7 ms·
Remember, Microsoft is part of this plot, even if they have "plausible deniability". Microsoft is giving NSA access to lists of vulnerabilities Windows has many
by higherpurpose 13y ago
Remember, Microsoft is part of this plot, even if they have "plausible deniability". Microsoft is giving NSA access to lists of vulnerabilities Windows has many months before Microsoft even begins to work on a fix. They are in effect helping NSA break into many computers, even if they are up to date.
http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap-data-with-thousands-of-firms.html http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t...
Every single one of these vulnerabilities could be seen as a backdoor, except Microsoft can have plausible deniability, since they are not actually putting a backdoor in the OS themselves - they're "just telling NSA about the vulnerabilities that exist".
If something like CISPA passes, which NSA keeps pushing for, this capability will expand dramatically, as all companies will be forced to give these vulnerabilities to NSA, but not to "protect us" and for cyber "security", as they keep claiming when they try to promote laws like these, but for offense. They will hoard every single one of them, and then use them in such automated systems to infect millions of computers.
- Fuxy 13y agoAnd this is why I'm glad my main OS is linux. Not impossible for NSA to get in but a lot more difficult.
- romanovcode 13y ago> I use Ubuntu, take that NSA! You're cute.
- Fuxy 13y agoClose... It's Arch though.
- computer 13y agoSo the only thing the NSA has to do is hack/convince/rendition/break-into-house a single person who holds a package signing key, and then they can MITM your pacman updater and have you as well. And there's enough people with such a key to choose from: https://www.archlinux.org/master-keys/ https://www.archlinux.org/master-keys/. (I run Arch as well, but I have no such illusions of security.)
- Fuxy 13y agoAs i said not impossible but at least we're not giving the NSA information about vulnerabilities months in advance of us fixing it. Where there's a will there's a way especially if you have billions of dollars in funding and the freedom to do so i just aim to make it as difficult as possible.
- clarry 13y agoIs running Linux all you can do to make it as difficult as possible?
- Fuxy 13y agoNo obviously not. There's a lot of things you can do to protect you privacy but it all starts with a good choice of OS and hardware. If the foundation is compromised there's no point in anything else you do to protect your privacy. Edit: Yes Arch it's not particularly security conscious I choose to compromise some security to stay on the bleeding edge now that could mean that I get some bad code sometimes but that also means that it gets fixed sooner too. Having a rolling release system that you can mold to your needs is worth it for me.
- clarry 13y agoI'm not trying to bash Arch, but it never looked like a particularly security-conscious or focused distro. To me it looked like it's about being cool and bleeding edge and Gentoo with binary packages... and I have a faint recollection of seeing some rather unimpressive packaging, though that was long time ago. So it runs on i686 and amd64 only. How do you select "good" hardware?
- Fuxy 13y agoIn an ideal world it would be open source hardware where you can review anything from the circuit diagram to the firmware. However since there's no such thing you will have to choose who you trust.
- voidlogic 13y agoWhile Linux is probably slightly harder for a sophisticated attacker (and a lot harder for a unsophisticated one), a lot of your protection probably comes from the fact that they spend most of their time targeting the 98% of the desktop software base- that isn't Linux. Of course maybe their server oriented efforts make this moot.
- Fuxy 13y agoThe most vulnerable part of a server is the fact that it's a server. It's a lot easier to attack the website running on the server and escalate from there then attack the OS directly. So the vulnerability would have to be in something that both servers and desktops have in common.
- logn 13y agoI seriously doubt linux presents a challenge for them. Think about all the web servers that are linux, you think they don't have an army of experts that can pwn those OS's?
- Crito 13y ago> Think about all the web servers that are linux None, unless you install them and activate them? What sort of desktop distro comes with pre-configured webservers?
- sentenza 13y agoI think you misunderstood the GP. He means that the internet runs on linux, so the OS is a high-value target. Thus, it is reasonable to assume that the intelligence agencies have collected some as-of-now-unknown-to-the-public vulnerabilities for libraries that are typically used with Linux.
- fc6e65dd360f10 13y agoI don't think it's hard at all for the NSA to hack your Linux install if you were manually targetted. * The NSA probably has a few 0day exploits for typical Linux software ready. Remember that most critical servers use Linux and the NSA would love to get access to them. * Even though you are tech-savvy and install most software from repositories, you probably will run some code which comes from a potentially compromisable source. This includes: Any kind of random "utility script", any installer that downloads data from the Internet, and any download of software from unencrypted HTTP. * If you were savvy enough to protect yourself, they could even get someone to come to your house and install some backdoor to your system. Also, I guess the correlation between the people who take paranoid-level anti-hacking measures and people who they want to surveill is pretty high, so as unlikely as this may sound, I don't believe it's this impossible. My particular take on it: * Assume that everything you do on your regular install, whatever it is, may be compromissed and/or surveilled right now. * If you want to do something anonymously, download TAILS. Check the integrity of the image with PGP and some other, random source. Burn it to a non-modifiable media and watermark it. * If you want to store data securely, use something like TrueCrypt (TAILS includes it, though it's disabled by default). Use whole drive encryption. Do NEVER connect any unencrypted storage media in the same session you mount your volume unless you plan to wipe it immediately later. Do NEVER connect to the Internet in the same session you mount the volume. (If you want to send some of your encrypted volume data to the Internet, make a temporary partition to hold it. Put the data to it while offline, send it, then wipe it). * If your unencrypted partitions have ever contained unencrypted data or you slip, consider them "tainted". You need to wipe them. (NOTE: SDDs and USB thumb drives are hard to securely erase. Either use at least 3 random whole-drive passes, or physically destroy them). Yes, I'm a paranoid.
- bananas 13y agoThis. Very frustrating as I work with a Microsoft-oriented company at the moment. Any mention of this to their architectural team results in nothing short of "mwuhahaha you're talking shit". There is some weird universal trust there that really makes no sense at all. To add insult to injury they don't log, don't have an IDS and don't have a clue stick to hit themselves with. Their funeral!
- tptacek 13y agoAs if having an IDS would make a difference.
- bananas 13y agoYou're right - it wouldn't but at least it'd look like they gave a crap.
- MichaelGG 13y agoMS's program to provide information on upcoming security issues to large customers isn't anything sinister. It's an obvious step to achieve a better overall security by allowing larger users to mitigate damage before a patch is available. You can spin it as a secret NSA-program, but I don't think that's very useful as this program does legitimately help a ton of users. (Not that it really would excuse things, but I'd be very surprised if intelligence agencies don't have people inside companies like Microsoft anyways.)
- bananas 13y agoI disagree. I've worked for a few large European financial orgs over the years and MS will not disclose issues early to them despite begging and piles of money. We're talking 50k+ employees here. However DoD connected companies like Lockheed Martin, Boeing and Raytheon are right in there without an invite. You just get the feeling there's something off when relationships are made like that.
- romanovcode 13y agoProbably because they don't care about any of that. They probably care about releasing products and making clients happy. Also, mwuhahaha you're talking shit.
- tptacek 13y agoNo. None of this is accurate. Microsoft gets information about vulnerabilities from the same sources as everyone else. They outspend every other software vendor by something like 4:1 on outside software security consultants. If they are in a privileged position regarding WinAPI software vulnerabilities at all, it is a marginally privileged position. No security person working at Microsoft would tell you they were confident that outsiders weren't holding severe, exploitable vulnerabilities back. NSA, meanwhile, is as competent at sourcing vulnerabilities as any organization on the planet. They have internal research teams that generate them that are presumably competitive with any private research team, and they apparently purchase vulnerabilities like everyone else --- not from Microsoft, but from research teams that sell vulnerabilities. Microsoft gives pre-release information about vulnerabilities to lots of different organizations; for instance, the IDS and network security vendors get pre-release info to create signatures. This program is, IIRC, over a decade old. NSA is a dual-role organization; it also houses the USG's center for defensive technology expertise. It is the opposite of surprising that NSA would have the same relationship with Microsoft as, say, Symantec would. Finally, CISPA does nothing resembling what you claimed it does. CISPA is opt-in; it cannot be used to force a company to disclose anything. CISPA is about incident data, not vulnerabilities. It is already lawful to share vulnerability information with the government. The gray area in data sharing is non- anonymized incident data, which can be covered by any of 10+ different regulations that make even IP-level metadata risky to share for collaborative defense. CISPA is an extraordinarily short bill; you can simply read it instead of taking my word for it.