[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [tor-talk] How does one remove the NSA Virus off the BIOS Chip as described by Snowden in the ANT Program

I would like to help in anyway i can , i'm currently developing an anti virus and auditing multi platform program , So if u can find out/copy all the viruses the nsa have given You and send it i would love to help on detecting and protecting ppl from it :)

coderman <coderman@gmail.com> skrev: (21 november 2015 13:10:05 CET)
>On 11/20/15, Virilha <tor@cheiraminhavirilha.com> wrote:
>> I believe you need immediate help, to capture evidence and/or reverse
>> engineer malware.
>it will be persistent but latent.
>  e.g. after a time period of "unable to successfully implant in OS"
>    it will quit trying. or maybe not! unknown unknowns, etc.
>or maybe not! large variance between paid proprietary LE only exploit
>and truly exceptional nation state intelligence and exploitation
>you should use the BIOS adventures below to find out.
> [the TAO-related Snowden leak details are informative]
>mobile implants are observed "geofenced" by tower or stringray. by
>activity of other apps. by network traffic. by time of day, ... this
>is a long list :)
>your router(s) are trash, now. (maybe you can directly flash, like
>BIOS adventures below?)
>> If the first case (capture evidence), advise you to join an IRC
>> channel on server irc.oftc.net channel #debian -
>capture is good first step, and if not in this instance perhaps the
>capture is always useful! (via independent and not networked device)
>> If the second (reverse engineer the malware), I advise you to join an
>> IRC channel on server irc.freenode.net on channel ##asm and/or
>> ##re - me or others can help you with x86/64 stuff (assembly).
>you can open up and search for BIOS flash chip. if you're lucky it
>will be a 3.3V SPI flash chip in 4 or 8MByte (they often measure in
>bits, too, don't ask me why).
>you can use a rPi to do it, even!
>that last is an SPI chip in my pair of ASUS B43J laptops - it is nice
>to have a pair, saving the good one, in case something like this
>happens. the stealthy stuff will betray power consumption and forensic
>flash image digest values (sha256 of specific flash regions)
>remember to adjust configuration parameters for SPI support if using
>the rPi.
>i highly recommend the Shikra as well, however, it requires postal
> http://int3.cc/products/the-shikra
>this is just the start, of course, but enough to give tells...
>best regards,
>tor-talk mailing list - tor-talk@lists.torproject.org
>To unsubscribe or change other settings go to

Sincerly Flipchan
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to