Report: NSA intercepting laptops ordered online, installing spyware

http://www.forbes.com/sites/erikkain/2013/12/29/report-nsa-intercepting-laptops-ordered-online-installing-spyware/

by obstacle1 • 13 years ago

114 55 13 years ago

forbes.com

zebra2• 13 years ago

Even Joe Average should be acknowledged that clean reinstallation after getting new hardware is a good practice.

Ed: BTW, does somebody know how to audit your laptop in its current state?

vsviridov• 13 years ago

Well, with current practice you don't even get OS recovery CDs anymore. You probably get a "Recovery Partition" with preconfigured OS image. And OEM windows license might not allow you to install from elsewhere and re-use your license.

mgurlitz• 13 years ago

The linked article on Der Spiegel has a section on what they call "persistence:"

The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO)... The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer's motherboard that is the first thing to load when a computer is turned on... This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this "Persistence" and believe this approach has provided them with the possibility of permanent access.

http://www.spiegel.de/international/world/catalog-reveals-ns...

zebra2• 13 years ago

My bad - I didn't read Der Spiegel article.

sillysaurus23• 13 years ago

This is probably one of the most important problems of our generation to solve (as hackers, not philanthropists) and it's sort of amazing that it's hardly known, let alone discussed. I've brought it up before and it seems like everyone's reaction is that it's not worth worrying about. But there are adversaries besides the NSA, such as malware. And since userspace programs can upgrade your BIOS, then therefore it's possible to write a viruses to infect your BIOS exactly as described here. If the BIOS security model is even slightly broken, then malware will find a way into it, and security is hard to do perfectly. Why are we trusting proprietary motherboard manufacturers not to have backdoors in their closed-source systems? The answer is probably because we have little choice in the matter. Thus we're giving up a basic right: for us to have faith in our security practices. If, say, Colin Percival's careful security habits can simply be circumvented by his motherboard, then none of us are safe.

We need an open source motherboard for people who care about protecting themselves from this kind of thing. Or at least an open source BIOS. But it's an insidious problem, because once a BIOS is infected, it controls everything that may ever replace the BIOS. Therefore it's almost impossible to detect if your BIOS has been "man in the middle'd," and hence even an open source BIOS may not be enough.

I don't have a good solution, but this is a terribly important problem to solve.

obstacle13• 13 years ago

From the article:

The latest report, this time via Der Spiegel and based on internal NSA documents, reveals that the NSA, in conjunction with the CIA and FBI, has begun intercepting laptops purchased online in order to install (quite literal) spyware and even hardware ... Agents divert shipments to secret warehouses ... install the software and/or hardware ...

So if they're installing hardware/firmware that is something a clean reinstallation won't fix. Probably should have titled the submission software/hardware.

padmanabhan012• 13 years ago

Seriously? Why on earth should Joe Average be made to clean reinstall OS after buying a new hardware?

cleverjake• 13 years ago

no one said 'be made'. He said the average joe should acknowledge that it is a good idea. Previously I have suggested other people reinstall to get rid of bloatware installed by the vendor.

ihsw• 13 years ago

Maybe it would've been better for this news to have been broken a month or two ago, for maximum financial impact.

In all seriousness, one has to wonder how shipments get diverted, and how easily this process can be taken advantage of. Surely the companies handling these "special" shipments are made aware of details on a need-to-know basis (eg: super-secret gov. employee is going to be taking the shipment for an hour, don't ask why and don't tell anyone), but are they able to verify that their handlers are who they say they are?

Would you trust a shipping company based in China? Why would you trust an American one any more than a Chinese one?

rdl5• 13 years ago

This capability already exists for counter drug and other interceptions. I'm sure it was FBI asking ups and fedex to hold a suspected drug shipment and let them look at it briefly; it is entirely possible no one at the shipper, and certainly not on the line, knew it was NSA. They might have said terrorism, too, but probably not. Maybe just "a law enforcement matter" with no questions asked.

throwaway_yy2Di• 13 years ago

Oh so that's why my Lenovo was held for "customs". Hope they at least removed the Chinese backdoors while they were installing the American ones.

Look at me, I'm so clever using HTTPS and GnuPG and FOSS linux when my hardware RNG is key escrowed, my USB cable is transmitting, my factory BIOS has at least two nationalities of spyware, and Big Brother is watching me naked in 720p. So glad I'm not a journalist and have an adequate physique.

teamgb• 13 years ago

Lol.

There's definitely a business opportunity out there for someone to come up with DIY laptops, much like the way you can purchase parts from anybody to create your own desktop PC.

blazespin• 13 years ago

Yeah, the customs point is very interesting and worthy of upvote. I suspect they'd need a warrant to do this on an American (one would hope) but I highly doubt they'd need one to do this on anyone who ordered it from across the border.

Canadians (and Americans who talk to Canadians) in particular are probably highly vulnerable to this spying. Emailing Americans, calling Americans, ordering laptops from the US, etc. The NSA is probably free to tap/interdict all of those interactions without any kind of pre-approval or probable cause.

Bottom line: the NSA has done irreparable harm to global trust in dealing with the US(and, sadly, the US dealing with those outside their borders), be it communications or buying their products.

redthrowaway• 13 years ago

Doesn't this seem a little moustache-twirly, even for the NSA? I imagine the only way they'd actually expend the necessary man-hours on this is if they were intercepting hardware ordered by people who were already targets of interest. Now, that probably means Merkel should buy her laptops in-store, with cash, but this really doesn't seem like the sort of panopticon story we've been reading elsewhere. Unless, of course, they've managed to convince a judge to give them a warrant to compromise the Dell/etc factory image.

geuis• 13 years ago

My suspension of disbelief is getting really close to breaking. Don't get me wrong, I'm fully against the entire NSA spying deal. But these "reports" just keep getting more and more outrageous. The problem is not that I don't think these things have been happening, but rather that the continuous slow leaking by news media is causing the next big reveal to be just more background noise.

We need a big, sudden, destructive reveal that causes a lot of impact. Not the slow drizzle of 'this week in civil liberties violations'. Probably too late for this, sadly.

kapitalx• 13 years ago

IMHO the only reason the NSA leaks have been so effective in shaping public opinion is that it's a 'slow drizzle'. Otherwise they would have ended up like other wikileak mass dumps which are too overwhelming to absorb and are quickly forgotten.

Houshalter2• 13 years ago

It seems kind of silly that something has to literally be "new news" in order to be worth broadcasting or discussing, even if it hasn't before.

rdl5• 13 years ago

I don't think this operation is very unreasonable if highly targeted. If they did this to computers bought by Iran's nuclear program, or known watched mid level jihadis , the only problem I'd have would be I don't have enough money to buy an open bar for everyone involved. No one is arguing this was pervasive.

The dangerous area IMO would be domestic law enforcement or political use (well , not so gray), and attacking innocent third parties with this to gain access to systems to attack actual bad guys. ( eg Belgacom)

obstacle13• 13 years ago

The problem is the NSA has shown itself to be indiscriminate in its targeting for other methods of info gathering. So trusting them to 'use responsibly' is a bit like trusting a bunch of teenagers to 'use responsibly' with a case of beer and the parents away.

linuxhansl• 13 years ago

Interesting my Lenovo order just delayed by over 30 days.

Not that I won't wipe it and put Linux on it anyway, but if the hardware or BIOS was tempered with I'd be none the wiser.

(Not that I'd be worth effort, but anyway)

leeoniya• 13 years ago

same with my order (finally being delivered tomorrow), though i'm highly doubtful that they do this for all computers. prolly only ones for already-monitored targets. doing it for everyone is highly impractical and expensive.

Yver• 13 years ago

And suddenly, people like Richman Stallman seem much less crazy when they ask for free (as in libre) hardware, free BIOS, free everything.

kevingadd• 13 years ago

Is 'free as in libre' hardware really any protection if the NSA intercepted your device at the border and planted undetectable MITM malware/hardware? Are you really gonna take the whole thing apart and check every chip for modifications?

fragsworth2• 13 years ago

No. And Stallman (unfortunately) doesn't seem to focus too much on the security aspect of it. His focus is mostly on the freedom, as in ability to copy/modify/do-as-you-please aspect of it.

nitrogen2• 13 years ago

The "free as in libre" part would make it much more difficult to create an undetectable MITM. You might have a much greater diversity of hardware, so they'd have to find and maintain more exploits. The full software/firmware stack would be verifiable by cryptographic signature. The hardware itself could be checked by looking for chips that don't match other units from the same lot, either visually or behaviorally, and even x-raying the components if necessary.

whyenot2• 13 years ago

After sitting through an embarrassingly awkward 2 1/2 hr talk by Richard Stallman at SJSU last month, I think he actually is a little... off. But that doesn't mean you shouldn't take his message to heart.

bdamm• 13 years ago

You know, I'd actually be less outraged if the NSA's backdoors weren't so damn buggy.

aegiso• 13 years ago

Because the GPL is the best defense against an adversary that gets to redefine laws as they see fit?

I'm all for FLOSSing all the things, but it wouldn't help one bit here.

felipe_albertao• 13 years ago

For the record, rms uses a Lemote [1] computer, which uses a Loongson chip [1] designed from scratch by the Chinese Academy of Sciences.

Given the fact this computer is 100% Chinese design, it's unlikely that NSA is able to add any spyware or backdoor at the source.

[1] http://stallman.org/stallman-computing.html

[2] http://en.wikipedia.org/wiki/Loongson

notastartup3• 13 years ago

I am so raging at news regarding NSA's rogue behavior. Why isn't anything being done about this serious breach of privacy, the freedom to be you, the pillars of democracy? It's like NSA is saying "Look at me fuckers we are above the law and you are just going to have to take it up the ass".

Seriously? This is depressing, knowing that some asshole at the top is ordering all of these things and telling us to close your eyes and say nothing while the ass fucking goes on. At least buy everyone dinner before you've decided to fuck them.

ketralnis2• 13 years ago

Why isn't anything being done

Because you're not doing it. Nor him, nor her, nor I. Because somebody has to actually do it, not just muse that somebody else should do it.

Houshalter2• 13 years ago

Well what can we do except vote? Maybe right a few angry letters? There isn't really anything that I know I can do to help.

whyenot2• 13 years ago

This is starting to get really bad. Why aren't there demonstrations in the streets? I tried to sound out my relatives over the holidays to see what they think about Snowden/NSA and nobody seems to care.

devanti• 13 years ago

Because the average person is short sited. They don't do anything (or don't realize how terrible it is) until it directly affects them.

notastartup3• 13 years ago

I actually had coworkers saying they didn't care and that it's necessary to keep terrorists away....

I realized how Hitler was able to rise to power so quickly, people just accept complete trust in authority, the all loving, the all caring and nurturing.

Just like herding cows telling each other everything's alright, we are still comfortable, enough grass to keep us going, owners seem nice. Refusing to believe they will all be slaughtered one day.

bkoa• 13 years ago

Does anybody have the links to these internal documents on which this allegation is based?

fragsworth2• 13 years ago

This is just fucking outrageous. Is there no line they wouldn't cross?

Our only option, now, to protect ourselves, is a healthy amount of paranoia and knowledge of security.

We should now live by the following rule: If it's possible that the government could do something to spy on you, then they have probably done it.

Everything you type into a computer connected to the Internet, that you didn't build, must be assumed to be logged by the NSA.

zby• 13 years ago

For reference - discussion of the source article from Der Spiegel: https://news.ycombinator.com/item?id=6979239

salient• 13 years ago

I thought the NSA wasn't "attacking domestic citizens"? They can't excuse this one away as an "error" anymore. NSA/Obama administration lied. Again. What a surprise.

And boy are these NSA stories flagged into oblivion or what? NSA/FBI psy-ops or just good ol' HN folks "getting bored" with the NSA abuses?

Istof• 13 years ago

I just figured why my laptop is transmitting on cellphone frequencies.

Report: NSA intercepting laptops ordered online, installing spyware

Related Stories