Slashdot Log In
No Backdoor in Vista
Posted by
Zonk
on Sat Mar 04, 2006 07:41 AM
from the inappropriate-comments-aplenty dept.
from the inappropriate-comments-aplenty dept.
mytrip wrote to mention a C|Net article stating that Vista will not have a security backdoor after all. From the article: "'The suggestion is that we are working with governments to create a back door so that they can always access BitLocker-encrypted data,' Niels Ferguson, a developer and cryptographer at Microsoft, wrote Thursday on a corporate blog. 'Over my dead body,' he wrote in his post titled Back-door nonsense."
Related Stories
[+]
Technology: UK Government Wants a Backdoor Into Windows 598 comments
REBloomfield writes "The BBC is reporting that the British Government is working with Microsoft in order to gain backdoor access to hard drives encrypted by the forthcoming Windows Vista file system. Professor Anderson, professor of security engineering at Cambridge University, urged the Government to contact Microsoft over fears that evidence could be lost by suspects claiming to have forgotten their encryption key."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
is Niels Ferguson.. (Score:5, Funny)
Re:is Niels Ferguson.. (Score:5, Funny)
Parent
Re:is Niels Ferguson.. (Score:5, Funny)
People didn't get it ... he said it would happen ...
We're talking Bush administration here. Talk about painting a target on your back! They'd WANT to get rid of anyone who can point a finger. Disposing of the body is no big deal.
Heck, they don't even have to "terminate with extreme sanction" any more. Just drop a hint to Balmer that he's going to work for google, and let a random chair take him out.
Speaking of which, if google wanted to throw up a few roadblocks, they could "hint/spread rumours/FUD" that a few critical microsoft developers have accepted/will accept/are in secret talks to accept to jump switch, and watch the body count in Redmond rise like the kill score in Alien 2, from the "pre-emptive kills".
Parent
Re:is Niels Ferguson.. (Score:5, Funny)
Parent
Balmer Says... (Score:5, Funny)
He'll give him 'The Chair'... (Score:4, Funny)
Parent
Right. (Score:5, Insightful)
I suspect the NSA, (who I seem to recall left a few stray tags lying around in a previous version of Windows' code), would look at you dead-pan and agree.
-FL
Re:Right. (Score:5, Insightful)
NSA surely is well aware of the way that trust can, unintentionally, propagate. Everybody trusts something; if somebody doesn't want to cooperate, you obtain his unwitting cooperating by coopting something he trusts. Does he personally supervise the building of every release and patch? Certainly not. He trusts the release process to carry out his intentions. Even if the individuals involved are not cooptable, they trust their compilers to generate object code that is perfectly isomorphic to their source code. Those who do not trust compilers trust their debuggers, disassemblers and operating system utilities.
Those who do not trust their operating system utilities, and live-boot from randomly chosen operating systems or remove their hard disks and examine them using a hand coded manchine language program on a custom built computer lacking a bios or operating system to be subverted, still trust the network to transfer their object code to the mastering facility, or their optical disk burning software to burn the image accurately. Or they trust the facility to read that data correctly, and to press it as they intended to the distribution media.
Those who trusted none of this and checked the hard disks by hand coded machine code on a hand wired computer without BIOS or operating system probably deserve assasination, but even so this is hardly necessary, since everyone gets patches over the Internet. A simple black bag job to retrieve the signing keys, and nobody can trust anything anymore.
Parent
Re:Right. (Score:3, Insightful)
What you left out is you need a separate computer that you trust. But how do you know you can trust it?
Until we evolve to be able to read magnetic domains directly off the platter, everything boils down to believing what your software tells you to be so.
Re:Right. (Score:3, Funny)
"REAL programmers use COPY CON PROGRAM.ZIP"
Re:Right. (Score:5, Interesting)
Yes and no.
True, there was a tag in one version of Windows NT 4 that had the name "_NSAKEY". However, it has never been linked to the NSA in any way whatsoever, except by conspiracy theorists.
You might as well claim that USER32.DLL is proof of a conspiracy to turn American back into a British colony (U.S. obviously stands for United States, and E.R. = Elizabeth Regina = the queen of England! OMG BILL GATES HATES AMERICA!)
Here [schneier.com] is Bruce Schneier's take on the matter.
Parent
Details (Score:5, Informative)
Parent
Re:Right. (Score:5, Insightful)
I know Niels, he certainly would not have any difficulty getting another job. He was pretty well known before he went to Microsoft. He was the cryptographer who worked on Two-Fish with Bruce Schneier. Microsoft has been hiring pretty much all the top security talent they can over the past five years.
Cryptography and data security is pretty much a guild craft. If Niels made such a categoric statement and it turned out to be untrue his personal reputation would be severely damaged. Microsoft can't force him to lie for them and since he works in the Netherlands trying to would be most inadvisable.
Parent
Re:Right. (Score:4, Insightful)
Microsoft is large enough and the codebase complicated enough that such a back door could be added without Niels being aware of it.
Why do you think the Netherlands are going to affect Microsoft's behavior? They're convicted criminals in the most powerful nation on Earth. I very much doubt that the Netherlands are going to make them clean up their act. Most of the news I see about European software patents seems to support the idea that MS is operating "business as usual" in Europe.
Parent
What else would he say? (Score:5, Insightful)
I think we would be reading about his dead body if he came out and admitted that there were backdoors being put into Vista.
Re:What else would he say? (Score:3, Informative)
Do you even know what BitLocker is? It's full drive encryption - basically they encrypt all the data on the hard disk using a key in the TPM.
It's not about DRM, and can't be used for DRM.
DRM's about ensuring that you can't INTENTIONALLY give your data to someone else. BitLocker is about ensuring that you can't ACCIDENTALLY give your data to someone else.
On a BitLocker encrypted system, if you can boot the system, you can access your hard disk without any
"Trust me," he said (Score:5, Insightful)
The problem with closed software is that we have to take his word for it.
Re:"Trust me," he said (Score:3, Insightful)
However (Score:3, Interesting)
But then we'd have to take the word of some un1337 student haxer at some institution, who just locked down access to their precious copied jewels because some un1337 student haxer at some instituion proved some M$ guy wrong.
Anyway, aren't there multiple reports of backdoors in PGP from various stages of its life? Of course, since its
Re:However (Score:4, Insightful)
Parent
Skunk team? (Score:3, Interesting)
(emphasis mine)
Re:Credibility (Score:4, Informative)
Here's what he actually wrote:
Parent
Re:You're right! (Score:4, Insightful)
Are you trolling?
Obviously, if you had the necessary skills you could audit the code yourself.
Alternatively you could pay someone to audit it for you; or just wait for someone else to blow the whistle.
The point is that it is much harder to hide malicious code when the source is available.
Parent
Re:You're right! (Score:5, Insightful)
2) You're wrong to state that open source is just about college students and not companies. There are many many companies with an interest in Linux being secure.
3) Why do you assume a company would be trustworthy? Having something to lose makes them vulnerable to government pressure. Look how fast all the search engines caved in to China.
Parent
Re:You're right! (Score:3, Informative)
Or in the case of OSS you can take the word of the hundreds of developers who want to audit the code themselves (and for something this important, there'll be hundreds of them), where it only takes one person to throw a red flag on bugtraq, and suddenly there's thousands if not tens of thousands of them looking over this code.
Also you could, if you had an especially vested interest, hire some developers to look over it. Say, perhaps, seve
Ballmer to his secretary: (Score:5, Funny)
Re:Ballmer to his secretary: (Score:4, Funny)
Parent
Dead Body? (Score:5, Funny)
"Your terms are acceptable" reply the NSA.
AHA! (Score:5, Insightful)
Dear Niels I hate to break it to you but... (Score:5, Interesting)
A quick look at the "Crypto AG" fiasco makes it plain how very much governments want backdoors. "For decades, the US has routinely intercepted and deciphered top secret encrypted messages of 120 countries." Imagine the power some entity would have if it could peek into any Windows system at will - the temptation must be making their toes curl.
Whether or not there is a top-level agreement with top-level spooks it is still unlikely that local lawmen will be allowed to know about it. So what exactly IS Microsoft planning to do when they inevitably get a request to "help" with an encrypted drive?
Damn straight! (Score:5, Funny)
No backdoor in Vista (Score:4, Funny)
Would they admit it? (Score:3, Insightful)
... that he knows of. (Score:5, Insightful)
Aside from the obvious "what about buffer overruns?" questions, aimed at the usually poor competence Microsoft shows in writing code, there's also "what about cryptographic strength?" question -- maybe the NSA already has a simple and fast way to break whatever encryption BitLocker will end up using.
And, of course, there may well be several people working at Microsoft who actually work for the NSA or MI-6 or the FSB. (I'd be astonished if there weren't at least a few such people on the Microsoft payroll.) Those people may well do things as described in Reflections on Trusting Trust [acm.org], without letting their superiors know.
Re:... that he knows of. (Score:4, Interesting)
There's no reason you couldn't be for Microsoft and also be for some other entity too. The deception would pretending to be for Microsoft alone. But if you work for the NSA, and you get a job at Microsoft, you may well write good code, and fix security holes, and otherwise help them succeed even while ensuring NSA access to things secured using Microsoft products. Very few things in life are completely either/or.
If Microsoft caught you and you got sued, the last thing that would happen is the NSA saying a word. I suspect the following, in decreasing order of probability:
In any case, before placing an asset in such a position, the NSA would probably train such a person with the right lies to tell if something goes wrong. If I were going to do something like that, I'd make up a fake history for the person before Microsoft hired him, and if he got caught then the FBI could investigate and tell Microsoft he was actually a spy for the Mossad. It wasn't even his real name or anything! But for sure the NSA would keep their name out of it. There's a reason they're known as the "No Such Agency".
Parent
I love the backdoor in MacOS X - it has its use (Score:5, Informative)
Dw.
Ad *) Or manually
No Backdoor in Vista (Score:5, Funny)
Part of the quote is missing! (Score:4, Funny)
But they left out the rest of his quote.
It will have a lot of security portals though (Score:3, Funny)
How NSA access was built into Windows (Score:3, Interesting)
NSA and secret keys added to windows. [heise.de]
Thanks for the link, truthsearch.
-FL
"Over my dead body" (Score:3, Funny)
Correction (Score:3, Funny)
I mean, why should it be different in Vista than it was 'til now?
The backdoor may be in the hardware (Score:5, Insightful)
IPMI is very powerful. An IPMI session starts with a Presence ping Any machine with IPMI hardware should answer a "presence ping" on UDP port 663. This identifies an IPMI-capable machine, and returns some vendor info. Anyone can send this. This should work even if the machine is "turned off", as long as it has standby power and is on a LAN.
Then, there's a challenge-response authentication sequence. More on this later.
Once you're in, here are some of the things you can do:
There's more. Much more. Basically, you can remotely take over the machine, turn it on, inventory the hardware, load an operating system, boot it up, and talk to it.
IPMI's back channel can do more than this. With some help from the operating system (and yes, it's supported in Windows) you can do more remote administration functions. This is great for administering your data center remotely. But it has darker implications.
Supposedly, most machines are shipped with IPMI mostly turned off, unavailable until a program is run on the machine to load in the keys that enable it. Supposedly.
Thus, all it takes for IPMI to be a "backdoor" is for a set of secret challenge/response keys to be preloaded into the IPMI chip. There's no way to read those keys. Short of taking the chip apart, gate by gate, there's no way to tell if there's a backdoor in there. Or a set of keys might be loaded by the system integrator before shipping the system. You can't tell. So that's where to put a backdoor, where no one can find it.
There's an open source, OpenIPMI [sourceforge.net], for sending IPMI commands on Sourceforge. Send "Presence pings" to the machines you have and see if they answer.
Re:Prove it. (Score:3, Insightful)
Re:Prove it. (Score:4, Insightful)
I'd be willing to bet that even Microsoft would not be willing to go so far as to create intentional "backdoors" in their encryption to facilitate government (Law Enforcement) access. First off I don't think the government (at least those in the UK and the US) have the power to legally force them into doing it, and secondly if they did it voluntarily one would think the public outcry would be deafening and severly damaging to Microsoft (and it seems that "keeping it quiet" would be nearly impossible).
I generally don't trust the government as far as I can throw them, and I don't trust Microsoft much farther than that, but I think the suggestion that they are colluding in something as nefarious as this is a bit in the Tin Foil Hat realm.
Besides how would they "prove" they aren't doing it? release the source? as if
Parent
Re:Prove it. (Score:4, Insightful)
Nice government contract you have there. Shame if anything were to happen to it.
Parent
Main problem still remains,the lack of transpareny (Score:4, Insightful)
Would you stake your business or for that matter, you life (as is the case in some regions of the world) on this assumption? Since there is no transparency in Microsoft products, you simply have to take their word for it.
I thought the golden rule of security was that any viable security mechanism should tolerate public scrutiny. Knowing how the software works should not work against the devised scheme itself.
Parent
Re:Famous last words (Score:3, Insightful)
He's crazy if thinks big corporations would even think twice of doing something over the dead body of one of their workers.
Corporations might think twice, but governments wouldn't.
Source code is no panacea here (Score:3, Informative)
Gnupg is open source, so you can verify there are no backdoors
Yes, absolutely. If you're going to use encryption semi-seriously or even professionally, you have no choice but to use open source crypto libraries and apps!
But source code alone is no panacea here: you (or anyone skilled enough -- a.k.a. the community) could discover obvious backdoors, but what about backdoors in some crypto algorithms themselves? Having the source code for this won't help you much. Nothing could really prevent the NSA [nsa.gov] fr
Re:Been in his shoes (Score:3, Interesting)