Http://www.google.com/wo0dh3ad

Re:Http://www.google.com/wo0dh3ad by pmjordan on Friday January 07, 2011 @06:46AM (#2079281)

With this scale of access to the network infrastructure[1], I'd be worried about them injecting drive-by downloads of browser exploits which install trust for a root certificate controlled by the government. Once in place, MITM attacks on https are possible. The tricky bit would be telling apart requests from compromised machines and uncompromised ones. (attempting to MITM the latter will cause the browser to start jumping up and down, potentially raising suspicion)

Even more scary is the thought experiment that Microsoft might cooperate with the Tunisian government and allow installing trust for such a root certificate via the windows update mechanism. (I have no evidence that this actually happens, it just seems a convenient vector)

[1] They're under no time pressure and can transparently proxy every single TCP connection and IP packet if they so desire. They control DNS.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by wladimir on Friday January 07, 2011 @08:12AM (#2079421)

If you want scary, what about bribing Intel and AMD to include 'propietrary instructions' for your government?

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by pmjordan on Friday January 07, 2011 @08:34AM (#2079463)

Seems a little far-fetched and overly complicated for carrying out a practical attack.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by wladimir on Friday January 07, 2011 @08:43AM (#2079481)

Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already.

Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by pmjordan on Friday January 07, 2011 @08:56AM (#2079506)

You'd still need some kind of software support to trigger the exploit. At which point you may as well go with a software-only attack.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by wladimir on Friday January 07, 2011 @09:17AM (#2079575)

Naah, if it's simply a few added instructions I agree with you.

But let's think in a wider scope (disclaimer: this is not my idea, I remember reading about it a long time ago): what if a certain cryptographic "magic code" at the beginning of a memory page would trigger the execution of arbitrary code embedded in that page?

Such a thing could be triggered over the network, wireless through bluetooth/wifi, or by specially crafted images on a webpage, or whatever creative technique you can think of. It'd effectively give the govt instant root access to any device with the affected CPUs.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by stcredzero on Friday January 07, 2011 @09:44AM (#2079655)

Stuff like this would be easy to hide in the guise of "Hardware DRM."

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by wladimir on Friday January 07, 2011 @11:31AM (#2079989)

Yes, I guess on-processor DRM and any kind of virtualisation (will the real hypervisor please stand up?) are prime suspects for this kind of thing. But they are also the most obvious, it could be cramped into everything.

It'd be mighty interesting to tear apart / scan / reverse engineer some modern CPUs like they did with the 6502. Then again, these beasts are so complex that's similar to looking for a needle in a galaxy-sized haystack.

[ Parent | on HN ]