Linux is a national security risk!

[n0cmonkey]

story

Some of my favorite points:

O'Dowd opined, essentially, that foreign developers contributing to the Linux source code pose a national security threat to the U.S. Said O'Dowd, "The open source process violates every principle of security. It welcomes everyone to contribute to Linux. Now that foreign intelligence agencies and terrorists know that Linux is going to control our most advanced defense systems, they can use fake identities to contribute subversive software that will soon be incorporated into our most advanced defense systems."

Because no one reviews patches. Bad bad Torvalds!

O'Dowd went on to criticize Green Hills competitors MontaVista and LynuxWorks for their international cooperation. The Green Hills press release borrows a Jim Ready quote from a LinuxDevices.com interview: "Recently, the CEO of MontaVista Software, the world's leading embedded Linux company, said that his company has 'two and a half offshore development centers. A big one in Moscow and we just opened one in Beijing -- so much for the cold war.'"

I've still got a bunker in the basement!

According to Green Hills, "Advocates of the Linux operating system claim that its security can be assured by the openness of its source code. They argue that the 'many eyes' looking at the Linux source code will quickly find any subversions. Ken Thompson, the original developer of the Unix operating system -- which heavily influenced Linux -- proved otherwise. He installed a back door in the binary code of Unix that automatically added his user name and password to every Unix system. When he revealed the secret 14 years later, Thompson explained, 'The moral is obvious. You can't trust code that you did not create yourself. No amount of source-level verification or scrutiny will protect you from using untrusted code.'"

The DoD should write their own software. Period.

All true innovation comes from the U.S. anyways. I mean, this Win2k machine is more secure than anything else out there! It's too damn slow to get anything done and hackers would pass it up for the Linux machines. If only the NSA knew what they were doing so we could trust Linux.

 

One of those points reminded me of something I received on an email list:

"Unix was used for years with a big 'hole'. Field engineers needed access when working on systems, so they installed engineer as a login with engineer as the password. Anyone could login at root level with access to the kernal IF they knew about it. I only found out about it when a fellow engineer was looking over the shoulder of a field engineer working on a network problem and observed his login. It only became public knowledge when a book was published about the hacking of the Lawrence-Livermore Labs and the author mentioned that little tidbit."

 

[n0cmonkey]

That was back in the day before the code was auditted the way it is now. Backdoors are found, and immediately removed all of the time.

Just look at Cisco, they're starting to remove their backdoors now.

 

[drag]

Isnt' this sort of thing what what NSA's security enhanced linux was about?

The government is free to develope their own versions of the kernel or just concintrate on kernel (random choice) 2.4.18.

That way they can have their own software completely audited in a proper way (goodness knows if anybody can do it the government can).

hell, the GPL doesn't preclude the government making it's own modifications and patches to the code and not openning it, as long as they don't redistribute the software they can do whatever they like to it and keep it completely closed if they feel like it.

It's nice that they choose to release it, and it benifits them, too, in the long run.

How many programmers and such does MS hire? How much code do they pull in from other, smaller, software companies do they depend on for some stuff. Is every one of those guys safe, has every MS employee been screened by the FBI? Plenty of closed source code has nasty little bugs in it. And what about the code that MS released to China as a condition for the government to use Windows software?

How many little tidbits of that code the chinese found and are unbeknown to MS or the government institutions that use Windows software for important and secret work?

Other companies are under the same situation. Are there no such thing as a radical-thinking programmer working for Sun? What about HP or IBM exporting to use talented programmers in other countries for it's software?

To me the safest bet is to at least start off with access to the code. If you can look at it and screen it then at least you have a chance. The only way to be 100% sure of a program is to program it yourself and even then you have the bugs to deal with. If the government is smart enough to choose it's use of applications wisely and restrict it's use of "serious" data to programs that have been screened and are familar then that is the best bet for security, and that generally means carefully selected open source software.

(Not that I have a huge amount of faith in the intellegence of government beuracrates, mind you.)

 

[n0cmonkey]

I'll consider to trust the software I use, even if it did come out of Canada 😛

Of course his point was: Stop using linux, use my software instead! But he can't just come out and say that, well he could and I'd have respect for him if he did 😛

OT: And what does distribute mean? If the government passed it out to all of the different departments, is that distributing? Like if the NSA passed it on to the CIA, do they have to make the src available to download? 😛

 

[drag]

Originally posted by: n0cmonkey
I'll consider to trust the software I use, even if it did come out of Canada 😛

Of course his point was: Stop using linux, use my software instead! But he can't just come out and say that, well he could and I'd have respect for him if he did 😛

OT: And what does distribute mean? If the government passed it out to all of the different departments, is that distributing? Like if the NSA passed it on to the CIA, do they have to make the src available to download? 😛

Ya that's a tough one.

I beleive that in this case it's as long as the government is using it for government business, then it doesn't have to be released. But if it starts giving it to 3rd parties or contractors then the source would have to go too. I understand that much of the business done thru the government is thru contracts with numerous individuals and private companies.

So I figure that interdepartment use will still be in-house. The CIA and NSA are mearly sub-sections of larger government instatutions. Sharing patches between those guys I don't think it would be distributing it, except across artificial beuarocratic boundries.

That's one of things that is a pain about liscencing with Linux and other software. By law there is a element of 'public domain" just because it's software developed by the government. As tax payers we should have access to it, simply because we paid for it, and the government works for us, not the otherway around like it seems sometimes.

So that complicates matters with dealing with closed source software, too. It's weird stuff and I don't even pretend to understand it. (In this case I think that BSD liscence would be a better choice for Nasa to adopt, but that's just how it goes, you know?)

Check out the NASA versions of Linux and the issues they went thru while developing it to be used in space missions and such. Apperently they worked it out and everything seems to be hunky-dory.

Nasa PDF, pretty much a case for OpenSource

Also Nasa's Linux is a attempt at a RTOS that can be used in the operation of the various subsystems needed for space flight. (could you imagine Windows CE incharge of turning your pee into drinking water? *shudder*)

It's called FlightLinux. I think that some weird inter-department bickering almost killed this stuff, but I can't find information about it right now...

Nasa is also responsible for creating the first Linux cluster, the type that is known now as Beowolf clusters. That was back in 1994.

some news about that if you care "I?m testing the cloud simulation and retrievals," says Dr. Jiang. "Without the Linux cluster, it takes about three days to process one day of data; but it takes less than thirty minutes with the clusters." They also recently built a cluster while working with SGI that gets 2.45 trillion operations per second. Oceananic simulations that used to take months, then took days with only part of the cluster dedicated to it.

If you haven't noticed. I like clusters, I think their KEEN.

Also so you don't think BSD gets left out while OS X and Linux has all the fun, here's one that was built using FreeBSD 4.8 and 12 Mini-itx VIA EPIA V8000. Each with a 800mhz low-power proccessor

It's equal to the power of 4 2.4ghz pentium4 machines in a cluster, but with a total power usage of 200 watts and no need for extra airconditioning. Cool stuff.

(I see that I got a bit off topic... oh well.)

 

[n0cmonkey]

NASA uses OpenBSD in interesting places 😉

 

[Sunner]

These clows are popping upp all over the place these days it seems.

And their great hero must the one and only, Rob Enderle.

 

[chsh1ca]

Yeah, I read that story yesterday. Ironically, I was told by a bunch of government people that linux was a joke and that nobody uses it, least of all in the security area.

 

[Megatomic]

Originally posted by: chsh1ca
Yeah, I read that story yesterday. Ironically, I was told by a bunch of government people that linux was a joke and that nobody uses it, least of all in the security area.

I work at a DOE facility (nuclear physics) and we don't use Linux in critical areas. If it's not running on HP-UX it's running on Windows 2000 of some flavor.

We do have some "experimental" linux systems, one is a HPC cluster that is really cool. I don't get to play with it, though. 🙁

 

[n0cmonkey]

As a government contractor, I can say with the utmost certainty that the government... Oh crap! They're here! I wasn't going to say anything!

No, they use Linux all over the place, for a variety of things. 🙂

 

[eigen]

All I want to know is what does the NSA use deep behind the triple fence in order to break encryption schemes....

Personally i think they just have killer perl script..

 

[drag]

Originally posted by: eigen
All I want to know is what does the NSA use deep behind the triple fence in order to break encryption schemes....

Personally i think they just have killer perl script..

I would supsect that it would be a combination of large old-school-style single (think Cray or IBM stuff) image type super computers and a few large Linux clusters. For some stuff bunches of cheap computers in a cluster is better, but still the old-school massive single image supercomputer is still king for other stuff.

 

[n0cmonkey]

I want to see if the DoD modified OpenBSD at all when they installed it 😛

My money is on Alpha clusters for the NSA though.

 

[drag]

Originally posted by: chsh1ca
Yeah, I read that story yesterday. Ironically, I was told by a bunch of government people that linux was a joke and that nobody uses it, least of all in the security area.

That's funny. To types like that sometimes seems like they think that ignorance == power.

 

[n0cmonkey]

Originally posted by: drag

Originally posted by: chsh1ca
Yeah, I read that story yesterday. Ironically, I was told by a bunch of government people that linux was a joke and that nobody uses it, least of all in the security area.

That's funny. To types like that sometimes seems like they think that ignorance == power.

It's old school thought. Walk into a government building, and count the number of people you see under say 50. Thinking IBM, Sun, HP, etc is how it used to be. You want something, you look at the big boys. Free software? Blah.

Atleast, that's one of the reasons I think it is the way it is 😉

 

[drag]

Originally posted by: n0cmonkey

Originally posted by: drag

Originally posted by: chsh1ca
Yeah, I read that story yesterday. Ironically, I was told by a bunch of government people that linux was a joke and that nobody uses it, least of all in the security area.

That's funny. To types like that sometimes seems like they think that ignorance == power.

It's old school thought. Walk into a government building, and count the number of people you see under say 50. Thinking IBM, Sun, HP, etc is how it used to be. You want something, you look at the big boys. Free software? Blah.

Atleast, that's one of the reasons I think it is the way it is 😉

Of course, but if they knew more about the software that the "big boys" used they'd realise that itself came from software that was "free" or at least somewhat free, at least originates from a era were people didn't think in terms of propriatory software and non-disclosure agreements.

Also its nice to point out one of the most infamous creators of highly specialized and propriatory software, IBM, has pretty much dedicated itself to using free software and often recommends people use Linux over their own products on many occasions. HP sells a lot of server hardware to be used for free software and they support it on the server level. And unless Sun begins to depend more and more on free software and openness, too, their days as the leading Unix vendor will slowly become history.

I understand the mentality though. I work with a guy who is at least somewhat a programmer and is a computer operator. He's been doing it for 20 years and doesn't even own or know how to operate a PC. To him computers = IBM, and PC's are just things people play around with.

Sometimes I wonder what he would think if I told him that the CPU I carry around in my laptop is at LEAST twice as powerfull as the one we use in the mainframe(completely different computers and archatectures, I know I know), but there realy isn't any point. He'd just look at me funny.

 

[n0cmonkey]

Originally posted by: drag
Of course, but if they knew more about the software that the "big boys" used they'd realise that itself came from software that was "free" or at least somewhat free, at least originates from a era were people didn't think in terms of propriatory software and non-disclosure agreements.

As people get older it gets tougher for them to accept new ideas. Dinosaurs didn't know it was time for the next level of creatures, major changes had to sweep through and kill them off. Computers move too fast for much of the last generation, and even much of Generation X. This generation coming up now, and the next are really the ones that will shake things up. I'm positive that one of these days I'll look at computers and go "WTF!" Hopefully we'll all be retired before then 😉

Also its nice to point out one of the most infamous creators of highly specialized and propriatory software, IBM, has pretty much dedicated itself to using free software and often recommends people use Linux over their own products on many occasions. HP sells a lot of server hardware to be used for free software and they support it on the server level.

It's interesting. BIM used to be the evil corporation, and now they're just another ally. Alliances change. We haven't seen the last of this. 😉

And unless Sun begins to depend more and more on free software and openness, too, their days as the leading Unix vendor will slowly become history.

Obviously, none of us really know what's going to happen. But I think the recent changes Sun has made (canceled 2 processors, big deal with Microsoft, etc) are helping to put them on a path to redemption. I don't think open source and Linux will save them, but it can give them another avenue to explore. Their money comes from big iron and support contracts for that big iron. I don't think Linux and small to midrange servers is going to make much of a difference.

I understand the mentality though. I work with a guy who is at least somewhat a programmer and is a computer operator. He's been doing it for 20 years and doesn't even own or know how to operate a PC. To him computers = IBM, and PC's are just things people play around with.

Sometimes I wonder what he would think if I told him that the CPU I carry around in my laptop is at LEAST twice as powerfull as the one we use in the mainframe(completely different computers and archatectures, I know I know), but there realy isn't any point. He'd just look at me funny.

Different architectures, and different purposes. The point of mainframes isn't to give anyone another 30fps. 😉

I don't think many people out there realize where their software originated. Unix wouldn't be where it is today if AT&T hadn't originally "opened up" the source to Universities. It also wouldn't be what it is today if Bill Joy hadn't done all of the wonderful work he did at Berkley. All of that being free (to varying degrees) software. Would GNU exist without the inspiration of BSD? Who knows... Anyways, that's off topic a bit. 😛

The point is, a lot of what we (Linux, BSD, Solaris, HP-UX, AIX, etc) users have is based on the free software that came before it. Linux and BSD users probably know this better than the rest. One day we might be the management deciding what gets put in place. Scary thought. Maybe we'll be better at figuring out what the best technology really is. Maybe not. Either way, some snot nosed geek is going to be complaining about what we choose. 😉

 

[Rainsford]

Sorry this is a little off-topic from what is being discussed, but I see a (well, another) big flaw in the whole "Linux is a security risk because anyone can add to it" argument. Wouldn't it be easier for terrorists to plant someone at, say, MS to install a backdoor in Windows? Far more people use it, and I'm 100% positive that more people review Linux source code than Windows source code. But that might just be me 🙂

 

[Jeff7]

Originally posted by: Rainsford
Sorry this is a little off-topic from what is being discussed, but I see a (well, another) big flaw in the whole "Linux is a security risk because anyone can add to it" argument. Wouldn't it be easier for terrorists to plant someone at, say, MS to install a backdoor in Windows? Far more people use it, and I'm 100% positive that more people review Linux source code than Windows source code. But that might just be me 🙂

Yeah, that, and also what I was thinking:
Don't trust the code to a lot of regular programmers - entrust it to a big corporation. Everyone knows that those people, both regular workers, and big bosses, are entirely incorruptible, and excellent upstanding citizens.

 

[JayHu]

Originally posted by: drag
Isnt' this sort of thing what what NSA's security enhanced linux was about?

To me the safest bet is to at least start off with access to the code. If you can look at it and screen it then at least you have a chance. The only way to be 100% sure of a program is to program it yourself and even then you have the bugs to deal with. If the government is smart enough to choose it's use of applications wisely and restrict it's use of "serious" data to programs that have been screened and are familar then that is the best bet for security, and that generally means carefully selected open source software.

(Not that I have a huge amount of faith in the intellegence of government beuracrates, mind you.)

I woudl tend to agree with this too.
Starting off with the source code is a good start, but, even then you can't even trust that.
The only way to be sure that everything is the way it's supposed to be, is to build your own compiler and go from there. Even if you have the source to the compiler, it guarantees nothing. That was something interesting I learned the other day in my operating systems class.

All that being said and relating to the original topic, any operating system is going to have bugs and hacks no matter how many people are working at it. That has to do mostly with the complexity of the OS.

 

[Smilin]

Didn't a read a while ago that someone almost slipped a backdoor into the Linux kernel? It wasn't caught because it raised a security red flag, it was caught because it used an inline declaration that's frowned upon. The guy's article sounds like a bunch of FUD to me (similar to the crap that's always thrown at MS) but people who touch the security portions of MS code do have background checks. People who touch the security portions of Linux code have...a keyboard.

Security aside, if you spend a dollar on a MS product it's very likely that dollar is going to be reintroduced to the US economy. Who knows that dollar might even buy a product from the company you work for thereby paying your salary. If a Chinese company spends a dollar on an MS product (as opposed to buying a pirated copy off the street hehe) it's likely the same thing happens. If you're going to use Linux, at least do Redhat instead of Suse 😛

 

[n0cmonkey]

By law there is a element of 'public domain" just because it's software developed by the government. As tax payers we should have access to it, simply because we paid for it, and the government works for us, not the otherway around like it seems sometimes.

I must have missed this earlier. But I think every piece of code that comes out of government money should be licensed with creative commons or better (less restrictions). After all, I helped pay for it and I hate the GPL 😉

I am sure that Microsoft employees go through background checks, and that there is a review process for code, especially when it comes from new employees.

Isn't Novell an American company? Wouldn't my SuSE dollars go to them? 😛 (slackware baby!) I'll continue doing my best to support Canadian citizens when I buy my software (OpenBSD is based in Canada where the government knows the difference between this and this! 😀

 

[spyordie007]

The government gets the source code to any microsoft application it uses. Granted this doesnt mean that they review everything, but at the level within Government that it occurs I'm willing to be they are pretty thourough:
http://www.microsoft.com/resources/sharedsource/Licensing/GSP.mspx

There are many other organizations that are constantly reviewing the source to microsoft applications and compilers; it would be hard for a developer to put in a "back door" without somebody noticing.

-Erik

 

[kamper]

Originally posted by: spyordie007
The government gets the source code to any microsoft application it uses. Granted this doesnt mean that they review everything, but at the level within Government that it occurs I'm willing to be they are pretty thourough:
http://www.microsoft.com/resources/sharedsource/Licensing/GSP.mspx

There are many other organizations that are constantly reviewing the source to microsoft applications and compilers; it would be hard for a developer to put in a "back door" without somebody noticing.

-Erik

yeah, it's not like anyone has ever put things in microsoft products that weren't supposed to be there (flight simulators in excel ??)

There are enough "back doors" that they put there by accident, purposely hiding something small would be easy