I am willing to tolerate custom firmware in hardware that lives behind an IOMMU and under an OS that uses it. That will at least make it unlikely that something scary lives in there and collects my data. Without an IOMMU in use, the entire RAM is fair game, and, with some creativity, the network card buffers to sneak the data out.
back
3 comments
That is, if the device allows you to use an IOMMU:
https://github.com/sstjohn/thundergate
additionally, how often do you do a firmware dump of your network card to ensure that what's flashed to it is what's intended to be there?
On every boot, when using TXT to compare current firmware measurements with known-installed values.
I've never understood this. Isn't it always possible to detect unsanctioned network traffic. Sure, most people don't. But all it takes is one person to spot an errant packet and a malicious actor's cover is blown. What purpose could possibly be served by putting code into firmware that gives itself away by generating network traffic.
Hacking firmware is another matter. But a vendor distributing malicious firmware code that generates network traffic? Not wittingly, it doesn't make sense. Of course if it's for some sensitive piece of machinery and the vendor has been compromised. But then if you're buying sensitive parts maybe you should be extra-cautious to ensure they operate as intended. But consumer hardware? I'm not seeing it. Call me naive or not tin-foil-hatty enough :)
You don't have to create additional packets to transmit additional information. You also don't have to transmit by default. So the detection model isn't "anyone dumps packets", it's "someone actively being monitored knows exactly what to look for".
So please hand in your badge and tinfoil hat.
As I understand it the SMM has full access to physical memory and contains proprietary firmware