270 votes
Accepted

Search for military installed backdoors on laptop

If the device left your sight for any amount of time, replace it. It can no longer be trusted. The cost to assure it can still be trusted significantly exceeds the cost of getting a new one There is ...
forest's user avatar
  • 66.6k
198 votes
Accepted

Is it theoretically possible to deploy backdoors on ports higher than 65535?

No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports) If you alter the protocol by reserving more bits for higher ports, you're violating ...
Arminius's user avatar
  • 44.7k
76 votes

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

Without access to the key, then the problem for attackers is the same as if there was no backdoor key: the attackers would have to break the encryption itself. But ... If we assume that the ...
schroeder's user avatar
  • 129k
75 votes
Accepted

How do large companies protect their source code?

First off, I want to say that just because a company is big doesn't mean their security will be any better. That said, I'll mention that having done security work in a large number of Fortune 500 ...
Trey Blalock's user avatar
  • 14.2k
73 votes
Accepted

Can the previewable option in file managers execute malware?

Yes, it is possible for previews to execute malicious code. Previews are created by checking the file type, and generating a thumbnail. For images, it resizes them. For videos, it decodes them, seeks ...
forest's user avatar
  • 66.6k
73 votes

Search for military installed backdoors on laptop

The main information we are lacking is your threat model. Is it likely that the military targets you specifically, and would be willing to expend some resources on you? We don't need to know the ...
Tom's user avatar
  • 10.3k
66 votes
Accepted

Apple's open letter - they can't or won't backdoor iOS?

Various commentators suggest that this would be possible, on the specific hardware involved in this case. For example, Dan Guido from Trail of Bits mentions that with the correct firmware signatures, ...
Matthew's user avatar
  • 27.4k
59 votes
Accepted

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?

In addition to the points mentioned by Lucas Kauffman I would elaborate on point two: 2.This algorithm generates one extra unique decryption key when used. This key is then sent via a secure ...
Philipp's user avatar
  • 49.4k
46 votes
Accepted

Any known cases of government backdoors creating exploitable security holes?

Wiretapping case in Greece 2004–05: officially mandated but disabled interface for tapping into talks was used by unknown entity to listen to talks by high-profile politicians. Juniper VPN Backdoor: ...
Steffen Ullrich's user avatar
45 votes

Apple's open letter - they can't or won't backdoor iOS?

After doing some research, I now believe this is possible, but that it isn't very easy. Without getting too technical, if you look closely, Apple repeatedly implies that they can do it: The United ...
Mark Buffalo's user avatar
  • 22.6k
40 votes
Accepted

How can you trust that there is no backdoor in your hardware?

The short answer is, you can't. The longer answer: there are a few things that can be done to increase your trust in hardware, though they also just shift the root of trust elsewhere. A first ...
plonk's user avatar
  • 643
35 votes

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor? No. Simply no. A backdoor is never considered safe. What you are describing is commonly ...
Lucas Kauffman's user avatar
33 votes

Don't one-time recovery codes for 2FA introduce a backdoor?

tl/dr: One time recovery codes give account owners an option for regaining lost access. People who consider this an additional risk can always ignore it or destroy it, but people who are worried ...
Conor Mancone's user avatar
32 votes

How do large companies protect their source code?

Disclaimer: I work for a very big company that does a good job in this area, but my answer is my own personal opinion and is not indicative of my employer's position or policies. First of all, how to ...
tylerl's user avatar
  • 83.3k
32 votes
Accepted

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

The whole story is weird. Since the iPhone in question does not have a tamper-resistant device, the FBI should be able to open the case, read the whole Flash chip, and then run the exhaustive search ...
Thomas Pornin's user avatar
30 votes

Search for military installed backdoors on laptop

In addition to what others have mentioned about detecting hardware changes (chiefly that it is nearly impossible), you should recognize that the most likely vector of compromise would be the ...
shellster's user avatar
  • 628
28 votes

Is it theoretically possible to deploy backdoors on ports higher than 65535?

No, it's that number because the TCP field for that is only 16 bits long (65536, but starting at 0), so it is fundamentally impossible to communicate a higher port than 65535 This post has a really ...
J.A.K.'s user avatar
  • 4,833
27 votes

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

While I agree that every point of schroeder's response is true, there are two deeper issues that make it so much more dangerous than the current model of security. Right now, if you install an ...
Nosajimiki's user avatar
  • 1,837
26 votes

Apple's open letter - they can't or won't backdoor iOS?

Could they actually accomplish this for an existing encrypted phone? Yes. They could provide a compiled image of os with anti-bruteforce features disabled. The fact they're making an open letter ...
Agent_L's user avatar
  • 1,941
25 votes

Is it theoretically possible to deploy backdoors on ports higher than 65535?

If you rebuilt the TCP/IP stack locally on the machine, would the overall concept not work due to how the RFC 793 - Transmission Control Protocol Standard works as mentioned below in some of the ...
LSerni's user avatar
  • 22.8k
24 votes

How would a backdoor gain persistence

You just need a way of reliably starting the process after the machine has booted. This can range from - asking Windows or another process to start it on boot (service, startup application etc) ...
Hector's user avatar
  • 11k
21 votes
Accepted

What does the Juniper backdoor actually allow an attacker to do?

As the exploit gives root access to the Juniper device, an attacker can: Decrypt all VPN traffic to the device, thus allowing viewing of all traffic through encrypted tunnels that terminate at the ...
Rory Alsop's user avatar
  • 61.5k
19 votes

How can Linux be secure if it allows for open source contributions from the public?

You are misunderstanding how open source software development works. Not just anyone can modify the kernel, so no "unknown developers from around the world" are submitting mysterious lines ...
forest's user avatar
  • 66.6k
18 votes

What does the Juniper backdoor actually allow an attacker to do?

Root on the box. So, "yes" to all. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search Exploitation of this vulnerability can lead to complete compromise of ...
StackzOfZtuff's user avatar
18 votes

Apple's open letter - they can't or won't backdoor iOS?

Only Apple knows, but I'm going to guess they won't do it. I suspect the FBI has a pretty good idea what is and what isn't possible, especially since Apple has otherwise been cooperating with them. ...
Phil Frost's user avatar
17 votes

Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

If there's a backdoor, it will be abused. The question is when, not if it will be abused. There are too many actors that could compromise such a system, and no easy way to plug the holes. If a ...
ThoriumBR's user avatar
  • 53.9k
16 votes

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?

I think that a word combo "Safe Backdoor" needs medical attention ;) There's NO "GOOD NGO" and NO UNCORRUPTED GOVERNMENTS - Ed Snowden proved it in depth and in full. The answer to this question is an ...
Alexey Vesnin's user avatar
16 votes

How can you trust that there is no backdoor in your hardware?

plonk's answer already outlines the technical options for increasing trust in your hardware, such as device inspection or open-source hardware. However, at the end of the day, the thing is: You need ...
sleske's user avatar
  • 1,643
15 votes

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?

When a legitimate law enforcement organization has need of a key to decrypt, it sends a formal request to the NGO. The NGO first analyzes the request based on the importance of the request. the NGO ...
pjc50's user avatar
  • 2,996

Only top scored, non community-wiki answers of a minimum length are eligible