adityaathalye

Reminds me of the old chestnut attributed to a Well Known computer security pioneer. I cannot for the life of me remember who.

Paraphrasing:

The only way to secure a computer is to not buy one. And if you buy one, to never plug it in. And if you plug it in, to never switch it on.

Something like the cheapest way to own $GasGuzzlerWithItsOwnPinCode is to bring it home after purchase, and set fire to it in the yard.

TIL; thanks for sharing! I am not surprised to hear this.

Still, I'd guess that the odds of remote exploits are better if one wants to control a device via the PSU-as-backdoor, versus exfil data from it. Do like the IoT people and UDP broadcast naughty control signals to the power circuit / subsystem that has the compromised device.

Guessing further, remote exfil will mean having a close-proximity wiretap into the precise power line circuit of the target infra---because of signal losses---it could still be UDP broadcast exfil. Or a physical tap at whatever power transformer is the single point of connect between the target and the main grid. And if you can't get anywhere near the installation, well you can't exfil, because AFAIK it's pretty hard to reverse a signal up a transformer back into the main grid.

A scan of the arxiv paper appears to suggest similarly---the situation they describe presumes a wiretap into the circuit or the mains switchboard.

A rogue PSU could modulate information back over the electrical wire. However getting it out will require doing a physical wiretap on potentially high-voltage electricals. Also, it will likely have to be exfil'd at or across a power transformer sitting outside the data centre. Not sure if the signal will survive long enough (like literally, in line length terms), for exfil to work.

brb reviewing some EE material...

But don't expect much from me... I wanted to do a final year project in Power Line Communication for my electrical engineering undergrad. Then-me decided it was a dead end... cannot go WAN-scale; too much line noise and signal transmission power loss. I did something else with power electronics---I can't remember---but then again, my undergrad was also a dead end :p

Them: Hey, what's your browser doing?

Me: IDK, running JavaScript... of some sort.

But seriously... The post got me wondering if one could (even crudely) fingerprint the make, model, and vintage of $AnonymousLanguageRuntimeBinary, by triggering a "sort fail" style complexity explosion of, well, sort, but also perhaps other common Big-O-sensitive language apis of standard libraries.

Strawman argument. Neither socialist nor nationalist nor communist policies at any level---centre or state---have formed "the work culture".

Organisational (mis)behaviour---corporate and government---is simply a product of our widespread and deeply rooted feudal-bureaucratic mindset. One that both fosters and then feeds on the divisive complexities crafted from exploiting age-status, patriarchal conventions, and class and caste and religious and ethnic identities.

We are a sublimely chaotic heterogenous people. The best of us have---through the ages---been finding ways to cooperate and co-exist without giving up what they cherish most about their ways of life. The worst of us manage to always fault someone else for all their troubles, and then further incite others to do the same.

This public company's criminal levels of incompetence single-handedly caused an instant international disaster, and continues to fail us all.

Speaking as a citizen, ignoring "all those bloody foreigners amplifying this on social media" for a (very very brief) moment to dwell on (suppresses gag reflex) ideological "national security" rhetoric which these people no doubt kowtow to (eMudhra's head honchos and board, the central ministry MeitY etc.)...

How have they not proactively taken out all stops to fix this already in their own house? On a national-disaster-scale emergency footing, which this is!

They're as mission-critical as it gets, in economic terms, in India.

Shameful beyond words... The head honchos there should be severely punished---and then made to stay on permanently as rank-and-file demoted operators charged with making sure the org does its day-to-day work better---waaaaay better in the future.

Well, I honestly believe it is rank incompetence. Speaking as someone who's monthly electronic GST filings, commercial authentications, and digital payments, i.e. continued livelihood, is beholden to cert and PKI authorities like eMudhra having their shit together...

As for the odds of this being state-sponsored... It depends on the state's incentive, weighed against its continued behaviour, over the last 10-odd years. Everything below is easy to substantiate with citations. There are too many to cite... I put myself at real risk just by stating any of the following under my real name.

  ---My take: Never attribute to malice, what one can to (rank) incompetence.---

I expect eMudhra-esque collossal gaffes, as a normal course of life, stemming from the apathetic, insular, feudal-minded, shoddily run bureaucracies that the majority of our government and quasi-government organisations are.

Basic day-to-day operations being unavailable, because "Sorry sir, site is down." is a normal everyday life experience of their own staff, not to mention the common person. eMudhra is one of that tribe, and I'd say they are not the worst offenders of the lot, by a wide margin. I'd probably give the "best of the worst" title to our national Employee Provident Fund.

Of course, one can't totally rule out nation-state-level stupidity, such as BGP poisoning by the Pakistanis.

  ---Nation-state action: Wither sufficient incentive? ---

If our current federal administration has incentive to do it, they will... And, given their track record, if it does turn out to be nation-state-engineered for short term tactical gains (to hell with the consequences for anyone else), all I will do is sigh and move on with my day. Cornered politicians can go to any length to save their own skin (usually, just to save face)... Collateral damage be damned. Popular examples include world superpowers bombing distant nations, for whatever gain or goal (usually short-term, because well you most probably won't be President a second time (and never a third)), using whatever pretext they can sell to get others to also get behind (the individual's psychological cover in a firing squad, scaled up to many allied powers).

In India, absolute majority governments have amply demonstrated the same failure mode as US heads of state empowered with de-facto fatwa powers, as of the US PATRIOT act. Given motive and incentive, they easily turn the full might of their uncheckable wrath and ire at our constitution, as well as directly at the common public.

You know, like sending out military forces to "calm down" the pesky student protesters acting against "the national interest".

As we speak, massive nationwide student protests have been bringing shame and angst to the government of our ruling party at the centre (BJP and allies), as well as their various governments across states. Many protests have happened at this scale in the last decade+ of the same ruling party's unbroken streak as a majority power in the centre (federal government). Those other protests were like water off a duck's back. The ongoing student protests, for reasons I've not dug into, appear to be a clear and present existential threat to the incumbents.

My gut feeling is... the incumbents aren't passing the electoral vibe check any more.

The sentiment on the streets of the national capital, and large urban centres nationwide---almost entirely comprised of a new crop of young voters (18 y.o. up to early 30s)----is that they feel robbed of an economically viable future. They've organised at scale (millions on the street) with persistence (they are literally owning the "Cockroach" epithet thrown at them by the powers that be). And in short order, material consequence---unprecedented in its decade-long winning streak so far---befell the incumbent party's administration. The Education Minister had to resign, and they've generally lost face with that whole voting-age cohort. Brand-name loss of key leadership is further disrupting their internal party cohesion. Plenty of hopefuls in there, salivating after the top dog position, but thus far too weak to sway the cult following of the public faces of the party. Even an hint of weakness gives the wannabes a real opening to try. Textbook demagoguery.

If that is indeed true, then in their place, I too would seriously worry about losing even more ground in the next national election... It's not far now. Because? "Winning by overwhelming majority" has been the one and only priority of the incumbents, driving all their work post-election (where work includes constitutional shenanigans)... Being a populist party borne of, and cultivated by far-right nationalist ideologues (the RSS and "Sangh" community), with a longstanding desire for religious supremacy (Hindutva and Sanatan dharma), they publicly and loudly dream of a hundred-year golden age. Uh, no, now I think it's become a thousand-year era (really!). That's not totally insane if you're suddenly goated at winning electoral politics, because our head of state can enjoy unlimited tenure. Yes, you heard that right, India has no constitutional limits to number of re-elections to the Big Chair, whether successive or alternating.

Without looking at absolute numbers, I feel confident that the influx of new voters (lots of people can turn 18 in a single government tenure) far outstrips the older ("whatsapp uncle / aunty") voter base that the incumbents pander to. This has been a lucky break for the fumbling Congress party because their legacy name is finally regaining some cachet... The much-mocked Rahul Gandhi presents like someone the young'uns can actually talk to, like a human being.

But the Gandhi-brand Congress were once an absolute majority power too. At which time they suspended our constitution, and weaponised federal agencies, and created the playbooks that all future governments have been able to deploy at various scales. I expect nothing less from any other party that grabs absolute majority. Currently it's the BJP. Tomorrow, it could be anybody else. Thus far, it's been the secular-presenting Congress, followed by the Hindutva-majoritarian BJP. Woe betide us if next the Communist Party of India gets a bite at that juicy apple. 'cause, like, I don't have to explain what that sort of government can do with absolute power. <shudders>

  ---Nation-state action: Whither evidence of having the means and using them with impunity?---

Ref: our liberally interpretable Information Technology Act. Among other things, it enables and empowers arbitrary blanket Internet Shutdowns and Blackouts, by local states as well as national authorities, to "protect the peace". In some deeply conflicted areas, like Jammu and Kashmir, censorship measures under martial law would give both, the Great Firewall of China and the Stasi a run for their money.

Ref: at-scale weaponisation of Pegasus, as of 2021. Federal and even state authorities like police departments have weaponised nation-state electronic warfare technology with impunity. Usual suspects / targets are politically inconvenient individuals and groups... opposition politicians, bureaucrats with a spine or conscience, students, media, artists, NGOs etc...

All this mixes badly with pre-existing supercharged Sedition laws. These effectively obviate habeus corpus, and are routinely used to prosecute speech interpreted as anti-national / seditious under the generous ambit of our IT laws (we don't have a real privacy law). Mere suspicion and/or fear and/or dislike + Pegasus + garbage IT laws = authority can brazenly plant incriminating evidence on your device... it's reportedly been done multiple times.

People have been held in prison for less (just inconvenient speech), without possibility of bail, for months and years on end, without trial. The main goal is to cause irreparable reputational damage, to create future deterrence... It's pretty effective. A secondary goal is to take the stubborn ones off the board, with no legal recourse, until they break. And of course, to permanently defang the truly outspoken and indomitable few... Some of those people have been in high-security federal prison for years on end now.

In conclusion:

I'm confident all federal administrations of India, current and future, will hold the lawful means to act wilfully, crudely, with impunity, at scale against India's own citizenry.

I'm not sure whether they currently have enough incentive to have used the eMudhra cudgel, to disrupt the protestors. Sure they could MITM the protestor websites, but it's so much easier to block them and takedown their socials. And for more specific work, they already have field deployments of Pegasus and other MITM / spyware technologies.

I'd say the jury's still out. Somehow, I feel---or, perhaps, would rather believe---reasonable doubt will prevail at the end of this AI hype cycle. From the essay, this version of the future sounds far more appealing, if not more likely, than a sudden-born superintelligence.

> Lynn Margulis [14] has made strong arguments for the view that mutualism is the great driving force in evolution.

> ...

> [14] Margulis, Lynn and Dorion Sagan, _Microcosmos, Four Billion Years of Evolution from Our Microbial Ancestors_, Summit Books, 1986.