Hacker News Reader

Comment by hackuser | Hacker News Reader

Is the government or anyone else trying to develop secure systems? I don't mean stock technology (Intel/Arm + Windows/*nix/etc.) retrofitted or 'locked down', I mean new tech built from the ground up for high security.

Given the exceptionally high value to foreign governents (and other actors) of breaking into US government computers, the latter approach seems like the only potential option. The stock tech just can't be secured effectively enough, IMHO.

----

EDIT: Answering my own question to a degree, here are presentations on High-Assurance Cyber Military Systems (HACMS), which apparently utilize seL4:

http://www.cyber.umd.edu/sites/default/files/documents/sympo...

https://www.youtube.com/watch?v=YqRdbgRPYw8

View on HN

Yes.

One project is SeL4, which is a provably correct microkernel. I listened to a talk by one of the developers and it sounded like they were getting funding from DARPA.

https://sel4.systems/About/seL4/

I also remember reading on Wikipedia about some proprietary closed-source OS that's used by the US government to work with very highly classified information. Apparently the requirement was that the kernel and every program be formally verified, so it had very limited features. IIRC, it still maintained, but newer versions support a Linux environment for less classified work.

Unfortunately, I don't remember what it was called so I can't link to the page.

edit: found it:

https://en.wikipedia.org/wiki/XTS-400

https://en.wikipedia.org/wiki/Trusted_Computer_System_Evalua...

> Examples of A1-class systems are Honeywell's SCOMP, Aesec's GEMSOS, and Boeing's SNS Server.

You mean like the kind of highly classified information that Hillary Clinton kept on her home server? :) was she running a probably secure microkernel?

Not a provably secure microkernel, nor even a probably secure one. Nor, probably, even a microkernel at all.

Might have run on a Windows NT variant. That was sort-of supposed to be a microkernel.

The problem is that at a certain level of government, you will have administrators who aren't technical experts and who have no interest in deferring to the opinions of technical experts.

Such folks just don't want to bother with the limitations that a secure system implies, even if such a system became much more featureful than the present ones. They want their Windows/Mac and probably want it for their work-groups.

It's not just a lack of technical know-how but a variety of psychological tendencies that stands against this. It's taken a long time for companies to develop UIs that people want to use but the existence of these "easy to UIs" is a barrier to any UI which requires even a small amount of training to use.

So? Hiring a UI expert to do a trivial amount of user testing is basically all that's required. You don't need to turn something into Windows to make it usable. As long as the basic activities are relatively painless, people have zero problem using an archaic system.

Order a report and make a revision. Repeat a couple times if you have to.

Fine. Then those people don't get access to secure systems or information that needs to be secured. Just don't let them have any kind of job that means they need to work with information that should be secure. Let them have their Windows/Mac machine, and let them work on writing Word docs and Powerpoint about stuff that nobody cares about.

Unforunately that's not how government (or any large institution) works. That person has enough political capital to hold onto that job, or probably they wouldn't have obtained the job in the first place. Try firing or moving them and you might find that someone powerful, whose good will you need in order to get important things done, will be unhappy with you.

Just don't let them have any kind of job that means they need to work with information that should be secure.

No, you don't understand that "those people" are in charge of the American state already. This is what the ruling elite looks like, not geeks or technical experts - lawyers, business school grads and ideologues generally. No one else is going to tell them they don't get access ... because they are in charge.

Hillary Clinton's email server and Sarah Palin's hotmail account were both symptoms of this.

Always good to see someone familiar with them. Unfortunately, NSA is transitioning to some new program that allows rapid certification of COTS security products at what looks like EAL1 and in IIRC about 90 days. Great for time to market and COTS acquisition but bad for security.

Fortunately, DARPA, NSF, and other organizations are funding a lot of good work. Here's a few:

http://www.crash-safe.org/

https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

http://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ (See hardware papers like Hardbound and Watchdog)

http://safecode.cs.illinois.edu/sva.html

http://scholar.lib.vt.edu/theses/available/etd-10112006-2048...

Much of Galois Inc's work is government funded. That includes CRYPTOL language, Ivory language, Xen work, Haskell work, and so on. NSA partly funded demo's from Praxis (now Altran) on their Correct by Construction process with Z specs and SPARK Ada code. They built SPARK, too.

So, lots of stuff going on that is already practical. There's even more that are academic prototypes or exist in simulation. Leaving them off for now.

Secure systems are much more than just a verified kernel or userland.

None of that matters if you are using it in a modern processor full of backdoors and malicious technologies like AMT/IME/PSP.

If you read the headlines enough, you'll notice the U.S. govt is doing the exact opposite of developing secure systems by forcing corporations to weaken their security.

I think the commenter was generally referring to developing secure systems for themselves.

The NSA 'owns' at least one semiconductor fab[1] in Texas, and used to (or still does) own another secure CMOS facility in Santa Clara [2]. Add in several facilities owned by defense contractors as well as the facilities at places such as Lincoln Lab. When you have the ability to develop and build your own secure technology, it would seem perfectly 'logical' to force others to use lesser, less secure hardware.

[1] http://www.chron.com/news/houston-texas/houston/article/NSA-...

[2] http://www.militaryaerospace.com/articles/print/volume-9/iss...

End of [1]: "The NSA issued a statement acknowledging that an antenna it was using interfered with garage door openers."

I didn't know antennaes could interfere with transmission.?

I would imagine it was what was coming out of the antenna...

Just another one of those fantastic science/technology/journalistic chain phone calls that result in nonsense being communicated to the public.

Yes. Sandia and others have certified fabs for developing classified stuff. The NSA has their own developments called Government Off The Shelf (GOTS) tools. They also contract out developments from defense contractors through certifications like their Type 1 process. They keep the best stuff for themselves and defense contractors.

Here's an interesting example I copied in a design at one point:

https://www.nsa.gov/ia/programs/inline_media_encryptor/index...

Compare that to the average tool for disk encryption. I bet the commercial one leaves off some requirements or countermeasures. ;)

They do both. One is worrying, the other is reassuring; clickbait rules dictate the former gets the headline.

You'd have to go REALLY back to basics... a lot of chipsets have backdoors themselves.. some of which the FBI ironically pushed for. So no matter how securely you make your own OS if you don't also make your own hardware it's all for naught.

Also if the government started making its own computers then private suppliers would raise a fuss about "big government" and hurting private enterprise. Also can you imagine the shitstorm ensuing from: "Government insists every tech company bakes in backdoors. Government then has to create its own computers because consumer models are too insecure."

> if the government started making its own computers then private suppliers would raise a fuss

I imagine they'd be designed and built by Boeing or Raytheon or some other major military contractor, just like all the other specialized government equipment.

The NSA has their own fab at Ft. Meade [1] and pays IBM to run one in Vermont [2].

[1] http://www.militaryaerospace.com/articles/print/volume-9/iss...

[2] http://www.manufacturingnews.com/news/04/0203/art1.html

and used to have one in CA[1] and owns one in texas as well[2]

[1] http://www.chron.com/news/houston-texas/houston/article/NSA-....

[2] http://www.militaryaerospace.com/articles/print/volume-9/iss....

Pretty sure the Vermont IBM facility is closed. Most of the surviving workers are at Global Foundries.

They probably have a program that swaps their silicon for others as it's in transit from wholesale, probably called something like FRIEDPOTATOS probably in cooperation with DIGIKEY… jokingly of course.

Somewhere in the depths of my brain I recall IBM developing a "secure" architecture from hardware up a long time ago, but the project was killed for some reason. Pretty sure HN user nickpsecurity originally posted about it.

Are you thinking of https://news.ycombinator.com/item?id=10823434

The famed IBM "Future Systems" project (to replace the S/360-descended mainframe architecture) was a failure, but it survived by evolving into System/38, then AS/400, later renamed to i5/OS and now IBM i. Hardware-based capability security was part of the architecture.

Who else? :) It was this one:

https://domino.research.ibm.com/library/cyberdig.nsf/papers/...

One of the founders and best performers of INFOSEC, Paul Karger, was on that project. Later did their smartcard OS, Caernarvon, for an anticipated EAL7 evaluation. In the past, he did MULTICS security evaluation and VAX VMM Security kernel among other things.

Far as HWMAC, they sort of just dropped it on us in 2011 and I haven't heard about it since. (shrugs) Meanwhile, Cambridge already has FreeBSD running on the CHERI processor with code available and a less-aggressive, legal team. :)

There exists a series of OS'es in use in DoD/Darpa/etc that are designed from the ground up for high security, but almost all of them are closed source/proprietary, which really frustrates me. QubesOS is promising, but has many issues to work through, and minix3 is interesting, but I'm not aware of any new FOSS secure OS movements.

The NSA actually has a lot of useful PDFs related to hardening existing OS's up on its site that you can find through Google:

Search: site:nsa.gov filetype:pdf hardening

(works in DuckDuckGo as well)

The search will probably get you noticed, but I remember spending like 2 days in highschool just scraping and going through every PDF I could find for useful things to know. ~

Reply on news.ycombinator.com