Comment on How do we know the government doesn't just have a secret hardware backdoor in all our devices?

kadup@lemmy.world ⁨2⁩ ⁨months⁩ ago

• Ephera@lemmy.ml ⁨2⁩ ⁨months⁩ ago

  I’m not aware of us knowing that they provide backdoors to the NSA. If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act). The NSA may also separately develop backdoors (e.g. EternalBlue). But that the NSA coerces US companies to actively attack their customers, is news to me.

  source

  • gothic_lemons@lemmy.world ⁨2⁩ ⁨months⁩ ago

    It’s been a minute but I feel like Snowden revealed a program like that. A quick search gave me PRISM which kinda fits the bill en.m.wikipedia.org/wiki/PRISM

    source

    • Ephera@lemmy.ml ⁨2⁩ ⁨months⁩ ago

      Hmm, I just realized that “backdoors” in my previous comment had somewhat of a double-meaning. They do provide the NSA access to data that they have on their servers. In that sense, a backdoor exists, which is also what this PRISM article confirms.

      But actually integrating vulnerabilities and making these available to the NSA is another shtick entirely. And I’m not finding anything in that article that says so (although I only read the parts that seemed relevant).

      source

      • underwire212@lemm.ee ⁨2⁩ ⁨months⁩ ago

        Yes this is something I’m more interested in learning as well. Data access to servers by adversaries can be largely mitigated with E2E encryption and VPN use so that even if, for example, the NSA wanted data on certain servers, unless they had an encryption key, would be largely meaningless (unless metadata wasn’t encrypted). We largely know that if LE wants data, they can get a court order to hand it over.

        What I’d like to know is if there has been any evidence of “hardware” backdoors like what you now describe. I haven’t been able to find evidence of any successful attempts by major agencies/corporations, but I guess part of a successful attempt involves the public not knowing that it exists.

        My threat model has me using an iPhone with Lockdown Mode & Advanced Data Protection enabled. I am wondering if I need to reassess my model to potentially go for the Pixel with GrapheneOS.

        According to my research, the iPhone with these specific settings for reducing attack surface and encrypting everything that gets put onto servers is more than enough for myself (admittedly a pretty stringent threat model). But would also like to hear what others think.

        source
      • gothic_lemons@lemmy.world ⁨2⁩ ⁨months⁩ ago

        Fair point. Building secret backdoors for the gov is a different beast all together.

        source
    • nicerdicer@feddit.org ⁨2⁩ ⁨months⁩ ago

      Seeing these Powerpoint slides again makes me realize that grapic design is really their passion.

      source
  • Venator@lemmy.nz ⁨2⁩ ⁨months⁩ ago

    modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.

    If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act).

    The key used to sign the remote code could be considered data that they’re legally obliged to make available to the NSA? 🤷😅

    source