<story><title>Federal agents seek to loosen rules on hacking computers during investigations</title><url>http://www.bloomberg.com/news/2014-05-09/federal-agents-seek-to-loosen-rules-on-hacking-computers.html</url></story><parent_chain><item><author>devconsole</author><text>A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn&amp;#x27;t compromised, someone else quipped &amp;quot;Could be the processors too, better forge those by hand.&amp;quot; &lt;a href=&quot;https://news.ycombinator.com/item?id=7609780&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=7609780&lt;/a&gt;&lt;p&gt;In fact, it turns out the future is probably headed in that direction.  All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amount of open software running on your phone can stop.  And as laptops become more and more mobile, it&amp;#x27;s going to seem strange that we&amp;#x27;ve spent so long trying to tether our mobile phones to our laptops.  Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee.  Consumers would probably love it, because it&amp;#x27;s very enticing: you get internet access in most of the world without having to find a public hotspot or tether your phone.  No more dealing with hotel wifi; no more dealing with logging in to someone else&amp;#x27;s.&lt;p&gt;The takeaway is that your children may grow up in a world where it&amp;#x27;s impossible to guarantee the government can&amp;#x27;t get into your computer if it really wanted to.  Desktop computers aren&amp;#x27;t ever going to go away, but hardware design seems to be trending towards having built-in theft prevention.  One feature of theft prevention is having the ability to locate the computer, or send it remote kill signals.  If trends like that do catch on with consumers, it&amp;#x27;s &amp;quot;gg no re,&amp;quot; because once our hardware is compromised to the point of third parties being able to remotely access it on demand, we&amp;#x27;ve all lost something precious, and there won&amp;#x27;t be any opportunity to fix it.  The more I think about it, the more it seems like it&amp;#x27;s just a matter of time until this happens, precisely because once it&amp;#x27;s here, it&amp;#x27;s never going away.&lt;p&gt;More and more network adapters seem to have DMA access to your computer.  It would be interesting if the protections afforded by open source software were defeated at the hardware level without most people noticing.  There doesn&amp;#x27;t seem to be any way to defend against it, because open source hardware simply can&amp;#x27;t survive: no money is necessary to develop open source software, whereas large investment would be necessary for development of open source hardware down to the chip level.</text></item></parent_chain><comment><author>DanBC</author><text>&amp;gt; The takeaway is that your children may grow up in a world where it&amp;#x27;s impossible to guarantee the government can&amp;#x27;t get into your computer if it really wanted to.&lt;p&gt;If your adversary is a well funded government you need to have:&lt;p&gt;Secure software&lt;p&gt;Secure firmware&lt;p&gt;Secure hardware&lt;p&gt;Secure staff who follow procedure&lt;p&gt;Secure location&lt;p&gt;Armed guards&lt;p&gt;Etc&lt;p&gt;Most people can not do all of this and this have been vulnerable to governments for a long time.&lt;p&gt;Suggesting that your mobile communications data was ever secure when it was available to your telecoms provider seems odd to me.</text></comment>
<story><title>Federal agents seek to loosen rules on hacking computers during investigations</title><url>http://www.bloomberg.com/news/2014-05-09/federal-agents-seek-to-loosen-rules-on-hacking-computers.html</url></story><parent_chain><item><author>devconsole</author><text>A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn&amp;#x27;t compromised, someone else quipped &amp;quot;Could be the processors too, better forge those by hand.&amp;quot; &lt;a href=&quot;https://news.ycombinator.com/item?id=7609780&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=7609780&lt;/a&gt;&lt;p&gt;In fact, it turns out the future is probably headed in that direction.  All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amount of open software running on your phone can stop.  And as laptops become more and more mobile, it&amp;#x27;s going to seem strange that we&amp;#x27;ve spent so long trying to tether our mobile phones to our laptops.  Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee.  Consumers would probably love it, because it&amp;#x27;s very enticing: you get internet access in most of the world without having to find a public hotspot or tether your phone.  No more dealing with hotel wifi; no more dealing with logging in to someone else&amp;#x27;s.&lt;p&gt;The takeaway is that your children may grow up in a world where it&amp;#x27;s impossible to guarantee the government can&amp;#x27;t get into your computer if it really wanted to.  Desktop computers aren&amp;#x27;t ever going to go away, but hardware design seems to be trending towards having built-in theft prevention.  One feature of theft prevention is having the ability to locate the computer, or send it remote kill signals.  If trends like that do catch on with consumers, it&amp;#x27;s &amp;quot;gg no re,&amp;quot; because once our hardware is compromised to the point of third parties being able to remotely access it on demand, we&amp;#x27;ve all lost something precious, and there won&amp;#x27;t be any opportunity to fix it.  The more I think about it, the more it seems like it&amp;#x27;s just a matter of time until this happens, precisely because once it&amp;#x27;s here, it&amp;#x27;s never going away.&lt;p&gt;More and more network adapters seem to have DMA access to your computer.  It would be interesting if the protections afforded by open source software were defeated at the hardware level without most people noticing.  There doesn&amp;#x27;t seem to be any way to defend against it, because open source hardware simply can&amp;#x27;t survive: no money is necessary to develop open source software, whereas large investment would be necessary for development of open source hardware down to the chip level.</text></item></parent_chain><comment><author>comex</author><text>&amp;gt; The takeaway is that your children may grow up in a world where it&amp;#x27;s impossible to guarantee the government can&amp;#x27;t get into your computer if it really wanted to.&lt;p&gt;This is impossible to guarantee today.  Certainly if you run the zero-day magnets known as browsers, and even if not, there is always some possibility of physical intrusion.&lt;p&gt;&amp;gt; More and more network adapters seem to have DMA access to your computer.&lt;p&gt;With an IOMMU (VT-d or equivalent on other platforms), it should be possible to protect against malicious DMA from any source.&lt;p&gt;Also, not all phones have basebands with DMA access to main memory.  I think iPhones do not, though I am not sure, and some older iPhones have been attacked by turning on &amp;quot;auto answer&amp;quot;, demonstrating direct access to the microphone.</text></comment>