News for hackers. Stuff that matters.

A comment on Air Gapping a MacBook Air: The Great BCM15700A2 Mystery. Parent comment

Re:Air Gapping a MacBook Air: The Great BCM15700A2 Mystery by viraptor on Saturday July 14, 2018 @07:48AM (#17529943)
> If they achieve access to a target, it's likely they control a path to it.

Without specific, documented cases this is speculation of course. But I don't see why they'd use a link level protocol. 1. It requires patching multiple networking devices in the path, which is not very quiet. 2. It sticks out in any monitoring (via mirror ports) more than a UDP packet to a random host. DNS or ntp as a transport would be much simpler to hide.

[ Parent | on HN ]
Re:Air Gapping a MacBook Air: The Great BCM15700A2 Mystery by amoshi on Sunday July 15, 2018 @02:15PM (#17536313)
And what exactly would be the problem for the NSA with patching networking devices? They even mention how it's useful specifically for these hard targets

>"some of the most productive operations in TAO because they pre-position access points into hard target networks around the world."

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

[ Parent | on HN ]