- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
NSA helps 'securing' Windows Vista
|
|
|
Comments (14)
Untrustworthy Computing.
Quoting: So the National Spying Association (oops) spent time with its fingers inside Vista?Gotta make sure those backdoor password keys aren't labeled so obvious somehow, you know. Look at the uproar over the last time they were openly named with "NSA" and "KEY".
And this is supposed to make me feel safer?
They gave us SE Linux last decade.
That was nice.
That was nice.
Ah, but SE Linux was open for all to see. This is closed, and indeed there has been a pattern of leaving fingerprints on dirty little secrets in closed source code.
Many government agencies have been using Linux since the mid nineties.
The National Laboratories, Like Fermi, Sandia, Los Alamos, etc were among the earliest adopters. The varied scientific research at these labs often demanded optimizations and customizations to software that would have been cost or time prohibitive with proprietary software. It would be impossible with off-the-shelf proprietary stuff.
The NSA also uses software extensively. They are also charged with helping to secure the nation's infrastructure, and software is becoming a part of that infrastructure. http://www.nsa.gov/selinux/info/faq.cfm
Fermi Lab took Red Hat and customized their own internal distro. This started being used at labs and universities around the world and grew into Fermi Linux: http://www-oss.fnal.gov/projects/fermilinux/
Fermi Linux led to Scientific Linux: http://www.scientificlinux.org/
The NSA FAQ does not say so, but my guess is that the fact that many of The USA's national labs, and probably many of its defense researchers were using Red Hat and Red Hat based distros, led to an SE Linux that was most compatible with Red Hat, with the least tweaking.
Red Hat was one of the first large distros to incorporate SE Linux in its code. Now many have support (see the Ubuntu link in the post above)
SE Linux is a strange beast, but once you get used to the rules it is nice to have. I remember many hours spent adapting the Bastille hardening scripts for whatever flavor of Linux a client wanted to run in the past.
(I always forget to change the rule on checking the MBR on my multi-boot machines, and usually have a distro or two bark at me when I install something and overwrite the MBR.)
The National Laboratories, Like Fermi, Sandia, Los Alamos, etc were among the earliest adopters. The varied scientific research at these labs often demanded optimizations and customizations to software that would have been cost or time prohibitive with proprietary software. It would be impossible with off-the-shelf proprietary stuff.
The NSA also uses software extensively. They are also charged with helping to secure the nation's infrastructure, and software is becoming a part of that infrastructure. http://www.nsa.gov/selinux/info/faq.cfm
Fermi Lab took Red Hat and customized their own internal distro. This started being used at labs and universities around the world and grew into Fermi Linux: http://www-oss.fnal.gov/projects/fermilinux/
Fermi Linux led to Scientific Linux: http://www.scientificlinux.org/
The NSA FAQ does not say so, but my guess is that the fact that many of The USA's national labs, and probably many of its defense researchers were using Red Hat and Red Hat based distros, led to an SE Linux that was most compatible with Red Hat, with the least tweaking.
Red Hat was one of the first large distros to incorporate SE Linux in its code. Now many have support (see the Ubuntu link in the post above)
SE Linux is a strange beast, but once you get used to the rules it is nice to have. I remember many hours spent adapting the Bastille hardening scripts for whatever flavor of Linux a client wanted to run in the past.
(I always forget to change the rule on checking the MBR on my multi-boot machines, and usually have a distro or two bark at me when I install something and overwrite the MBR.)
We're:
1) Using the NSA's SELinux.
2) Using the NSA's official encryption algorithm (AES).
3) Using the NSA's official hash algorithms (SHA1/2).
The software might be Open Source and reviewable, but what about the hardware that runs it? Imagine this:
The AES algorithm could be chosen specifically because it's easy to detect it running by Intel and AMD in the processor - an invariant signature when compiled. The NSA publishing compilable reference code could further this - they could assume everyone's using the reference code and test what is produced by various compilers to know its signature. So Intel and AMD could capture the key going into an AES routine without you knowing. Now, just have them tack the 256 bit key to the next disk write and have the disk append it in the invisible, untouchable extra storage used to replace bad blocks, and/or have the on-board ethernet report it in some way you'd not be able to really notice (like slightly regulating the time between packets) and presto, you're bugged, even if the software looks 100% clean.
As the author of 'wipe' says, "People should better think of their computing devices as facilities lended by the DHS."
[1] http://security.nnov.ru/docs1116.html
1) Using the NSA's SELinux.
2) Using the NSA's official encryption algorithm (AES).
3) Using the NSA's official hash algorithms (SHA1/2).
The software might be Open Source and reviewable, but what about the hardware that runs it? Imagine this:
The AES algorithm could be chosen specifically because it's easy to detect it running by Intel and AMD in the processor - an invariant signature when compiled. The NSA publishing compilable reference code could further this - they could assume everyone's using the reference code and test what is produced by various compilers to know its signature. So Intel and AMD could capture the key going into an AES routine without you knowing. Now, just have them tack the 256 bit key to the next disk write and have the disk append it in the invisible, untouchable extra storage used to replace bad blocks, and/or have the on-board ethernet report it in some way you'd not be able to really notice (like slightly regulating the time between packets) and presto, you're bugged, even if the software looks 100% clean.
As the author of 'wipe' says, "People should better think of their computing devices as facilities lended by the DHS."
[1] http://security.nnov.ru/docs1116.html
yikes!
This should make 'foreign' governments feel much safer about deploying Vista. NSA would not install backdoors, would they? Not under this administration?
Richard
Richard
Absolutely not! You have my word on that...
Naw. They can read your mail and tap your phone without asking, what do they need with a backdoor into your computer system?
My tax dollars at work. Sigh.
My tax dollars at work. Sigh.
SELinux was also developed jointly with the NSA, so let's not bag on MS too much for copying us. Imitation is the sincerist form of flattery. However, the different between SELinux and Vista is that we can see the source for SE.
> SELinux was also developed jointly with the NSA, so let's not bag on MS too much for copying us.
You're missing something. SELinux is *used* by the NSA. Windows Vista is not. As far as I can find NSA IT policies online (there are a few anonymous comments here and there -- e.g. latest groklaw article) NSA has a strict "no Microsoft" policy. So, it the NSA isn't using it, why is it meddling with it's development? For the benifit of the general public? Riiight.....
You're missing something. SELinux is *used* by the NSA. Windows Vista is not. As far as I can find NSA IT policies online (there are a few anonymous comments here and there -- e.g. latest groklaw article) NSA has a strict "no Microsoft" policy. So, it the NSA isn't using it, why is it meddling with it's development? For the benifit of the general public? Riiight.....
> NSA has a strict "no Microsoft" policy.
I'm not so sure about this, seeing as the explanation of the _NSAKEY thing (the only one that made sense) was that it was for the NSA to sign their own crypto services for their own use without having to submit them to MS. Since nothing has ever turned up publicly signed with that key, it sounds likely.
I'm not so sure about this, seeing as the explanation of the _NSAKEY thing (the only one that made sense) was that it was for the NSA to sign their own crypto services for their own use without having to submit them to MS. Since nothing has ever turned up publicly signed with that key, it sounds likely.
Not a big deal
Iam sure that the NSA makes all Microsoft Windows it uses secure, it must have been forced on them I would believe, knowing the threats directed at the Windows OS. It is work that must be done, its not a threat to linux.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
And this is supposed to make me feel safer?