4 ms·

Reproducible builds is an excellent QA initiative, but let's not overestimate their security benefits. They're maybe going to protect us from random ELF viruse

by jwilk 10y ago

Reproducible builds is an excellent QA initiative, but let's not overestimate their security benefits. They're maybe going to protect us from random ELF viruses on developers' machines, but not from a targeted attack. Why bother pwning binaries when it's much easier to pwn the source? I mean, it's so easy it's already been done: https://lists.debian.org/20030213165225.GB7379@azure.humbug.org.au https://lists.debian.org/20030213165225.GB7379@azure.humbug....

nickpsecurity 10y ago
Lets also remember that its threat model is FBI, CIA, and do on. They mainly exploit vulnerabilities in software or bad configurations. They're quite successful. Repeoducible builds with normal Linux environments isnt going to stop them. Doing it with "hardened" OS's might but incurs the risk that such niche OS gets less security review. So, this post and effort is ultimately misguided if it's about securing computers from nation states. Linux cant be trusted for this job. They need strong, endpoint security with verified source and compilation for that. Likely be console apps with a microkernel OS since labor involved will demand simple system.
- drvdevd 10y ago
  Also, lets not forget that it's not just Linux (or any one kernel or OS) that's the issue but also every popular hardware architecture can be expected to be subvertable, especially x86 it would appear. And exploiting these types of bugs is within the capablilities of many non-nation state actors as well at this point.
  - nickpsecurity 10y ago
    Oh yeah. It's why you see me pushing things like the GPL'd Leon3 processor (SPARC) that can be implemented on visually-inspectable nodes. Or the 8-16bitters or Forth CPU's if it really needs minimalism. Even open-source EDA tools like Qflow that could use attention from smart OSS contributors.
- linkregister 10y ago
  I can't stand this "throw up our hands" reaction to nation-state adversaries. None of these APTs have unlimited budgets; sufficient hardening and defense-in-depth will encourage the planner to use different targets to satisfy the tasker's intent. Every security improvement helps. We can't just say "run SELinux in a VM and use Tails with JavaScript disabled or accept the Mossad completely owning your life." There has to be a realistic middle ground.
  - nickpsecurity 10y ago
    It's not a throw up your hands reaction. The Linux stacks, from kernel to key apps, have had boatloads of vulnerabilities since they accept insecure code written in languages easy to screw up by people who arent security engineers. Such a stack has no business being used in anything designed to resist well-funded or determined attackers. Federal government's own criteria rates Linux at EAL4: "can protect against causual or inadvertant attempts to breach security." Whereas, even trying to stop nation-states requires very-rigorous developmenf plus review of vastly simpler systems. Systems done like that resisted NSA penetration during evaluation. So, the trick for FOSS is to do their stacks like that. They refuse. Genode is at least architecturally doing it right. Muen and seL4 are separation kernels that might be turned into the foundation. The pieces are there and could be turned into a usable system with a tiny amount of effort compared to what's going into Linux right now. It can even run Linux apps user-mode. Commercial implementations already exist for these (eg Turaya Desktop, Dell SCC) while FOSS just ignores it like most high-security techniques. Google Nizza Secure Systems architecture pdf for an example from CompSci. Genode evolved from it but basis could be done in other projects.
    - linkregister 10y ago
      I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems. I want to emphasize that computer network security is more than a secure operating system. It is defense in depth: the combination of well-designed networks that are hard to traverse, isolated endpoints for internet-facing products, management interfaces that are also properly isolated, monitoring that alerts with a low false positive and negative rate, sufficient logging and analysis that surfaces anomalies while keeping noise down, etc. These are hard and should be scaled to the appropriate threat level to prevent impact to usability. It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system.
- deleted 10y ago
  [deleted]

by jwilk 10y ago

nickpsecurity 10y ago

Lets also remember that its threat model is FBI, CIA, and do on. They mainly exploit vulnerabilities in software or bad configurations. They're quite successful. Repeoducible builds with normal Linux environments isnt going to stop them. Doing it with "hardened" OS's might but incurs the risk that such niche OS gets less security review. So, this post and effort is ultimately misguided if it's about securing computers from nation states. Linux cant be trusted for this job. They need strong, endpoint security with verified source and compilation for that. Likely be console apps with a microkernel OS since labor involved will demand simple system.

drvdevd 10y ago
Also, lets not forget that it's not just Linux (or any one kernel or OS) that's the issue but also every popular hardware architecture can be expected to be subvertable, especially x86 it would appear. And exploiting these types of bugs is within the capablilities of many non-nation state actors as well at this point.
- nickpsecurity 10y ago
  Oh yeah. It's why you see me pushing things like the GPL'd Leon3 processor (SPARC) that can be implemented on visually-inspectable nodes. Or the 8-16bitters or Forth CPU's if it really needs minimalism. Even open-source EDA tools like Qflow that could use attention from smart OSS contributors.
linkregister 10y ago
I can't stand this "throw up our hands" reaction to nation-state adversaries. None of these APTs have unlimited budgets; sufficient hardening and defense-in-depth will encourage the planner to use different targets to satisfy the tasker's intent. Every security improvement helps. We can't just say "run SELinux in a VM and use Tails with JavaScript disabled or accept the Mossad completely owning your life." There has to be a realistic middle ground.
- nickpsecurity 10y ago
  It's not a throw up your hands reaction. The Linux stacks, from kernel to key apps, have had boatloads of vulnerabilities since they accept insecure code written in languages easy to screw up by people who arent security engineers. Such a stack has no business being used in anything designed to resist well-funded or determined attackers. Federal government's own criteria rates Linux at EAL4: "can protect against causual or inadvertant attempts to breach security." Whereas, even trying to stop nation-states requires very-rigorous developmenf plus review of vastly simpler systems. Systems done like that resisted NSA penetration during evaluation. So, the trick for FOSS is to do their stacks like that. They refuse. Genode is at least architecturally doing it right. Muen and seL4 are separation kernels that might be turned into the foundation. The pieces are there and could be turned into a usable system with a tiny amount of effort compared to what's going into Linux right now. It can even run Linux apps user-mode. Commercial implementations already exist for these (eg Turaya Desktop, Dell SCC) while FOSS just ignores it like most high-security techniques. Google Nizza Secure Systems architecture pdf for an example from CompSci. Genode evolved from it but basis could be done in other projects.
  - linkregister 10y ago
    I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems. I want to emphasize that computer network security is more than a secure operating system. It is defense in depth: the combination of well-designed networks that are hard to traverse, isolated endpoints for internet-facing products, management interfaces that are also properly isolated, monitoring that alerts with a low false positive and negative rate, sufficient logging and analysis that surfaces anomalies while keeping noise down, etc. These are hard and should be scaled to the appropriate threat level to prevent impact to usability. It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system.
deleted 10y ago
[deleted]