3 ms·

Back when the U.S. Was accusing China of widespread corporate espionage, I wondered why the U.S. didn't have a major effort to harden common OSs. Then Snowden

Back when the U.S. Was accusing China of widespread corporate espionage, I wondered why the U.S. didn't have a major effort to harden common OSs. Then Snowden came out, and we learned the U.S. government is doing the opposite, trying to keep all systems readily exploitable. Surely the defense and intelligence departments already have hardened versions of OSs. As taxpayers, we actually own that software. We should all have access. Where's the EFF on this one?

dguido 12y ago
First, no the NSA does not have some kind of secret, hardened OS. Second, https://en.wikipedia.org/wiki/Security-Enhanced_Linux https://en.wikipedia.org/wiki/Security-Enhanced_Linux Third, https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml https://www.nsa.gov/ia/mitigation_guidance/security_configur...
- ams6110 12y ago
  And yet step one in installing many commercial and open-souce software is: echo 0 > /selinux/enforce
bediger4000 12y ago
The DoD has at least researched hardened OSes in the past: I attended a seminar in 1990 or 1991 where they talked about "hardened Solaris" or maybe hardened SunOS. One of the talks was about how Sun had to rewrite the windowing system to avoid information moving up or down a level inappropriately. Also, if you read Fred Cohen's 1984 paper, "Computer Viruses - Theory and Experiments", in section 5 "Experiments with computer viruses" (http://all.net/books/virus/part5.html http://all.net/books/virus/part5.html), Cohen mentions a "Bell-LaPadula based system implemented on a Univac 1108." No real details are given, but the sentence " The virus demonstrated the ability to cross user boundaries and move from a given security level to a higher security level" appears in the write up. I have to conclude Cohen is talking about some proprietary system. There's also the famed Multics, known to have been used by the NSA on into the 1990s (http://www.multicians.org/site-dockmaster.html http://www.multicians.org/site-dockmaster.html). The only certified multi-level-secure OS or some such. It did run on some odd hardware, though. I conclude that the NSA at least has some weird, "hardened" or otherwise unusual operating systems. They're not widely used, it seems.
- walterbell 12y ago
  Secure system design history: https://www.schneier.com/blog/archives/2014/11/friday_squid_bl_451.html#c6683396 https://www.schneier.com/blog/archives/2014/11/friday_squid_...

dguido 12y ago

First, no the NSA does not have some kind of secret, hardened OS. Second, https://en.wikipedia.org/wiki/Security-Enhanced_Linux https://en.wikipedia.org/wiki/Security-Enhanced_Linux Third, https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml https://www.nsa.gov/ia/mitigation_guidance/security_configur...

ams6110 12y ago
And yet step one in installing many commercial and open-souce software is: echo 0 > /selinux/enforce

bediger4000 12y ago

The DoD has at least researched hardened OSes in the past: I attended a seminar in 1990 or 1991 where they talked about "hardened Solaris" or maybe hardened SunOS. One of the talks was about how Sun had to rewrite the windowing system to avoid information moving up or down a level inappropriately. Also, if you read Fred Cohen's 1984 paper, "Computer Viruses - Theory and Experiments", in section 5 "Experiments with computer viruses" (http://all.net/books/virus/part5.html http://all.net/books/virus/part5.html), Cohen mentions a "Bell-LaPadula based system implemented on a Univac 1108." No real details are given, but the sentence " The virus demonstrated the ability to cross user boundaries and move from a given security level to a higher security level" appears in the write up. I have to conclude Cohen is talking about some proprietary system. There's also the famed Multics, known to have been used by the NSA on into the 1990s (http://www.multicians.org/site-dockmaster.html http://www.multicians.org/site-dockmaster.html). The only certified multi-level-secure OS or some such. It did run on some odd hardware, though. I conclude that the NSA at least has some weird, "hardened" or otherwise unusual operating systems. They're not widely used, it seems.

walterbell 12y ago
Secure system design history: https://www.schneier.com/blog/archives/2014/11/friday_squid_bl_451.html#c6683396 https://www.schneier.com/blog/archives/2014/11/friday_squid_...