It is public knowledge that US intelligence agencies actually just hijack computers and equipment on their way to the customer and install hardware backdoors there (Snowden et al., 2014).

It is also known that they have had backdoors in commercial systems as they came off the shelf, but I think usually those were CIA owned and controlled companies like the crypto AG phones.

What is unknown (pure speculation) is whether, for example, Intel CPUs come backdoored straight from the factory floor? On the one hand, that would be a powerful capability to have, but on the other hand, the risk of exposure and subsequent damage to the US economy, prestige, etc. would be non-zero. So it's hard (for a plebian like me, anyway) to estimate how those costs/benefits might be weighed up by the US government.

>What is unknown (pure speculation) is whether, for example, Intel CPUs come backdoored straight from the factory floor?

There is also a third possibility, that some intelligence agency invested a ton of cash into finding abusable exploits in these systems giving them the same access a backdoor would provide.

Also from the Snowden leaks, we know that they have programs with budgets in the millions into finding similar exploits and that there were similar programs outside Snowden's clearance. And though a bug may cause the same damage to the economy, it wouldn't hurt US prestige in the same way.

If I'm the CIA I have dozens of highly placed agents or at least informants at Intel. Not necessarily placing backdoors, but finding and not fixing exploits and sending them back to the CIA for later use. It would be extremely cheap, hell if I'm China, Russia, the UK, or Israel I'm doing the same thing.

You don't even Intel employees for that. State actors typically get source access for 'verfication' purposes.

Russia and China would get Windows source access for instance.

Budgets in the millions, eh? So two full-time engineers?

Sorry, I misremembered the details. Around $400 million a year for the one program we have details on.

> On the one hand, that would be a powerful capability to have, but on the other hand, the risk of exposure and subsequent damage to the US economy, prestige, etc. would be non-zero

If I were a three-letter agency, I'd bribe/blackmail somebody into inserting intentionally vulnerable code. After all, sufficiently advanced malice is indistinguishable from incompetence.

We've often seen that the code inside firmware, secure environments like trustzone, etc tend to lack many of the mitigations for the classic vulnerabilities. Just rewrite one of the ASN.1 parsers in the ME (I'm sure there's at least one), "forget" a bounds check in some particularly obscure bit, and you'd have a textbook stack smash.

You don’t need to bribe anyone; Intel is a US company, so A TLA can just discretely explain to them how export restrictions work.

Subtly change the RNG implementation so there’s a predictability only you know.

That’s one of the reasons why operating systems provide a proper CPRNG instead of trusting RDRAND.

How would an OS seed an RNG in the cloud? How would you seed an RNG on a headless server in a VM? What about when that VM is copied, possibly while running, in order to duplicate server functionality? There are vulnerabilities and threats here that your comment does not take into account.

You can use virtio_random.

But really, it's not about operating systems not using RDRAND at all - it's fine to use it as one of the entropy sources; what you don't want to do is use RDRAND directly instead of CPRNG.

Remotely? I think Intel would need to produce a backdoored ME firmware, get the system vendor to incorporate that into a system update and then convince the target to flash that. In that sense I don't know that they'd technically need physical access, but it doesn't really meet most people's description of a remote attack.

Don't use CPUs from companies that have employees that can be kidnapped.

Don't use CPUs from companies that have employees.

Don't use CPUs from companies.

Don't use anything

Don't be so paranoid. Just build your own CPU from discrete NAND gates like everyone else.

A pen and paper is everything you need.

But what if it’s some of that fancy paper or a pen that records everything you write! Might need to manufacture your own pen and paper now...

Hold up there you don't know if someone's been tampering with the trees, you'll have to grow your own forest first

The “trusting trust” flaw still applies, better sequence your own species of tree.

And trust the same chemical processes that eventually resulted in the mess we’re in? Start a new universe.

Don’t

Doesn't seem like that would leave many possibilities... ;)

I guess out of business CPU companies are one easily accessible category.

While true, it's pretty likely their IP was sold to still-in-business companies. ;)