Hacker News Reader

Comment by saagarjha | Hacker News Reader

> This driver was digitally signed by Realtek

> that driver started signing it with secret keys from JMicron

I think this is the scariest part of the worm. Not only do the people writing it have access to zero-days, they also somehow have (possibly physical) access to the private keys of two large corporations.

View on HN

Nah, this is almost easy. In comparison, Flame used a previously-unknown (and still unknown AFAIK) method to compute MD5 collisions on a certificate, which was used for a signature.

https://arstechnica.com/information-technology/2012/06/flame...

This isn't stealing a cert or burning four zero-days. This is dropping a zero-day cryptographical attack, which hasn't been reverse engineered yet.

Also: we only know about this because one of the world's best hash-collision experts, Marc Stevens, wrote a tool to detect the method of collision used when we have two different cleartext with the same hash.

He's also one of the minds behind shattered.io ; which happened because Google decided to invest some resources on his research (estimated at around ~300k). Imagine if he "simply" took a job working for an intelligence agency ?

I'm not so sold on the belief of the author the keys were kept under best security practices.

Both from Taiwan I see. So if the parties involved have some pull with their government it could be that. They also could of: bought them, cracked them or as you said stolen them.

*could have

Try not to think about how many SREs in the big five are likely receiving a second secret paycheck from Langley and/or Fort Meade.

Interesting. This is the first time I've seen a public comment anywhere about a strong suspicion I've held for more than 20 years.

It seems obvious to me. Want to illegally snoop on someone’s iMessages? Don’t compromise Tim Cook’s plausible deniability, just get an asset to climb the ladder until they can touch the systems that send the list of keys to the target device. Same goes for signing malware binaries for evil maid against iOS devices, chromebooks, et c. There are controls you can put in place as an organization to make this harder, but not impossible; eventually human beings are going to be handling keys and senior management isn’t always going to be in the room to make sure NSLs aren’t being handed out.

“Keep this quiet or go to the same jail in which Manning was tortured basically to death” is a pretty persuasive argument.

The fact that Google was asleep at the wheel so long wrt encryption of internal network WAN links (I mean, wikipedia has an article about the double-hull sub that the navy uses to tap intercontinental fibers) suggests to me that most Googlers (and despite organizational differences, also most Apple and FB and Amazon staff (outside of govcloud)) simply aren’t thinking about the illegal lengths to which the military will go to obtain huge amounts of information about possible threats to their safety, security, or persistence methods (e.g. whistleblowers).

It’s like the industrial rank and file never read the military-industrial complex speech, even while hearing their bosses take off from Moffet using taxpayer jet fuel. [1]

[1] https://www.wsj.com/articles/google-jet-fleet-loses-a-nasa-f...

> “Keep this quiet or go to the same jail in which Manning was tortured basically to death” is a pretty persuasive argument.

You don't even have to speak about it. Not cooperate, and you'll go to jail.

https://www.washingtonpost.com/news/the-switch/wp/2013/09/30...

Some secrets keep themselves.

They mentioned they were Tawainese comapanies. I’d bet it was stolen rather than passed to them by some insider.

The hard part was writing the worm and getting it in to the facility, not getting in to Realtek's network. I would bet.

Didn’t the CIA drop USB sticks around the enrichment facility? I read that somewhere trying to find the source.

If I were to guess, probably many different types of media. Music CDs, DVDs disks, usb.

Maybe those types of facilities are 99% focused on keeping data from leaving. But employees were bringing plenty of media to listen to while watching the monitors before stuxnet.

A typical facility would likely scan that incoming media and pass it to you later if it was okay’d. You aren’t allowed to ever take that media out again, however.

I’m just guessing though.

Yeah, if you've got a big budget, state sponsoring, and years to plan how to steal a signing key from a foreign company, I'm not going to bet against you.

What is the legal situation with this? I mean, forget for a second that illegal things are done all the time, I presume it would be unconstitutional were the CIA or NSA found to be paying google engineers? How big of a scandal would this be, or is it kind of tacitly understood in the way that black-budgets for large projects are?

It would almost be as big a scandal as someone sharing internal slides showing secret programs to illegally and unconstitutionally spy on every person with a cellphone in their own country.

Or perhaps a video of a high ranking intelligence official lying to congress under oath, whilst answering questions received in advance, and then never being prosecuted for perjury to cover up such illegal activity.

So, not a big scandal at all. Page 2 news.

Reply on news.ycombinator.com