5 ms·

Make no mistake, there are back doors into Linux as well.

by bdamm 5y ago

h4x0r12345 5y ago
Back doors in the Linux kernel source code? No. Back doors in GNU/Linux distribution repositories? Maybe.
- taylorfinley 5y ago
  You don't think, with all the resources available to them, the intelligence community would spend just about whatever it took to sneak a vulnerability or two into the most-run piece of code on the planet? The core devs don't even have to be corrupted--there are 28 million lines of code in the kernel, you don't think a motivated adversary could sneak something past the gate keepers?
  - h4x0r12345 5y ago
    It's well known that they've already tried to insert back doors many times. On the other side is a huge amount of resources auditing and reviewing the kernel. Many reviewers, auditors, security analysts.
    - Hackbraten 5y ago
      Details about a few known attempts: https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_tried_to_backdoor_linux_three_times/ https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_t...
      - Tijdreiziger 5y ago
        TIL Linus Torvalds' father is a Member of European Parliament.
  - anthk 5y ago
    Any middleware Linux/BSD router could detect suspicious traffic.
    - PhantomGremlin 5y ago
      I don't think this is realistic any more. There's just too much noise, too many chatty processes, too much traffic. A while ago I tried to track the start of a single application, a new install of Firefox. IIRC the first start generated traffic to about a dozen endpoints. Also, macOS and Windows generate enormous amounts of traffic (others here have noted that). The amount of background traffic is simply overwhelming. Perhaps security companies can make sense of it all, but it's far too much for most technical people. I run my own OpenBSD firewall and I've long since given up trying to understand what my Macbooks are doing. The beauty of OpenBSD itself is that it starts very few daemons, and all source code is available. So it's easy for me to understand what my firewall is doing. user@catalina ~ % ps aux |wc -l 542 vs openbsd_user$ ps aux |wc -l 42
      - anthk 5y ago
        tcpdump on pflog0 and then use wireshark.
smoldesu 5y ago
Care to point out a few that I might accidentally have installed?
anthk 5y ago
Very difficult to do so as anyone can create (and distros do) a customized kernel and userland with severally different compiling options. OpenSSL vs LibreSSL, Glibc vs Musl, X11 vs Arcan (or just the framebuffer/KMS), and so on. Also, on exploits realize Linux and BSD run in devices very different from X86 right? NetBSD today runs even on Alpha, and 0days won't work with ease there. Even more with the new RISC-V arches here.
livinginfear 5y ago
I'm a very privacy conscious Linux user. I'm not doing anything illegal, so I have no active concern about security. I'm not unrealistic. When it comes to my threat profiling, I don't expect my desktop to withstand attack by alphabet-soup US federal agencies. I just want to know that I have complete ownership of my hardware, and my data. I'm satisfied just knowing that a shadowy company like Google, or Apple, is not profiling me. If someone was going to be concerned with security from the government, Linux is still much more preferable than Windows, Android, or MacOS.
hdjjhhvvhga 5y ago
When you think about the utility of such backdoors, the ones in Windows like in Bitlocker are much more useful to intelligence agencies than a similar thing in Linux. As Linux is mainly installed on a server, we are talking about a backdoor that allows defined or arbitrary code execution based on a given signal such as specific connection data. What happens next is also important (a connection is established, a hidden process is created and so on). When you take all this into consideration, hiding a backdoor in the Linux kernel is not the most efficient way to proceed, especially when you normally deal with specific targets. So instead of a full backdoor you would prefer introducing a feature that would play nicely with a zero day you already developed.
PYTHONDJANGO 5y ago
You could avoid looking like a clown by adding some URLs to relevant sources to your post.

Make no mistake, there are back doors into Linux as well.

by bdamm 5y ago

Make no mistake, there are back doors into Linux as well.

h4x0r12345 5y ago

Back doors in the Linux kernel source code? No. Back doors in GNU/Linux distribution repositories? Maybe.

taylorfinley 5y ago
You don't think, with all the resources available to them, the intelligence community would spend just about whatever it took to sneak a vulnerability or two into the most-run piece of code on the planet? The core devs don't even have to be corrupted--there are 28 million lines of code in the kernel, you don't think a motivated adversary could sneak something past the gate keepers?
- h4x0r12345 5y ago
  It's well known that they've already tried to insert back doors many times. On the other side is a huge amount of resources auditing and reviewing the kernel. Many reviewers, auditors, security analysts.
  - Hackbraten 5y ago
    Details about a few known attempts: https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_tried_to_backdoor_linux_three_times/ https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_t...
    - Tijdreiziger 5y ago
      TIL Linus Torvalds' father is a Member of European Parliament.
- anthk 5y ago
  Any middleware Linux/BSD router could detect suspicious traffic.
  - PhantomGremlin 5y ago
    I don't think this is realistic any more. There's just too much noise, too many chatty processes, too much traffic. A while ago I tried to track the start of a single application, a new install of Firefox. IIRC the first start generated traffic to about a dozen endpoints. Also, macOS and Windows generate enormous amounts of traffic (others here have noted that). The amount of background traffic is simply overwhelming. Perhaps security companies can make sense of it all, but it's far too much for most technical people. I run my own OpenBSD firewall and I've long since given up trying to understand what my Macbooks are doing. The beauty of OpenBSD itself is that it starts very few daemons, and all source code is available. So it's easy for me to understand what my firewall is doing. user@catalina ~ % ps aux |wc -l 542 vs openbsd_user$ ps aux |wc -l 42
    - anthk 5y ago
      tcpdump on pflog0 and then use wireshark.

smoldesu 5y ago

Care to point out a few that I might accidentally have installed?

anthk 5y ago

Very difficult to do so as anyone can create (and distros do) a customized kernel and userland with severally different compiling options. OpenSSL vs LibreSSL, Glibc vs Musl, X11 vs Arcan (or just the framebuffer/KMS), and so on. Also, on exploits realize Linux and BSD run in devices very different from X86 right? NetBSD today runs even on Alpha, and 0days won't work with ease there. Even more with the new RISC-V arches here.

livinginfear 5y ago

I'm a very privacy conscious Linux user. I'm not doing anything illegal, so I have no active concern about security. I'm not unrealistic. When it comes to my threat profiling, I don't expect my desktop to withstand attack by alphabet-soup US federal agencies. I just want to know that I have complete ownership of my hardware, and my data. I'm satisfied just knowing that a shadowy company like Google, or Apple, is not profiling me. If someone was going to be concerned with security from the government, Linux is still much more preferable than Windows, Android, or MacOS.

hdjjhhvvhga 5y ago

When you think about the utility of such backdoors, the ones in Windows like in Bitlocker are much more useful to intelligence agencies than a similar thing in Linux. As Linux is mainly installed on a server, we are talking about a backdoor that allows defined or arbitrary code execution based on a given signal such as specific connection data. What happens next is also important (a connection is established, a hidden process is created and so on). When you take all this into consideration, hiding a backdoor in the Linux kernel is not the most efficient way to proceed, especially when you normally deal with specific targets. So instead of a full backdoor you would prefer introducing a feature that would play nicely with a zero day you already developed.

PYTHONDJANGO 5y ago

You could avoid looking like a clown by adding some URLs to relevant sources to your post.