Hacker News Reader

Comment by autoexec | Hacker News Reader

> I'm more confident that local apps on my Linux desktop are secure

Why should you be? Linux gives us software we can reasonably say we own, but not hardware. Everything you type into your local linux apps can be being monitored by your processor and whatever is sitting in the CSME/PSP subsystem which you don't have permission to access, but which is always running even when your computer is off. We need fully open, documented, auditable hardware if allowing any third party access to our devices means our private documents will make us all into criminal suspects.

View on HN

Most of the hardware isn't made in the US, so either the spooks would need agreements with every offshore business, intercept every hardware shipment, or convince every vendor operating in the US, even if they are not locally owned, to do this for all hardware sold here, and convince all of these offshore vendors not to ever leak the fact that it is happening.

On top of that, the data has to pass through several layers of routers and access points we control, which makes at least the fact of exfiltration visible. Plenty of people have a very strong vested interest in preventing data exfiltration from company hardware and so the government would have to somehow get in touch with every one of them to tell them to stay quiet before they leak any hints of it happening.

It's possible for targeted shipments, but the prospect of it being done for all consumer hardware sold in the US is a bit far fetched.

> Most of the hardware isn't made in the US

We know for a fact the government does intercept hardware shipments already on some scale. It's a lot easier when there are only a few chip makers being used for most devices. Intel and AMD alone cover the vast majority of the CPU market for desktops and laptops. It's basically the same situation for the wireless chipsets in every mobile device. No need to worry about dealing with about every cell phone manufacturer directly when you only need to hit up the extremely small number of companies every manufacturer has to get their chips from.

> Plenty of people have a very strong vested interest in preventing data exfiltration from company hardware and so the government would have to somehow get in touch with every one of them to tell them to stay quiet before they leak any hints of it happening.

Whistleblowers are extraordinarily rare. Edward Snowden worked with many many others. Any of them could have come forward at any time, but they didn't. Only one AT&T employee came forward to tell the public about Room 641A (https://en.wikipedia.org/wiki/Room_641A). The government marched into AT&T's building, took over part of their offices, rerouted their network and the whole AT&T backbone into their offices and through hardware. You can bet that more than one person noticed that. Government has no problems at all with going to a business with guns and gag orders and telling people to keep their mouths shut. Companies have no problems keeping quiet about what's happening either.

No one who isn't directly in the know is going to notice if someone's CPU (which is running it's own network stack) sends a few extra encrypted packets going to the servers of major internet companies (microsoft, cloudflare, apple, google) to either be collected at those end points or just picked up as it passes across the internet backbone.

Maybe if we had a ton more competition in things like chip makers, ISPs, operating systems, etc. it might be more difficult, but the way things are it'd be easy.

Yes, I mentioned the Tailored Access Operations NSA unit in a sibling comment. The thing is, open source hardware won't save you from any of this unless you have the manufacturing skills and equipment to build it yourself. Just like with open source software, if you aren't building it yourself, with your own hands, you can't be sure that what end result you have actually matches the code that you've read, unless there's a published checksum that you've also verified is real. Quite a bit harder to do with hardware than software though, especially since every single piece of the stack, including monitor cables, have been targeted by TAO.

> Plenty of people have a very strong vested interest in preventing data exfiltration from company hardware

The US government's own digital security people disable Intel's management engine on sensitive servers. What does that tell you?

NOBUS.

Companies like Google and Microsoft pay top dollar to build special workstations to interact with production systems. These are not just special because of the software they run, but also the chips these machines are built with.

Sure, I'll take your comment at face value, not all consumer hardware has spyware, but it cannot be ruled out now, in the future, or at least now for targeted high value customers.

That’s… really not true or at least not as dramatic as that statement makes it sound.

Those “special workstations” are mostly about lack of features they view as potential attack vectors (external or internal motherboard ports, replaceable/non-soldered components, thunderbolt, anything extensible or “repairable”) and mandate certain hardware features (hardware tpm, locked secure boot, locked UEFI). Other than that, those workstations are Lenovo, Samsung, or Dell machines running typical chips. They may pick certain CPU models or chips but that’s mostly about avoiding new or “cool” features that may not have matured enough yet. Most of them are moving to thin clients though. Where you use that “special workstation” to remote into an VM that can access production systems. And that part is partially about controlling the software running in the VM and making sure updates can be forced “offline” on the VM even if you haven’t connected to it in few weeks.

> but it cannot be ruled out now, in the future, or at least now for targeted high value customers.

Well, sure, there was NSA's Tailored Access Operations unit which interfered with all kinds of hardware, even computer monitor cables:

https://www.nbcnews.com/tech/tech-news/report-nsa-intercepts...

For these kinds of operations, open source hardware won't save you unless you build it yourself, much like open source software. At the end of the day, you're hoping that the pre built thing matches what it claims to be.

The hardware case of TAO is still targeted and didn't rely on the manufacturer's compliance and secrecy for their entire line of products, though. The scale of that to my mind is quite the qualitative difference.

This is (seems) impossible.

You can have open and auditable hardware, but how can you be sure that the hardware you buy is exactly the same hardware as what's in the Github repo?

It's true that you'd have a hard time knowing a chip wasn't swapped someone on its way to you. There are a few things that would help but nothing easy. Getting the hardware into retail locations so that anyone could walk in off the street and buy a system with cash. Random spot checks, chip by chip. Packing the system in colored beads/rice to prevent tampering after it's in a box.

At this point, even if I could never be sure my system was secure, just knowing that systems were purchased, tested, and verified would make me feel a lot better. It'd be nice to have confirmation that it's even possible to make and sell a system that isn't backdoored in this country.

Reply on news.ycombinator.com