little Googling didn't yield much

Many of the more technically advanced governments create and/or buy malware which is able to persist in places other than just your hard drive and BIOS.

As it seems you're new to the idea, look into APTs for a general understanding of how persistent threats can be useful when they're embedded into a target:

https://en.wikipedia.org/wiki/Advanced_persistent_threat

The mechanisms for persisting outside of HDD/SSD data areas and the BIOS can vary. There are a lot of support chips in computers and peripherals. For example, Intels AMT (supposed to secure PCs) has been shown by researchers to be a useful place to put malware.

https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

I'm not personally sure if there's active malware using that vector yet, it's just an example. But it also wouldn't be even slightly surprising.

Does that help? :)

Some russian hackers at DEFCON a few years back handed out power cables that leaked data via the hotel's power system.

I've also heard of altered USB-C power cables being used to exflitrate data, and a software-altered USB port used as a radio wire

Snowden revealed that the government is capable of planting malware in peripheral firmware. So you can have a hacked bios/EFI, system controller, security chip, hard drive, SSD, GPU, WiFi/networking card/chip that is virtually impossible to detect from the main OS.

Yes, if determined the government agencies have tremendous capabilities. But will they use it at a large scale, i.e. against an arbitrary lawyer?

I’m thinking maybe this guy was flagged because he is a lawyer and might have sensitive information on a person of interest.

Maybe they put a keylogging device between the keyboard ribbon cable and the motherboard? Say this device exfiltrates keypresses via a radio and a government agency, knowing where you work or live, can then pick up the data wirelessly.

It’s a bit sci-fi, but well within the resources of any of these governments.

Security goes beyond technical means. Sometimes it also involves keeping an eye out for flower delivery vans.

If the bios is corrupt it can corrupt the OS. So that the OS does not really flash it. Or there might be a hardware exploit that makes it look like the bios is being flashed while keeping the corruption or one that injects the corruption after each bios flash. In general if the HW has been modified it would be really hard to detect the exploit.

I think we simply don’t know in this case.

But if a super sophisticated approach is used, they could just as well catch and prepare your computer before you receive it i.e. if you ordered it by mail.

Apparently that's already been happening for years:

https://www.theatlantic.com/technology/archive/2013/12/nsa-i...

Seems like a one-size-fits-all approach leaves gaps in targeting, so something a bit more Tailored for the others make sense.

Reply on news.ycombinator.com