4 ms·

After all these years of free software proponents advocating for open source BIOSes and getting mocked for their supposed impracticality, we see the truth.

danielweber 13y ago
Why? From the article, they seem to have broken into equipment the same way that "security researchers" would do. They just keep the information for themselves instead of selling it to the vendor, a security company, or the black market. Any pen-testing company has a big list of tools that it keeps internally for breaking into things. Did anyone think that the NSA wouldn't have as big a list of its own?
- w1ntermute 13y ago
  The NSA has a lot more resources than independent security researchers, and it takes a lot more resources to find vulnerabilities when the software is closed source. If it had been open source, those vulnerabilities would have been much more likely to have been found by independent security researchers as well, and then patched.
  - danielweber 13y ago
    Assuming that the "independent security researchers" were being paid to do it by someone with wholly good intentions, sure. But lots of open-source software have giant vulnerabilities sitting around for years because no one skilled in the art has done the drudge work of going through the code looking for bugs. High-status projects like OpenSSL or qmail will always have a sufficiently large community of researchers constantly combing over them, but the assumption of "well, it's open-source, so someone must have looked through it for security holes" self-fails because everyone assumes someone else did the hard work and often no one does. And if "people looking through the code for exploits" is the measure of a secure code-base, then Windows is the most secure platform ever. Vast numbers of very very qualified (read: expensive) people have looked through that source code specifically to find security holes.
    - fit2rule 13y ago
      What exactly is your argument? That closed-source is more secure than open-source, because there are no 'guarantees' that the open-source project gets the security audit it needs? Hogwash. There is no guarantee that just because something is closed-source, its going to be 'safer' or necessarily 'more secure'. Billion-dollar security industries have risen because Microsoft won't/can't fix its bugs.
      - danielweber 13y ago
        You might wish I had said that closed-source was more secure than open-source, but I didn't say that. However, I am pointing out that the argument of "open-source is more secure because lots of security researchers worked hard to find all the bugs" necessarily leads to the conclusion that Windows is the most secure thing ever. Armies of people have looked at that, both internally and externally. I also said nothing whatsoever about "guarantees." But the idea that the very expensive labor needed to look through a code-base for vulnerabilities somehow shows up for free merely because a project is open-source is deeply flawed.
        fit2rule 13y ago
        First of all, Windows is not the most secure thing ever, by far. Second of all, far more eyeballs have looked at the Linux Kernel than the Windows kernel. Far, far more. A factor of 100x more, I would imagine.
        deleted 13y ago
        [deleted]
        danielweber 13y ago
        I did not claim that Windows was the most secure thing ever. I was just giving the logical result of "the most audited code is the most secure code." Yes, lots of people have looked at the Linux kernel. Looking at something doesn't make it more secure. In fact, Linus has to spend some of his time dealing with assholes who decide the best way to submit pull requests is by making petitions on change.org to get Linux to change its RNG. If right now a thousand PHP developers decided to look at qmail's source to look for bugs, djb would just think "oh shit, now I have to deal with that today." You need people highly skilled in the art. The most high profile open-source projects can muster that for free, but by definition most open source projects cannot be the most high profile.
  - xarball 13y ago
    I'm sorry but I don't think this argument holds any water. Not once has there ever been a single organization that writes software where the product automatically becomes more secure by virtue of it being 'closed source'. Quite frankly I've seen far more of the opposite. When the software WAS closed source, more often than not we see this being used as an expressway to cut corners! Things like "Nobody will ever do X", or, this is safe because "Who will try that!" And then there's my personal favorite: Where you get a company where all of the programmers are too stuck up in their own world to even realize that their product is completely dangerous and bug-ridden with issues because their code is NEVER scrutinized in the public eye! There's a much bigger reason why code is way better off as open source in the long run: Public Ridicule, Public Oversight, and Community Integration. All of these things stop people from basically writing what boils down to 'speculative garbage'! You'll still get the odd-ball where one guy from the NSA might find one exploit -- but I think that the cost of that issue alone definitely does not outweigh the earlier gains from open sourcing code.
- dlgeek 13y ago
  I think that's true for only a subset of the claimed catalog. The article claims "the catalog even lists the prices for these electronic break-in tools, with costs ranging from free to $250,000". I suspect all of the ones with a cost are with the consent of the manufacturer, as why would there be a charge for an internally developed exploit?
  - dwild 13y ago
    I don't know how to quote on HN but here's what they say in the article. "Some of the equipment available is quite inexpensive. A rigged monitor cable that allows "TAO personnel to see what is displayed on the targeted monitor," for example, is available for just $30. But an "active GSM base station" -- a tool that makes it possible to mimic a mobile phone tower and thus monitor cell phones -- costs a full $40,000. Computer bugging devices disguised as normal USB plugs, capable of sending and receiving data via radio undetected, are available in packs of 50 for over $1 million."
- jlgaddis 13y ago
  And the NSA is {possibly|likely} monitoring the internal communications of those pen testing companies.
Spearchucker 13y ago
That doesn't guarantee that a legit reviewer of an open source BIOS missed a vulnerability that the NSA found.
- nodata 13y ago
  Your point?
- arbus 13y ago
  It atleast opens up the possibility of that happening if it was open source
wmt 13y ago
NSA is not exploiting or pre-backdooring the BIOS, it's just reflashing it with an malicious payload to keep the system infection alive. No amount of open source anything would make them unable to do this.
- sneak 13y ago
  They have to gain access to the machine first to do the reflashing. Closed source systems make this a lot easier. Apple's software update process allows for remote targeting of individual machines by MAC address, for example.
  - mayrund 13y ago
    This is interesting. where is this information taken from?
- tptacek 13y ago
  In fact, the things that would make it difficult to do this are routinely criticized by "open source" partisans as tools for suppressing Linux.
  - ynniv 13y ago
    The only way trusted computing secures your computer is if you install a TPM chip with your own certificate and constantly verify that it is active. If it runs software signed by Microsoft or Apple, it's useless against a state agent.
  - cheald 13y ago
    Presuming, of course, that the TPM wasn't backdoored (or even just had keys held in escrow where the NSA could reach them), which would be more or less impossible to verify.
  - makomk 13y ago
    The things that make it difficult to do this are only obstacles to adversaries that don't have access to Intel's secret keys. If you have those, by design you can both bypass secure boot and reflash the BIOS with whatever code you like, and the very same restrictions that stop normal users from doing those things also make it impossible for them to detect that it's happened. The NSA has an entire well-funded division dedicated to helping enable eavesdropping by retrieving information like those keys. Those security features are genuinely only useful for stopping people from installing Linux and open BIOSes. They can only protect computers from their users, not from the NSA.

danielweber 13y ago

Why? From the article, they seem to have broken into equipment the same way that "security researchers" would do. They just keep the information for themselves instead of selling it to the vendor, a security company, or the black market. Any pen-testing company has a big list of tools that it keeps internally for breaking into things. Did anyone think that the NSA wouldn't have as big a list of its own?

w1ntermute 13y ago
The NSA has a lot more resources than independent security researchers, and it takes a lot more resources to find vulnerabilities when the software is closed source. If it had been open source, those vulnerabilities would have been much more likely to have been found by independent security researchers as well, and then patched.
- danielweber 13y ago
  Assuming that the "independent security researchers" were being paid to do it by someone with wholly good intentions, sure. But lots of open-source software have giant vulnerabilities sitting around for years because no one skilled in the art has done the drudge work of going through the code looking for bugs. High-status projects like OpenSSL or qmail will always have a sufficiently large community of researchers constantly combing over them, but the assumption of "well, it's open-source, so someone must have looked through it for security holes" self-fails because everyone assumes someone else did the hard work and often no one does. And if "people looking through the code for exploits" is the measure of a secure code-base, then Windows is the most secure platform ever. Vast numbers of very very qualified (read: expensive) people have looked through that source code specifically to find security holes.
  - fit2rule 13y ago
    What exactly is your argument? That closed-source is more secure than open-source, because there are no 'guarantees' that the open-source project gets the security audit it needs? Hogwash. There is no guarantee that just because something is closed-source, its going to be 'safer' or necessarily 'more secure'. Billion-dollar security industries have risen because Microsoft won't/can't fix its bugs.
    - danielweber 13y ago
      You might wish I had said that closed-source was more secure than open-source, but I didn't say that. However, I am pointing out that the argument of "open-source is more secure because lots of security researchers worked hard to find all the bugs" necessarily leads to the conclusion that Windows is the most secure thing ever. Armies of people have looked at that, both internally and externally. I also said nothing whatsoever about "guarantees." But the idea that the very expensive labor needed to look through a code-base for vulnerabilities somehow shows up for free merely because a project is open-source is deeply flawed.
      - fit2rule 13y ago
        First of all, Windows is not the most secure thing ever, by far. Second of all, far more eyeballs have looked at the Linux Kernel than the Windows kernel. Far, far more. A factor of 100x more, I would imagine.
        deleted 13y ago
        [deleted]
        danielweber 13y ago
        I did not claim that Windows was the most secure thing ever. I was just giving the logical result of "the most audited code is the most secure code." Yes, lots of people have looked at the Linux kernel. Looking at something doesn't make it more secure. In fact, Linus has to spend some of his time dealing with assholes who decide the best way to submit pull requests is by making petitions on change.org to get Linux to change its RNG. If right now a thousand PHP developers decided to look at qmail's source to look for bugs, djb would just think "oh shit, now I have to deal with that today." You need people highly skilled in the art. The most high profile open-source projects can muster that for free, but by definition most open source projects cannot be the most high profile.
- xarball 13y ago
  I'm sorry but I don't think this argument holds any water. Not once has there ever been a single organization that writes software where the product automatically becomes more secure by virtue of it being 'closed source'. Quite frankly I've seen far more of the opposite. When the software WAS closed source, more often than not we see this being used as an expressway to cut corners! Things like "Nobody will ever do X", or, this is safe because "Who will try that!" And then there's my personal favorite: Where you get a company where all of the programmers are too stuck up in their own world to even realize that their product is completely dangerous and bug-ridden with issues because their code is NEVER scrutinized in the public eye! There's a much bigger reason why code is way better off as open source in the long run: Public Ridicule, Public Oversight, and Community Integration. All of these things stop people from basically writing what boils down to 'speculative garbage'! You'll still get the odd-ball where one guy from the NSA might find one exploit -- but I think that the cost of that issue alone definitely does not outweigh the earlier gains from open sourcing code.
dlgeek 13y ago
I think that's true for only a subset of the claimed catalog. The article claims "the catalog even lists the prices for these electronic break-in tools, with costs ranging from free to $250,000". I suspect all of the ones with a cost are with the consent of the manufacturer, as why would there be a charge for an internally developed exploit?
- dwild 13y ago
  I don't know how to quote on HN but here's what they say in the article. "Some of the equipment available is quite inexpensive. A rigged monitor cable that allows "TAO personnel to see what is displayed on the targeted monitor," for example, is available for just $30. But an "active GSM base station" -- a tool that makes it possible to mimic a mobile phone tower and thus monitor cell phones -- costs a full $40,000. Computer bugging devices disguised as normal USB plugs, capable of sending and receiving data via radio undetected, are available in packs of 50 for over $1 million."
jlgaddis 13y ago
And the NSA is {possibly|likely} monitoring the internal communications of those pen testing companies.

Spearchucker 13y ago

That doesn't guarantee that a legit reviewer of an open source BIOS missed a vulnerability that the NSA found.

nodata 13y ago
Your point?
arbus 13y ago
It atleast opens up the possibility of that happening if it was open source

wmt 13y ago

NSA is not exploiting or pre-backdooring the BIOS, it's just reflashing it with an malicious payload to keep the system infection alive. No amount of open source anything would make them unable to do this.

sneak 13y ago
They have to gain access to the machine first to do the reflashing. Closed source systems make this a lot easier. Apple's software update process allows for remote targeting of individual machines by MAC address, for example.
- mayrund 13y ago
  This is interesting. where is this information taken from?
tptacek 13y ago
In fact, the things that would make it difficult to do this are routinely criticized by "open source" partisans as tools for suppressing Linux.
- ynniv 13y ago
  The only way trusted computing secures your computer is if you install a TPM chip with your own certificate and constantly verify that it is active. If it runs software signed by Microsoft or Apple, it's useless against a state agent.
- cheald 13y ago
  Presuming, of course, that the TPM wasn't backdoored (or even just had keys held in escrow where the NSA could reach them), which would be more or less impossible to verify.
- makomk 13y ago
  The things that make it difficult to do this are only obstacles to adversaries that don't have access to Intel's secret keys. If you have those, by design you can both bypass secure boot and reflash the BIOS with whatever code you like, and the very same restrictions that stop normal users from doing those things also make it impossible for them to detect that it's happened. The NSA has an entire well-funded division dedicated to helping enable eavesdropping by retrieving information like those keys. Those security features are genuinely only useful for stopping people from installing Linux and open BIOSes. They can only protect computers from their users, not from the NSA.