6 ms·

Speaking of OpenBSD, does anyone know what happened here and how true it is? https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-bac

by mtgx 8y ago

Speaking of OpenBSD, does anyone know what happened here and how true it is? https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a... It would certainly jive with John Gilmore's story on how the NSA worked through the standard bodies to keep IPSEC easily exploitable by making the design too difficult to implement properly: https://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html https://www.mail-archive.com/cryptography@metzdowd.com/msg12... Their behavior around Simon & Speck and how they refused to reveal details on how exploitable they could be also seems to be similar to their previous tactics. This is why it's worrisome that Google intends to implement Speck in Android and have pushed it to the Linux kernel, too. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=da7a0ab5b4babbe5d7a46f852582be06a00a28f0 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... More details on how the NSA has been sabotaging open source projects here: https://www.youtube.com/watch?v=fwcl17Q0bpk https://www.youtube.com/watch?v=fwcl17Q0bpk

admax88q 8y ago
Don't have all my sources on hand, but the last time I looked in to this the general conclusion I came to was that there's evidence to suggest that someone was in fact paid to put vulnerabilities into the IPSec stack of OpenBSD. But there was no evidence to suggest that those vulnerabilities ever got written or if they were written that they ever made it into the source tree. I believe OpenBSD conducted an audit of their tree when rumours of an IPSec backdoor started and didn't find anything alarming.
- sverige 8y ago
  Pretty ancient stuff to bring up, especially in this context. Here's the last denial I recall by one of the people accused of planting backdoors in OpenBSD. Note the date. https://www.itworld.com/article/2744922/open-source-tools/openbsd-fbi-allegations-denied-by-named-participants.html https://www.itworld.com/article/2744922/open-source-tools/op...
  - reacharavindh 8y ago
    Sorry to indulge in tin foil hattery. But this all seems in conclusive.. has there been an independent audit of the components involved?
    - reacharavindh 8y ago
      Following up my own question. Just read the security and audit details on OpenBSD page. https://www.openbsd.org/security.html https://www.openbsd.org/security.html It appears that there is a continuous audit of source code. So, even if a malicious hole was planted, it ought to be discovered in the years of repeated auditing. Cheers to OpenBSD!
      - sverige 8y ago
        Yes, it is the best OS for security, and the audits have gone on for the duration of the project.
forapurpose 8y ago
The issue has been discussed many times on HN. My guess is that people don't want to revisit it (and I don't know enough off the top of my head to write a good answer). Look at HN history and you can find much of what you need.

by mtgx 8y ago

admax88q 8y ago

Don't have all my sources on hand, but the last time I looked in to this the general conclusion I came to was that there's evidence to suggest that someone was in fact paid to put vulnerabilities into the IPSec stack of OpenBSD. But there was no evidence to suggest that those vulnerabilities ever got written or if they were written that they ever made it into the source tree. I believe OpenBSD conducted an audit of their tree when rumours of an IPSec backdoor started and didn't find anything alarming.

sverige 8y ago
Pretty ancient stuff to bring up, especially in this context. Here's the last denial I recall by one of the people accused of planting backdoors in OpenBSD. Note the date. https://www.itworld.com/article/2744922/open-source-tools/openbsd-fbi-allegations-denied-by-named-participants.html https://www.itworld.com/article/2744922/open-source-tools/op...
- reacharavindh 8y ago
  Sorry to indulge in tin foil hattery. But this all seems in conclusive.. has there been an independent audit of the components involved?
  - reacharavindh 8y ago
    Following up my own question. Just read the security and audit details on OpenBSD page. https://www.openbsd.org/security.html https://www.openbsd.org/security.html It appears that there is a continuous audit of source code. So, even if a malicious hole was planted, it ought to be discovered in the years of repeated auditing. Cheers to OpenBSD!
    - sverige 8y ago
      Yes, it is the best OS for security, and the audits have gone on for the duration of the project.

forapurpose 8y ago

The issue has been discussed many times on HN. My guess is that people don't want to revisit it (and I don't know enough off the top of my head to write a good answer). Look at HN history and you can find much of what you need.