The dangers that lurk

Before I entered college, I was already fairly interested in cyber security. So when, many years ago, I happened to talk about that topic with someone who worked in an intelligence agency, I asked that person a question that I think every intelligence agency should ask themselves: how do you know the hardware you bought or the operating system you installed did not come infected with a backdoor?

That person replied that there basically wasn't much you could do about that. A strange answer, I thought - because if I were the head of an intelligence agency in charge of cyber warfare, that and rerouting non-secure downloads to malware servers would be my first two projects. Each of these two "vulnerabilities" could be prevented, of course - at a cost.

Rerouting non-secure downloads to malware servers
For a nation state, it would be fairly trivial to ensure that the executables they are downloading are always what they expect through forced checksums from secure verified identities - assuming they own both the server and client. For all other executables, they should either perform their own vulnerability assessments on those or not be using those anyway.

But normal people like us are unfortunately screwed. Of course, we could think that we would only download files from certified servers and verify the file checksum. That is somewhat true, but would not happen in reality. Think Java or Flash plugins, for example. These are distributed through HTTP and basically open to any MITM to be tampered with. Then think of tens or hundreds of other websites you download content from, which also use HTTP. Then think of the multitude of applications you use which might automatically search, download, and execute updates through insecure means. Not much you can do about that.

Should I stay in this field long enough to get sufficiently paranoid, one of the methods I would probably try to harden my system would be to create an application that runs through a one or more VPNs as an independent file verifier. When I download a file from the browser, for example, I would be downloading through my network and also downloading that same file through the VPN(s). After the downloads are complete, all those files would be compared to make sure they match. A little extreme maybe, but it is simply too easy for an attacker who is big enough to tamper with insecure downloads.

Backdoors in hardware or OS
As reported in the Kaspersky report (also linked above, see #10 in the report), intelligence agencies (probably the NSA) are and have already been hacking firmware for years. There is really not much that can be done here, especially on an individual level. But if I was a sufficiently determined intelligence agency with enough resources, I would force all firmware to be created in house. For operating systems, I would probably fork out an open source operating system and continue internal development from there. For example, internal developers could simply follow the changelog of that unix version and make the same changes - but through their own code. Security through obscurity perhaps, but with sufficient vulnerability testing I believe it is still a better choice than having to wonder whether there is a in-built backdoor in the OS.

Final comments: security through obscurity
I always feel funny when people laugh at the weakness of security through obscurity. Just like blacklisting and whitelisting in my previous post, security through obscurity is a horrible thing to completely rely on. But those people do not realize its potential. Let us take a very simple example of some kind of router and assume that the computers connected to it do not have any other way to communicate other than through that router. All communications with the computer to the router are always secure. Now suppose the NSA tries to hack this intelligence agency. They sell other infected firmware and operating systems to government contractors. They send out spear phishing emails to key personnel and those related to the key personnel. They give out or drop infected USBs. They use a whole bunch of zero days. Eventually, they will get in.

But what happens if both the router and select trusted applications were set to have their own networking protocol? Maybe, the applications on the OS all appended a "1" to their packets, and the router automatically dropped all packets without that "1". The NSA would -never- get in unless they knew that secret (well actually they can get in, but they can't get data out). Even in the case of infected firmware. Now of course something stupid people could say is their backdoor would analyze the packets being sent and understand that secret, but that in reality would never happen. So assuming that secret never leaks, the NSA would have to hack the computer/router through physical access or an insider. By itself, I would say using this simple technique could halve the NSA's chances of a successful attack. And there are literally hundreds or thousands of other significant game changing security through obscurity methods like these that could be used. If properly done, security through obscurity offers zero downside (in the worst case, it only does not work) with a lot of potential upside.

Note: even in an air gap environment, intelligence agencies would still need access to the internet. So they would presumably use one air-gapped computer and at least one other computer to access normal networks. Using such a theoretical security through obscurity protection would ensure that the risk of computer that is outside the air-gap environment is partially mitigated. Of course, there are other ways to breach an air gap and despite what recent reports claim, have been around for years.