"Million dollar" question concerning the hardware we use
- Inicie sesión o regístrese para enviar comentarios
I've been mentioning this, discretely, on this forum. But, after having finally expressed my concern more directly, on another thread (https://trisquel.info/en/forum/some-current-free-software-friendly-hardware#comment-42809) I just thought it was something important enough to make a thread of its own.
Since this is the Free Software community, that I know of, that is most worried about privacy and security, I thought this would be the best place to discuss this.
So, the following, is a "copy-pasted" dialogue that led me to such a question (also posted, at the end of such dialogue) that I consider to be one of great importance. (And, even one about which I would like to hear, someday, what RMS has to say...)
=== start of dialogue ===
# 19 September, 2013 - 23:06 - Magic Banana:
Stallman's position on free hardware looks clear to me. As far as I understand, he considers that, today, the freedoms defining "free software" cannot be applied to hardware because no individual can build her own hardware; even less copy some existing hardware. The fact is: we all depend on mass-produced hardware. This will remain so for years or, more probably, decades. Therefore, rms does not bother to consider this problem that has not arisen. When and if it arises, it ought to be understood and solved with the technology that will be then available.
Now, rms cares about "free software" up to the drivers and firmware. That is why he cares about "documented hardware". The documentation is self contained in free drivers/firmware if the manufacturer provides them. Otherwise, the free software must be able to develop those and documentation helps a lot. If no documentation is available, the free software community has to rely on tedious reverse-engineering (a great contribution to achieve). Whatever the way the free drivers/firmware are obtained, the hardware is then, according to rms, freedom respecting: anybody can use it running only free software.
# 20 September, 2013 - 01:37 - Chris:
You have his perspective perfectly stated.
# 20 September, 2013 - 17:18 - Fernando_Negro:
"Whatever the way the free drivers/firmware are obtained, the hardware is then, according to rms, freedom respecting"
But, isn't there a (constant) concern, among Free Software adepts, with security and privacy, also?
I mean, isn't that something that is implied in the concept of Free Software, itself? (The need for security and privacy, that can only be obtained with free and "open source" software?)
If so, you have to take into account the existence of "hardware trojans" that can be possibly embedded into motherboards and microchips. (And, one way to counter that would be the idea of documented/"free" hardware.)
I mean, shouldn't we take the concepts inherent to, and that are behind the idea of, Free Software, and apply them also to the hardware?
(the following is the concern I'm talking about:)
"'Elbit' flash memory chips, allegedly designed at Kir Yat-Gat south of Tel Aviv. The unique feature of the Elbit chips was that they worked on ambient electricity in a computer. In other words, they worked when the computer was turned off. When combined with another newly developed chip, the 'Petrie,' which was capable of storing up to six months worth of key strokes, it was now possible to burst transmit all of a computer's activity in the middle of the night to a nearby receiver - say in a passing truck or even a low flying SIGINT (Signals Intelligence) satellite."
--- http://www.fromthewilderness.com/free/pandora/052401_promis.html
"CELL PHONE (FBI can listen to you when phone is turned off)": http://www.youtube.com/watch?v=0G1fNjK9SXg
=== end of dialogue ===
P.S. - When I talk about "free hardware", I'm talking about the concept discussed here: https://trisquel.info/en/forum/open-source-hardware-free-hardware-foundation#comment-42500
"And, even one about which I would like to hear, someday, what RMS has to say..."
You can use email and ask him any time.
Yes. I know, from someone I met here, that he's a much more accessible person than I thought he was. And, maybe I'll do that, someday, when things get more calm for me and I have more time to do so. (Since, he's a person I respect very much, and which should deserve my full attention.)
But, for now, I'm most interested to know what does this "privacy-concerned" community have to say about this... :)
For those who may not like the term "Free Hardware"...
Remember that, a "Free Software" copy is also, ultimately, always a /physical/ copy. Be it, a DVD that one has burned, or part of the space on a drive that one has. So, the "copy" of a free software piece, is also a "physical copy".
And, a "free hardware" copy is just something that is not as simple or cheap to do, or one that is accessible to anyone. But, one thing that a person, with the means to, can do, with the proper equipment.
(And, even if it's not the final product that is copied, like in the case of compiled software, copying a piece of hardware through the blueprints - that is, it's "source code" - to then "burn it", ends up having the same result.)
CD burners also started as something that not everyone had. And, if anyone thinks that making "hardware copies" will always be something only possible to be done by a few, start informing yourselves about the wonderful concept of "3D printing": http://www.corbettreport.com/episode-251-solutions-3d-printing/
This is a topic that also concerns me. What can with do with the privacy and security issues of hardware? If I decided to manufacture CPU chips, how can I insure you that those chips respect your privacy and security?
It is a very good question; you could provide documentation for your hardware which shows that there are no malicious circuits built in and allows people to make free software drivers for the device, but after all, no one can figure out if your documentation tells really the truth or not.
We would need kind of a microscopy-scanning device which can compare the actual micro (or nowadays even nano?) circuits with the documentation.
A real problem. The functionality of the technology we rely on can't be checked with our eyes.
Yes. In practical terms, most of the times, it all comes down to a matter of trust in the entity that ultimately provides you the product.
Very few people also inspect the source code of the programs they use, and compare it with the compiled form in which such programs are distributed. (Because, most of them, are not even able to, in terms of knowledge.) And, merely choose a distro they think they can trust in.
But, the same way that I count on this happening for the software... If a curious person, who knows a lot about the subject and that has the ability (or, in this case, the material capacity) to make such inspection, were to find something wrong, it could warn the others.
And, with "free hardware", you wouldn't necessarily be dependent on some shady corporation, you wouldn't trust in, that would be the only entity authorized to make such a hardware. And, you could improve, a lot, the confidence on your equipment, if it was possible for such a hardware to be also made by another entity you knew you could trust in.
There comes a point where privacy and security are simply not possible. If you use a PC, no matter what software you have installed you are vulnerable. And despite all the hooha about back doors, hidden spyware, etc, all ISP's (certainly in the UK and therefore almost certainly in all "Western developed nations") records are kept of all you do, see and say. Even the very keyboard strokes you make are detectable, even if you are not online at the time. Which is of course not to say they are listening, just that if theyt want to, you have zero chance of avoiding detection.
The following excerpt is taken from a pdf published in 2009, address at the bottom.
Computer keyboards are often used to transmit confidential data such as passwords. Since they contain electronic components, keyboards eventually emit electro-magnetic waves. These emanations could reveal sensitive information such as keystrokes. The technique generally used to detect compromising emanations is based on a wide-band receiver, tuned on a specific frequency. However, this method may not be optimal since a significant amount of information is lost during the signal acquisition. Our approach is to acquire the raw signal directly from the antenna and to process the entire captured electromagnetic spectrum. Thanks to this method, we detected four different kinds of compromising
electromagnetic emanations generated by wired and wireless keyboards. These emissions lead to a full or a partial
recovery of the keystrokes. We implemented these side-channel attacks and our best practical attack fully recovered 95% of the keystrokes of a PS/2 keyboard at a distance up to 20 meters, even through walls. We tested 12 different keyboard models bought between 2001 and 2008 (PS/2, USB, wireless and laptop). They are all vulnerable to at least one of the four attacks. We conclude that most of modern computer keyboards generate compromising emanations (mainly because of the manufacturer cost pressures in the design). Hence, they are not safe to transmit confidential information.
Taken from www.usenix.org/event/sec09/tech/full_papers/vuagnoux.pdf
Not wanting to drift from the initial topic... I'll just confirm (for the "privacy-concerned" ones, that read the above posted) that, that is indeed true. And, I've known that for years, from the same source that I linked to, when I quoted above some examples of "spychips".
"By April of 2001 it had been documented that Echelon was particularly effective against cell phones, and had even been improved to the point where it would recognize the unique sound made by each individual key on a computer keyboard. This enabled the sound of keystrokes to be picked up remotely and translated into text."
--- Michael C. Ruppert, in "Crossing the Rubicon: The Decline of the American Empire at the End of the Age of Oil"
"Latest advances in listening technology mean that if a bug can be attached to a computer keyboard it is possible to monitor exactly what is being keyed in. Because every key on a computer has a unique sound when depressed, it's simply a case of translating the clicks into words.
"The threat of this technology has led some internet banks to rely on a degree of mouse movement."
--- http://news.bbc.co.uk/2/hi/asia-pacific/1259940.stm
That's why one should never type sensitive passwords near a phone. ;)
(And, not going through all the incredible methods of surveillance that I know of...)
The establishment can, indeed, really surveil you, if it wants to... But, it's not a simple, or easy, thing to do, to a lot of people, at the same time... So, we should never facilitate such surveillance, by using software or hardware with surveillance features already included in it (or that we suspect it to) that transmit almost all that we do to Big Brother, all the time.
(Or, we should, at least, try to avoid that same software and hardware, as much as possible.)
I am a member!
Privacy and security concerns became more "real" for more people with the revelations of Snowden.
Security is an ongoing and ever-changing thing. Always was. There are new exploits all the time, security is never fully achieved. Always trade offs.
Online privacy in the form of being anonymous isn't possible practically speaking. Being pseudonymous is more possible, having separate online identities/habits/hardware and so on. Difficult for most people.
If a powerful adversary wants to know something, they will find out regardless of privacy and security measures, probably regardless of law.
As a cryptographer and research professor at Johns Hopkins University said recently, "Unfortunately active software exploits only work if you have a target in mind. If your goal is mass surveillance, you need to build insecurity in from the start. That means working with vendors to add backdoors." http://blog.cryptographyengineering.com/2013/09/on-nsa.html
For decades software was free and the source code was available. That started changing in the 1970's. Stallman believed in those values and saw them slipping away so he did something about it and here we are today.
The FSF is against mass surveillance. http://www.fsf.org/search?SearchableText=surveillance
Beyond hardware and software there is mind control. This is nothing new. https://en.wikipedia.org/wiki/Panopticon
Using an "internet of things" to implement it is already working. http://techcrunch.com/2013/09/20/apples-iphone-5s-and-5c-launch-draws-big-crowds-including-biggest-ever-line-at-nyc-flagship-store/
CIA Director Promotes Surveillance, Endorses Bugging Home https://www.youtube.com/watch?v=CJBfp7ySHtE
Freedom is contrary to this.
The "Internet of Things" concept, that you mentioned, just reminded me of the preceding phenomenon of computerizing everything - even cars, now - and the risks that that poses to security.
If anyone is thinking of buying a new car with a computer in it, here's a most worrying thing you should know about:
http://www.youtube.com/watch?v=dUYMPZ4nEOY#t=29m00s
(If the link doesn't do it, jump to the 29m mark.)
I am a member!
Well, that's bad but there are other things also. Like when timely payments are not recieved, the car can be remotely disabled. http://www.mattberkus.com/blog/miss-your-car-payment-car-gets-disabled/
But what if I have paid in full and now own the car? The "feature" may still be there. Why should such a thing be on "my" car once I've bought it?
I am a member!
I've always felt Internet connected devices (like cell phones) and devices which record, track, etc are a really bad idea. That includes those non-technological things like license plates, social security numbers, and drivers licenses. Things people wouldn't normally associate with being dangerous. Unfortunately the laws are going even further and mandating black box style logging. Much of this technology has been implemented for a long time anyway. Most cars have technology created privacy issues that are on the road today. Unfortunately the government is mandating its implementation so even if you could have avoided it yesterday you can't now.
Even if Michael Hastings had been in a 1970s vehicle the government could have still ensured his demise. The big difference would probably have been collateral damage and the involvement of a 2nd car. In fact it might have been more believable as they could then have used the car and driver of someone with a drinking issue.
Perhaps. But, as I said above, we should never facilitate this kind of access. And, avoid such as much as possible.
As an example, the investigator recently interviewed here - http://www.youtube.com/watch?v=sfgZrRoflCI#t=30m09s - had his truck messed with, but was able to avoid being killed.
I am a member!
Have to also add how using technology for mass surveillance is being reinforced with corporate propaganda.
Coke and surveillance ad: "Let's look at the world a little differently." http://youtu.be/pETma-CDU6M
Coke's brand position: http://www.coca-colacompany.com/coca-cola-unbottled/interbrand-ceo-insights-on-coca-cola-topping-best-global-brands-2012-rankings
https://www.blackhat.com/html/bh-us-12/bh-us-12-archives.html#Brossard
"backdooring of hardware is practical"
I am a member!
Amazing link, thanks. Hardware backdoors.
"Built on top of free software" (coreboot) in 4 weeks. Really, really, really hard to detect as malicious. 230 motherboards affected. Not dependent on an operating system. So much for free software.
Laws would be nice, except plausible deniability and non-attribution would make enforcement near impossible.
This is good to know, sad as it is to see.
Maybe the best hardware in terms of freedom, is no hardware at all. Or at least no hardware that is ever connected to the internet, a never updated separate machine. Hadn't been thinking in that direction. Thanks.
"Russian Government Buys Typewriters to Prevent Intel Leaks"
http://www.youtube.com/watch?v=yRntCca21ec
:)
My idea on this subject is pretty simple. When you get a computer you should have the "source code" the same way you are expecting it when buying (or downloading) software. Only this way we can innovate and unify ourselves as human beings.
But this is not possible at this day because we are depending on manufacturers for a lot of pieces of hardware, this may change in the future, but for now it is a lock hard to solve.
I am a member!
"…highlights the ability for an administrator to shut down PCs remotely “even if the PC is not connected to the network,” as well as the ability to bypass hard drive encryption."
“Intel actually embedded the 3G radio chip in order to enable its Anti Theft 3.0 technology. And since that technology is found on every Core i3/i5/i7 CPU after Sandy Bridge, that means a lot of CPUs, not just new vPro, might have a secret 3G connection nobody knew about until now,”reports Softpedia.
Jeff Marek, director of business client engineering for Intel, acknowledged that the company’s Sandy Bridge” microprocessor, which was released in 2011, had “the ability to remotely kill and restore a lost or stolen PC via 3G.”
“Core vPro processors contain a second physical processor embedded within the main processor which has it’s own operating system embedded on the chip itself,” writes Jim Stone. “As long as the power supply is available and and in working condition, it can be woken up by the Core vPro processor, which runs on the system’s phantom power and is able to quietly turn individual hardware components on and access anything on them.”
The above says it all: a second processor with its own operating system and phantom power supply which doesn't need to be connected to YOUR network (or any existing network you know of) because a secret 3g connection is built in!
Free software is great. However once it is installed on a machine with a chip containing these other "features", it loses its freedom, as it is at the mercy of the other software built deep inside the hardware chip. It is a huge security and privacy lapse. Encryption is also bypassed. Wow.
As RMS says it will take lots of reverse engineering, and perhaps large bounties paid to those who can crack certain features. A never ending cat and mouse game.
The apparent old model of disinterested makers of computer hardware who would not reveal their firmware or microcode has changed from disinterest to complete interest in having the power and the benefits of having the keys to the kingdom remain under their control.
I can see why they are reluctant to "give" that power away. And why they often say, "What's in it for us if we release the code?" It's good to be king.
I am a member!
I'd read that article with a bit of skepticism. While it points out issues that we really should be concerned about 3g being integrated in the CPU is not realistic. It would almost certainly be easy to detect. More than likely the article is written by someone who doesn't understand the technology or was trying to put things together in such a way that it was scary. It's scary although more because we don't have all the info about the technology in question rather than there actually being some unknown 3g chip inside every CPU. This technology almost certainly has to work alongside a 3g mini card and there would probably have to be other support on the system as well. However that isn't to say some of the technology doesn't exist in every system at some level. It would probably be trivial (given the amount of money governments have) to have Intel implement the system such that it communicates whenever there was an Internet presence detected. There probably is no business or government case for there to be 3g in the CPU when 99.999% of computing technology is connected to the Internet. If it isn't and the goal is Iran's nuclear facilities or similar chances are the systems are locked down (shielded). The signal wouldn't get through. And what network is it going to connect with?
And what network is it going to connect with?
Inductive scanning.
Much like RFID chips give up thir information when scanned, why not a powered down pc too? Surely it's just a matter of the power applied to the scan?
Several years ago it was reported that the ability had been obtained to scan a football stadium's worth of people in a few seconds and get a reliable read out of all present, using handheld scanners and RFID chips. That was a "Linux being deployed" story.
I do think that the various Gnu licences need updating to include strict clauses stopping their use in drones or any devices which can be used to monitor people without their being aware or kill them or in anything that compromises people's right to privacy, security or freedom.
Re Iran - it was claimed that their networks were shielded and secure from outside interference, yet the stuxnet virus got in. Either it was in the hardware to begin with, just waiting for a time/date/activation condition to arrive; or it was put there by someone undercover; or the ability to remotely infect exists.
I am a member!
I'm not saying that it couldn't be done technically although we are switching between two things here. And if the system is shielded your idea for inductive scanning probably wouldn't work either.
It would be an awful way of implementing it for spying purposes. It would be better to do it as they appear to have done it. VIA a GSM module using SMS or TCP/IP over wifi/ethernet. The TCIP/IP thing wouldn't be instant. You would have to connect to the Internet first. The later the government could use against anybody (from a spying perspective). The GSM module though requires a bit more. GSM modules require an antenna and are pretty big still. You'd have a hard time hiding one of those I think in a CPU. However it could be used alongside a CPU. I'd be curious how one might go about hiding a mini GSM inside a CPU and still get a sufficiently significant connection to the cellular networks.
"I do think that the various Gnu licences need updating to include strict clauses stopping their use in drones or any devices which can be used to monitor people without their being aware or kill them or in anything that compromises people's right to privacy, security or freedom."
Why should the people doing that care?
It also would abolish freedom #0, the freedom to run a program for any purpose.
This article may clarify more.
http://www.gnu.org/philosophy/programs-must-not-limit-freedom-to-run.html
Another link: http://www.gnu.org/licenses/hessla.html
There's a reasonable chance that this stuff is aimed at Corporate espionage, spying on other nation's military/Governments and making sure that journalists with access to juicy stuff don't get ideas into their heads.
Ah. Nice... :)
RMS ended up (inadvertently) answering my question, in his lecture given at the GNU's 30th anniversary celebrations. (So, there's no need to e-mail him, any more, about this...)
He talks about the need to encourage a "Free/Libre Hardware Movement", due to the same concerns that I talk about, in a segment that starts at around 7m40s into the following video: http://files.jxself.org/rms-gnu30-1.ogv
(So, the "million dollar" question has been correctly answered. ;) And, now, what we need to do, to collect the prize/fortune/benefits, is to follow his advice and encourage such a movement, which is beginning to take form.) :)
Let's start buying, using and pressuring for this type of non-proprietary hardware, instead, and make our whole systems free!
(http://trisquel.info/en/forum/some-current-free-software-friendly-hardware)
I am a member!
Thanks for the links! Do you know where I could find more videos/audios
on lectures/speeches by RMS?
On 09/29/2013 02:54 AM, name at domain wrote:
> Ah. Nice... :)
>
> RMS ended up (inadvertently) answering my question, in his lecture
> given at the GNU's 30th anniversary celebrations. (So, there's no need
> to e-mail him, any more, about this...)
>
> He talks about the need to encourage a "Free/Libre Hardware Movement",
> due to the same concerns that I talk about, in a segment that starts
> at around 7m40s into the following video:
> http://files.jxself.org/rms-gnu30-1.ogv
>
> (So, the "million dollar" question has been correctly answered. ;)
> And, now, what we need to do, to collect the prize/fortune/benefits,
> is to follow his advice and encourage such a movement, which is
> beginning to take form.) :)
>
> Let's start buying, using and pressuring for this type of
> non-proprietary hardware, instead, and make our whole systems free!
>
> (http://trisquel.info/en/forum/some-current-free-software-friendly-hardware)
>
>
>Thanks for the links! Do you know where I could find more videos/audios on lectures/speeches by RMS?
Here's some older material http://audio-video.gnu.org/
And if you don't mind the privacy implications I'm sure you can find something also on youtube (ewww)
I am a member!
On 09/29/2013 10:15 AM, name at domain wrote:
> >Thanks for the links! Do you know where I could find more
> videos/audios on lectures/speeches by RMS?
>
> Here's some older material http://audio-video.gnu.org/
>
> And if you don't mind the privacy implications I'm sure you can find
> something also on youtube (ewww)
>
Thanks! Regarding youtube, I normally just get the links of the videos I
want to watch and fetch them with youtube-dl.
Hi there.
The link that I posted, to a video from yesterday's lecture, is one of two files that "jxself" (user of this forum) uploaded to his web site, and that are listed here: https://trisquel.info/en/forum/video-stream-gnu-30th-birthday#comment-43278
And, concerning other lectures/speeches by RMS - and, in addition to the page that "lembas" linked to, that has his old ones - user "quantumgravity", of this forum, recently gave me a link to a page that keeps track of his future and present ones, and that you can use as reference to find the corresponding video or audio files online: https://trisquel.info/en/forum/rms-talk-libreplanet#comment-42790
Personally I think that if the spying continues, other countries will start up their own hardware manufacturing facilities but it may not be exportable to to the US. Perhaps those of you young enough can make plans to emigrate [snark]
- Inicie sesión o regístrese para enviar comentarios