> Disconnect from the internet and nobody is getting in, including the NSA.

Oh boy. That's some serious delusion in 2020. Wireless cards and higher end network interface cards are independent computers. Your processor has another processor (Intel ME and others) in it. Baseband Management Controllers are also independent computers on their own right.

With closed firmware and wireless capabilities, you can never know what they're doing at a given time.

Stuxnet reached systems which were seriously air gapped. Consider a what a laptop with a witty wireless card firmware can do.

I'm not getting into TEMPEST attacks and their newer versions, passive surveillance, etc.

I've listened tales about Cisco devices which were configured to isolate and prevent internet traffic but, they mistakenly forgot to drop some magic packets. Uh.

---

Random facts about this stuff:

- Your Intel system runs a special version of Minix on its Management Engine. A version of Minix customized for Intel by its original developer.

- There are photos of Cisco devices which were delightfully enchanced by NSA before shipping to its customer via special firmware and/or hardware. NSA still retains this capability.

Stuxnet is interesting. Apparently, the US and Israeli agents threw away a number of USB devices around target facilities. What do you do when you find a USB stick? Well, eventually someone working in an air gapped facility picked up one and used it inside.

The NSA apparently perfectly aligned 4 zeros days in Siemens and Microsoft products to spread the malware from USB into the Iranian LAN (shared printers, industrial PICs etc).

The fact that they could choose and align 4 zero days indicates that the NSA probably has a large list of zeros days.

Its more nuanced than that. Didn't read the book completely but read a long report. What I remember:

- They got exact hardware details and topology of the centrifuges somehow.

- They've stolen Realtek's driver signing keys.

- The virus looks like a simple worm which can infect other USB devices and doesn't unpack beyond a certain point if it can't find the SCADA equipment and the correct device ID & topology (It's like a homing cruise missile which looks like an RC plane from distance until it finds its target).

It's possibly the most sophisticated hacking campaign when social and technical aspects combined.

> It's possibly the most sophisticated hacking campaign when social and technical aspects combined.

It’s the most sophisticated one _we know of_

And it's 10 year old now...

Frankly I expect basically all computers are compromised at this point.

And I expect all food is unhealthy, so all I eat is pancakes.

> - They've stolen Realtek's driver signing keys.

I have been to Realtek's offices in Hsinchu many times. While the other efforts may have taken major resources I don't think getting their private keys would have been hard at all. Especially back then. IMHO the building and some people could be easily compromised and I suspect they didn't really care much about security.

The hardware-software combination that was used to compromise the Iranian nuclear facilities was amazingly old and primitive, though. It truly was a weak link that I cannot fathom how this wasn't upgraded looong before. I mean, I guess it just didn't matter that much, after all, it's only a uranium enrichment facility, after all. What could possibly go wrong?

You're overestimating SCADA systems (and industrial control systems in particular) about their pace of evolution.

Some ideas about the reason they had this particular hardware and software combination:

- The SCADA hardware they got was not compatible with newer software which runs on more modern OSes.

- The SCADA software didn't have any newer version which runs on newer OSes (Windows 7 and further versions are more restrictive in terms of direct HW access).

- Since there are sanctions it was the only hardware and software combo they were able to legally obtain.

Industrial control is like automotive industry. Everything is improved in minuscule steps and by encapsulating everything in more modern carriers. A good example is MODBUS. They still carry the same data, the old way. Only thing is it's either encapsulated in USB or TCP/IP. Why? Because it works and allows perfect backward compatibility.

Since neither the hardware and the software has to run latest version of Doom (metaphorically), if the application is reliable, it's left as is. Even if it runs on DOS 6.22.

Fun fact: There's an auto repair shop in Poland which runs its main application on a C64 [0].

[0]: https://www.popularmechanics.com/technology/gadgets/a23139/c...

Morality aside, the whole system was a work of art.

If anyone is interested in this, or wanna refresh your memory, you should watch the docufilm Zero Days (2016) by Alex Gibney (most of his ‘movies’ are quite interesting)

https://www.imdb.com/title/tt5446858/

Book?

Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon - by Kim Zetter [0]

[0]: https://www.goodreads.com/book/show/18465875-countdown-to-ze...

You know, I've heard so many variations of those "USB drives in the parking lot" stories, I wonder if that isn't a cover for something else. Or maybe just someone covering their asses and not willing to take blame for something else.

"USB drives in the parking lot" could be the tech industry's Korean fan death.

> In one test of how well a USB scam can work, Trustwave planted five USB drives decorated with the targeted company’s logos in the vicinity of the organization’s building. Two of the five “lost & found” drives were opened at the organization. One of the openings even enabled the researchers to glimpse software employed to control the organization’s physical security. https://www.redteamsecure.com/blog/usb-drop-attacks-the-dang...

They are used to great effect in pentesting. I think it's natural to see a drive and think "Oh no, I need to get this back to a coworker."

I have a friend who does pentesting and she collects many cool and interesting looking usb flash drives for this very purpose. She says "60% of the time, it works every time."

I agree. I'm sure the level of this organization operates at utilizes teams of their own vulnerability researchers to provide themselves with the ability to create new and novel zero-day exploits that are not-disclosed to the big players. This is Internet warfare.

I tend to repeat these types of concerns: the number of powerful and complex black boxes are increasing, with things like 5G making it even easier to low-key pass information without us knowing.

A common counterargument comes up when discussing devices like smart speakers. Defenders say that the devices are too low-power and that we would be able to notice power usage changes and sniff network data being sent if spying were happening. IMO, this is true to an extent, but also any onboard preconfigured recognition of certain products could easily send info back to, say, Amazon servers and you wouldn't be able to distinguish it from a "false positive" question to "Alexa". Knowing the extent to which these capabilities are plausible and/or would have been caught by now if they existed is, to me, murky.

This also applies to on-board chips and wireless data. Would we not notice from power usage and sniffing?

> - Your Intel system runs a special version of Minix on its Management Engine. A version of Minix customized for Intel by its original developer.

I hear a lot about Intel's ME, but not much about AMD's PSP. I assume it's just as bad. At least we know how to hobble the ME.

> At least we know how to hobble the ME.

No, we just think we know how to hobble the ME.

I'm actually kinda curious if TEMPEST attacks or similar have been used spy on citizens ever now.

Here's a hobby-grade GSM modem dev board you can add to any 'offline' device for $40.

https://www.adafruit.com/product/1946

There are cheaper alternatives. A basic SIM800 based board can cost just above $3 on Ebay, probably less on Aliexpress, or less than $10 for a similar one with Raspberry PI compatible connections (useable with other systems as well). Also interesting is the SIM7600 module which supports 4G LTE down to GSM plus GPS. Also available in Mini PCI-E boards.

https://www.ebay.com/itm/191879410081

https://www.ebay.com/itm/292237166116

https://www.ebay.com/itm/293802495042

Dang i might have to order some, thanks!

Fine, make a Faraday cage around the PC. Are you happy now?

Not enough: https://news.ycombinator.com/item?id=24919589

> - Your Intel system runs a special version of Minix on its Management Engine. A version of Minix customized for Intel by its original developer

Not on all systems. It's neutralized and disabled on my Librem 15: https://puri.sm/learn/intel-me/.

When Russian hackers discovered and started using Intel ME backdoor Intel immediately published (already prepared?) instructions on how to disable it...

Please stop posting this disinformation.

How is this disinformation? The Intel ME is replaced with zeroes, except a few percent: https://puri.sm/posts/neutralizing-intel-management-engine-o..., and it’s hardly functional.

The Intel ME is a circuit, not a software program. You can't "overwrite" it. And the HAP bit doesn't do what you think it does:

https://twitter.com/rootkovska/status/938458875522666497

You can overwrite most of it: https://github.com/corna/me_cleaner. AFAIK such overwriting will fix the bug in your link (and this is exactly what Purism is doing).

> Disconnect from the internet and nobody is getting in, including the NSA.

Wait until they put 5g chips in every single product to make them "smart". Few people talk about that but I believe it's the main use case for 5g. Everything will be connected and you'll have no way to opt out

> 4G can support about 4,000 devices per square kilometre, whereas 5G will support around one million

Who pays for the connection?

I assume for the radio to stay on, it's either subsidized by the parent company (Amazon pays for Alexa's 5G) or I'm paying for a subscription (Xbox subscription pays for 5G on some future mobile XBox)

Maybe you could get the cost down to $1 / month. If you invest $400 in the market it should pay out about that much, so you could make it a one-time payment of $400 for a 5G chip.

Consumer network connections, of any kind I'm aware of, don't go down to $1 per month. Maybe with a big volume order and a low bandwidth cap the cell companies would do it, or maybe 5G itself is just cheaper, but where does that monthly cost come from?

I have no answer but the amount of data that could be collected and the possibility to transmit ads to anything with a speaker or screen even if they're not connected to your wifi would be attractive to many companies.

> Disconnect from the internet and nobody is getting in, including the NSA.

That is patently false.

> Disconnect from the internet and nobody is getting in, including the NSA.

Ah, the "just move to the wilderness and grow your own food if you don't like the government infringing your constitutional rights" argument. I want to be able to meaningfully engage in normal society by buying consumer goods and connecting them to communications platforms and I want my 4th amendment rights protected. I really don't think that is too much to ask.

a little interdiction while that new airgapped laptop is shipped to you and they got you, even though you never connected to a network

Exactly what have they got, if you never connect it to a network afterward, either? A key-log that never makes it back to them?

(I’m presuming here that the laptop is openable, and that you will do so and physically remove any wi-fi M.2 card from it — and associated antennae — since you won’t be using it. There might be some sort of extra surface-mount snooper chip left onboard that could replicate the same function — but without big antennas, how’s it going to report?)

You might not understand the depth to which you can be exploited. They will simply let you use your laptop and switch your USB cable, which has a built in 6ft antenna.

https://en.m.wikipedia.org/wiki/File:NSA_COTTONMOUTH-I.jpg

Researchers have been able to make integrated circuits emit radio waves.

Perhaps with something like this?

https://www.schneier.com/blog/archives/2014/03/ragemaster_ns...

Or this?

https://www.schneier.com/blog/archives/2014/03/cottonmouth-i...

If you have actually attracted the attention of the NSA, pulling your NIC is playground stuff.

Ignoring the larger context, but just technologically, RAGEMASTER sounds freakin' sweet. Like that's actually amazing.

And it can add a slight flicker that can be used as a signal and detected from outside.

Hope you have your bluetooth also turned off

And your mic and speaker. And the light sensors while you're at it. All can be used for exfiltration.

And never use USB devices (see: BadUSB).

or rather they're not getting in _or_ out. they might already be in. as long as both in _and_ out are disconnected, you're set.

A 2g or 3g module is <$100 and easy enough to hide without RF detection equipment. Plain radio is easier.

If the NSA has enough of an interest to be intercepting your packages, they're not going to shy away at adding in a transmitter or two of their own preference.

Quite considerably less. This one from Adafruit (hardly the cheapest supplier) is $30 and has GPS built in too: https://www.adafruit.com/product/2637

And yet I have to buy a new phone because 3G is getting shut down.

I guess if I was the NSA I'd bring my own Stingray, but then you have to amortize in the cost of the van.