3 ms·

And this, ladies and sirs, why we should prefer Macbooks and Linux in security critical productivity work. Microsoft Windows and its hardware partners, with the

And this, ladies and sirs, why we should prefer Macbooks and Linux in security critical productivity work. Microsoft Windows and its hardware partners, with their device drivers and lack of transparency, have been a dumpster fire for the last 30 years.

x30n 3y ago
lead researcher on this here. I've spent a big part of my career exploiting Apple, and I definitely wouldn't say Linux is better in security critical work.
- sonicanatidae 3y ago
  [flagged]
- Multicomp 3y ago
  I'm curious what your thoughts are on potential solutions to writing 'secure' (enough to resist non APTs, assuming the human does not fall for phishing, just hardware/software vulns) software as an industry? Slower releases? Formal verification everywhere? Demanding more than 3 days notice and vague requirements before we start implementing features? Unionization/licensure so devs can pushback when bosses of various stripes want to cut corners like they have gotten to their entire careers? It is clear that the industry of popular commercial computing devices at large does not have the incentives to write 'secure' code and hardware as defined above. What would it take to make the default state be secure instead of insecure? My attempt at fixing incentives leads me over to UNIX and C which was a massive paradigm shift from the mainframes before and arguably is the foundation for modern computing at large today. Trying to kill our old 80s insecure-unless-you-really-work-at-it UNIX & C-dynasty might be a good step but seems almost impossibly painful for us to do. Like how medical best practices in some areas can only move forward one death of an old guard doctor at a time. We all (me included) are used to this von neumann architecture on one of several popular ISAs and doing imperative code pretending to be a PDP-7, plus or minus lots of abstraction, depending on where we go from embedded to Blazor WASM web programming. Let's say someone does do that, a new OS from first principles, new programming language(s), an entire stack built on, IDK, ARM or x86 ISA on up. VC money demands they lock out making the device general purpose computing. Few would buy it because of their sunk cost investments in the cloud / SAP / activedirectory corporate networks / X gen enterprise offerings of the past that this would not be as easily integrated with. Yikes. What will it take to make us as an industry write 'secure enough' software by default?
- mijoharas 3y ago
  Out if interest does this flaw impact Linux as well if we got one of these devices? It sounds like it's protocol dependent with some specific Microsoft protocol, which I guess means it's unknown whether these fingerprint sensors are secure under Linux, but wanted to check in case this was investigated.
nerdjon 3y ago
If the problem is the hardware itself and not Windows in this case, I fail to see how Linux would fix this particular problem. Also worth pointing out that: > Microsoft’s Offensive Research and Security Engineering (MORSE) asked Blackwing Intelligence to evaluate the security of fingerprint sensors Hating on Windows is fine, but lets be realistic about where the hate is going here.
spicymaki 3y ago
Apple certainly uses hardware partners to make components of their systems. Apple has an advantage in that they can charge more for their systems due to their brand value and reputation. Since the value of their products are high they have less of a need to cut corners and oversight to maintain margin. Chinese manufactures produce the quality to the spec you give them and you pay for.
- londons_explore 3y ago
  Apple typically will be writing the protocols your product must talk. While all other buyers just take your datasheet and have to implement whatever you have decided.
deafpolygon 3y ago
I wouldn't look at Linux for security-critical productivity work. Most cybersecurity experts run Windows, with Linux in a VM. Or they run Macbooks because of battery life, etc. In this case, it comes down to the tooling that they can use to exploit vulns and so on. Linux would be more private, but privacy != security and it all comes down to what your threat model is. The three major OSes have their own security mitigations that you can use to reduce the attack surface. In general, in a multi-user networked environment Windows is going to be more secure than running Linux -- Linux works great as a server because it can be be run barebones thus reducing the attack surface on the OS.
petee 3y ago
The Linux-side was actually part of the vulnerability here "After comparing the enrollment operations on the Windows and Linux sides, we found that while enrolling via Windows follows the enrollment process specified in the SDCP spec, enrolling via Linux does not."

x30n 3y ago

lead researcher on this here. I've spent a big part of my career exploiting Apple, and I definitely wouldn't say Linux is better in security critical work.

sonicanatidae 3y ago
[flagged]
Multicomp 3y ago
I'm curious what your thoughts are on potential solutions to writing 'secure' (enough to resist non APTs, assuming the human does not fall for phishing, just hardware/software vulns) software as an industry? Slower releases? Formal verification everywhere? Demanding more than 3 days notice and vague requirements before we start implementing features? Unionization/licensure so devs can pushback when bosses of various stripes want to cut corners like they have gotten to their entire careers? It is clear that the industry of popular commercial computing devices at large does not have the incentives to write 'secure' code and hardware as defined above. What would it take to make the default state be secure instead of insecure? My attempt at fixing incentives leads me over to UNIX and C which was a massive paradigm shift from the mainframes before and arguably is the foundation for modern computing at large today. Trying to kill our old 80s insecure-unless-you-really-work-at-it UNIX & C-dynasty might be a good step but seems almost impossibly painful for us to do. Like how medical best practices in some areas can only move forward one death of an old guard doctor at a time. We all (me included) are used to this von neumann architecture on one of several popular ISAs and doing imperative code pretending to be a PDP-7, plus or minus lots of abstraction, depending on where we go from embedded to Blazor WASM web programming. Let's say someone does do that, a new OS from first principles, new programming language(s), an entire stack built on, IDK, ARM or x86 ISA on up. VC money demands they lock out making the device general purpose computing. Few would buy it because of their sunk cost investments in the cloud / SAP / activedirectory corporate networks / X gen enterprise offerings of the past that this would not be as easily integrated with. Yikes. What will it take to make us as an industry write 'secure enough' software by default?
mijoharas 3y ago
Out if interest does this flaw impact Linux as well if we got one of these devices? It sounds like it's protocol dependent with some specific Microsoft protocol, which I guess means it's unknown whether these fingerprint sensors are secure under Linux, but wanted to check in case this was investigated.

nerdjon 3y ago

If the problem is the hardware itself and not Windows in this case, I fail to see how Linux would fix this particular problem. Also worth pointing out that: > Microsoft’s Offensive Research and Security Engineering (MORSE) asked Blackwing Intelligence to evaluate the security of fingerprint sensors Hating on Windows is fine, but lets be realistic about where the hate is going here.

spicymaki 3y ago

Apple certainly uses hardware partners to make components of their systems. Apple has an advantage in that they can charge more for their systems due to their brand value and reputation. Since the value of their products are high they have less of a need to cut corners and oversight to maintain margin. Chinese manufactures produce the quality to the spec you give them and you pay for.

londons_explore 3y ago
Apple typically will be writing the protocols your product must talk. While all other buyers just take your datasheet and have to implement whatever you have decided.

deafpolygon 3y ago

I wouldn't look at Linux for security-critical productivity work. Most cybersecurity experts run Windows, with Linux in a VM. Or they run Macbooks because of battery life, etc. In this case, it comes down to the tooling that they can use to exploit vulns and so on. Linux would be more private, but privacy != security and it all comes down to what your threat model is. The three major OSes have their own security mitigations that you can use to reduce the attack surface. In general, in a multi-user networked environment Windows is going to be more secure than running Linux -- Linux works great as a server because it can be be run barebones thus reducing the attack surface on the OS.

petee 3y ago

The Linux-side was actually part of the vulnerability here "After comparing the enrollment operations on the Windows and Linux sides, we found that while enrolling via Windows follows the enrollment process specified in the SDCP spec, enrolling via Linux does not."