Hacker News Reader

Comment by btilly | Hacker News Reader

Anyone who doesn't think that NSA has backdoor access in Linux is a naïve optimist.

All that the NSA needs is a security hole. They can generate them by submitting reasonable code whose misbehavior is hard to spot, like http://www.underhanded-c.org/, or by searching for holes that already exist in the wild. And if you wind up putting a proprietary driver into your computer and they got a hole in the driver, you do even better.

Given the NSA's resources and the rate at which groups like Project Zero find bugs, they certainly have multiple ways in to any system that they want.

View on HN

> reasonable code whose misbehavior is hard to spot,

Have you submitted code to Linux? It's routine that people are told to rewrite something in a more clear way.

I'm not saying that it's impossible, far from it, but it's not like you could just submit something and have it accepted. You'd have to put a lot of work over a long time and be very careful, preferably with one of the more obscure drivers. Then again, enormous patience and budgets are what the three letter agencies are best at.

I don't think people think that NSA doesn't have backdoor access in Linux.

But I think there's a huge difference between the maintainers purposefully implemented a backdoor for the NSA, and the NSA found exploits to gain backdoor.

Given that, what I'm more interested in is why Linus would say no when asked.

He lives in the US currently, right?

That being the case, I can think of a number of reasons to say no.

> reasonable code whose misbehavior is hard to spot

Like this one! https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-...

I wonder if the same is true for OpenBSD systems, given their greater focus on security.

It was alleged that the FBI paid someone to put that kind of backdoor masquerading as a bug into OpenBSD, but no evidence was ever found. OpenBSD being discussed as a possible target by an ex-FBI consultant is enough for me to assume they have something.

This just made me wonder about the engineering culture at the FBI. Do they have standups and roadmaps? What's their relationship with the rest of the FBI? Do they search stackoverflow like the rest of us? Are they in on all the latest programmer memes? Maybe it's just the secrecy but there's something fascinating about all of this.

It is a great OS, they do focus on security. On the other hand they use old compilers for license reasons and threading is not yet on the same level as in FreeBSD or NetBSD.

The kernel itself should hopefully be unaffected by these issues though.

They do update compilers now. Except for some architectures.

    $ cc -v
    OpenBSD clang version 10.0.1 
    Target: amd64-unknown-openbsd6.8
    Thread model: posix
    InstalledDir: /usr/bin

Threading is plenty fast, and the kernel has, like everything, bugs.

I came across some slides once which compared bugs in Linux & BSDs. Overall it found that bugs per lines of code was relatively consistent across projects, but OpenBSD came out ahead since they tend to have less lines of code

But it definitely wasn't zero

Do you also think that Qubes OS (https://qubes-os.org) has an NSA backdoor, too?

I've never heard of Qubes doing significant in-distro kernel hardening, so if they think Linux does Qubes would too.

This is not so simple. Qubes implements security through isolation. Dom0 has not Internet access, so you can only have a backdoor in VMs. Some VMs also have no Internet access, so they're safe. Others are reset every reboot. In addition, all VMs can rely on different Linux distributions (Arch, Debian, Fedora etc.). I think Qubes provides a good defense against such attacks.

Upd:

> I've never heard of Qubes doing significant in-distro kernel hardening

https://github.com/QubesOS/qubes-issues/issues/4233

https://github.com/QubesOS/qubes-issues/issues/2748

https://github.com/QubesOS/qubes-issues/issues/2045

Better defense of course, but reminds me this [0] quote.

[0] https://news.ycombinator.com/item?id=7585031

Qubes OS v4+ does not use typical software virtualization methods. VT-d hardware virtualization it uses was broken only once, and it was done by the Qubes founder: https://en.wikipedia.org/wiki/Blue_Pill_(software)

Why do they need to submit code?

Why not just do the same as for Windows and MacOS back doors they’ve uncovered? https://en.m.wikipedia.org/wiki/Zero-day_(computing)#Vulnera...

Like the Apple double semicolon bug?

Stealthy. That was like using a secret door knock to get root.

Reply on news.ycombinator.com