Only use it if you want to send all of your information to FSB (modern KGB). Evgeniy Kasperskiy has friends in government, police and FSB. He also is apologet of state surveillance.
This will be a russian OS, designed to allow russian companies to buy routers, switches, and firewalls that are not made by western companies.
It has to scare the shit out of russia to think that if they did have a war with the west, they would lose their access to the technology needed to run their businesses. This is a first step towards trying to build some type of technological independence from the west.
And they have good reason to be. The US has really shot itself in the foot by intentionally compromising the systems we create. Hopefully we can use this (and similar actions by other countries) to turn that around.
Open-source hardware would be great at counteracting this (and for other reasons), but it's harder than open-source software.
This is actually the crux and to my knowledge is non-existent.
https://lwn.net/Articles/688751/
Some folks trying to do open hardware:
And this is not step forward, but to the side, since they're becoming technically dependent on Chinese now.
Outside of national politics, Russia is most likely to steal the I.P. of say an American user outside of it. Whereas American intelligence and police organizations might lock up that same user for some bullshit. Situation is reversed for a Russian considering U.S. solutions. Some countries or organizations are unlikely to steal your I.P. or attack you. They become better choice than the aggressive ones. Then there's multinational, FOSS projects with strong security focus at the high-end. Gotta build them from carefully-acquired source, though. ;)
https://en.wikipedia.org/wiki/Eugene_Kaspersky#Alleged_affil...
Kaspersky Lab: Based In Russia, Doing Cybersecurity In The West: http://www.npr.org/sections/alltechconsidered/2015/08/10/431...
Russia’s Top Cyber Sleuth Foils US Spies, Helps Kremlin Pals: https://www.wired.com/2012/07/ff_kaspersky/
Global Cyber Security Firm Kaspersky Denies KGB Ties and Helping Russian Intelligence: https://themoscowtimes.com/articles/global-cyber-security-fi...
PS. Perhaps I just missed some publications, so I would welcome any links.
1) there is none 2) they are too good at hiding
Even your anti-virus companies has worked with the govt to allow some govt sponsored malware through.
Would be great if Kaspersky OS will be free and open source.
I've been slightly paranoid after it was revealed that Kryptowire discovered backdoors in some Chinese made smartphones:
http://www.nytimes.com/2016/11/16/us/politics/china-phones-s...
It was not a bug. Rather, Adups intentionally designed the software to help a Chinese phone manufacturer monitor user behavior, according to a document that Adups provided to explain the problem to BLU executives
And extra slow, considering Elbrus performance.
Linux cannot do anything about it.
I get not everything on the system is pure FOSS. But every binary ball isn't NSA spyware. If you assume that is true, you literally cannot use ANY computer.
FOSS OS's make it nothing but a question of work-hours to do the full trust but verify paradigm.
You could go into that rabbit hole. I'd recommend against it... I lost days reading all the docs and playing with this
To get access to POWER8/9 literature you sign away your rights to OPEN-POWER. Also if you make anything for POWER8/9, under a public license (what license you can/can't use are dictated by the license agreement), using docs obtained from an OPEN-POWER member company if that member company upon leaving the OPEN-POWER may claim ownership of your code.
They'll really only let you use 3 Clause BSD or Apache2. Linux has the only exception for GPLv2, and GPLv3 is banned, using it on a project can have your membership to OPEN-POWER revoked, and your code ownership transferred to IBM. If they decide to purpose it.
OPEN-POWER isn't open. The docs are free and if you write anything too useful a high paying member can seize your software. The only protection from this, is to buy in as a high level enterprise member. OPEN-POWER is down right predatory for research free-tier membership.
The point is - it's about the only way to do a real actual code audit on what your processor is doing.
There's been many options but basically little individual, non-profit, or corporate work to make them happen. (shrugs)
I think it's easier to do deep packet inspection if you're that concerned, honestly.
Especially if it's intermittent or simply passive. Then you could have an embedded issue for years and never know (I've long suspected that this could eventually be a problem for Defense companies)
Mobile phones are an amazing platform to do... well, almost anything. There are some areas where their possession is restricted, though I suspect a motivated party could sneak a stripped down mobile device into nearly anywhere.
Keyboards, on the other hand. Wow. I've seen even airgapped systems have random keyboards right off the pallet slapped onto them. These sit in racks for months or years, then get tossed usually to a recycler, a donation program, stolen, or just thrown into a dumpster. Considering how much tech is in a keyboard, and how much volume it has, you could place nearly anything in there and possibly go ages without catching on.
A scenario that I recently pointed out as a 'thought exercise' was a refitted USB keyboard with a microphone, pinhole camera, and simple keylogger+screenshot engine that contained an intermittent RF/wifi/bluetooth/ultrasonic network. Programmed to dump its payload whenever an individual passed nearby and triggered it remotely.
Such a trojan could sit in a datacenter or conference room for years completely unnoticed. The data it captured transmitted only to the cleaning crew or whatever.
Worse yet, such a device could also pass instructions to the system it was attached to as an actual USB device.
You could fit a lot of horsepower in an innocuous Dell or MS or whatever mass-produced keyboard. Toss it into a top level conference room for corporate espionage, toss it into a data center for more direct trouble, whatever.
Scary thought, and I think part of why I still use the same keyboard I've had since 1997 ;)
You're thinking on the right lines. I've thought of weaponizing them, too. Main reason most don't is someone might look inside one. Even if it's not the target, finding something obvious could make the news with result that attack no longer works. That's why NSA weaponizes the USB connectors themselves. I do think there's room for doing what NSA is doing in a mobile-style SoC that replaces main MCU of the keyboard with same labeling. People would be none the wiser unless carefully measuring electrical properties.
" and I think part of why I still use the same keyboard I've had since 1997 ;)"
Haha. I keep updating but I stopped trusting the computers a while back. Far as subversion, most PC-level subversions seem to have started close to 2000 with NSA's programs kicking in around 2004. So, I recommend people use pre-2004 or pre-2000 tech. Plenty of usable stuff in that category.
https://news.ycombinator.com/item?id=10468624
It's a hard problem. That's why DARPA is throwing tons of money and brains at it right now. Also why a number of defense contractors maintain their own fabs and packaging plants despite the technology aging.
End of freaking story. If you don't, and/or you can't throw a fab plant at it, your options are limited. You can read all the docs on the open CPU stuff (as far as that goes), you can literally do everything from scratch, but unless you're a Nation State or a massive company, you're pretty much wasting your time.
/edit: I don't mean this as a criticism of your writeup (where you basically state the same thing), or even some of your other comments (where you state much the same thing). It's literally an issue where there are VERY few people in the entire world capable of doing cutting edge processor design, coding, and implementation. They cost phenomenal amounts of money, and even with the money, people, and the best of intentions - a motivated nation state actor can muck things up.
The only real defense we have, as regular people, is to basically see if anything we own is misbehaving. Even that is a specialized skill set and time investment beyond what most folks are interested in committing.
Equals you trust blindly or don't trust at all. There's a whole range of verifiability between those two. It's worth exploring.
"but unless you're a Nation State or a massive company, you're pretty much wasting your time."
There's smaller firms on buying and supply side of the equation benefiting from simpler, easier-to-inspect stuff. Especially for energy or cost savings. Examples include Moore's Forth processors, Java CPU's, Plasma MIPS (FOSS), 16-bitters in smartcards, etc. Those on 0.35 micron or up can have random samples inspected by eye with microscopes if user wants to go extra mile. Alternatively, they at least have black boxes they can analyze or test for conformance to white-box designs they're supposed to be. Or more easily monitor at analog or digital levels for inconsistencies w/ power shut off during such an event.
Much more to this topic than you're suggesting.
I'm happy to hear that there are some smaller fabs and things that are easier to inspect, but I think that the commodity level of most hardware still makes it super unlikely.
If a company is willing to use Office 365 (which I can neither confirm nor deny some very large shops might use, but wouldn't be out of the usual), you cannot seriously expect them to pay proper attention to what their processors are doing.
I would hope that if someone worked in high-clearance, there would be MANY such measures in place. The ease with which a fully loaded laptop can walk out of Los Alamos wouldn't really lend credence to them patching the biggest hole... the people.
You are my favorite form of security guy - the insanely suspicious sort who is always looking for the weakest point. But when it comes right down to it, there's billions of weak points at much higher levels and much more easily compromised than a chipset or compiler. It's a good academic exercise though.
Oh I'm with you on this. Steve Walker's Computer Security Initiative and the Orange Book gave us lots of highly-secure stuff for defense, etc. They got rid of that for cheap, fast, fully-featured COTS. The same happens in business, aerospace, etc. The exceptions are usually pre-made appliances or, in aerospace, better components in the DO-178B Level A stuff. Much of it is shoddy. A good chunk of the defense fabs' business is probably replacing legacy parts in old equipment at prices guaranteed through corrupt contracts. They don't give a shit about security in general: just money. ;)
"But when it comes right down to it, there's billions of weak points at much higher levels and much more easily compromised than a chipset or compiler."
There's lots of weak points. Stopping code injection from all known vectors with simple, proven techniques at CPU and language levels eliminates the whole malware problem if apps are whitelisted, built from source, and include no executable scripting/JIT. There's ways to conveniently enforce POLA within a system (eg CapDesk), do secure (even automated) configurations of networks (Boeing's Survivability Grammers), and so on. There's components for most use-cases just waiting to be productized, integrated and sold to larger audience. Given this is 90+% of attacks, it's certainly worth pushing to establish a stronger baseline for companies that want less loss of secrets, availability, data, etc.
There's only so much the traditional methods like coaching and monitoring can do if one can simply open a folder (not a file!) that immediately results in full-control of machine by malware since a thumbnail rendered. Endless crap like that exploiting underlying foundation of quicksand. The HW and SW of endpoints, at least at lowest layers, need to get in check for that other stuff to be meaningful. I'm also in favor of an integrated networking stack that makes different applications, even if using TCP or HTTP, look visibly different at the packet level so NIDS spots weird patterns more easily. Like the MLS extension but not MLS policy itself. Do it at application layers with stuff like Ethos's eTypes or security-enhanced ZeroMQ where developers don't worry about plumbing much.
" It's a good academic exercise though."
It's also an industry bringing in tens of millions of dollars at least. That's with costs that are too high, lack of key software support, and little to no advertising. I imagine it could be larger than tens of millions with such obstacles reduced or eliminated.
If it could be done with proper 'design by contract', inspections, and at a cost that folks could swallow, you might have a new Apple 2 on your hands. Not in the corporate world, at least not immediately (where tomorrow's profits outweigh next-week's), but among security cautious folks and researchers.
I'd love to see if a laptop, for example, could be built to that standard. And if built, if it could actually accomplish real (not hobbyist) work. BlacktOPS or something catchy :)
You can use one, but you can expect it's exploited. It might not be a happy fact, but we shouldn't deny it if it's true.
The NSA by itself has 40,000 employees, tens of billions in budget, the best tools and tech in the world, and a track record of doing such things. I expect that if they see a valuable vulnerability, they will develop an exploit.
Answer isn't optimistic...
Priorities. :|
Even disregarding vulnerabilities, these OSes are not secured by design. Keeping your OS secured is a strong trade-off with convenience.
Although I guess that if you use OpenBSD, that's a strong signal that you want to go the extra mile in the direction of security.
I use it for my router, but my desktop is Linux (Steam. It's because of Steam. I'll be totally honest :D )
There are quite a few open source operating systems that you can personally verify that they protect your information appropriately.
That's basically what I was always telling myself in the back of my mind during the latest US election, every time I heard that the Wikileaks DNC email leaks were originating from Russia :D
I know for sure that my apple and my linux boxes aren't making any network connections that I don't understand.
It's turtles all the way down.
I'm being a little sarcastic, as obviously, they aren't watching everyone all of the time, really, and most devices' backdoors, for those that have them, are unused. I'm fine with all of it, for the most part. Yeah, I'm not perfect, and I don't want all my info made public or sold, but we give up much, much more just by everything being online. Our banks, investments, to some extent our medical history, geneology, likes/dislikes, actions, schedule... it's all there. Each of us could be simulated with all of the info they have at this point, but they can't fully- yet. Now they just have to keep and mine all the data- which they do, but it's selective; it'll be a lot less selective about what is analyzed as time goes on. Then one or more AI's will decide what will happen to all that information, and us, if we don't all kill our planet or each other before then.
Best thing to do? Use the hell out of Kaspersky OS. Use Red Flag Linux. Just take all of your banking info and give it to the Nigerian whose been asking for it. If we all just gave up on security, what would humanity do with all of that trust? Ok, maybe not such a good idea... maybe paranoia can help you be a little more secure, for now. However, if it's open source and you build it yourself- then at least you could look at it, if you wanted, and had time.
Isn't it, though? Apple seems to be the only company that has stood up to the three letter agencies. (I'm a US citizen.)
No, it's not the same. Despite its flaws, the United States government is not at all the same as Russia's.
You sure about that?
https://wikispooks.com/wiki/US/Efforts_to_Suppress_Democracy...