For example, if I want to build my own circuit to read or test USB stick content, then often I must use a computer to write driver, load driver...

That computer must use an OS like Windows or Linux... and even the code and the program that I use to load the driver to controller might be compromised and alternated.

So in the end, it is very hard (nearly impossible) to do everything from scratch without using third party hardware/ software/ OS/ code. But if the security is required, can this be done with enough budget? If it is not, then what is the alternative?

Another approach I can think of is just building the device any way, then test it, e.g. read and verify the content of the driver with different devices/ methods.

Another approach is build multiple generations electronics. E.g. the fist laptop is used to build a simple keyboard to write code, then that keyboard is used to write a second generation keyboard with different code/ approach... then with some generations the possibility of the keyboard is compromised is low enough to use to write code to new electronics device..

This is not only apply to simple circuit, but for example, a security customized laptop/ phone might be compromised because the wireless IC is compromised.

So how to build trusted electronics against the thing like, e.g. NSA?

  • you could build something with arduino parts that can inspect the storage, using a dedicated LCD screen to display/browse the contents. Those can be programmed over serial, eliminating any usb shenanigans. A rooted android phone with usb otg could also be used, factory resetting after use (not 100%, but less vulnerable than a computer)
    – dandavis
    Sep 13 '16 at 15:31

I'd consider using open sourced OS like Fedora, Mint, Ubuntu etc.

Open Source Projects are now having more developers than ever and projects are really well monitored and maintained, like Kernel, GCC, glibc etc.

It's quite important to use still maintained and well reviewed libraries to build new software, and do it in such fashion that keeping it up to date is not difficult.

At NSA, they have requirement to use Mandatory Access Control which is called SELinux in Fedora. It's good even on the desktop, you can sandbox command line utility which is running on another user, which gives you similar process security to the one on Android.

Regarding firmware, the good approach is to be able to over-write and read all firmware by yourself, which is mostly doable today. Like you can read / write BIOS (and even lock it permanently), you can load firmware to Ethernet and Wifi.

And keep the source code in Git. It makes sure that there's no one tampering anything.

Regarding plugging USB sticks, you can disable certain types of devices from ports, like allow only storage but not keyboards etc.

  • That's a rather optimistic view. BIOS and peripheral firmware doesn't have available source often. And there can be a lot of firmware in an average PC. There's also CPU microcode, USB devices have their own firmware.
    – domen
    Oct 13 '16 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.