4 ms·
Microsoft certifies to the government that they can not protect against moderately skilled attackers via their Common Criteria certifications as seen on their s
by Veserv 3y ago
Microsoft certifies to the government that they can not protect against moderately skilled attackers via their Common Criteria certifications as seen on their security homepage [1][2]. These are the only security certifications they mention on that page (FIPS is also mentioned, but it is more of a crypto certification than a security certification). They specifically certify that they only conform to EAL1 [3][4] which only requires AVA_VAN.1 which is the ability to protect against attackers with a "Basic attack potential" [5]. The evaluation methodology required by AVA_VAN.1 can be seen on their certification report [6]. Effectively, they do a Google search for "Windows CVE" then they check that all the search results are patched. That's it. I am not joking. That is how they certify security. I am not joking. Seriously.
To be fair, Microsoft has historically certified to conform to EAL4 which requires AVA_VAN.3 which is the ability to protect against "Enhanced basic" attackers and includes a actual penetration test. However, despite decades of attempts, they have never once successfully certified any product against AVA_VAN.4 which is the ability to protect against "Moderate" attackers. They have literally never once been able to protect against "Moderate" attackers. And they have the certifications to prove that they absolutely, positively, can not.
It is the height of idiocy that anybody listens to or trusts anything that Microsoft says at all about security. The have literally certified that the height of their ability is abject incompetence and the total inability to protect against "moderately" skilled attackers. Until they can definitely prove and certify otherwise, their claims of security should be completely ignored as the useless trash that it is.
[1] https://learn.microsoft.com/en-us/windows/security/ https://learn.microsoft.com/en-us/windows/security/
[2] https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/windows-platform-common-criteria https://learn.microsoft.com/en-us/windows/security/security-...
[3] https://www.commoncriteriaportal.org/pps/ https://www.commoncriteriaportal.org/pps/
[4] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.2.1.pdf https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4....
[5] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.2.1.pdf https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... Page 53
[6] https://www.commoncriteriaportal.org/files/epfiles/2022-21-INF-3955.pdf https://www.commoncriteriaportal.org/files/epfiles/2022-21-I... Page 14
- matheusmoreira 3y agoWhat exactly are moderate and advanced attackers? The documents cited only seem to go up to the "enhanced basic level" you mentioned which is penetration testing with public vulnerability search.
- fragmede 3y agoModerate would be a cyber crime gang, rich from ransomware. Advanced would be the CIA, Mossad, FSB, and the like.
- Veserv 3y agoYou can see the standard here [1]. Of note are the Security Assurance Requirements (SAR) seen here [2] which discuss the certification process. The Security Functional Requirements (SFR) seen here [3] are more focused on what you are certifying and the sorts of problems you are certifying to solve. As seen in the SAR document [4], AVA_VAN.1 is "basic" with a public vulnerability search. AVA_VAN.2 is the same, but they do a independent pentest. AVA_VAN.3 is "enhanced basic", AVA_VAN.4 is "moderate", AVA_VAN.5 is "high". The EAL levels are listed here [5] and echo the same things I stated about their corresponding AVA_VAN assurance requirements. Historically, EAL4 (the highest level ever achieved by Microsoft for any product in any configuration) said something like: "protects against casual and inadvertent" attackers, so that should probably help you calibrate what "enhanced-basic" means. As for what constitutes "high". You can see a OS certified against the SKPP [6] here [7] at EAL6+. A EAL6+ certification requires AVA_VAN.5 or equivalent. For the SKPP they use a equivalent, AVA_VLA_EXP.4, which requires the NSA to certify that it protects against the NSA (with full source code) as a proxy for a "high attack potential" actor. Yes, that is a certification by the NSA certifying that the NSA can not hack the OS even with full source. This is the OS used on the F-35 and the certification was done to determine if it was acceptable to bet the entire US Air Force on the OS, so the NSA was not playing pretend in this case. That is what constitutes a "high attack potential" actor. So the gap here is: "protects against casual and inadvertent attacks" vs. the literal NSA. The funniest part is that literally everybody says they are being attacked by "nation-state" actors. If they really are being attacked by "nation-state" actors, then they should be using systems that have been proven and certified to protect against them, not systems proven and certified to protect against your roommate in college. [1] https://www.commoncriteriaportal.org/cc/ https://www.commoncriteriaportal.org/cc/ [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... [3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... [4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 184 [5] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 33 [6] https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf [7] https://www.commoncriteriaportal.org/files/epfiles/st_vid10119-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid101...