Following the news about Super Micro spy chips embedded in motherboards
supplied to Apple, I wonder what precautions will be taken to avoid such
occurance on Librem 5 - a security and privacy oriented product - clearly
a very worthy target to Chinese tech espionage
The article I believe indicated that super micro, Apple, and Amazon were the targeted companies and products.
I’m also not ruling out that this is a coordinated political move that helps certain agendas.
I would also guess that even though the Librem 5 has done well in terms of sales that it is still NO WHERE near the volume that any of those companies enjoy.
And finally, I would say given the landscape of things as they are, all that Purism has said regarding their products and the phone is as good as it is going to get from any commercial entity.
The best part? There is no other company I know of that is so visible about these things.
True but it does beg the question, would you want to bug every android and ios device and then not bug a phone specifically built to be secure and private?
Of course and as it is an agency outside of Purism the problem is one shared by all manufacturers. My point being that Purism’s approach to fulfilling their goals is not reliant on a single point or part.
Also it is probably safe to say that the companies affected were not inspecting their products in such a way. Purism on the other hand will be much more observant of such things. At least that is what I would imagine.
In contrast to just buying ready made boards like for servers, the Librem5 is designed exclusively for us, we get to know every part, we get the schematics, gerbers and all manufacturing data, we carefully verify and analyze all of this and all production steps. Thus it is close to impossible to sneak in additional parts into the device. (“Close to impossible” means, if someone with really a lot of criminal energy bribing the manufacturer and introducing some malicious devices into our production, this will be hard to find - but anything else we would find and never ever ship - we will see and verify every stage of the production).
The sad reality here is this is an attack below ring 0 and not only difficult detect but as small as the chip is reported to be, hard to find. basically there would need to verification of every board. however that is not really good enough, as it would not be hard to hide something that small inside a chip die. and once at the die level, full encryption could be included in the stack. It really is a scary thought. but sadily no Purism has no way to guarantee that this type of attack could not happen on one of there systems.
There are something uncertain about the story. Super-micro and Apple have strong denial against the story, which is not usual since the statement will be used against them if they are false.
However, one thing is clear. Supply chain exploit is a potential real threat and we have to find a way to prove the hardware is not tampered. I am not sure if Librem key with anti-tampering feature will solve the problem. I have read some blog post. As I understand, those chip are too small that it should not be powerful enough to run on its own. It need to rely on modifying the behavior of the firmware on memory. Now, does it make anti-tampering firmware detected this kind of modification? Or could the chip possibly bypass the anti-tampering firmware if it is targeted specifically to Librem laptop?
Maybe disassemble the hardware and check it one by one could be a solution. But my rusty disassembling skill could possibly damage the hardware. Or maybe a option to send the parts and the laptop will be assemble by the user.
Or maybe a option to send the parts and the laptop will be assemble by the user.