Hacker News Reader

Comment by boon | Hacker News Reader

Does anyone know of how to secure against this type of thing (other than tape)?

NSA information assurance guidelines specify that one should cut the cables to all unnecessary IO devices before deploying hardware in a sensitive environment.

Not sure where that one is, but there is a wealth of data here: http://www.nsa.gov/ia/mitigation_guidance/index.shtml

It's safe to assume they left a few things out, but part of NSA's mission is to protect the communications of US interests (government and enterprise) so it actually is part of their mandate to give advice like this.

Buy hardware and software you, as the paying customer, remain allowed to control.

? Are you suggesting the problem here is people aren't allowed to control 2008 era macbooks?

I'm assuming this is a dig at Apple. Care to show that any other laptop manufacturer's webcams are impervious to having their firmware overwritten?

It's a dig at anything closed.

Why would open source hardware not be vulnerable to this sort of attack?

Two reasons:

First: peer review. If your design documents are readily available, researchers don't have to reverse engineer them. Also, by open sourcing hardware design you lower the bar for critique: you might get feedback from an experienced electrical engineer who might not know how to write and upload a custom firmware for a USB controller.

Second: you can easily change it because it's not a black box.

Care to show any Apple laptops that don't have built-in webcams?

This doesn't help here. The computer's control of the light is the problem--it's what lets the malware turn it off.

Reply on news.ycombinator.com