this post was submitted on 23 Dec 2024
126 points (99.2% liked)

No Stupid Questions

36167 readers
1336 users here now

No such thing. Ask away!

!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules (interactive)


Rule 1- All posts must be legitimate questions. All post titles must include a question.

All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.



Rule 2- Your question subject cannot be illegal or NSFW material.

Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.



Rule 3- Do not seek mental, medical and professional help here.

Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.



Rule 4- No self promotion or upvote-farming of any kind.

That's it.



Rule 5- No baiting or sealioning or promoting an agenda.

Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.



Rule 6- Regarding META posts and joke questions.

Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.

On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.

If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.



Rule 7- You can't intentionally annoy, mock, or harass other members.

If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.

Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.



Rule 8- All comments should try to stay relevant to their parent content.



Rule 9- Reposts from other platforms are not allowed.

Let everyone have their own content.



Rule 10- Majority of bots aren't allowed to participate here.



Credits

Our breathtaking icon was bestowed upon us by @Cevilia!

The greatest banner of all time: by @TheOneWithTheHair!

founded 2 years ago
MODERATORS
 

Edit: Changed "the government" to "governments"

I mean, people say use end to end encryption, VPN, Tor, Open Source Operating System, but I think one thing missed is the hardware is not really open source, and theres no practical open source alternative for hardware. There's Intel ME, AMD PSP, so there's probably one in phones. How can people be so confident these encryption is gonna stop intelligence agencies?

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 15 points 8 hours ago

We don't.

We really really don't.

Consider the attack that Israel carried out this fall by detonating walkie-talkies and pagers. This wasn't just some illicit code in the firmware or hardware, they managed to hijack the supply chain and hide literal bombs in commercially-produced handheld devices!

Bottom line: If you do not directly control the production chain from chip design and fab to end-user software, you can never be sure.

40 years ago, the legendary Ken Thompsonand Dennis Ritchie accepted the Turing Award for creating Unix. Thompson's acceptance speech Reflections on Trusting Trust pointed out this same fundamental security flaw.

I encourage everyone to read the article, and spread it as widely as possible. It is terrifying and accurate, nearly half a century later.

[–] [email protected] 11 points 11 hours ago

It's not just back doors. All governments will have a group of people who's job is to find security vulnerabilities in OS and use them to attack other nations.

If Wanacry rings a bell the you might be aware that the Eternal Blue exploit was the infection vector which was originally designed by the NSA and leaked by a hacking group. Only after the leak did the NSA tell Microsoft how it worked and it was patched.

[–] [email protected] 1 points 7 hours ago

‘They’ (I.e. government agencies/PPP) actively exploit weaknesses or institutionally create them. Personal favorite is the backdoors built into TETRA, which is used for mainly government purposes (law enforcement, emergency services). ETSI acts as a strawman for government interest and serves no cause other than that of its masters. That bugs me to no end because this does not serve any purpose.

https://www.zetter-zeroday.com/interview-with-the-etsi-standards/

[–] [email protected] 11 points 15 hours ago

https://en.wikipedia.org/wiki/Intel_Management_Engine

https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor

If I was a government intelligence agency I'd probably sell my soul to get access to these...

I get that they have legitimate use cases for corporations, but why are there virtually no consumer grade CPUs without that stuff ? Surely they would be less expensive and no one would miss the features on their home computers.

[–] [email protected] 30 points 18 hours ago (1 children)

Well, there is this time a few months ago where the Chinese government hacked AT&T and Verizon using the mandatory backdoors the US government left for wiretaps...

https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b

That's the reason leaving backdoors is generally a really, really bad idea, because you don't know who else can use them

[–] [email protected] 1 points 8 hours ago

Lol they still have persistence in the network too, afaik

[–] [email protected] 9 points 15 hours ago
[–] [email protected] 6 points 14 hours ago
[–] [email protected] 6 points 16 hours ago* (last edited 16 hours ago) (1 children)

Didn't national treasure Edward Snowden prove this?

[–] [email protected] 8 points 15 hours ago* (last edited 14 hours ago)

AFAIK, his leaks showed that corporations are collaborating, and software could have backdoors. I don't think they ever showed docs that reveal non-targeted hardware based surveillance. The common understanding post-snowden was, use Open Source OS and use Encryption and you're safe, unless you are specifically targeted.

My question is asking about hardware-based mass surveillance.

[–] [email protected] 16 points 20 hours ago* (last edited 20 hours ago) (1 children)

Wasn't that something Asange or Snowden blew the whistle on? That the CIA or NSA or something actually has backdoors in pretty much everything, along with all kinds of spyware floating around the net?

[–] [email protected] 6 points 20 hours ago* (last edited 14 hours ago) (1 children)

I think they were more like Verizon and other carriers logging metadata. Google and Apple, in their server side services. And the government has physically tapped internet cables. HTTP was not widespead at the time, and corporations were (either forced, or willingly) co-operating with authorities for mass surveillance. Also, most devides had no encrption for data at rest. You know, that type of thing.

I don't think the snowden leaks ever said anything about a hardware backdoor outside of targetted attacks (Correct me if I'm wrong). So it was widely understood post-snowden era that using an open source OS + encryption for both at rest and communications would be good enough for non-targeted attacks.

But my question asks if governments could be listening to everyone as a mass surveillance non-targeted attack, via hardware backdoors

[–] [email protected] 3 points 17 hours ago

If they listen to everyone, it would show up in some way, using power and bandwidth. Even using like steganography wouldn't hide it very well IMO. One exception being windows ofc 😅 where they spy on you for sure already.

Wasn't it that mega share guy (king dotcom or something) that figured out his PC was compromised because his ping skyrocketed on CS-GO?

[–] [email protected] 14 points 21 hours ago

There's no way to check the whole thing, but you can totally pick a component and reverse engineer it, which is something people do quite a bit. When spying is found, it's usually a private company doing it.

The NSA doesn't care about your search history, but advertisers do. (and the government ever did, they'll just call up google)

[–] [email protected] 5 points 18 hours ago* (last edited 18 hours ago)

Yeah, we don't. It's generally hard/impossible to prove the nonexistence of something. Similar as with God. It's unlikely, but we can't prove he doesn't exist with certainty. These proofs only work for very simple and contained systems.

[–] [email protected] 14 points 23 hours ago (3 children)

I've worked for the government. They had me managing 78 full AWS accounts for various departments. Me, 1 guy. And I had to explain basics of tech to everybody in charge of the cloud accounts.

Our gov can barely manage itself, let alone some next level tech on millions of devices and keep track of it all. They couldn't even get me a new mouse without 2 forms, 1 online ticket, and 2 levels of approvals.

[–] [email protected] 1 points 8 hours ago

Does your govt not have an NSA like entity?

[–] [email protected] 6 points 21 hours ago

Yep but the capable agencies know what they want

[–] [email protected] 4 points 22 hours ago

Which government is this?

[–] [email protected] 10 points 21 hours ago

A few years ago they had rerouted shipments from Cisco to the NSA and then forward to the intended recipients. Not just a few parcels, but truckloads.

[–] [email protected] 58 points 1 day ago (2 children)

We will never have a way of knowing for sure. There are stories of government agencies famously requesting backdoor access to Apple devices, seemingly because they can't get in otherwise, and Apple refusing, however they end up getting access on their own eventually. But who knows how much of that is even true? Government agencies are historically manipulative when it comes to public narrative, so anything made public by them should be taken with a hefty grain of salt

[–] [email protected] 1 points 16 hours ago

The side of corporation is corrupt as well because they use it for marketing.

load more comments (1 replies)
[–] [email protected] 43 points 1 day ago (7 children)

We know they do, actually.

All US companies provide the NSA with backdoors. All modern AMD and Intel CPUs have the ability to run remote code signed by their manufacturer and snoop into memory.

Put the two things together and now you know.

load more comments (7 replies)
[–] [email protected] 35 points 1 day ago* (last edited 1 day ago) (1 children)

We don't. The point is to reduce attack surface relative to target value. People use a VPN for piracy, for example, not because it's totally secure, but because rights holders generally aren't going to bother going after a single person when they'd have to go thru a VPN provider as well. OTOH someone doing it on clearnet is being logged by their ISP and the data is right there. OTOOH, the three letter agencies are absolutely going to bother if they have a tip that you're doing something really dangerous to the status quo.

TL;DR: It's like IRL security. If somebody really wants your shit, they'll find a way to get it. The point is to make it generally not worth it.

[–] [email protected] 5 points 21 hours ago

Today I learned you have 3 hands

[–] [email protected] 21 points 1 day ago (4 children)

Okay so here's my take on it not that anybody asked.

There are likely back doors in all computerized Networked devices.

There is likely some identifying information being sent back to random servers from a myriad of places.

That being said, you are not worth the time to directly observe.

Most likely, all of this data goes into a large database where they analyze trends and look for people that are outside of various tolerance zones.

Other than that, all of your data is just noise, grist for the grist Mill.

It is only when you become a person of interest who is worth devoting the time to directly analyze that these risks escalate to the point where you should have concern about it.

99.9999% of us are just not important enough to pay attention to.

[–] [email protected] 2 points 9 hours ago

That being said, you are not worth the time to directly observe.

At the moment; it's important to remember facist governments can end up doing things that make no logical sense for idealogical reasons, so the best protection is to try to avoid ending up with a fascist government.

[–] [email protected] 13 points 1 day ago (3 children)

Also the government is not all one monolithic entity. Just because the NSA has a backdoor doesnt mean theyll hand that information out to anyone who asks. Maybe if the CIA fills out a ton of paperwork, but if its the FBI theyll laugh in their faces and tell them the data doesnt exist.

[–] [email protected] 4 points 19 hours ago

The Jersey drone story is a great example.

The FAA posted a a security update for the Picatinny area a few weeks ago. Now where did that come from? Some governmental org that wanted to do testing.

But the rest of government was unaware, so could honestly say they didn't know anything about the drone activity.

[–] [email protected] 4 points 21 hours ago

Here's the most down to earth comment in the whole post

[–] [email protected] 7 points 1 day ago (1 children)

Lol that FBI/CIA government bureuacracy was what (allegedly) led to the 9/11 hijackers getting through the cracks in the fishing net.

[–] [email protected] 4 points 1 day ago

Cause the FBI are the keystone cops of the intelligence world. Theres a reason they spun off a whole new agency rather than just give the FBI unlimited resources for the war on terror.

[–] [email protected] 8 points 1 day ago* (last edited 1 day ago)

This is probably going to be a very unpopular opinion but I am much angrier at a corporation having my data than a govermment and the former is much easier to avoid

[–] [email protected] 7 points 1 day ago (2 children)

“If you can’t trust the governments of the world, then who can you trust?”
Albert Einstein, Young Einstein

[–] [email protected] 2 points 20 hours ago

Me, myself, and I

pulls out a glock with suppressor

"Nothing, personal"

/jk

load more comments (1 replies)
[–] lurch 16 points 1 day ago (1 children)

If the government wants to snoop, they can just get a Certificate Authority in the boat and MITM whoever they want.

In my region there are laws that telecoms have to provide a way to let the government snoop, but the government doesn't use it without probable cause.

Some people think a VPN will protect them, because the provider doesn't log, but all the government needs is the VPN keys and they can intercept all traffic between the VPN and the user and log it themselves.

[–] [email protected] 10 points 1 day ago

...the g9verenment doesn't use it without probably cause YET.

The way politics are going lately, that might all change in an instant. Not that there's anything you or I can do about it. I'm not trying to fearmonger here, just that you shouldn't be putting any Qurans or Communist manifestos on your Onedrive account, that's all. Be mindful.

[–] [email protected] 10 points 1 day ago* (last edited 1 day ago)

It's difficult to know that for sure, which is why (e.g.) the US government wants to make sure that there is domestic chip manufacture with a completely controlled supply chain to make hardware for classified communications. It can help to consider the difference between targeted surveillance (spending millions to tap the President's phone, to get big juicy national secrets) and dragnet surveillance (tapping everybody's phone so that you can have dirt on Joe Schmoe if he does something interesting later, even if he is of no particular interest right now). Hardware backdoors would be used mostly for targeted surveillance.

Stuff like VPN's and encrypted apps can be of considerable help against dragnet surveillance, which is what the civil privacy community mostly cares about. If you think you might be a subject of targeted surveillance, you have to be much more paranoid. Not just hardware backdoors in your computer, but suspicious white vans on your street, microphones in your flower pots, FBI agents under your bed, the whole bit.

There are some countermeasures you can take against hardware backdoors (electromagnetically isolate a computer from the network and transfer data from it by floppy disc or similar) but basically you're in a different world if you're dealing with this.

You mght like the book "Security Engineering" by Ross Anderson (older editions free online and still very good: https://www.cl.cam.ac.uk/archive/rja14/book.html and scroll down). It goes into this stuff, has lots of good overviews even if you gloss over the technical parts, and will generally help you see clearly in the topic.

[–] [email protected] 3 points 1 day ago

I mean we pretty much can be certain that we're all being surveilled to some extent all the time.

[–] [email protected] 5 points 1 day ago

I would assume CIA has a list of vulnerabilities in processors /mobos that they can exploit

[–] [email protected] 6 points 1 day ago (1 children)

You have to operate as if they have back doors.

With that being said, shit positing is not a national security issue yet.

Although DHS chief glowie did provide comments recently on how online discourse is a serious threat to CEOs

So they are clearly monitoring all socials for these vibes.

The fact that they got full might of daddy Sam LARPing dead parasite is telling.

Shit Posting Might have more power than previously thought.

Even without copy cats, parasites will uncomfortable with this public sentiment.

But they never discuss why the pedons would feel sucn a way

[–] [email protected] 5 points 1 day ago (1 children)

Remember, the only way to resolve a denied claim is to [Redacted By lemmy.world Admins]

load more comments (1 replies)
load more comments
view more: next ›