lainchan / sec

BEWARE

Liet Kynes · 2019-08-01 22:56
It is becoming increasingly serious. Why? Package interception and the bulk purchase of key devices off of craigslist/ebay/amazon/etc. for the implantation of modified hardware with minimal physical or operational impact. I've noticed a great shortage of laptops on a certain sale website recently, and I have my suspicions. Consider the implantation of a modified CPU. For this to be effective, they would need to contract with the parent company, most likely Intel or AMD for designs, which they then would need to modify themselves or send a modification request to the parent, where the design then needs to be manufactured. This is assuming of course that Intel/AMD aren't already complying/always have, and seeing how Intel has the ME, AMT, the HAP bit, PSN, and other technologies, this is most likely the case. PROCESS: >Identification of key devices (Example X60) >Fabrication/Identification of components presenting opportunity for modification with minimal chance of impact. >Interception of packages known to contain key device, or all if resources permit it. >Bulk purchase, modification, and resale of hardware on websites such as Ebay. Everyone is now impacted. >Individual purchases modified device, no knowledge of process. Proceeds to use device. This is a MAJOR problem that has no easy solution. An entirely different MB is an obvious indicator, and they aren't dumb enough for this. The process of CPU fabrication is far too complex for backdoored alternatives to be manufactured. So then, we are left with the small yet mighty devices of the computer: The controllers. Controllers for keyboard, mouse, screen, chipset, and other components with extended capability. They aren't going to stuff a modem into a capacitor. If it isn't obvious by looking at the MB physically, then it most likely never will be. Power demands could be measured, but such measurement requires precision devices that aren't cheap nor easy to employ. The device doesn't have to send data to an external entity, but could perhaps store data onboard for a "neighborhood burglar" to come and steal the computer in a few weeks. I am at a potential risk by using the computer I am at the moment. They are not dumb, they know what we know. They ARE DOING THIS RIGHT NOW!
Emmanuel · 2019-08-02 00:31
>I've noticed a great shortage of laptops on a certain sale website recently >X60 Are you talking about a shortage of 13 year old meme machines being evidence of a government surveillance program? Because that's fuarrrking stupid.
Sabo Engle · 2019-08-02 00:50
>>8102 Those "meme machines" are what privacy oriented individuals are most likely to use because of libreboot and their general build. Especially due to their publicity. With everything they are doing to circumvent peoples security, it would be wise to target the people most likely to be important by targeting the hardware they are most likely to use? What alternatives are there? A Sun fire T1000? Good luck getting an activist/journalist/person in need of privacy but not technical skill to use one.
Debbie Charteris · 2019-08-02 02:44
>>8103 You may be overthinking the supply situation.
Roger Pollack · 2019-08-02 04:26
>>8104 I distinctly remember purchasing one and there being great variation in their availability to the point of me spending much time looking for one of good price and features. This was of course a few years ago, but now there are barely any (<3 Ads) which I find suspicious. DESPITE THIS, package interception is still a major problem. Why is it that you are avoiding the main topic of my post?
Roger Pollack · 2019-08-02 05:05
why would they do that when they could just use the pre-existing hardware backdoors?