Did this Tor developer become a victim of NSA's laptop interception program?

For fuck's sake, the most popular show on television centered on government conspiracies.

The millenials did not invent distrust of the government.

Of note, when searching Amazon for "NEW and ORIGINAL IBM Lenovo Thinkpad Keyboard 42T3209 42T3177", I find one seller ("u fix it", who "Ships from TN") selling that item. Assuming that's the seller Andrea bought the keyboard from, that clearly doesn't jive with the tracking information, which shows the item shipping from California.

1. Amazon transposed a tracking code.

2. A third-party reseller transposed a tracking code.

3. USPS transposed a tracking code.

4. The tracking code is correct, but an error in USPS's backend showed tracking data for another shipment anyway.

5. The tracking code is correct, and the tracking data is correct, and the package went to Virginia because USPS screwed up.

I've personally seen #5, and none of the others are all that hard to believe.

A few comments:

• This "low-level operative" was a system administrator who used social engineering to obtain other people's authentication credentials and gain access to material to which he wasn't authorized. He wasn't the janitor or some clueless field agent.

• Did Snowden expose operational shortcomings? Absolutely. A lot of the programs that have been publicly revealed through his leaks have been running for over a decade without ever seeing the light of day, though. That tells me these "pervasive operational shortcomings" aren't very pervasive. (If they were, the NSA would be absolute shit at their mission.)

• I don't think Andrea is a "high value target," or at least high value enough to risk compromising whatever method they might use to bug her keyboard. I don't say this to belittle her or her work in any way — she seems to be a skilled programmer/hacker/infosec person. And that's exactly why this whole "the NSA is bugging her keyboard" theory doesn't make any sense.

Let's assume for the sake of argument that the NSA had planned to bug her keyboard, and that keyboard is now sitting in an NSA (or contractor) facility in/near Alexandria, Virginia, waiting for some modification to be made before shipping it back out. But, oops, they screwed up and forgot to fake the USPS tracking information. They know she knows because she tweeted about it. She's also tweeted that she can never trust the keyboard if/when it shows up. Why would they ship her a bugged keyboard at this point? If/when the keyboard shows up, she's probably going to take it apart and share anything interesting she finds with the world. There will be hard evidence.

Even if they hadn't bungled the tracking information in our hypothetical argument, they're risking exposure of the exact methods they use to bug a machine for not much potential gain. (Remember, Andrea's a skilled hacker/programmer. There's a very good chance she'll figure out what's going on and tell the world if she has any inkling that her laptop's been tampered with.)

• The keyboard she ordered fits a ThinkPad T60/T61/T400/T500 (and the equivalent "R" models, plus a few others). Internally, the keyboard and TrackPoint speak PS/2. While they could log keystrokes to an on-board chip and transmit keystrokes via radio, there aren't any especially interesting things the NSA can do to her laptop via a modified keyboard. They certainly won't be rooting it that way.

• I said that I don't think Andrea is a "high value target," despite her work on Tor, because everything about Tor is open. Anyone can download the code and see exactly how it works. The protocol is well-known. There's no curtain to peek behind and gain strategic information about Tor's workings.

So while I don't reject the argument that the NSA is trying to bug her laptop as impossible, I think it's exceedingly improbable. My money's still on "seller screwed up the tracking number."

I also like the part where the NSA is guarded by the Catch-22 "it wasn't them, because if it was, you'd never know", such that that there's no scenario in which you could be convinced that the NSA did anything.

The flip side of this argument, which everyone here seems to be clutching onto and running with, is that if the NSA is capable of it, they're doing it at every available opportunity, even when it doesn't make any sense to.

But there's a different direction to look at it from: What is the probability that someone's laptop was compromised by the NSA?

This is approaching 100%: we know that they do this.

And I think you misunderstand. I am not arguing that it "could not be" the NSA. And I haven't see anyone say that. I am simply arguing that it is extremely unlikely.

It's a guess, yes, but it's an informed guess. It's a matter of looking at probabilities and seeing what's more likely. Shippers screw up all the time. Packages make crazy detours because somebody tossed a box in the wrong truck. A label falls off and a mixup occurs. Somebody typos a tracking number.

On the other hand, for this to be the NSA, several unlikely things would have to be true:

1. The NSA would need to be intercepting computer equipment destined for certain people and modifying it to spy on them.

2. The NSA would need to be targeting the person in question for this program.

3. The NSA would need to have set up this program in such a boneheaded way that it shows up on a package tracker. (If I were in charge of this program, I'd just set it up in FedEx's sorting facility in Memphis and then ensure all the relevant equipment uses FedEx. Simple, fast, and no chance of the target finding out.)

4. The NSA would need to have set up this program in Alexandria, even though it has little to recommend it for such a thing.

Now, we know that #1 is actually true. So that's one requirement fulfilled, out of several. But what about the rest?

I'm somewhat skeptical on #2. It's possible, but it seems unlikely. Why would the NSA target Tor developers? The security of Tor falls apart in the presence of an adversary that is able to monitor the entire internet, because you can just correlate traffic that enters with traffic that exits. The NSA can presumably monitor enough of the internet to defeat Tor right now. So why bother spying on Tor developers? It's possible as a belt-and-suspenders maneuver, but this person just doesn't strike me as a likely target.

I'm really skeptical on #3. It's about as believable as having the FBI spy on me by parking a van outside my house that says "Flowers By Irene". It's possible, but really unlikely.

And #4 doesn't make a whole lot of sense to me. Again, possible, but unlikely.

So we have one thing that's true, and then several other things that are individually unlikely, and combine to be really unlikely. It looks to me that people are committing the basic fallacy of thinking that the truth of #1, since it's unlikely, somehow makes the rest more likely too.

It comes down to this: is it a screwup by USPS or Amazon or a third-party reseller, or is it the NSA screwing up royally while trying to plant a bug? In the absence of evidence, we are stuck guessing, but we can guess intelligently by realizing that one is vastly more likely than the others.

"When you hear hoofbeats, think of horses not zebras."

That doesn't mean zebras are impossible. But it means you should prefer the more obvious explanation unless there's evidence to the contrary.

BTW, UPS would be particularly good for intercepts, because UPS operates an electronics repair facility that does factory authorized repairs. When you think you are sending your broken laptop by UPS to, say, Toshiba, it can get automatically diverted to the UPS repair facility a couple miles from the hub, where Toshiba-trained technicians do the repair.

This means that a laptop shipment being diversion for the NSA would not even have to be done with some secret diverter on the line somewhere. They could just make it look like an ordinary repair job. The repair facility is large. Who would know if one or two of the repair technicians are really NSA agents?

Now, if this EC chip is vulnerable, a malicious keyboard can have direct DMA access (just like FireWire controllers, EC is usually connected to the main PCI bus)... no need for drivers here.

In any case, a malicious keyboard can simulate keypresses and pwn your machine that way. No evil driver needed.

Connection-wise it looks like this:

http://i.imgur.com/ayFybSd.png

Keystrokes can be dangerous on their own but engineering a solution to this that assumes the correct state of the machine and can operate software is unlikely simply due to the margin of error.

The overwhelming likelihood is that the package simply took an unusual route due to factors that are unknown to us. For this story to be true, it would require a level of incompetence that is orders of magnitude beyond that which we have previously seen from the NSA.