How do we know the government doesn't just have a secret hardware backdoor in all our devices?

Submitted ⁨⁨3⁩ ⁨days⁩ ago⁩ by ⁨IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com⁩ to ⁨[deleted]⁩

I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There’s Intel ME, AMD PSP, so there’s probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?

source

Comments

Sort:hotnew top

Nurse_Robot@lemmy.world ⁨3⁩ ⁨days⁩ ago
We will never have a way of knowing for sure. There are stories of government agencies famously requesting backdoor access to Apple devices, seemingly because they can’t get in otherwise, and Apple refusing, however they end up getting access on their own eventually. But who knows how much of that is even true? Government agencies are historically manipulative when it comes to public narrative, so anything made public by them should be taken with a hefty grain of salt

source
- droporain@lemmynsfw.com ⁨3⁩ ⁨days⁩ ago
  What about that thin shiney metallic woodwind instrument? And the musician who plays it?
  
  source
- sit@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
  The side of corporation is corrupt as well because they use it for marketing.
  
  source
kadup@lemmy.world ⁨3⁩ ⁨days⁩ ago
We know they do, actually.

All US companies provide the NSA with backdoors. All modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.

Put the two things together and now you know.

source
- Ephera@lemmy.ml ⁨3⁩ ⁨days⁩ ago
  I’m not aware of us knowing that they provide backdoors to the NSA. If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act). The NSA may also separately develop backdoors (e.g. EternalBlue). But that the NSA coerces US companies to actively attack their customers, is news to me.
  
  source
  - gothic_lemons@lemmy.world ⁨3⁩ ⁨days⁩ ago
    It’s been a minute but I feel like Snowden revealed a program like that. A quick search gave me PRISM which kinda fits the bill en.m.wikipedia.org/wiki/PRISM
    
    source
    -> View More Comments
  - Venator@lemmy.nz ⁨3⁩ ⁨days⁩ ago
    
    modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.
    
    If US companies have data, then they’re legally obliged to make it available to the NSA (PATRIOT and CLOUD Act).
    
    The key used to sign the remote code could be considered data that they’re legally obliged to make available to the NSA? 🤷😅
    
    source
MargotRobbie@lemmy.world ⁨3⁩ ⁨days⁩ ago
Well, there is this time a few months ago where the Chinese government hacked AT&T and Verizon using the mandatory backdoors the US government left for wiretaps…

wsj.com/…/u-s-wiretap-systems-targeted-in-china-l…

That’s the reason leaving backdoors is generally a really, really bad idea, because you don’t know who else can use them

source
- y0kai@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
  Lol they still have persistence in the network too, afaik
  
  source
swordgeek@lemmy.ca ⁨3⁩ ⁨days⁩ ago
We don’t.

We really really don’t.

Consider the attack that Israel carried out this fall by detonating walkie-talkies and pagers. This wasn’t just some illicit code in the firmware or hardware, they managed to hijack the supply chain and hide literal bombs in commercially-produced handheld devices!

Bottom line: If you do not directly control the production chain from chip design and fab to end-user software, you can never be sure.

40 years ago, the legendary Ken Thompsonand Dennis Ritchie accepted the Turing Award for creating Unix. Thompson’s acceptance speech Reflections on Trusting Trust pointed out this same fundamental security flaw.

I encourage everyone to read the article, and spread it as widely as possible. It is terrifying and accurate, nearly half a century later.

source
Strayce@lemmy.sdf.org ⁨3⁩ ⁨days⁩ ago
We don’t. The point is to reduce attack surface relative to target value. People use a VPN for piracy, for example, not because it’s totally secure, but because rights holders generally aren’t going to bother going after a single person when they’d have to go thru a VPN provider as well. OTOH someone doing it on clearnet is being logged by their ISP and the data is right there. OTOOH, the three letter agencies are absolutely going to bother if they have a tip that you’re doing something really dangerous to the status quo.

source
- trolololol@lemmy.world ⁨3⁩ ⁨days⁩ ago
  Today I learned you have 3 hands
  
  source
slazer2au@lemmy.world ⁨3⁩ ⁨days⁩ ago
It’s not just back doors. All governments will have a group of people who’s job is to find security vulnerabilities in OS and use them to attack other nations.

If Wanacry rings a bell the you might be aware that the Eternal Blue exploit was the infection vector which was originally designed by the NSA and leaked by a hacking group. Only after the leak did the NSA tell Microsoft how it worked and it was patched.

source
Kolanaki@yiffit.net ⁨3⁩ ⁨days⁩ ago
Wasn’t that something Asange or Snowden blew the whistle on? That the CIA or something actually has backdoors in pretty much everything, along with all kinds of spyware floating around the net?

source
- IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
  I think what more like Verizon and other carriers logging metadata. Google and Apple, in their server side services. And the government has physically tapped internet cables. HTTP was not widespead at the time, and corporations were (either forced, or willingly) co-operating with authorities for mass surveillance. Also, most devides had no encrption for data at rest. You know, that type of thing.
  
  I don’t think the snowden leaks ever said anything about a hardware backdoor outside of targetted attacks (Correct me if I’m wrong). So it was widely understood post-snowden era that using an open source OS + encryption for both at rest and communications would be good enough for non-targeted attacks.
  
  But my question asks if governments could be listening to everyone as a mass surveillance non-targeted attack, via hardware backdoors
  
  source
  - Valmond@lemmy.world ⁨3⁩ ⁨days⁩ ago
    If they listen to everyone, it would show up in some way, using power and bandwidth. Even using like steganography wouldn’t hide it very well IMO. One exception being windows ofc 😅 where they spy on you for sure already.
    
    Wasn’t it that mega share guy (king dotcom or something) that figured out his PC was compromised because his ping skyrocketed on CS-GO?
    
    source
LordCrom@lemmy.world ⁨3⁩ ⁨days⁩ ago
I’ve worked for the government. They had me managing 78 full AWS accounts for various departments. Me, 1 guy. And I had to explain basics of tech to everybody in charge of the cloud accounts.

Our gov can barely manage itself, let alone some next level tech on millions of devices and keep track of it all. They couldn’t even get me a new mouse without 2 forms, 1 online ticket, and 2 levels of approvals.

source
- trolololol@lemmy.world ⁨3⁩ ⁨days⁩ ago
  Yep but the capable agencies know what they want
  
  source
- DavidDoesLemmy@aussie.zone ⁨3⁩ ⁨days⁩ ago
  Which government is this?
  
  source
- y0kai@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
  Does your govt not have an NSA like entity?
  
  source
nothacking@discuss.tchncs.de ⁨3⁩ ⁨days⁩ ago
There’s no way to check the whole thing, but you can totally pick a component and reverse engineer it, which is something people do quite a bit. When spying is found, it’s usually a private company doing it.

The NSA doesn’t care about your search history, but advertisers do. (and the government ever did, they’ll just call up google)

source
Sylvartas@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
en.wikipedia.org/wiki/Intel_Management_Engine

en.wikipedia.org/…/AMD_Platform_Security_Processo…

If I was a government intelligence agency I’d probably sell my soul to get access to these…

I get that they have legitimate use cases for corporations, but why are there virtually no consumer grade CPUs without that stuff ? Surely they would be less expensive and no one would miss the features on their home computers.

source
lurch@sh.itjust.works ⁨3⁩ ⁨days⁩ ago
If the government wants to snoop, they can just get a Certificate Authority in the boat and MITM whoever they want.

In my region there are laws that telecoms have to provide a way to let the government snoop, but the government doesn’t use it without probable cause.

Some people think a VPN will protect them, because the provider doesn’t log, but all the government needs is the VPN keys and they can intercept all traffic between the VPN and the user and log it themselves.

source
- abbadon420@lemm.ee ⁨3⁩ ⁨days⁩ ago
  
  …the g9verenment doesn’t use it without probably cause YET.
  
  The way politics are going lately, that might all change in an instant. Not that there’s anything you or I can do about it. I’m not trying to fearmonger here, just that you shouldn’t be putting any Qurans or Communist manifestos on your Onedrive account, that’s all. Be mindful.
  
  source
NeoNachtwaechter@lemmy.world ⁨3⁩ ⁨days⁩ ago
A few years ago they had rerouted shipments from Cisco to the NSA and then forward to the intended recipients. Not just a few parcels, but truckloads.

source
bokherif@lemmy.world ⁨3⁩ ⁨days⁩ ago
They do.

source
Skyrmir@lemmy.world ⁨2⁩ ⁨days⁩ ago
Every phone has a radio with remote root access controlled by a security key that is supposedly only in the hands of the manufacturer. A manufacturer that could be forced to give up that key, and forced not to tell anyone they had done so.

At least with a PC you can control the physical access to transmission, giving you a way to possibly audit before send, and physically control all input.

The reality is that any large scale communication network will be breached by the controlling government, or it will be shut down. If you want actually secure communication, you have to do it by broadcasting in the clear using an unbreakable cypher that’s been physically passed on.

source
- IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com ⁨2⁩ ⁨days⁩ ago
  
  you have to do it by broadcasting in the clear using an unbreakable cypher that’s been physically passed on.
  
  Time for One Time Cipher?
  
  Very impractical, but unbreakable, assuming no one else got a copy of the key, and its destroyed after a single use.
  
  Dice rolls for code generation.
  
  Take that, big gov!
  
  source
solrize@lemmy.world ⁨3⁩ ⁨days⁩ ago
It’s difficult to know that for sure, which is why (e.g.) the US government wants to make sure that there is domestic chip manufacture with a completely controlled supply chain to make hardware for classified communications. It can help to consider the difference between targeted surveillance (spending millions to tap the President’s phone, to get big juicy national secrets) and dragnet surveillance (tapping everybody’s phone so that you can have dirt on Joe Schmoe if he does something interesting later, even if he is of no particular interest right now). Hardware backdoors would be used mostly for targeted surveillance.

Stuff like VPN’s and encrypted apps can be of considerable help against dragnet surveillance, which is what the civil privacy community mostly cares about. If you think you might be a subject of target surveillance, you have to be much more paranoid. Not just hardware backdoors in your computer, but suspicious white vans on your street, microphones in your flower pots, FBI agents under your bed, the whole bit.

There are some countermeasures you can take against hardware backdoors (electromagnetically isolate a computer from the network and transfer data from it by floppy disc or similar) but basically you’re in a different world if you’re dealing with this.

You mght like the book “Security Engineering” by Ross Anderson (older editions free online and still very good: www.cl.cam.ac.uk/archive/rja14/book.html and scroll down). It goes into this stuff, has lots of good overviews even if you gloss over the technical parts, and will generally help you see clearly in the topic.

source
passiveaggressivesonar@lemmy.world ⁨3⁩ ⁨days⁩ ago
This is probably going to be a very unpopular opinion but I am much angrier at a corporation having my data than a govermment and that former is much easier to avoid

source
brlemworld@lemmy.world ⁨3⁩ ⁨days⁩ ago
Didn’t Snowden prove this?

source
- IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
  AFIAK, his leaks showed that corporations are collaborating, and software could have backdoors. I don’t think they ever showed docs that reveal non-targeted hardware based surveillance. The common understanding poat-snowden was, use Open Source OS and use Encryption and you’re safe, unless you are specifically targeted.
  
  My question is asking about hardware-based mass surveillance.
  
  source
thermal_shock@lemmy.world ⁨3⁩ ⁨days⁩ ago
they do

darknetdiaries.com/transcript/146/

source
DirigibleProtein@aussie.zone ⁨3⁩ ⁨days⁩ ago
“If you can’t trust the governments of the world, then who can you trust?”
Albert Einstein, Young Einstein

source
- IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
  Me, myself, and I
  
  pulls out a glock with suppressor
  
  “Nothing, personal”
  
  /jk
  
  source
- trolololol@lemmy.world ⁨3⁩ ⁨days⁩ ago
  Nobody?
  
  source
hendrik@palaver.p3x.de ⁨3⁩ ⁨days⁩ ago
Yeah, we don't. It's generally hard to prove the nonexistence of something. Same as with God. It's unlikely, but we can't prove he doesn't exist with certainty.

source
TrickDacy@lemmy.world ⁨3⁩ ⁨days⁩ ago
I mean we pretty much can be certain that we’re all being surveilled to some extent all the time.

source
Boot@lemmy.ml ⁨3⁩ ⁨days⁩ ago
‘They’ (I.e. government agencies/PPP) actively exploit weaknesses or institutionally create them. Personal favorite is the backdoors built into TETRA, which is used for mainly government purposes (law enforcement, emergency services). ETSI acts as a strawman for government interest and serves no cause other than that of its masters. That bugs me to no end because this does not serve any purpose.

zetter-zeroday.com/interview-with-the-etsi-standa…

source
Mango@lemmy.world ⁨3⁩ ⁨days⁩ ago
The same way we know there’s nothing wrong with drugs that are pushed en mass. We don’t.

source
ricecake@sh.itjust.works ⁨3⁩ ⁨days⁩ ago
You need to think about what a backdoor looks like for different devices, and different functions of that device. “Backdoor” generally means a way to bypass security measures, but that entails can vary wildly in different contexts. For some things you can know because you can check to see if the hardware is doing what’s expected because the only meaningful backdoor would be local to the hardware.
For example, hardware based encryption systems can have their outputs compared against a trusted implementation of the same algorithm.

For cases where there isn’t an objective source of truth for “proper functioning”, or where complex inputs are accepted and either produce a simple answer (access granted/denied), or a complex behavior (logging login attempts and network calls are always expected) it can be harder to the point of impossibility to know that what’s being done is correct.
This is also the case for bugs, so it can actually be unclear if something is a backdoor or an error.
“Any sufficiently hair brained programming error is indistinguishable from an attack by a nation state threat actor”. (the goto fail bug is a great example of this. extremely dumb error every programmer has made, or a very well executed and sophisticated attack.

Ultimately, any system can be compromised by a sufficiently determined attacker. Security cannot be perfect, because at some point you need to trust someone.
The key is to decide how much you trust each system to handle whatever you need it to handle.
I trust my phone’s manufacturer as much or more than I trust the network provider. If I’m doing something naughty the person I’m communicating with getting snagged leads to me via the network and their device without needing to compromise my hardware. I choose to focus on the weak link: the people I talk with who might be unable to properly conduct a criminal conspiracy, and getting them up to speed.

source
MITM0@lemmy.world ⁨3⁩ ⁨days⁩ ago
Hardware backdoors are extremely expensive & taxes aren’t enough to cover it

source
- hendrik@palaver.p3x.de ⁨3⁩ ⁨days⁩ ago
  I doubt that's the case. We already had a good amount of government-sponsored hacking, worms like Stuxnet. The Israelis can make every pager explode. It has been debated if there's surveillance in some networking equipment. I think it'd be quite affordable to put a few more lines of code into Intel ME and AMD's equivalent. The hardware is already there.
  
  source
  - joe_archer@feddit.uk ⁨3⁩ ⁨days⁩ ago
    If you honestly think that the exploding pagers where just standard pagers, and somehow made to explode by hacking them, your grasp of physics and technology could do with some improvement.
    
    The pagers where packed with a small amount of explosive and remote detonation system and then fed into the Hamas group through a supply chain attack.
    
    source
    -> View More Comments