6 ms·

This article misses the most important security tip: do not use any proprietary software, especially the ones starting with "W" made by MS.

by kbart 13y ago

skrebbel 13y ago
Are you sure? How much more difficult would it be for an intelligence agency to get an open source hacker to "accidentally" inject a vulnerability disguised as a bug, than to pressure MS to write a backdoor? (or to get MS to hire a mole)
- kbart 13y ago
  Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophisticated and hidden than the one buried in the precompiled binary. Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet, contrary to the countless examples of products by big names. Not saying that open source is 100% secure, but it's still much safer than proprietary programs. [EDIT] Thanks for pointing out Debian SSL example, I wasn't aware of that. But it still doesn't deny the key point I mentioned - that there are more discovered backdoors and vulnerabilities in proprietary software than the open one.
  - claudius 13y ago
    > Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet. One could argue that the Debian SSL issue[0] would qualify as such a backdoor/vulnerability, although I don’t want to argue that it was introduced maliciously, merely that it could have been introduce with such intentions. [0] http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571
  - DanBC 13y ago
    All those people reviewing the code took two years to discover the Debian SSL bug. https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... https://wiki.debian.org/SSLkeys https://wiki.debian.org/SSLkeys
    - sneak 13y ago
      Now how long would that have taken WITHOUT source code? Would we _ever_ have known (without keyfiles on disk to analyze)?
- antocv 13y ago
  You dont have to trust GNU/Linux, in fact you should distrust it as well, but it is safer and better than Windows according to record so far, since you have many more independent security solutions and can customize it to your liking, and we have seen Stuxnet, NSA_KEY etc... You can modify the kernel so much as to make any existing 0days unpractical for your particular installation. You cant do that with windows kernel. For linux, you can remove all the drivers not really needed for your particular computer, and prevent modules from being used. If you're really paranoid you must go with ArchHurd or HaikuOS, those extremely small OS not many have heard about yet NSA to have devoted time for 0daying them or inserting backdoors. But definitely not go back to Windows.
  - hyperpape 13y ago
    Almost all of that goes out the window for targeted attacks. For general safety, you just need to be a little bit better than the average computer user--the money is in simple reliable attacks that hit broad swaths of the public. But for targeted attacks you need to have near perfect security. Edit: You're probably still gaining by leaving the beaten path, but if you're exposed, and someone knows what you're running and has the resources to create custom exploits, that won't help much.
- eliteraspberrie 13y ago
  The premise that a large, US-based software company needs pressure from intelligence agencies to write a backdoor in their product isn't historically accurate. For example, Microsoft developers invented the idea of USB AutoRun -- that an executable on a USB drive is executed automatically when the drive is plugged in -- without any kind of pressure. That feature is responsible for the Buckshot Yankee attack,[1] early Stuxnet,[2] and of course COFEE.[3] COFEE in particular was certainly not a bug or written by a single mole. On the other hand there is no evidence of open-source projects going out of their way to accommodate intelligence agencies in the same way Microsoft has. Without this active collaboration from developers, it is far more difficult to backdoor software. [1] http://www.washingtonpost.com/wp-dyn/content/article/2010/08/24/AR2010082406495.html http://www.washingtonpost.com/wp-dyn/content/article/2010/08... [2] http://www.symantec.com/connect/blogs/stuxnet-lnk-file-vulnerability http://www.symantec.com/connect/blogs/stuxnet-lnk-file-vulne... [3] https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_Forensics_Evidence_Extractor)_tool_and_documentation,_Sep_2009 https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_...
  - clarry 13y ago
    > On the other hand there is no evidence of open-source projects going out of their way to accommodate intelligence agencies in the same way Microsoft has. http://blogs.iss.net/archive/papers/ShmooCon2011-USB_Autorun_attacks_against_Linux.pdf http://blogs.iss.net/archive/papers/ShmooCon2011-USB_Autorun...
JabavuAdams 13y ago
I don't think this matters against the NSA. An adversary either has the resources to exploit some target, or not. If the NSA has a lot of exploits to choose from for each of Linux, Mac, and Windows then it doesn't matter which one you're using. Think of this in Bayesian terms. You have some prior beliefs that MS W software is less secure than other software. What we've gotten as a result of all these leaks is new likelihoods, so we have to modify our posterior. I.e. A is more secure than B doesn't matter if both A and B are easily exploitable by your adversary.

This article misses the most important security tip: do not use any proprietary software, especially the ones starting with "W" made by MS.

by kbart 13y ago

This article misses the most important security tip: do not use any proprietary software, especially the ones starting with "W" made by MS.

skrebbel 13y ago

Are you sure? How much more difficult would it be for an intelligence agency to get an open source hacker to "accidentally" inject a vulnerability disguised as a bug, than to pressure MS to write a backdoor? (or to get MS to hire a mole)

kbart 13y ago
Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophisticated and hidden than the one buried in the precompiled binary. Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet, contrary to the countless examples of products by big names. Not saying that open source is 100% secure, but it's still much safer than proprietary programs. [EDIT] Thanks for pointing out Debian SSL example, I wasn't aware of that. But it still doesn't deny the key point I mentioned - that there are more discovered backdoors and vulnerabilities in proprietary software than the open one.
- claudius 13y ago
  > Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet. One could argue that the Debian SSL issue[0] would qualify as such a backdoor/vulnerability, although I don’t want to argue that it was introduced maliciously, merely that it could have been introduce with such intentions. [0] http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571
- DanBC 13y ago
  All those people reviewing the code took two years to discover the Debian SSL bug. https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... https://wiki.debian.org/SSLkeys https://wiki.debian.org/SSLkeys
  - sneak 13y ago
    Now how long would that have taken WITHOUT source code? Would we _ever_ have known (without keyfiles on disk to analyze)?
antocv 13y ago
You dont have to trust GNU/Linux, in fact you should distrust it as well, but it is safer and better than Windows according to record so far, since you have many more independent security solutions and can customize it to your liking, and we have seen Stuxnet, NSA_KEY etc... You can modify the kernel so much as to make any existing 0days unpractical for your particular installation. You cant do that with windows kernel. For linux, you can remove all the drivers not really needed for your particular computer, and prevent modules from being used. If you're really paranoid you must go with ArchHurd or HaikuOS, those extremely small OS not many have heard about yet NSA to have devoted time for 0daying them or inserting backdoors. But definitely not go back to Windows.
- hyperpape 13y ago
  Almost all of that goes out the window for targeted attacks. For general safety, you just need to be a little bit better than the average computer user--the money is in simple reliable attacks that hit broad swaths of the public. But for targeted attacks you need to have near perfect security. Edit: You're probably still gaining by leaving the beaten path, but if you're exposed, and someone knows what you're running and has the resources to create custom exploits, that won't help much.
eliteraspberrie 13y ago
The premise that a large, US-based software company needs pressure from intelligence agencies to write a backdoor in their product isn't historically accurate. For example, Microsoft developers invented the idea of USB AutoRun -- that an executable on a USB drive is executed automatically when the drive is plugged in -- without any kind of pressure. That feature is responsible for the Buckshot Yankee attack,[1] early Stuxnet,[2] and of course COFEE.[3] COFEE in particular was certainly not a bug or written by a single mole. On the other hand there is no evidence of open-source projects going out of their way to accommodate intelligence agencies in the same way Microsoft has. Without this active collaboration from developers, it is far more difficult to backdoor software. [1] http://www.washingtonpost.com/wp-dyn/content/article/2010/08/24/AR2010082406495.html http://www.washingtonpost.com/wp-dyn/content/article/2010/08... [2] http://www.symantec.com/connect/blogs/stuxnet-lnk-file-vulnerability http://www.symantec.com/connect/blogs/stuxnet-lnk-file-vulne... [3] https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_Forensics_Evidence_Extractor)_tool_and_documentation,_Sep_2009 https://wikileaks.org/wiki/Microsoft_COFEE_(Computer_Online_...
- clarry 13y ago
  > On the other hand there is no evidence of open-source projects going out of their way to accommodate intelligence agencies in the same way Microsoft has. http://blogs.iss.net/archive/papers/ShmooCon2011-USB_Autorun_attacks_against_Linux.pdf http://blogs.iss.net/archive/papers/ShmooCon2011-USB_Autorun...

JabavuAdams 13y ago

I don't think this matters against the NSA. An adversary either has the resources to exploit some target, or not. If the NSA has a lot of exploits to choose from for each of Linux, Mac, and Windows then it doesn't matter which one you're using. Think of this in Bayesian terms. You have some prior beliefs that MS W software is less secure than other software. What we've gotten as a result of all these leaks is new likelihoods, so we have to modify our posterior. I.e. A is more secure than B doesn't matter if both A and B are easily exploitable by your adversary.