What’s with the unhinged edits

There’s a chance, OP, that you might have carbon monoxide poisoning if it’s true that you “became paranoid all of a sudden”. For anyone with gas appliances, regularly check that your CO detectors are working.

I don’t mean this as a diss or to invalidate your (totally valid) concerns about data privacy.

“I’M NOT INTERNET SHOUTING”, he internet shouted.

You don’t. It’s possible that the firmware or bootloader is doing evil things. They have access to hardware in a way your OS may not detect.

The seminal paper in this area is On Trusting Trust. That link isn’t to the original, but it has a nice overview.

The best way to prevent this kind of spying is through air gaps: ie, no network. Realistically, most of us don’t want to do that.

At some point, you need to ask yourself what your threat model is. If you’re going to have severe consequences from doing something in range of the device, maybe you wanna do it elsewhere.

Bro lost his shit in the edits section

LIKE ARE YOU TELLING ME THAT TOP CYBERSECURITY WORKERS OR ELITE HACKERS ARE JUST HOPING THEIR HARDWARE IS NOT SPYING ON THEM AND THERE IS NO WAY FOR AN ELITE HACKER OR CYBERSECURTY WORKER TO ENSURE THEY ARE NOT BEING SPIED BY THEIR HARDWARE

Yes.

Professional ELITE HACKERS who work for governments need to leave their electronic devices outside secure facilities for precisely this reason.

Similarly, government networks that are air gapped have their hardware physically destroyed when it’s decommissioned because it’s impossible to be sure that it’s secure.

Why did you suddenly become paranoid about specifically your hardware chips spying on you?

If you’re trolling that’s okay. If not: Please talk to someone. A real person who can check if you’re alright.

Easy. It’s far too expensive to implement, both in money and man-hours. Especially man-hours.

The amount of people required to personally surveil the general populace is way too exorbitant, AND they have to monitor their own people to prevent leaks. The logistics explodes well before this becomes feasible.

Then there’s discoverability. Once such hardware is out there, it’s only a matter of time before it falls into the hands of someone capable of dissecting it. Given that such spying methods would be ‘sold’ to federal management on the grounds of national security, there’s an interest in not having it fall into such hands. Therefore, these methods are reserved for high-profile targets. Not the average Joe citizen.

To summarize: Too expensive (money), too expensive (logistics), and too expensive (R&D). Unless you’re on Interpol’s most wanted list or something, you don’t need to worry about this.

If you want to be absolutely sure, the only way is to unplug all the network cables and physically break or disconnect all the wireless equipment. If you have a SIM card, the carrier can automatically install spyware. On the computer you can get malware or the bootloader/UEFI can be compromised. There are many other ways to spy as well, especially if it’s a targeted attack (done by the local law enforcement or your own enemy). The Internet was never meant to be private. It’s really hard to keep any data secure on a machine that has access to it. You can minimize the risk and decrease it by 1000000% but you can’t completely mitigate it unfortunately

I am also quite interested in this. It is not something that keeps me awake at night, and I am not particularly paranoid about it. But I find that working towards answering this question is a fun frame from which to learn about electronics, radio communications, and networking.

Since this appears to be something that is causing you some anxiety, I think it is better if I start by giving you some reassurance in that I have not yet managed to prove that any electronic device is spying on me via a hidden chip. I don’t think it is worth being paranoid about this.

I can explain some things that could be done to test whether a Linux computer spying. I am not suggesting that you try any of this. I am explaining this to you so that you can get some reassurance in the fact that, if devices were spying on us in this manner, it is likely that someone would have noticed by now.

The “spy” chip needs some way to communicate. One way a chip might communicate is via radio waves. So, the first step would be to remove the WiFi and Bluetooth dongles and any other pieces of hardware that may emit radio waves during normal operation. There is a tool called a “Spectrum Analyzer” that can be used to capture the presence of specific radio frequencies. These devices are now relatively affordable, like the tinySA, which can measure the presence of radio frequencies of up to 6 GHz.

One can make a Faraday cage, for example, by wrapping the PC with a copper-nickel coated polyester fabric to isolate the PC from the radio waves that are coming from the environment. The spectrum analyzer antennas can be placed right next to the PC and the device is left to measure continuously over several days. A script can monitor the output and keep a record of any RF signals.

Since phones are small, it is even easier to wrap them in the copper-nickel polyester fabric alongside with the spectrum analyzer antenna to check whether they emit any RF when they are off or in airplane mode with the WiFi and Bluetooth turned off.

What this experiment may allow you to conclude is that the spy chip is not communicating frequently with the external world via radio frequencies, at least not with frequencies <= 6 GHz.

Using frequencies higher 6 GHz for a low-power chip is not going be an effective method of transmitting a signal very far away. The chip could remain hidden and only emit the signal under certain rare conditions, or in response to a trigger. We can’t rule that out with this experiment, but it is unlikely.

A next step would be to test a wired connection. It could be that the spy chip can transmit the data over the internet. One can place a VPN Gateway in between their PC and the router, and use that gateway to route all the traffic to their own server using WireGuard. All network packets that leave through the PC’s ethernet connection can be captured and examined this way using Wireshark or tcpdump.

If one can show that the device is not secretly communicating via RF nor via the internet, I think it is unlikely that the device is spying on them.

You can use Wireshark to monitor all network traffic. It’s not a simple task though. But if you take the time to set it up and learn how to use it, you can know everything that leaves your computer.

Throw it on pihole, you can see all traffic coming and going through your house. Also a great anti-advertise option.

In my experience, theres a lot less spying and a lot more BS/bad scripts checking in, but you do you.

Being privacy-conscious can protect your information from being passively collected by mainly corporate entities that track your buying habits, life events, and health.

If you think you’re being actively targeted for surveillance, then you need security that is proportional to the resources that the people who are spying on you have. In the case of say, the NSA, they could have a backdoor in a various location in your hardware or software stack. If you have privacy tools like tor, they’re liable to target you and collect your data just for that. Most android/IOS phones are thoroughly bugged and tracked, to the point where if the battery is still attached and the phone is switched off you can still be tracked. If the NSA does collect your data, there’s a 99% chance no human will look at your data unless they have a reason to search for you.

If you are being spied on, odds are you won’t catch it. You might be able to isolate abnormal outbound network traffic if you’re really good about tracking that kind of thing on your network. Your phone could connect to a fake Stingray cell station and you wouldn’t know.

If you’re being stalked by a person with less resources than the NSA, it becomes a lot easier and common-sense privacy protections can help you keep a low enough profile.

It’s also worth noting that if private companies get a hold of your data, they’ll sell it to any government or private organization who’ll pay them. There’s scant regulation about what they can’t collect and what they can’t do with it.

I think the simplest rule of thumb is if you have something sensitive, don’t say it near an android or ios phone and don’t put it on a computer that’s plugged into the internet. Criminals have their own OPSEC, as do people in the intelligence industry, and usually the answer is an “air gap”.

System76, Tuxedo computers and Framework may be close to what you are looking for.

But you need to think about your threat model and decide how much work/study you need to consider yourself “safe”, because the only way to be absolutely sure that your hardware is trustworthy, is too build it from the scratch.

So here’s the brief take, you don’t know. Firmware is a very opaque thing that will never be truly visible without outright scanning the chip structures and relevant exchange mechanisms. A recent article demonstrated bypassing the Windows full disk encryption through a hardware hack using consumer available SOCs even.

What you can do is control the environment. Data can be extracted through a mess of crazy ways. ICMP and DNS calls can be used to tunnel traffic even. The goal for the end user is mitigation. There has been research where data was pulled via the sounds a spinning disk made even off an air-gapped device. Layering the controls makes it that much less likely that anything can compromise all the controls at once. There is no silver bullet solution however. High security systems are often custom fabricated and even then it’s possible a supply chain injection can compromise the product.

Your best bet as a consumer is to trust in the math (crypto) and ensure your data is encrypted at rest and in flight. Keeping keys on a separate vault, generated away from the protected system where possible is a more extreme but possible solution when you control all parts of the communications.