5

It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance:

March 12, 2014: NSA has developed implants to take over targeted computers’ microphones and webcams, record keystrokes and internet browsing histories, and save data from removable flash drives connected to targeted computers. These implants often enable NSA to circumvent encryption software.

December 30, 2013: NSA has developed a keystroke logger that functions even when the target computer is not connected to the internet.

December 29, 2013: NSA prefers to install malware in BIOS, rather than on hard drives.

Also, the NSA has already installed malware on probably millions of computers (is.gd/dCpQgE) (and hundreds of thousands almost certainly (is.gd/QQ4RRI)).

Given the prevalence of this malware, and that most antivirus companies refused to state whether they have worked with government agencies to whitelist certain malware, how can NSA implants and backdoors be detected?

Improve this question
4
  • That's impossible to answer directly, as a back door can be put in almost any location, in any layer. So this is only a meaningful discussion if you pick out one backdoor application. AFAIK there is no such thing as a specific backdoor detection application in place (at least not one that can be used by regular companies and persons).
    – Maarten Bodewes
    May 10, 2014 at 13:23
  • 1
    @owlstead ...and when there would be such an application, malware authors (private or government) would do their best to circumvent it.
    – Philipp
    May 10, 2014 at 14:21
  • You could try to avoid the implants in the first place. Use an open hardware computer, such as the Raspberry Pi. And use open source software. These things have been inspected by dozens of eyes, and it's nearly impossible for anyone to hide a backdoor in there. Disclaimer: The Raspberry Pi CPU is not open hardware, I am not aware of a fully open hardware project. I'd love to hear about one.
    – Hello World
    May 10, 2014 at 17:15
  • The Olimex is fully open hardware. olimex.com/Products
    – Hello World
    May 10, 2014 at 17:20

2 Answers 2

Reset to default
4

You are unlikely to detect a backdoor even by disassembly. These things are baked in to chipsets that maybe the BIOS doesn't even touch.

Perhaps, if you install a mirror port on your line then monitor to see if there is encrypted UDP traffic being transmitted to somewhere. UDP doesn't need a reply from the far endpoint. It doesn't even need to be sent to a real IP address - the authorities will intercept it in transit. Lack of a real IP target means its 'deniable' and untraceable back to who is the actual receiver, or if it is a real IP, it could be a false diversion.

I imagine if you work in the North Korean embassy even this is not sufficient.

If the authorities go looking for needles in all the haystacks they will find lots of sharp pointy things that aren't needles. The false positives will be your problem not theirs.

Improve this answer
-5

You can't detect officially authorized implants and backdoors (I hope).

I hate to burst your bubble but the NSA isn't that into you.

Most NSA employees and contractors play by the rules and, unless you're involved with international terrorism or some other activity that is of legitimate interest to an intelligence agency, odds are any data retrieved from your boxen will sit, unread, in some mountain in Utah until doomsday.

Let's face it, members of intelligence agencies, and your local police, have enormous power that can wreak havoc on citizens if misused. It's necessary that some people have that kind of power. You do want them to catch child pornographers and terrorists, right?

We all know of cases where the power was terribly misused, and we all support checks and balances on that power. Cops, as well as NSA personnel, are carefully vetted, their computer use is supposedly monitored, and there are civil and criminal sanctions that are supposed to deter against misbehavior. It's the ancient question of "Who will guard the guardians?"

There will always be debate on whether existing checks and balances are sufficient, or whether more limits should be placed on the government's collection and surveillance capabilities. As of now it looks like Congress is going to outlaw or curtail many mass data collection programs of the type exposed by Mr. Snowden.

And you need a tinfoil hat.

Improve this answer
5
  • 4
    Yes, they play by the rules. But these are rules they created to maintain their interests, which might not exactly overlap with your interests. I don't believe that the NSA are the bad guys, but even their good intentions can cause severe collateral damage.
    – Steffen Ullrich
    May 10, 2014 at 6:15
  • 5
    Downvoted because this doesn't attempt to answer the question "how can NSA implants and backdoors be detected?"
    – davidwebster48
    May 10, 2014 at 11:20
  • 1
    This doesn't answer the question.
    – Hello World
    May 10, 2014 at 17:12
  • There is nothing magical about NSA implants. You find them the way you'd find any other attacker's: by careful inspection of the hardware, by analyzing software from a known-clean computer, and so on.
    – Mark
    May 10, 2014 at 23:12
  • Not really an awnser, mostly seems to kinda batter at the quistion asker, escpecially that very last line
    – Lighty
    May 23, 2014 at 9:24

Not the answer you're looking for? Browse other questions tagged .