• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Linux is a national security risk!

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

Also keep in mind that just because you have the source code it doesn't mean that you would be safe from a backdoor.

You could build in a insecurity into a compiler, for instance. So that every file compiled with a compiler will have a built in flaw that a knowledgable person could exploit.

Also binaries can be modified. Even after you compile a program and start distributing it, it's possible to inject a security flaw into the program after its been compiled. So for instance somebody is distributing programs from a ftp server and that ftp server gets cracked a clever person could replace the binary with his own version or simply get a hex editor and if they know were to look to stick in a flaw, or modify a binary, it wouldn't be trerrificly hard.
 
Originally posted by: kamper
Originally posted by: spyordie007
The government gets the source code to any microsoft application it uses. Granted this doesnt mean that they review everything, but at the level within Government that it occurs I'm willing to be they are pretty thourough:
http://www.microsoft.com/resources/sharedsource/Licensing/GSP.mspx

There are many other organizations that are constantly reviewing the source to microsoft applications and compilers; it would be hard for a developer to put in a "back door" without somebody noticing.

-Erik

yeah, it's not like anyone has ever put things in microsoft products that weren't supposed to be there (flight simulators in excel ??)
rolleye.gif
There are enough "back doors" that they put there by accident, purposely hiding something small would be easy

That's sily. There is a big difference between having easter-eggs and having backdoors.

If a auditor found a easter egg, why should they care or tell anybody?

That doesn't mean it wasn't found or noticed.
 
Also the easter egg mentioned (flight sim. in excel) was on excel 97 which is coming on 8 years old now. The development and review processes nowadays are much more strict.

-Erik
 
Ok, I didn't say the flight simulator was a current problem, just an example. And as for the backdoor/easter-egg comparison: I would think any auditor finding something as out of place as that would report it. The easter egg itself could easily be a cover for a back-door so they'd have to thoroughly inspect it too. Just what I figured, I've never managed a large software project though.
 
Easter eggs also serve a real purpose, too. It's just not a programmer screwing around.


For isntance it's usefull tool in potentially legal disputes.

Say you got program 1 mady by Ima Programmer, and they release it with the code. Now programmer 2, Albert Goring, takes that code and produces a competing program that has better advertising and thus becomes popular.


Now Ima figured out what happened, and takes Albert to court.

The show up with the laywers and all that. Ima proceeds to take out a computer with Albert's program on it.

He hit's ctrl-alt-y, double clicks on preferences and enters the code "tellmepollywhomadeyou@#$?"

Then a weird message scrolls across the top of the program saying: "I was made by Ima, thank you very much".

Ima and Albert settles out of court for damages and now Ima gets a fat percentage of Albert's profits. 😛

Now that's a extreme example, but there realy isn't any reason not to have easter eggs as long as they have no chance to conflict with the normal operation of a program. Most can be just very small.

You could also use them as proof to find out how good a auditor is for example.
 
That's an excellent example, drag. So you're saying that it's fine to put this kind of egg in a program? Because if Albert didn't know about the identification egg he also didn't know that when Ima types "tellmepollywhatsthisuserspassword@#$?" the program spits out the password that was being used to connect to the database with sensitive information in it.
If code must be audited for backdoors it must also be audited for eggs because the line between the two can get real fuzzy.
 
Originally posted by: kamper
That's an excellent example, drag. So you're saying that it's fine to put this kind of egg in a program? Because if Albert didn't know about the identification egg he also didn't know that when Ima types "tellmepollywhatsthisuserspassword@#$?" the program spits out the password that was being used to connect to the database with sensitive information in it.
If code must be audited for backdoors it must also be audited for eggs because the line between the two can get real fuzzy.

Look. It's ok for a programmer to do whatever he wanted to to a program, just as long as it's not aimed at violating your security, or degrade it.

When a programmer makes a program, he does it for himself, his own motivations, his own purpose. You have to trust him (or her, whatever), if you don't then don't use the program. For a person to hide whatever they want in a complex program of their own creation is very very easy. Debugging code, auditing code, especially programs created by strangers under a different orginization is about the most difficult thing you could hope to accomplish in programming.

Even if you go thru code line by line, it isn't enough. It's easy to hide stuff. Even if you get your programs from a large coporate entity it isn't enough, either.

Easter eggs are stupid little things, put their for a veriaty of reasons. It has very little to no bearing on the quality or security of the rest of the program. To say that MS is unsecure because they've had easter eggs is silly, to say a program is more secure because it has no easter eggs is just as silly.
 
Ok, I don't think we're actually disagreeing here. I was also trying to say how easy it is to hide little things by pointing out that big things have been hidden in the past (regardless of what the "things" are).

Crap, now I've gotta reread the whole thread to see we're actually discussing 🙂 So software is only "secure" if you trust each and every developper (and anyone else connected with the product in any way)? Are we arguing for MS or Linux now? Or against both? 😕
 
According to the SuperSites list in Aug 1999 The NSA runs a lot of Cray
machines.

National Security Agency, Fort Meade, Maryland,US
1) Cray T3E-1200 LC1084 1300.8
2) Cray T3E-900 LC1328 1195.2
3) Cray SV1-18/576 576
4) SGI Origin2000/250-864 432
5) Cray T3E-1200 LC284 340.8
6) 3 * Cray T932/321024 174
7) Cray T3E-750 LC220 165
8) Cray T94/SSS-256K 100
... snip
20) 4 * Cray C916/161024 64


taken from this site: Googled
 
cool lowpost. A couple of questions about crays for the people who have no clue about 'real computing' (like me):
-would crays run some sort of unix? developed in house at cray? is this os generally trusted?
-what purposes are they generally used for? I got the impression that they are not highly networked machines and are used more for number crunching than communications (in which case security wouldn't be as big a deal?). I really have no idea though.

and did anybody pick up what the guy in the OP (who was criticizing linux) thought we should use? I don't recall reading that he was advocating windows or anything else in specific.
 
Originally posted by: kamper
cool lowpost. A couple of questions about crays for the people who have no clue about 'real computing' (like me):
-would crays run some sort of unix? developed in house at cray? is this os generally trusted?

Cray uses a Unix version for lots of stuff, they also have linux in their clusters they make. Cray is about HPC.

It's called Unicos, and is probably a system-v descedent like IBM's AIX.
-what purposes are they generally used for? I got the impression that they are not highly networked machines and are used more for number crunching than communications (in which case security wouldn't be as big a deal?). I really have no idea though.

Well you get things like x86 clusters, which are all about massive number crunches.
Then you have old-school mainframe types. Those guys are all about I/O. Massive amounts of information in massive numbers of controllers, controlling large disks in large numbers. Lots of database type stuff. Moving, sorting information. That sort of thing. But they are relatively weak in CPU power (they rely heavily on secondary controllers to control the disk controllers. Like your GPU in your vid card is used for 3-d stuff)

Well supercomputers can do both. Sorting thru massive amounts of data while doing large amounts of number crunching on that data. Also do that with 99.999999 percent reliability. That stuff is kinda weird for us x86 PC stuff. For instance at were I work we have a mainframe with a single mid-range proccessor. It's a "dual core" design, meaning that it has 2 cpu's in one. The extra cpu core isn't for extra power, it's just a backup to make sure that the first cpu doesn't make any mistakes. 😛

So if you think about it that's the sort of thing that they would use.

Security it critical, but they are probably kept mostly isolated. They would probably have a secondary database machine that hooks up to the supercomputer stuff that is used to interact with the users/researchers/whatever. Something that will build the queries to run on the supercomputer and to collect the results.

(Not that I know a whole lot about this sort of stuff, I am just speculating mostly. I wouldn't be suprised if I am completely wrong.)

and did anybody pick up what the guy in the OP (who was criticizing linux) thought we should use? I don't recall reading that he was advocating windows or anything else in specific.

In this specific case he was talking about RTOS. Real time operating systems. They run off of low-power proccessors like the Geode, Xscale or low-end PowerPC proccessors in embedded platforms. They are probably used mostly in weapon systems, in-car computers, and that sort of thing.

This character makes and sells RTOS systems for a living. He doesn't like the fact that people are choosing linux for embedded systems instead of his OSes.

It's not so suprising that people are using Linux, though. Lots of systems are created using 100% custom systems, and are built for specific purposes. Linux, I am guessing, provides a nice code base to work off of.
 
drag, I think his product is called RTOS, but I'm not sure. I know I kept reading it as real time os. 😛

I think a number of embedded "general purpose" cpus are based off of mips32 instruction sets, but I don't know for sure.

lowpost: nice link, but 1999 was a loooong time ago. Before the NSA started releasing Linux patches. (still worth while, just think they've updated a bit)

I want a mainframe. I think I'm the only person I know that's been to IBM's site to price one out...
 
Originally posted by: n0cmonkey
drag, I think his product is called RTOS, but I'm not sure. I know I kept reading it as real time os. 😛

oh.

I think a number of embedded "general purpose" cpus are based off of mips32 instruction sets, but I don't know for sure.

lowpost: nice link, but 1999 was a loooong time ago. Before the NSA started releasing Linux patches. (still worth while, just think they've updated a bit)

I want a mainframe. I think I'm the only person I know that's been to IBM's site to price one out...

Good greif. It isn't the price that expensive, its the monthly service fees. I don't know for sure, but I think the people were I work spend over 5000 dollars a month on just the OS alone, and that doesn't include the OS inside that OS that they run.

Then a mainframe is useless without all the devices to handle the I/O, the disk drives, the tape drives.

And then on top of that you have the terminals, and then the disk controllers themselves which are basicly dedicated low-power computers themselves just for controlling the disk. These sort of things is what makes a mainframe a mainframe.

Then you have to get a airconditioner that is roughly the size of a VW bus, and a powermain from the power company that has wires probably as thick as your arm. The monthly electrical bills would be staggering.

Then of course you have to build a dedicated room that can handle all this with raise floor for all the wires for all that crap.

Hell, I'd bet that the cost of the CPU housing part of the mainframe would be a fraction of all that would cost to set the entire thing up...

But then again, that may be the only way one man can manage a mirrored copy of all the porn on the entire internet. 😛

BTW, what qoute did you get?

After all, IBM's VM operating system would be a thing to behold. It would be interesting to see the latest technology that decendences directly from the first modular computer system in history, the S/360 mainframes, and built by the company that is responsible for creating such things as Virtual Memory.


You know, if you realy want to save up your pennies and forgo the next new car, you can get a dual-cpu Power4+ computer for under 8 grand...
 
The name of the OS is integrity. oops 😛

RTOS does stand for real time os, so I guess it's good I kept reading it as that.

I think the price I got quoted was around $2m USD.
 
Googled

NSA's budget is classified, but Jacobs said the agency has budgeted "multiple millions" of dollars just to update its cryptographic systems in 2002 and is seeking to increase funding in its 2003 to 2008 budget plan.

Straight from the NSA

Today, our work takes us to the worlds of knowledge discovery, advanced mathematics, quantum computing, nanotechnology, networking technologies and, of course, computer systems security.

If they've actually got a working quantum computer, then I'll be d4mn3d... I'd sell my left pinky for a chance to work in that R&D dept.
 
No quantum computers. Millions of dollars doesn't realy amount to a whole lot when put in the context of Super computer, mainframes, and the government.

After all a low-end serious Mainframe will probably cost a company around 3-4 million dollars to set up (just guessing), in government terms with their insane wastfulness that would easily be 7-10+ million dollars. So you could imaging a high-end one, or two, or three, or ...
 
Originally posted by: lowpost
Googled

NSA's budget is classified, but Jacobs said the agency has budgeted "multiple millions" of dollars just to update its cryptographic systems in 2002 and is seeking to increase funding in its 2003 to 2008 budget plan.

Straight from the NSA

Today, our work takes us to the worlds of knowledge discovery, advanced mathematics, quantum computing, nanotechnology, networking technologies and, of course, computer systems security.

If they've actually got a working quantum computer, then I'll be d4mn3d... I'd sell my left pinky for a chance to work in that R&D dept.

LoL ... is there a good market for used pinkies?

And yea, "multiple millions of dollars" is pocket change there. The government ... especially the DoD, operates on a whole nother scale. As an Lt in the Air Force I was responsible for overseeing contracts worth "multiple millions of dollars".
 
well... with the GWAT, millions is pocket change too. We are being told that the marine corps alone spends 1 billion a day in iraq.
 
Back
Top