Catalog of NSA compromised equipments

[Bob Jonkman]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

James Knott wrote:
> How does a hard drive communicate anything back to the NSA?

Digimer wrote:
> It doesn't work that way. It works by, for example, knowing when 
> /etc/shadow is being read and modifying/injecting data into the 
> stream[...]

Time to re-read "Reflections on Trusting Trust" by Ken Thompson. He
writes: "A well installed microcode bug will be almost impossible to
detect."

http://cm.bell-labs.com/who/ken/trust.html

- --Bob.


On 13-12-30 11:46 PM, Digimer wrote:
> On 30/12/13 09:20 PM, James Knott wrote:
>> William Muriithi wrote:
>>> 
>>> Another program attacks the firmware in hard drives
>>> manufactured by Western Digital, Seagate, Maxtor and Samsung,
>>> all of which, with the exception of latter, are American
>>> companies. Here, too, it appears the US intelligence agency is
>>> compromising the technology and products of American
>>> companies.
>>> 
>> 
>> One would assume they want to collect info.  How does a hard
>> drive communicate anything back to the NSA?  That would require
>> the drive to send the data via the SATA port, through the IP
>> stack and then out the NIC.  How is that possible?
> 
> It doesn't work that way. It works by, for example, knowing when 
> /etc/shadow is being read and modifying/injecting data into the 
> stream that would allow an attacker to log into a target system. 
> You'll note that specific support for ext2/3 FS were listed (and
> that was some years ago, so no reason not to think ext4 is also 
> vulnerable).
> 
> At the end of the day, if an attacker has access to your BIOS, you 
> have no privacy, OS aside.
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Ensure confidentiality, authenticity, non-repudiability

iEUEARECAAYFAlLDJcEACgkQuRKJsNLM5eowaACeMLR9OCTdbdy5xf1TOlf52Nni
tEYAmIrb0ZhOsG1JcM2AWeRsjchv374=
=0XXP
-----END PGP SIGNATURE-----
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists