4 ms·

> Practically every major piece of software and hardware that's not open source has a backdoor embedded. [citation needed], and I mean a credible one with evid

> Practically every major piece of software and hardware that's not open source has a backdoor embedded. [citation needed], and I mean a credible one with evidence, not tinfoil-hat raving. Yes, we know that three-letter agencies look for, and probably have a stash of, zero-days for covert access. And they also do physical attacks wherever possible (like fiber taps at Google's datacenters). But those are two very different things from backdoors built in with the cooperation of the vendor. And despite how many people on the Internet treat "companies build in gov't backdoors" as just unquestioned fact, I've never actually seen any proof.

galdosdi 10y ago
I dunno. Before Snowden, a lot of nasty stuff that we now take for granted the intelligence community does, was seen as "tin foil hat." After Snowden, I no longer doubt the possibility of any realistically imaginable attack, ie, assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. Our intelligence apparatus has cried wolf too many times, in terms of denying they do something and then it turns out they do it, to be trusted anymore. They've lost the benefit of the doubt and if they don't want people believing all the tin foil hat things, maybe they should stop doing so many of them.
- Analemma_ 10y ago
  > Before Snowden, a lot of nasty stuff that we now take for granted the intelligence community does, was seen as "tin foil hat." This is true, but using it as a justification for "And therefore, my theory about what the intelligence community is doing is correct and does not need evidence" is a non sequitur fallacy that has become depressingly common in recent years. You still need evidence for individual allegations. To show you what I mean, suppose I were to say, "The NSA has a constellation of mind-control satellites built with help from the lizard men!", and then responded to the deserved skepticism with "A lot of things that used to be tinfoil hat theories we now know to be true thanks to Snowden, so this is too!". That's obviously fallacious reasoning, but it's exactly what people are doing when they toss around allegations of backdoors with no proof. Again: there's no shortcut around the need for evidence. > After Snowden, I no longer doubt the possibility of any realistically imaginable attack ie, assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. I agree completely, but that's not what I, or the person I replied to, was talking about. The issue I was addressing in my comment was whether their backdoors are being built with the knowledge and cooperation of the vendors, which is very much unknown. Attacks like taps on cables are orthogonal to what I was saying.
  - MawNicker 10y ago
    There's merit in just pondering. This is a message board not a legal proceeding. What you're saying isn't totally orthogonal. I'm often surprised at how terrible modern software is. I suspect they actively subvert and displace popular software that they can't hack. Most hacks are probably generic exploits of library code. I imagine they economized. They wanted Total Information Awareness. I can't prove any of this; It just seems sensible. He's doing a red team analysis. It's not of the same form of thought. You can't invalidate it with the arguments you're making except for in some logical domain or something. It's not a true/false statement. It's not even fuzzy.
    - Analemma_ 10y ago
      I agree! And I don't mind pondering, as long as it's clearly marked as such. I do mind statements like "Practically every major piece of software and hardware that's not open source has a backdoor embedded" presented as established fact when they are not.
      - MawNicker 10y ago
        A vulnerability is a back door. The only problem I have with that statement is it's exclusion of open-source software. It's got more back doors embedded in it than closed-source software. Jimmy: a short crowbar used by a burglar to force open a window or door. He didn't necessarily say it was collusion but I suppose it's fair to clarify. It seems narrow to suggest it's just a stash of 0-days. I suspect they've been heavily yet covertly involved in the popular software tool-chains and computing hardware.
  - galdosdi 10y ago
    Not what I said. I said "realistically imaginable attack" ie ethics is the only thing hypothetically stopping them, not lack of fantasy technology. See if you can come up with a counterexample that actually meets that hurdle. Mind control satellites and lizard men are both so far away from our current science and technology that even assuming the NSA could be a few years ahead, it's not worth considering. If there really were mind control sattelites or similar precursor technology available or in research today, and there were lizard men who had a history of being good at working with those and willing to sell their skills, then I would agree that it's plausible they're doing it. Also, I'm more interested in the /practical/ applications of this knowledge of whether the intelligence community does a certain thing X, not the philosophical certainty of whether they do a thing X. You lock your doors because someone /might/ break in /maybe/, not because you're certain John Doe is planning on doing so at 4:30am tonight. Even if no one ever does, it's certainly technically possible, so if locks are cheap it's a reasonable tradeoff, even if you'll never be sure if they really helped. You're probably right though that I'm moving the goalposts around! :-) I'm not trying to have a formal debate, just idly shooting the shit on the net, so I'm OK with that.
- kobayashi 10y ago
  >assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. Prepare for that scenario as a possibility, but there should still be a burden of evidence before possibility is accepted as reality.
nitrogen 10y ago
Dual EC DRBG.
- Karunamon 10y ago
  The RNG that was only ever used in one (RSA) company's product and then swiftly deprecated once the news dropped? That's a far cry from "Practically every major piece of software and hardware that's not open source has a backdoor embedded."
  - nitrogen 10y ago
    It's a bit disingenuous to call the RSA lib "one company's product" when it was used by many, many other products.
    - Karunamon 10y ago
      Is it one company's product or is it not?! The pedantry around here can be infuriating sometimes. You take issue with my strictly true comment, and ignore Analemma_'s comment upthread (every product) which is strictly false.
      - igravious 10y ago
        The clue is in the name. It's a library, it is both the work of one company and used in many products, which is why it is suspected that it was targeted. You're both right. GP is not being pedantic.
Lordarminius 10y ago
>[citation needed], and I mean a credible one with evidence, not tinfoil-hat raving I think The Puzzle Palace (https://www.amazon.com/Puzzle-Palace-National-Intelligence-Organization/dp/0140067485 https://www.amazon.com/Puzzle-Palace-National-Intelligence-O...) made the same argument as far back as 1982
- Bud 10y ago
  You're aware that The Puzzle Palace was written by the same guy that wrote this article, right? Bamford.
guimarin 10y ago
Intel Actice Management Technology fits the bill[1]. An out of band processor on select chips. Most likely it's on all the chips and only activated for consumers on the vPro and certain Xeon models. 1. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...
runjake 10y ago
> like fiber taps at Google's datacenters Likewise, [citation needed]. That would be pretty stunning, if true.
- FooHentai 10y ago
  This has been known about for ages and was part of the Snowden leaks: https://www.google.com/search?q=google+nsa+%22encryption+added+and+removed+here https://www.google.com/search?q=google+nsa+%22encryption+add...
  - runjake 10y ago
    Everything I've read from the Snowden docs indicates traffic is intercepted over big pipes on backbones or at Internet Exchanges. The parent poster was suggesting (and I was questioning) this occurred at Google Data Centers, which would prove explicit cooperation by Google. A whole different ballgame. The closest I've seen are the PRISM slides which imply cooperation from Google and the other big companies, but this could be bad choice of wording.
    - FooHentai 10y ago
      No, this one was on the Google 'Front End Servers': http://www.japantimes.co.jp/wp-content/uploads/2013/11/nc20131113d1a.jpg http://www.japantimes.co.jp/wp-content/uploads/2013/11/nc201... Regarding PRISM cooperation, I'm not sure where your doubt is coming from there. http://imgur.com/a/wRKtL http://imgur.com/a/wRKtL The slide was explicit, and is now many years out of date so without doubt the number of providers has increased. The means by which these provider agreements are reached is well known (National Security Letters) as is the fact that organizations are fully barred from disclosing their existence.
- MertsA 10y ago
  It was fiber taps between Google Datacenters overseas. The implication being that if your location history, emails, photos, secret diary, or what have you is transferred overseas at any point then you automatically have no more rights to privacy than a suspected terrorist.
finid 10y ago
That's like asking me for evidence for the existence of the Sun. All I can do is shake my head...
Animats 10y ago
The number of bad random number generators found in crypto system is deeply suspicious.[1] [1] http://eprint.iacr.org/2012/064.pdf http://eprint.iacr.org/2012/064.pdf
- igravious 10y ago
  Yes, but I wouldn't class that as building in a backdoor to a specific "major piece of software and hardware" or software and hardware range, I would class it as industrial sabotage on a more subtle and general scale. Equally pernicious but not the claim that is being made.
nickpsecurity 10y ago
I did something like that in a counterpoint to an apologist for NSA here: https://www.schneier.com/blog/archives/2014/03/friday_squid_bl_420.html#c5226750 https://www.schneier.com/blog/archives/2014/03/friday_squid_...
finid 10y ago
If they can have a backdoor in Lotus Notes, what else can't they have a backdoor into? Do a search for "ibm lotus backdoor" or start from http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

galdosdi 10y ago

I dunno. Before Snowden, a lot of nasty stuff that we now take for granted the intelligence community does, was seen as "tin foil hat." After Snowden, I no longer doubt the possibility of any realistically imaginable attack, ie, assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. Our intelligence apparatus has cried wolf too many times, in terms of denying they do something and then it turns out they do it, to be trusted anymore. They've lost the benefit of the doubt and if they don't want people believing all the tin foil hat things, maybe they should stop doing so many of them.

Analemma_ 10y ago
> Before Snowden, a lot of nasty stuff that we now take for granted the intelligence community does, was seen as "tin foil hat." This is true, but using it as a justification for "And therefore, my theory about what the intelligence community is doing is correct and does not need evidence" is a non sequitur fallacy that has become depressingly common in recent years. You still need evidence for individual allegations. To show you what I mean, suppose I were to say, "The NSA has a constellation of mind-control satellites built with help from the lizard men!", and then responded to the deserved skepticism with "A lot of things that used to be tinfoil hat theories we now know to be true thanks to Snowden, so this is too!". That's obviously fallacious reasoning, but it's exactly what people are doing when they toss around allegations of backdoors with no proof. Again: there's no shortcut around the need for evidence. > After Snowden, I no longer doubt the possibility of any realistically imaginable attack ie, assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. I agree completely, but that's not what I, or the person I replied to, was talking about. The issue I was addressing in my comment was whether their backdoors are being built with the knowledge and cooperation of the vendors, which is very much unknown. Attacks like taps on cables are orthogonal to what I was saying.
- MawNicker 10y ago
  There's merit in just pondering. This is a message board not a legal proceeding. What you're saying isn't totally orthogonal. I'm often surprised at how terrible modern software is. I suspect they actively subvert and displace popular software that they can't hack. Most hacks are probably generic exploits of library code. I imagine they economized. They wanted Total Information Awareness. I can't prove any of this; It just seems sensible. He's doing a red team analysis. It's not of the same form of thought. You can't invalidate it with the arguments you're making except for in some logical domain or something. It's not a true/false statement. It's not even fuzzy.
  - Analemma_ 10y ago
    I agree! And I don't mind pondering, as long as it's clearly marked as such. I do mind statements like "Practically every major piece of software and hardware that's not open source has a backdoor embedded" presented as established fact when they are not.
    - MawNicker 10y ago
      A vulnerability is a back door. The only problem I have with that statement is it's exclusion of open-source software. It's got more back doors embedded in it than closed-source software. Jimmy: a short crowbar used by a burglar to force open a window or door. He didn't necessarily say it was collusion but I suppose it's fair to clarify. It seems narrow to suggest it's just a stash of 0-days. I suspect they've been heavily yet covertly involved in the popular software tool-chains and computing hardware.
- galdosdi 10y ago
  Not what I said. I said "realistically imaginable attack" ie ethics is the only thing hypothetically stopping them, not lack of fantasy technology. See if you can come up with a counterexample that actually meets that hurdle. Mind control satellites and lizard men are both so far away from our current science and technology that even assuming the NSA could be a few years ahead, it's not worth considering. If there really were mind control sattelites or similar precursor technology available or in research today, and there were lizard men who had a history of being good at working with those and willing to sell their skills, then I would agree that it's plausible they're doing it. Also, I'm more interested in the /practical/ applications of this knowledge of whether the intelligence community does a certain thing X, not the philosophical certainty of whether they do a thing X. You lock your doors because someone /might/ break in /maybe/, not because you're certain John Doe is planning on doing so at 4:30am tonight. Even if no one ever does, it's certainly technically possible, so if locks are cheap it's a reasonable tradeoff, even if you'll never be sure if they really helped. You're probably right though that I'm moving the goalposts around! :-) I'm not trying to have a formal debate, just idly shooting the shit on the net, so I'm OK with that.
kobayashi 10y ago
>assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. Prepare for that scenario as a possibility, but there should still be a burden of evidence before possibility is accepted as reality.

nitrogen 10y ago

Dual EC DRBG.

Karunamon 10y ago
The RNG that was only ever used in one (RSA) company's product and then swiftly deprecated once the news dropped? That's a far cry from "Practically every major piece of software and hardware that's not open source has a backdoor embedded."
- nitrogen 10y ago
  It's a bit disingenuous to call the RSA lib "one company's product" when it was used by many, many other products.
  - Karunamon 10y ago
    Is it one company's product or is it not?! The pedantry around here can be infuriating sometimes. You take issue with my strictly true comment, and ignore Analemma_'s comment upthread (every product) which is strictly false.
    - igravious 10y ago
      The clue is in the name. It's a library, it is both the work of one company and used in many products, which is why it is suspected that it was targeted. You're both right. GP is not being pedantic.

Lordarminius 10y ago

>[citation needed], and I mean a credible one with evidence, not tinfoil-hat raving I think The Puzzle Palace (https://www.amazon.com/Puzzle-Palace-National-Intelligence-Organization/dp/0140067485 https://www.amazon.com/Puzzle-Palace-National-Intelligence-O...) made the same argument as far back as 1982

Bud 10y ago
You're aware that The Puzzle Palace was written by the same guy that wrote this article, right? Bamford.

guimarin 10y ago

Intel Actice Management Technology fits the bill[1]. An out of band processor on select chips. Most likely it's on all the chips and only activated for consumers on the vPro and certain Xeon models. 1. https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...

runjake 10y ago

> like fiber taps at Google's datacenters Likewise, [citation needed]. That would be pretty stunning, if true.

FooHentai 10y ago
This has been known about for ages and was part of the Snowden leaks: https://www.google.com/search?q=google+nsa+%22encryption+added+and+removed+here https://www.google.com/search?q=google+nsa+%22encryption+add...
- runjake 10y ago
  Everything I've read from the Snowden docs indicates traffic is intercepted over big pipes on backbones or at Internet Exchanges. The parent poster was suggesting (and I was questioning) this occurred at Google Data Centers, which would prove explicit cooperation by Google. A whole different ballgame. The closest I've seen are the PRISM slides which imply cooperation from Google and the other big companies, but this could be bad choice of wording.
  - FooHentai 10y ago
    No, this one was on the Google 'Front End Servers': http://www.japantimes.co.jp/wp-content/uploads/2013/11/nc20131113d1a.jpg http://www.japantimes.co.jp/wp-content/uploads/2013/11/nc201... Regarding PRISM cooperation, I'm not sure where your doubt is coming from there. http://imgur.com/a/wRKtL http://imgur.com/a/wRKtL The slide was explicit, and is now many years out of date so without doubt the number of providers has increased. The means by which these provider agreements are reached is well known (National Security Letters) as is the fact that organizations are fully barred from disclosing their existence.
MertsA 10y ago
It was fiber taps between Google Datacenters overseas. The implication being that if your location history, emails, photos, secret diary, or what have you is transferred overseas at any point then you automatically have no more rights to privacy than a suspected terrorist.

finid 10y ago

That's like asking me for evidence for the existence of the Sun. All I can do is shake my head...

Animats 10y ago

The number of bad random number generators found in crypto system is deeply suspicious.[1] [1] http://eprint.iacr.org/2012/064.pdf http://eprint.iacr.org/2012/064.pdf

igravious 10y ago
Yes, but I wouldn't class that as building in a backdoor to a specific "major piece of software and hardware" or software and hardware range, I would class it as industrial sabotage on a more subtle and general scale. Equally pernicious but not the claim that is being made.

nickpsecurity 10y ago

I did something like that in a counterpoint to an apologist for NSA here: https://www.schneier.com/blog/archives/2014/03/friday_squid_bl_420.html#c5226750 https://www.schneier.com/blog/archives/2014/03/friday_squid_...

finid 10y ago

If they can have a backdoor in Lotus Notes, what else can't they have a backdoor into? Do a search for "ibm lotus backdoor" or start from http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html