Hacker News Reader

Comment by zellyn | Hacker News Reader

The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?

View on HN

Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work.

If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.

There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/

Now they are in the SMC and the secure enclave.

As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?

>Five years is a pretty good run.

For a project this big & complex, and for something that cost hundreds of millions of dollars to develop, 5 years is paltry. Duqu remained hidden for 11+ years.

Reply on news.ycombinator.com