[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [tor-talk] How does one remove the NSA Virus off the BIOS Chip as described by Snowden in the ANT Program
I would like to help in anyway i can , i'm currently developing an anti virus and auditing multi platform program , So if u can find out/copy all the viruses the nsa have given You and send it i would love to help on detecting and protecting ppl from it :)
coderman <firstname.lastname@example.org> skrev: (21 november 2015 13:10:05 CET)
>On 11/20/15, Virilha <email@example.com> wrote:
>> I believe you need immediate help, to capture evidence and/or reverse
>> engineer malware.
>it will be persistent but latent.
> e.g. after a time period of "unable to successfully implant in OS"
> it will quit trying. or maybe not! unknown unknowns, etc.
>or maybe not! large variance between paid proprietary LE only exploit
>and truly exceptional nation state intelligence and exploitation
>you should use the BIOS adventures below to find out.
> [the TAO-related Snowden leak details are informative]
>mobile implants are observed "geofenced" by tower or stringray. by
>activity of other apps. by network traffic. by time of day, ... this
>is a long list :)
>your router(s) are trash, now. (maybe you can directly flash, like
>BIOS adventures below?)
>> If the first case (capture evidence), advise you to join an IRC
>> channel on server irc.oftc.net channel #debian -
>capture is good first step, and if not in this instance perhaps the
>capture is always useful! (via independent and not networked device)
>> If the second (reverse engineer the malware), I advise you to join an
>> IRC channel on server irc.freenode.net on channel ##asm and/or
>> ##re - me or others can help you with x86/64 stuff (assembly).
>you can open up and search for BIOS flash chip. if you're lucky it
>will be a 3.3V SPI flash chip in 4 or 8MByte (they often measure in
>bits, too, don't ask me why).
>you can use a rPi to do it, even!
>that last is an SPI chip in my pair of ASUS B43J laptops - it is nice
>to have a pair, saving the good one, in case something like this
>happens. the stealthy stuff will betray power consumption and forensic
>flash image digest values (sha256 of specific flash regions)
>remember to adjust configuration parameters for SPI support if using
>i highly recommend the Shikra as well, however, it requires postal
>this is just the start, of course, but enough to give tells...
>tor-talk mailing list - firstname.lastname@example.org
>To unsubscribe or change other settings go to
tor-talk mailing list - email@example.com
To unsubscribe or change other settings go to