InfoSec Institute

I stand out a little bit, because although I'm a "Valley-type techie", I'm also a woman with purple hair. Being a woman in tech has its pros and cons.
The Silicon Valley I'M based out of is what some in the tech media refer to as "Silicon Valley North"- Toronto. (I also live near downtown, but that's irrelevant.)
I was a computer whiz ever since I was a very young girl. By the time I was 11, it was 1995 and I just got into web development, as a self-taught hobby. (There, I just dated myself.)
I didn't even consider a career in tech until I was already in my mid-20s. Why? I theorize that being female (girls aren't encouraged to get into computing as much as boys are) was a minor reason, but being told by teachers in the public school system for years that you have to be EXCELLENT at math to get into computing professionally is the main one. I'm not bad at math, but I thought I was when I was a kid. I blame former Ontario premier Mike Harris. In the 1990s, he really fucked up the school system. One of the policy/curriculum changes he and John Snobelen orchestrated was "show your work" in math. As soon as arithmetic and algebra get more complex, I use different techniques to solve problems than the mainstream ones in textbooks. For example, I don't do long division. I look at a division problem, figure out what the largest "X times Y" is that fits into the number I'm dividing, and I work back and forth from there. I can even get a decimal answer correct down to the first few…

The five eyes IC apparatus has invested in Tor relays and mitm attacks of Tor exit traffic so much so that I personally think using Tor endangers you [1]. They were doing this ~10 years ago (public info - [2]).

As for the surveillance state,I keep pondering other aspects of society. Like how public restrooms are intentionally designed to lack privacy,how in the military and prison you're expected to be comfortable with being completely naked around others and how it is completely acceptable for an arrested citizen to be forced to undress in front of other prisoners and possibly undergo a full on body cavity search all without the chance to defend his accusation in court. I could go on,but you get the point.

I am not so sure the people want privacy. Or maybe they think so lowly of their freedoms,short term safety is always more preferable.

From the intelligence community's perspective, it's all about information control. They do this in other countries. They topple regimes and adjust public opinion in the inteterests of western security and economical goals. If I was in their shoes, I can see myself using fear of other countries doing the same thing against us and use that as an excuse to "beat them to the punch" and take control of information flow in the west.

They simply don't have the clear consent of the people to use the means they use by which they justify the end goal: national security. Regardless of how oblivious and clueless the people may be, the very…

> Verify the ROMs integrity in that first stage (...) need open firmware or some mechanism to hash the ROM that is installed, you need to have a means to read it in its entirety"

Does such a mechanism exist? If you can do this[1] from BIOS, why is it safe to assume that the same can't be done for the dump-bios-image routine? AFAIK the BIOS handles this in real-mode [2] (overrides the OS), and "returns" the image by copying it somewhere in low memory. So, you're trusting the BIOS that it's copied the right data out for you. (goodguybios)

> I say open firmware because you need to be able to guarantee the FBI couldn't embed a backdoor firmware.

This reminds me of this NSA RAID controller rootkit for Dell Poweredge Servers [3]. Nuts. Every closed firmware on your servers is a potential hiding place to someone with (soldering-iron-to-the-motherboard) physical access.

In our Dread Pirate use case, you don't even have to think that far as you can't ensure your own BIOS. Who are you going to buy TPM servers [4] from, when you're defending against the FBI? Intel? HP?

The Rootkit wikipedia page is alarming, to say the least. [5]

--

[1] A Real SMM Rootkit: Reversing and Hooking BIOS SMI Handlers http://phrack.org/issues/66/11.html#article

[2] http://en.wikipedia.org/wiki/Real_mode

[3] http://resources.infosecinstitute.com/nsa-bios-backdoor-god-mode-malware-deitybounce/

[4] http://en.wikipedia.org/wiki/Trusted_Platform_Module

[5]…

I'm not using the right words, but it isn't that easy.

On modern phones, even if you have an image of the phone's storage, the code you enter is merged (wrong word) with a large random number stored in an externally inaccessible chip in the phone (different for each phone, obviously). This large random number is then used as a seed to encrypt the drive. So it's not anything like just extracting the disk image then brute force attempting the 10000 valid codes from 0000-9999.

edit: here is a better explanation

Apple was a front runner in implementing some sort of encryption long before
others even thought about it. Apple uses a 256-bit device-unique secret key
(UID) stored in the phone’s hardware, where it’s hard to extract from. Apple
says this UID is unique to the device and it doesn’t store these values. It
also says that no software or hardware can read this key. This UID is mixed
with the passcode to generate a new key (passcode key) to secure data on the
device. Unlike Android, this UID key can’t be extracted from the device, so
all the brute forcing attempts have to be done on the device itself. [1]

So I would guess it's reasonably secure to non-governmental adversaries. If you're worried about governments, the US now supports torture (the only person punished for torture during the war on terror was a whistleblower), so the NSA is free to torture your code out of you.

[1]…

Tor hidden services are not bulletproof. Just as a really simple example, you can do network traffic analysis to find network nodes with one-way traffic to hosts without a correlated public service and deduce if a hidden service is nearby.

There are several exploits which have been used in the past to expose Tor hidden services, and several papers on theoretical ways to expose them. Many of these attacks can be used in reverse to expose the origin of a connection to a hidden service.

In the [not so] extreme case, the govt can always issue a National Security Letter to WaPo and scoop up any data it wants directly from the hidden service servers, similar to its Silk Road and Freedom Hosting takedowns.

The FBI TOR Exploit [ http://resources.infosecinstitute.com/fbi-tor-exploit/ ]

Heartbleed used to reveal Tor hidden services [ https://blog.torproject.org/blog/openssl-bug-cve-2014-0160/ ]

Hot or Not: Revealing hidden services by their clock skew [ http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf ]

Tor Hidden Service Passive De-Cloaking [ http://blog.whitehatsec.com/tor-hidden-service-passive-de-cloaking/ ]

This is reminiscent of the 2013 takedown of Freedom Hosting.[0,1] Exploiting a JavaScript vulnerability in Firefox, compromised sites dropped a Windows executable (“Magneto”) which phoned home (bypassing Tor) with the user's MAC address and hostname. Gareth Owen identified it as EgotisticalGiraffe,[1] which is an NSA tool.[2]

[0] http://resources.infosecinstitute.com/fbi-tor-exploit/

[1] https://ghowen.me/fbi-tor-malware-analysis/

[2] http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document

Edit: Rereading, I see:

>The NIT exploit bypassed Tor by creating a direct socket connection that eschews Tor's routing—in this particular case, by using a Flash component. This functionality, the experts noted, was identical to Metasploit's decloaking code.

Anonymous used the Metasploit code in a previous attack on Freedom Hosting. Both vulnerabilities used against Freedom Hosting have long been patched. I wonder what vulnerability this takedown exploited. One of the Hacking Team ones, maybe?