News for hackers. Stuff that matters.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by squarefoot on Tuesday September 19, 2023 @11:16AM (#37571112)
When I buy something electronic, my approach is "everything that is closed and goes online will be used to spy on people". It may seem a stretch, but governments can't exercise power over something they cannot control, and truly private communications would take away some of that control. To me there are no conspiracy theories or other strange reasons for being able to decrypt any seemingly private information except the will to preserve the status quo at any cost, which implies knowing in advance what a potential adversary may think or do. I would expect every device to be bugged for that reason, including all cellphones and computers and associated hardware, from CPUs with closed subsystems down to network chipsets with closed firmware. There will be no way to ensure private communications until someone will find a way to make a device which is 100% open and auditable from the operating system to the CPU, from all chipsets down to the last screw.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by wombat-man on Tuesday September 19, 2023 @11:37AM (#37571467)
For sure, but since a state has basically unlimited resources to find vulnerabilities, I'd assume it's possible for state actors to reach a target if they are determined enough.

Might as well make it difficult though.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by iballing on Tuesday September 19, 2023 @11:30AM (#37571358)
“100% open and auditable from the operating system to the cpu” is the main goal of the Betrusted project: https://betrusted.io/
Re:Snowden leak: Cavium networking hardware may contain NSA ... by ramesh31 on Tuesday September 19, 2023 @11:37AM (#37571481)
>“100% open and auditable from the operating system to the cpu” is the main goal of the Betrusted project: https://betrusted.io/

Hopefully there's a 4G version coming. This seems too good to be true.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by RF_Savage on Tuesday September 19, 2023 @01:42PM (#37573439)
The 4G modem is exceedingly unlikely to be audittable. Something like srsUE is not welcome on many telcos networks and requires some decently beefy hardware to run.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by 0xCMP on Tuesday September 19, 2023 @05:08PM (#37576695)
It's possible to modify it and add a 4G modem, but that would probably be third-party.

The creators of the project suggest using your phone's hotspot if you need connectivity when not connected to Wi-fi (something I heard in interviews they gave).

Re:Snowden leak: Cavium networking hardware may contain NSA ... by Fnoord on Tuesday September 19, 2023 @12:12PM (#37572085)
Which seems to be an iteration of the Precursor (Mobile, Open Hardware, RISC-V System-on-Chip (SoC) Development Kit) by Bunnie Huang and Sean Cobs

> Part of the purpose of Precursor is to validate the system-on-chip (SoC) design we hope eventually to produce as a custom ASIC for use in future such products. This SoC, which we call "Betrusted-SoC," is meant to be the central pillar of security for devices like Precursor. The version of Betrusted-SoC used in Precursor is based on a Xilinx FPGA and has the following features [...] [1]

As for the person who replied to you requesting LTE: won't happen, there's no completely FOSS stack for LTE. Always there is closed source firmware due to regulations. Oh, that wonderful world of transceivers. If you want FOSS, go wired. Tho it seems Precursor found a way to utilize Wi-Fi with a FOSS stack?

[1] https://www.crowdsupply.com/sutajio-kosagi/precursor

Re:Snowden leak: Cavium networking hardware may contain NSA ... by AndrewKemendo on Tuesday September 19, 2023 @11:55AM (#37571815)
This is the right approach IMO.

Just assume you’re being persistently surveilled - if you use a computer or electronics then the likelihood approaches 100% over your lifetime.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by phito on Tuesday September 19, 2023 @12:14PM (#37572119)
I try to have this approach, but I find it so exhausting tbh. It makes me want to just not use technology.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by flangola7 on Tuesday September 19, 2023 @01:05PM (#37572950)
If you have to take this approach they have already won
Re:Snowden leak: Cavium networking hardware may contain NSA ... by AndrewKemendo on Tuesday September 19, 2023 @01:21PM (#37573150)
You are correct, “they” have won so far unfortunately

Doesn’t mean we don’t do anything about it, just means we have to acknowledge reality

Re:Snowden leak: Cavium networking hardware may contain NSA ... by mbakke on Tuesday September 19, 2023 @12:12PM (#37572086)
I generally hold a similar opinion. However I have two data points that suggests back-doors are not available by default (for my government at least), but that they are aggressively bugging (or auditing, lol) devices:

* When I ordered the first generation Raspberry Pi, they were stuck in the toll a long time, and when they arrived all the warranty seals were broken. Consequently I never really used them.

* When I ordered the first generation Google Pixel, before it was generally available in my country, it was stuck in domestic mail for almost a week. The person who imported them sold and sent two phones the same day: the other one arrived after just two days and travelled a lot further. I used it regardless as I already considered phones a lost cause... (and could not with good conscience sell a possibly compromised device).

At this point I don't trust anything sent by mail.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by ilyt on Tuesday September 19, 2023 @12:25PM (#37572304)
I just assume I'm not interested enough to be spied upon by randoms

> When I ordered the first generation Raspberry Pi, they were stuck in the toll a long time, and when they arrived all the warranty seals were broken. Consequently I never really used them.

If state have means to bug raspberry pi it has means to re-seal the box...

Re:Snowden leak: Cavium networking hardware may contain NSA ... by mbakke on Tuesday September 19, 2023 @12:36PM (#37572468)
> If state have means to bug raspberry pi it has means to re-seal the box...

That's a good point that I never made sense of. The most likely explanation is simply an oversealouz toll agent. It just left a bad taste in my mouth so I didn't want to play with them...

I had largely forgotten about it until the Google Pixel got stuck.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by backtoyoujim on Tuesday September 19, 2023 @12:48PM (#37572664)
unless they wanted you to know and feel threatened by it
Re:Snowden leak: Cavium networking hardware may contain NSA ... by phero_cnstrcts on Tuesday September 19, 2023 @01:46PM (#37573490)
> I just assume I'm not interested enough to be spied upon by randoms

I believe the fewest are. But constant surveillance is an advantage if you need to monitor general opinions or if they find you interesting at a later point and want to check your history.

So if you talk about burning wood in your stove a lot and it later becomes illegal you might have a hard time denying you have a stove if they ask you to pay extra carbon emission taxes.

Or if you talk about chest pain a lot and later want to get a new health insurance you might find that your options are mysteriously more expensive than others.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by croes on Tuesday September 19, 2023 @07:41PM (#37578608)
As we learned from Snowden, they spy ob everyone they just don't look in every data point but they still collect everything they can get.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by TheRealDunkirk on Tuesday September 19, 2023 @01:19PM (#37573133)
You act like the NSA has been caught intercepting Cisco switches during shipping, and installing backdoored firmware, or something. Crazy conspiracy theorists...
Re:Snowden leak: Cavium networking hardware may contain NSA ... by tromp on Tuesday September 19, 2023 @12:37PM (#37572495)
If I want to do some computation that should not be spied on, I can still program it in BASIC on my Sinclair ZX Spectrum. If it doesn't fit in its measly 48KB of RAM, I'm probably still safe programming it on my Commodore Amiga 500.

Basically, you can only trust things manufactured before "going online" became a thing.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by fallat on Tuesday September 19, 2023 @12:44PM (#37572587)
or you know, just don't connect your computer online.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by doublerabbit on Tuesday September 19, 2023 @12:50PM (#37572682)
And ensure it's not by any windows, the case HD LED doesn't blink nor does the FAN make any noise.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by TacticalCoder on Tuesday September 19, 2023 @01:30PM (#37573289)
Hardware and software backdoors does scale.

Data exfiltration through audio / fan speed / LEDs blinking / power draw / etc. simply doesn't.

I think that a discussion about metric shitloads of networking gear being compromised is not the place to make fun of the few that didn't compromise on security.

There's a place for offline/airgapped devices and private keys (PGP keys, seeds, whatever) being generated by throwing dice.

If anything all these backdoors do show that math/cryptography do work. The NSA's budget may be 100% of the US GDP, they still wouldn't be changing Sun's gravity or the math behind cryptography.

The joke today is on those who kept making fun of those who didn't trade security for convenience.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by tromp on Tuesday September 19, 2023 @01:47PM (#37573508)
Both these computers were fan-less, like nearly all hobby computers at the time (clockspeeds were single digit Mhz). The Amiga only had a floppy disk drive.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by 13of40 on Tuesday September 19, 2023 @12:39PM (#37572517)
"If it's technically possible, they're doing it."

It's their job.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by dizhn on Tuesday September 19, 2023 @02:14PM (#37573917)
If it exists, they're buying it. (States)
Re:Snowden leak: Cavium networking hardware may contain NSA ... by archontes on Tuesday September 19, 2023 @01:06PM (#37572956)
It's clear that they feel that way also. The engineer Andreass Speiss recently appeared in a briefing on dangerous, anarchy-enabling technologies simply for making a youtube video on an encrypted messaging protocol over lora mesh networking.

They're carefully watching and cataloging any communications technology they can't compromise.

Re:Snowden leak: Cavium networking hardware may contain NSA ... by s3p on Tuesday September 19, 2023 @01:52PM (#37573597)
It's also hard to distinguish between legitimate security threats and scare tactics designed to make us think we're in danger. Remember the Bloomberg Supermicro "bombshell"[0]? I still don't know if that was ever confirmed true or false, but to my knowledge Bloomberg never retracted it.

[0] https://www.theregister.com/2021/02/12/supermicro_bloomberg_...

Re:Snowden leak: Cavium networking hardware may contain NSA ... by Lammy on Tuesday September 19, 2023 @02:56PM (#37574582)
I still believe it. Wouldn't surprise me if ASPEED were a "SIGINT enabled" vendor as well. It would be foolish not to target the most widespread BMC platform.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by SamPatt on Tuesday September 19, 2023 @02:17PM (#37573951)
The guy with the Swiss accent?

What's your source on this?

Re:Snowden leak: Cavium networking hardware may contain NSA ... by dariosalvi78 on Tuesday September 19, 2023 @03:15PM (#37574905)
Re:Snowden leak: Cavium networking hardware may contain NSA ... by lawlessone on Tuesday September 19, 2023 @02:43PM (#37574328)
TBF that same tech would probably be great for them or militaries to have.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by dkqmduems on Tuesday September 19, 2023 @02:53PM (#37574517)
Well advertising is a form of psychological warfare.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by madars on Tuesday September 19, 2023 @03:01PM (#37574694)
Which briefing was that?
Re:Snowden leak: Cavium networking hardware may contain NSA ... by dfc on Tuesday September 19, 2023 @05:21PM (#37576920)
The guy's video was linked to from /r/SocialistRA and a screenshot of the link was included in a paper about "How Militant Anarcho-Socialist Networks Use Social Media to Instigate Widespread Violence Against Political Opponents and Law Enforcement." The paper never mentioned Spiess or meshtastic. What are we supposed to infer from that?
Re:Snowden leak: Cavium networking hardware may contain NSA ... by mk89 on Tuesday September 19, 2023 @02:02PM (#37573735)
If that is the case they are doing a pretty s** job spying on people, considering the amount of harm being done to children (and people in general).
Re:Snowden leak: Cavium networking hardware may contain NSA ... by irreticent on Tuesday September 19, 2023 @03:45PM (#37575383)
I wouldn't say they are doing a bad job spying on people for that reason; I think it's more likely that the reason they are spying is not to help children/people but rather to strengthen their control over the people. Knowledge is power and they want to be more powerful than everyone else. I've always assumed that the spying wasn't altruistic but more for selfish reasons.
Re:Snowden leak: Cavium networking hardware may contain NSA ... by eastbound on Tuesday September 19, 2023 @04:00PM (#37575642)
This. All of this spying, not even being used for security ever, ie their goal might as well be general insecurity. It feels like their goal is the stability of the social layers, no or rare promotion, and maximum impermeability for the masses.