6 ms·

Backdoors in software is one of those nightmarish scenarios that disturbs you until you just think about something else and kind of temporarily forget it (like

by ghgr 9y ago

Backdoors in software is one of those nightmarish scenarios that disturbs you until you just think about something else and kind of temporarily forget it (like nuclear war, killer bees, climate change or asteroid impact). Open Source just raises the bar but in no way solves these problems (for example OpenSSH's roaming feature/bug, OpenSSL and Heartbleed). In computing one can quickly become paranoid: software buttons for switching smartphones off (are they 'really' off?), always-on microphones, webcams (granted, you can cover it), blobs in your smartphone and home router, downloads from http://download.cnet.com http://download.cnet.com (note the lack of https), winscp, putty from www.putty.org (again, no https, which is not even the actual site, but nevertheless the first result from Google). In Linux the landscape is slightly better, but do you really trust all those packagers? Do you really understand each line of code when you "git clone foo; cd foo; ./configure; make; sudo make install"?, and in X11 you can easily make a key-logger without even being root! [1]. And not even full disk encryption can protect us (Evil Maid [2]). That's one of the reasons I'm skeptical of the Ethereum smart-contract concept. In theory it works, but in practice I'm not sure at all. The DAO heist was one early example of security bugs in smart contracts, but I fear they will become more common when malware developers turn to "contract-engineering". [1] https://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real https://superuser.com/questions/301646/linux-keylogger-witho... [2] https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html https://www.schneier.com/blog/archives/2009/10/evil_maid_att...

Buge 9y ago
Reminds me of badBIOS[1]. A security researcher became sure he was infected by a very advanced piece of malware that could hide itself completely. Many people think it was just his imagination. [1] https://arstechnica.com/information-technology/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/ https://arstechnica.com/information-technology/2013/10/meet-...
- zdkl 9y ago
  And then the intel ME debacle became widely known and, as usual, the tinfoil hatted among us got to say "told you"
  - vog 9y ago
    Small nickpick: The tinfoil hats would have loved to say "told you so", but even they had not predicted the true scale of things. Intel ME is not just some BIOS code, but a separate hardware component that is deeply connected with all CPU actions.
    - zdkl 9y ago
      Nitpick to your nitpick: Real tinfoilers have been warning about this since the 80's
      - chii 9y ago
        And do you know what happened to those people?! Nobody knows, of course! They got taken out coz they know to much!
      - LoSboccacc 9y ago
        yeah, remember when people where laughed off when talking abut ECHELON?
        mason55 9y ago
        Yeah, growing up with ECHELON and Carnivore, the whole Snowden thing didn't surprise me at all. You didn't even need to assume they were doing it, past evidence pointed to the fact the government was 100% spying on everyone already.
  - throwawayknecht 9y ago
    Intel ME was widely known of before BadBIOS. BadBIOS is still nonsense.
    - zdkl 9y ago
      True but for this argument, I'd say the specific location of the backdoor isn't the relevant part.
    - 9y ago
vog 9y ago
> https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html https://www.schneier.com/blog/archives/2009/10/evil_maid_att... The following part of this classic (2009) article caught my eye: > Symantec’s CTO Mark Bregman was recently advised by "three-letter agencies in the US Government" to use separate laptop and mobile device when traveling to China, citing potential hardware-based compromise. It is strange how much this changed after the Snowden relevations. In Europe, now you get that same advice when travelling to the US.
- daenney 9y ago
  Yup. I no longer carry my regular laptop or phone to the US. I have separate devices that receive a wipe before entering and after leaving. Doesn't prevent hardware compromise though, but at least it won't compromise my daily driver. Even US companies advise their overseas employees to be careful and thoughtful as to what you bring with you, b/c of what can happen at the border: https://github.com/basecamp/handbook/blob/master/international-travel-guide.md#company-security-at-the-border https://github.com/basecamp/handbook/blob/master/internation...
- Angostura 9y ago
  Now all we have to worry about are the attacks from our countries' domestic security services.
  - zdkl 9y ago
    You mean by the private contractors they hire.
kahnpro 9y ago
I feel like this needs to be repeated over and over. In theory, encryption and smart contracts and bitcoin are mathematically sound and "you can't argue with the math!" But the theory is written into real programs by humans, who make mistakes. The math is unassailable until, oops, it isn't, because someone forgot a bounds check!
- traitormonkey 9y ago
  ..or the government had a bug placed in the random generator to weaken the crypto? In UK they want to do this openly now. What are you supposed to do roll your own crypto? Build your own CPU? It has code too - many operations are undocumented. We have this thing, the internet, where for the first time in history practically anyone can collaborate with anyone else in the world. We have the supposed bulwark of the right to bear arms and some rabidly protect it when in reality guns will be no use against a malign government. And yet often the same people are more than happy to relinquish this incredibly powerful weapon of liberty. Even worse some people are currently using this weapon to influence elections and seize power.
- fmap 9y ago
  Which is why you use mathematics to write formally verified software e.g. in Coq. :) This whole "move fast and break things" philosophy should be unacceptable, if you want people to trust in your new cryptocurrency/voting machine/etc, but try telling your investors that it'll take 5 years to develop the software instead of 5 weeks to "a first prototype" whose bugs and bad design decisions will haunt you forever...
  - xfer 9y ago
    Coq extraction is not formally verified.
    - fmap 9y ago
      1) It will be very soon: http://www.cs.princeton.edu/~appel/certicoq/ http://www.cs.princeton.edu/~appel/certicoq/ CertiCoq is a formally verified compiler from Coq to assembly (using Compcerts backends), not just an extraction to Ocaml/Haskell/Scala. 2) Extraction is not the only approach to verifying software with Coq (see Verifiable C, or Bedrock). In other proof assistants, e.g., in Isabelle or HOL extraction isn't even available and so other approaches are common. For a nice example look at the bootstrapping process of CakeML (https://cakeml.org/ https://cakeml.org/). 3) Even if it wasn't, the point is that the trusted base with verified software is tiny compared to anything else that people are actually using. "It's not perfect" is not an excuse if it is basically perfect in practice. See the Csmith paper ("Finding and Understanding Bugs in C Compilers", https://embed.cs.utah.edu/csmith/ https://embed.cs.utah.edu/csmith/) and what they had to say about CompCert.
gruez 9y ago
>putty from www.putty.org (again, no https, which is not even the actual site, but nevertheless the first result from Google) Doesn't matter on windows. The binaries are authenticode signed.
- sitkack 9y ago
  Security is a layer, https://www.theguardian.com/technology/2011/aug/30/faked-web-certificate-iran-dissidents https://www.theguardian.com/technology/2011/aug/30/faked-web...
- geraldcombs 9y ago
  A better example might have been Cygwin. As far as I can tell, none of their executables (particularly the installers) are signed.
neo2006 9y ago
I agree, the equation is simple as long as 3 letters organisations have more men power to scrutinize code and find bugs in oss software this model will not work. 3 letters organization don't need to implement backdoors they just need to review existing code and find bugs and exploit them. For most developers writing code and adding functionalities is fun and rewarding on it self, reviewing code is not and this is way we end up with oss projects core teams or maintainers overwhelmed and making mistakes.
eeZah7Ux 9y ago
> Open Source just raises the bar but in no way solves these problems While technically true, yet, you are comparing air travel safety with motorbike safety. https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy
- sillysaurus3 9y ago
  Not really, no. It's a deep problem that nobody has solved. Just because some code is on Github doesn't mean they're running that code, for example.
perlgeek 9y ago
And then there are potential backdoors in hardware (or microcode). Supply-chain attacks really are a nightmare. Suppose you are a medium-sized IT company (large enough to be a valuable target, but not google-large where you can employ a really good security team that knows their hardware in an out). And then think of all the hardware you buy from all different vendors and manufacturers, and make a list of those that could totally own you if there was a backdoor. What can you even do except shudder in horror?

by ghgr 9y ago

Buge 9y ago

Reminds me of badBIOS[1]. A security researcher became sure he was infected by a very advanced piece of malware that could hide itself completely. Many people think it was just his imagination. [1] https://arstechnica.com/information-technology/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/ https://arstechnica.com/information-technology/2013/10/meet-...

zdkl 9y ago
And then the intel ME debacle became widely known and, as usual, the tinfoil hatted among us got to say "told you"
- vog 9y ago
  Small nickpick: The tinfoil hats would have loved to say "told you so", but even they had not predicted the true scale of things. Intel ME is not just some BIOS code, but a separate hardware component that is deeply connected with all CPU actions.
  - zdkl 9y ago
    Nitpick to your nitpick: Real tinfoilers have been warning about this since the 80's
    - chii 9y ago
      And do you know what happened to those people?! Nobody knows, of course! They got taken out coz they know to much!
    - LoSboccacc 9y ago
      yeah, remember when people where laughed off when talking abut ECHELON?
      - mason55 9y ago
        Yeah, growing up with ECHELON and Carnivore, the whole Snowden thing didn't surprise me at all. You didn't even need to assume they were doing it, past evidence pointed to the fact the government was 100% spying on everyone already.
- throwawayknecht 9y ago
  Intel ME was widely known of before BadBIOS. BadBIOS is still nonsense.
  - zdkl 9y ago
    True but for this argument, I'd say the specific location of the backdoor isn't the relevant part.
  - 9y ago

vog 9y ago

> https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html https://www.schneier.com/blog/archives/2009/10/evil_maid_att... The following part of this classic (2009) article caught my eye: > Symantec’s CTO Mark Bregman was recently advised by "three-letter agencies in the US Government" to use separate laptop and mobile device when traveling to China, citing potential hardware-based compromise. It is strange how much this changed after the Snowden relevations. In Europe, now you get that same advice when travelling to the US.

daenney 9y ago
Yup. I no longer carry my regular laptop or phone to the US. I have separate devices that receive a wipe before entering and after leaving. Doesn't prevent hardware compromise though, but at least it won't compromise my daily driver. Even US companies advise their overseas employees to be careful and thoughtful as to what you bring with you, b/c of what can happen at the border: https://github.com/basecamp/handbook/blob/master/international-travel-guide.md#company-security-at-the-border https://github.com/basecamp/handbook/blob/master/internation...
Angostura 9y ago
Now all we have to worry about are the attacks from our countries' domestic security services.
- zdkl 9y ago
  You mean by the private contractors they hire.

kahnpro 9y ago

I feel like this needs to be repeated over and over. In theory, encryption and smart contracts and bitcoin are mathematically sound and "you can't argue with the math!" But the theory is written into real programs by humans, who make mistakes. The math is unassailable until, oops, it isn't, because someone forgot a bounds check!

traitormonkey 9y ago
..or the government had a bug placed in the random generator to weaken the crypto? In UK they want to do this openly now. What are you supposed to do roll your own crypto? Build your own CPU? It has code too - many operations are undocumented. We have this thing, the internet, where for the first time in history practically anyone can collaborate with anyone else in the world. We have the supposed bulwark of the right to bear arms and some rabidly protect it when in reality guns will be no use against a malign government. And yet often the same people are more than happy to relinquish this incredibly powerful weapon of liberty. Even worse some people are currently using this weapon to influence elections and seize power.
fmap 9y ago
Which is why you use mathematics to write formally verified software e.g. in Coq. :) This whole "move fast and break things" philosophy should be unacceptable, if you want people to trust in your new cryptocurrency/voting machine/etc, but try telling your investors that it'll take 5 years to develop the software instead of 5 weeks to "a first prototype" whose bugs and bad design decisions will haunt you forever...
- xfer 9y ago
  Coq extraction is not formally verified.
  - fmap 9y ago
    1) It will be very soon: http://www.cs.princeton.edu/~appel/certicoq/ http://www.cs.princeton.edu/~appel/certicoq/ CertiCoq is a formally verified compiler from Coq to assembly (using Compcerts backends), not just an extraction to Ocaml/Haskell/Scala. 2) Extraction is not the only approach to verifying software with Coq (see Verifiable C, or Bedrock). In other proof assistants, e.g., in Isabelle or HOL extraction isn't even available and so other approaches are common. For a nice example look at the bootstrapping process of CakeML (https://cakeml.org/ https://cakeml.org/). 3) Even if it wasn't, the point is that the trusted base with verified software is tiny compared to anything else that people are actually using. "It's not perfect" is not an excuse if it is basically perfect in practice. See the Csmith paper ("Finding and Understanding Bugs in C Compilers", https://embed.cs.utah.edu/csmith/ https://embed.cs.utah.edu/csmith/) and what they had to say about CompCert.

gruez 9y ago

>putty from www.putty.org (again, no https, which is not even the actual site, but nevertheless the first result from Google) Doesn't matter on windows. The binaries are authenticode signed.

sitkack 9y ago
Security is a layer, https://www.theguardian.com/technology/2011/aug/30/faked-web-certificate-iran-dissidents https://www.theguardian.com/technology/2011/aug/30/faked-web...
geraldcombs 9y ago
A better example might have been Cygwin. As far as I can tell, none of their executables (particularly the installers) are signed.

neo2006 9y ago

I agree, the equation is simple as long as 3 letters organisations have more men power to scrutinize code and find bugs in oss software this model will not work. 3 letters organization don't need to implement backdoors they just need to review existing code and find bugs and exploit them. For most developers writing code and adding functionalities is fun and rewarding on it self, reviewing code is not and this is way we end up with oss projects core teams or maintainers overwhelmed and making mistakes.

eeZah7Ux 9y ago

> Open Source just raises the bar but in no way solves these problems While technically true, yet, you are comparing air travel safety with motorbike safety. https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy

sillysaurus3 9y ago
Not really, no. It's a deep problem that nobody has solved. Just because some code is on Github doesn't mean they're running that code, for example.

perlgeek 9y ago

And then there are potential backdoors in hardware (or microcode). Supply-chain attacks really are a nightmare. Suppose you are a medium-sized IT company (large enough to be a valuable target, but not google-large where you can employ a really good security team that knows their hardware in an out). And then think of all the hardware you buy from all different vendors and manufacturers, and make a list of those that could totally own you if there was a backdoor. What can you even do except shudder in horror?