Hacker News Reader

Comment by vacri | Hacker News Reader

Wireshark or similar network sniffer. Any phone-home is going to require using the usual channels to get out of your location to the general internet. Things like TEMPEST require external sniffers; an autonomous agent will have to use what is going to be available, and your modem isn't going to be transferring custom protocols... and if it is, then the ISP's equipment probably wouldn't. And if all three units are, well, things are worse than we could have imagined, but you'd be talking about a conspiracy that would require the silence of an incredible amount of people.

View on HN

This is definitely a pure conspiracy theory, but there have to be hundreds of readily usable side-channels for transmitting information out of a compromised box that wouldn't show up in Wireshark unless you knew exactly what to look for. Think biases in timings or not-so-random bits in client-generated TLS values.

This is a good point, but remember also that those packets have to go somewhere specific - the information may not be encoded in the bits, but in the timing instead. This being said, the information still has to arrive at its destination.

We're talking about an adversary that potentially taps and stores all traffic at major endpoints worldwide. They packets have to go further than a few hops, but not to a specific destination, not necessarily.

Think taping a playing card to the spokes of a deaf person's bike. You won't automagically hear it when they're riding it in the basement, but if they ride through the streets, you'll know.

Don't know why you were downvoted, it's a valid concern. It won't be "phoning home", though -- you only can phone the so called "global adversary" this way (because you can't send packets to arbitrary addresses).

Also, messing with TLS probably won't work at all. Messing with e.g. MTU sizes, IP sequence numbers and perhaps TCP options, on the other hand, could probably work.

There's nothing quite like a good conspiracy theory to start the morning, I read your comment and thought, "Gosh, encoding phoning home spyware that way would be straight forward to implement on top of an automatic updates feature."

I won't say I am a bit more paranoid, rather I am amused by the thought that I could be, but for the understanding that the technical details are so raw that there is no avoiding such exploits once anyone is granted my trust.

Scariest subthread in months. Steganography that doesn't depend on packet contents, but on metadata that seems ephemeral, insignificant, and/or arbitrary. If all of the traffic on a few large pipes has to pass through you, I don't see how this wouldn't be both straightforward to implement and undetectable.

If this hasn't been done, it will be.

Reply on news.ycombinator.com