Hacker News new | ask | show | jobs
by dan-silver 3883 days ago
Is there any easy way to determine if the equipment can be trusted?

Does anyone offer services in this area and how much would it cost him?

2 comments

A security researcher obviously can't trust those devices anymore.

If I were him I would sell them and buy new ones.

I saw a talk by him this year.

He would not sell these devices. He would be someone who feeds false information into them to screw with people that are on the other end, and laugh manically while doing so.

What better way to feed false information into a computer than giving it to someone else?

In all honesty, I think a security researcher would be more curious figuring out what they did.

You make a valid point. Trying to find what they did would be valuable to find what kinds of tactics the FBI and such use.
Maybe I have an overactive conscience, but I'd feel kind of wrong about selling without disclosing that I had good reason to believe it was compromised (a serious, unfixable, almost-invisible defect), and probably nobody would buy if I told them that.
Agreed. This would be similar to knowingly selling a defective device, only much worse.

But another thought that crosses my mind is that future disclosures and research may give him new insight to inspect the equipment and try to understand the extent of potential compromise. I would replace it but then hold onto it forever. Twenty years from now, the parts could be a goldmine for documenting what will surely be a historically significant time in the world of surveillance and privacy.

more likely people would pay more for a device with confirmed FBI/CIA/NSA implant

a LOT MORE

Why do you assume the equipment was trustworthy prior to seizure?
If the FBI had (remote) access to the machine prior to seizing it why would they need to seize it?
If they did have that capability they might seize the equipment to maintain the illusion that they did not.

The allied forces did this during the second world war. They could not admit that German encryption had been cracked, so if their only source of knowledge about an event was through breaking of encryption, they would not act on it - even if by doing so, large numbers of civilians would die, because in the long run - far more would be saved by bringing the war to a quicker end.

That's an interesting analogy, but I think that it's not the right one here. Surely the proper analogue would be if the FBI had derived information from their remote infiltration but didn't act on it, rather than if they seized the computer to pretend that they didn't have remote access it?
keyword: parallel construction