How do we know that governments don't just have a secret hardware backdoor in all our devices?
How do we know that governments don't just have a secret hardware backdoor in all our devices?
Edit: Changed "the government" to "governments"
I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There's Intel ME, AMD PSP, so there's probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?
You're viewing a single thread.
We know they do, actually.
All US companies provide the NSA with backdoors. All modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.
Put the two things together and now you know.
I'm not aware of us knowing that they provide
backdoorsvulnerabilities to the NSA. If US companies have data, then they're legally obliged to make it available to the NSA (PATRIOT and CLOUD Act). The NSA may also separately develop backdoors (e.g. EternalBlue). But that the NSA coerces US companies to actively attack their customers, is news to me.It's been a minute but I feel like Snowden revealed a program like that. A quick search gave me PRISM which kinda fits the bill https://en.m.wikipedia.org/wiki/PRISM
Hmm, I just realized that "backdoors" in my previous comment had somewhat of a double-meaning. They do provide the NSA access to data that they have on their servers. In that sense, a backdoor exists, which is also what this PRISM article confirms.
But knowingly integrating vulnerabilities and making these available to the NSA for attacking customer devices, that is another shtick entirely. And I'm not finding anything in that article that says so (although I only read the parts that seemed relevant).
Yes this is something I’m more interested in learning as well. Data access to servers by adversaries can be largely mitigated with E2E encryption and VPN use so that even if, for example, the NSA wanted data on certain servers, unless they had an encryption key, would be largely meaningless (unless metadata wasn’t encrypted). We largely know that if LE wants data, they can get a court order to hand it over.
What I’d like to know is if there has been any evidence of “hardware” backdoors like what you now describe. I haven’t been able to find evidence of any successful attempts by major agencies/corporations, but I guess part of a successful attempt involves the public not knowing that it exists.
My threat model has me using an iPhone with Lockdown Mode & Advanced Data Protection enabled. I am wondering if I need to reassess my model to potentially go for the Pixel with GrapheneOS.
According to my research, the iPhone with these specific settings for reducing attack surface and encrypting everything that gets put onto servers is more than enough for myself (admittedly a pretty stringent threat model). But would also like to hear what others think.
Fair point. Building secret backdoors for the gov is a different beast all together.
Seeing these Powerpoint slides again makes me realize that grapic design is really their passion.
modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.
If US companies have data, then they're legally obliged to make it available to the NSA (PATRIOT and CLOUD Act).
The key used to sign the remote code could be considered data that they're legally obliged to make available to the NSA? 🤷😅
That said, the lengths they had to go to for stuxnet kinda implies it's still not super easy to do, but I guess maybe they were using older cpus that don't have the signed code vulnerability? 🤷