Hot Comments
- About time! (5 points, Informative) by sackvillian on Tuesday February 09, @09:50AM attached to Call For Scientific Research Code To Be Released
- Re:Be careful using the P2V tool. (5 points, Informative) by klocwerk on Tuesday February 09, @03:41PM attached to The Hidden Treasures of Sysinternals
- W.A.G. (5 points, Insightful) by ipb on Tuesday February 09, @01:17PM attached to How Do You Accurately Estimate Programming Time?
- Re:Surprise (5 points, Insightful) by Anonymous Coward on Tuesday February 09, @04:38PM attached to Microsoft Says Windows 7 Not Killing Batteries
- Re:i'm going to get modded troll... (5 points, Insightful) by shutdown -p now on Tuesday February 09, @10:55AM attached to Space Shuttle Spy Gets 15 Years
7132814
story
Comments: 450 +- IT: Microsoft Denies It Built Backdoor Into Windows 7 on Thursday November 19, @05:16PM
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicgovt.gif); width:57px; height:80px;
government
background: url(//a.fsdn.com/sd/topics/topicintel.gif); width:68px; height:35px;
intel
background: url(//a.fsdn.com/sd/topics/topicprivacy.gif); width:71px; height:53px;
privacy
background: url(//a.fsdn.com/sd/topics/topicwindows.gif); width:49px; height:65px;
windows
CWmike writes "Microsoft has denied that it has built a backdoor into Windows 7, a concern that surfaced yesterday after a senior National Security Agency (NSA) official testified before Congress that the agency had worked on the operating system. 'Microsoft has not and will not put "backdoors" into Windows,' a company spokeswoman said, reacting to a Computerworld story Wednesday. On Monday, Richard Schaeffer, the NSA's information assurance director, told the Senate's Subcommittee on Terrorism and Homeland Security that the agency had partnered with the developer during the creation of Windows 7 'to enhance Microsoft's operating system security guide.' Thursday's categorical denial by Microsoft was accompanied by further explanation of exactly how the NSA participated in the making of Windows 7. 'The work being discussed here is purely in conjunction with our Security Compliance Management Toolkit,' said the spokeswoman. The company rolled out the Windows 7 version of the toolkit late last month, shortly after it officially launched the operating system."
Related Stories
It is sweet to let the mind unbend on occasion.
-- Quintus Horatius Flaccus (Horace)
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
I have no problem believing MS this time... (Score:5, Funny)
I believe Microsoft anytime that they would not build back doors into the system... If they tried, the backdoor would probably have enough bugs to be unusable.
Besides - doesn't it already state it in the story:
"Microsoft has not and will not put "backdoors" into Windows"
"the agency had worked on the operating system."
Seems pretty clear, MS did NOT put a backdoor into it... ;-)
Re:I have no problem believing MS this time... (Score:5, Funny)
Why would Microsoft build a back door into Win7, when the front door is so wide open?
Parent
Re:I have no problem believing MS this time... (Score:5, Insightful)
What the "we're able to shut down your computer if we suspect you may not have an authorized version of our software" backdoor isn't enough of a backdoor for them?
Parent
Re:I have no problem believing MS this time... (Score:5, Funny)
Parent
Re:I have no problem believing MS this time... (Score:5, Insightful)
To say it more clearly, the allegation is that NSA put the back door in, microsoft didnt deny it. They are using political speak to make is sound like nobody put back doors in.
An think about it, what self respecting intelligence agency wouldnt want a back door in windows. Their job is to collect intelligence, and windows is almost everywhere and handles lots of information.
It might sound paranoid to say windows is bugged by the NSA, but it totally ignorance to suggest they wouldnt want to bug it.
Parent
Re:I have no problem believing MS this time... (Score:5, Insightful)
.
An think about it, what self respecting intelligence agency wouldnt want a back door in windows. Their job is to collect intelligence, and windows is almost everywhere and handles lots of information.
It might sound paranoid to say windows is bugged by the NSA, but it totally ignorance to suggest they wouldnt want to bug it.
You are overlooking the fact that intelligence agencies are, also, usually tasked with preventing (as much as possible) foreign countries from collecting intelligence about the U.S. government. If Windows has a back door that the NSA can use, how would they prevent foreign intelligence agencies from using it? It is a well understood fact that any security vulnerability that is introduced will be discovered by those with nefarious goals (the NSA would not view their own goals as nefarious, but they would consider the goals of many foreign intelligence agents to be nefarious).
Parent
The NSA has helped LInux in the same way, FFS (Score:5, Insightful)
Seriously, you're absolutely correct. The NSA has every incentive to improve the security of Windows, not compromise it. They did the same for Linux, where you can see the changes they made. In the past, they've made suggestions for improvements to encryption algorithms that academic researchers later realized had a sound mathematical basis. The NSA is as much about strengthening computer systems as they are compromising them. Hell, if in a particular situation they want to compromise the security of a system, all they usually have to do is ask (see: AT&T et. al.).
The thing is, they know that important information they want to be kept secret is going to exist on Windows machines. On Linux machines. On [x] machine that isn't necessarily controlled directly by the NSA.
And even outside such "National Security" secrets... The NSA may want to listen in on your phone calls, but it doesn't help them at all for every Tom, Dick, and Sally to have their credit card information stolen, their bank acccounts phished and plundered, and so on.
Parent
Re:I have no problem believing MS this time... (Score:5, Insightful)
Or another reasonable conclusion: the spokesperson did not, in fact, talk to every single developer who may have worked with the NSA to confirm that no back door was put in, and managed to get independent "third-party" developers to code-review everything to confirm this, thereby saying the truth as s/he knows it, which does not need to line up with objective truth as it really is.
I've failed to keep count of the number of times I see a press release from $work claiming that we do or do not do something that I know damned well falls short of the truth. They don't usually ask me.
Parent
Re:I have no problem believing MS this time... (Score:5, Insightful)
Whether they did or did not put a back door in windows is arbitrary. What is of concern is a government department doing free work to improve the profitability of a single corporation against the corporate interests of every other competing corporation. Remember the screams coming out of Redmond when the NSA produce SE Linux, taht would be made available for free to all taxpayers.
Now you have the NSA and the department of defence attempting to prop up the security incompetence of a corporation at tax payer expense so that corporation can now turn around and charge their customers for work their customers already paid for.
If M$ is to security incompetent to produce reliable software, no government departments should be steeping ion to to their work for them they should simply stop using their software rather the propping up the company at taxpayer expense.
Besides everybody knows backdoors belong in hardware not software, any tech person with more than half a brain dual boots and uses the Linux side of things for anything they want to keep safe and secure, the windows side is built to power a game console and that's all it should be used for.
Parent
Re:I have no problem believing MS this time... (Score:5, Interesting)
"Microsoft has not and will not put "backdoors" into Windows"
No, no, that's "will not put 'backdoors' into Windows 7"!
The "7" is important, because chances are high that the backdoors added to WinNT3.5 are still working just fine; no need to add any new ones! :)
(A lot of people picked up on the "MS didn't add it" vs. "NSA worked on it", but I haven't seen any other comments about possible pre-existing backdoors.)
Parent
Re:I have no problem believing MS this time... (Score:5, Insightful)
One of the biggest reasons this country is falling apart? On his best night less than 1% of the country is watching his show. You give him way too much credit.
Parent
Well.. (Score:5, Funny)
At least, not intentionally.
Really people (Score:5, Insightful)
The NSA put the backdoor in the Intel compiler, that's a much better place to put a backdoor or more accurately spread a backdoor
Re:Really people (Score:5, Insightful)
Or the network adapter firmware or the encryption libraries or the BIOS or the processor itself. Yeah, there's no reason to poke a hole in the OS itself when so much of what it depends on is at your finger tips.
What's more, the NSA does have a legitimate reason to be involved. It's the same reason they wrote the SE/Linux extensions. They are required (in their public role) to provide the federal government with analysis and review of software for security purposes. To avoid having the NSA say, "Win 7 is too insecure, don't use it," Microsoft would go to them for review and comments prior to release, and respond to whatever concerns they have.
People often forget that the NSA has a public function.
Parent
Re:Really people (Score:5, Insightful)
I'll leave you with that while I go to make my 30-char SSH password a little longer.
Parent
Re:Really people (Score:5, Insightful)
People often forget that the NSA has a public function.
Oh, I don't think anyone is forgetting that at all. It's just that the NSA cannot be trusted, and Microsoft cannot be trusted, and so when the two work together the result is something untrustworthy.
Parent
Re:Really people (Score:5, Funny)
They cancel each other out. So it is a positive.
Right?
Parent
Re:Really people (Score:4, Funny)
The back door is usually considered "taboo" and therefore makes people feel like they're "bad-ass" (no pun intended). Plus, it's usually more pleasuring.
Parent
Re:Really people (Score:5, Funny)
>>>Who needs a back door when the front door is wide open?
"That's what she said!"
Parent
On the other hand... (Score:4, Insightful)
Not really necessary (Score:5, Insightful)
Odds are the NSA is privy to whatever the current exploits are for windows operating systems anyways. I wouldn't be surprised if they had staff working on breaking into Windows machines if for nothing else than attacks on targets outside the US.
Re:Not really necessary (Score:5, Insightful)
Yes, this.
And if they had smuggled something into it, the testimony before Congress would have been sealed. The fact we know about it without some kind of secret leak means that we can be confident the NSA did not think the disclosure was valuable intel.
Parent
Re:Not really necessary (Score:5, Insightful)
Wait a second
<paranoia intensity="100%"> But maybe that's what they want me to think
Parent
Re:Not really necessary (Score:5, Insightful)
I think it's much more likely that the NSA would partner with Microsoft to ensure that Windows is actually more secure, so that those same targets outside of the US cannot get into the US government systems.
The NSA doesn't need to rely on Windows to gain access to other networks, but considering the fact that many government systems are running Windows, the National Security Agency definitely has an interest in making sure those systems are secure.
Parent
Re:Not really necessary (Score:5, Informative)
I think it's much more likely that the NSA would partner with Microsoft to ensure that Windows is actually more secure
It's not "likely." It's their job [nsa.gov].
Parent
Re:Not really necessary (Score:5, Insightful)
Parent
Re:Not really necessary (Score:5, Interesting)
I'd say a more likely NSA "backdoor" would be some sort of subtle flaw in the implementation of an encryption, hash or some other algorithm critical to Windows. NSA spends alot of time and money on cryptanalysis.
Parent
Re:Not really necessary (Score:5, Insightful)
Considering that historically the NSA has improved cryptographic implementations against attacks that were (at the time) unknown to the public, I'd say that's almost certainly BS. For example, DES. Even when their modifications appeared to be weakening the encryption algorithm, once the algorithm was a standard and other parties got around to hunting weaknesses for it, it was found that the modified version (which had become the standard) was far more resistant to attack. Turns out the attack had been known but kept secret, yet the algorithm had been modified to make the attack weaker.
TL;DR: No, the NSA uses their extensive cryptanalysis knowledge to take backdoors *out* of encryption, rather than to put them in. Remember: we (the US, including the government) use it too, and enemy forces might stumble upon any backdoor they leave/put in place.
Parent
"We did NOT put in a backdoor for the NSA." (Score:5, Insightful)
"It's for the RIAA."
With props to Bill Cosby (Score:5, Funny)
God: "NOAH!"
Noah: "What!"
God: "Noah, I did not put a backdoor in Windows 7."
Noah: "[...] RIGHT."
NSA helped on Linux as well (Score:5, Insightful)
The NSA did SELinux (for Linux...) so I don't think it's unreasonable to think they might have helped MS on security issues without doing anything nasty.
Re:NSA helped on Linux as well (Score:5, Informative)
And they also recommended a couple of changes to DES when it was being developed:
http://www.schneier.com/blog/archives/2004/10/the_legacy_of_d.html [schneier.com]
Folks at the time thought it was some nefarious backdoor, but a couple of decades later came to realize it actually improved the security of DES.
Parent
Re:NSA helped on Linux as well (Score:5, Informative)
DES with twice the key length wasn't proportionally stronger, and the speed of computation was important enough that halving the key length with a negligible impact on strength was well advised.
3DES at 168 bits isn't nearly as strong, cryptographically, as AES or many other modern algorithms. Yet many of these algorithms can use 128-bit keys and 128-bit block sizes. So key size does not make the algorithm.
In hindsight, the NSA is fully validated on DES.
Parent
Re:NSA helped on Linux as well (Score:5, Interesting)
where all eyes in the world are watching what they do
I have never looked at the SELinux code.... have you?
Parent
I Tried to Interview Microsoft About This (Score:5, Funny)
Please, they have microphones in my clothes, on the desk, in the walls, the fly buzzing by your mouth is their robot!!! Meet me by the dumpster out back around 5pm, come alone.
Unfortunately I have a bad habit of reading things aloud when I read them and by the time I was finished the fly was gone and the man sitting across from me was dead. The government doctor that rushed in the room and gave him pentobarbital in an attempt to revive him said it was due to an aneurysm caused by a robotic fly which he says he sees a lot of so it's nothing for me to look into.
I guess there's no story here after all.
Re:I Tried to Interview Microsoft About This (Score:5, Funny)
MS marketing reps can't write.
Parent
Idiocy of ComputerWorld and slashdot... (Score:5, Insightful)
ComputerWorld: "OMG NSA TROJANED WINDOWS 7"
NSA: "WTF? We made a document and stand-alone download..."
ComputerWorld: "CONSPIRACY!"
NSA: "Uh, we work with linux too you know... SELinux...?"
ComputerWorld: "FRONTPAGE HEADLINE NEWS! WINDOWS 7 BACKDOOR EXISTS!"
Slashdot: "ZOMG! NSA MADE A WINDOWS 7 BACKDOOR!"
I'm the NSA... (Score:5, Funny)
and Windows 7 was my idea.
Re:I'm the NSA... (Score:5, Funny)
and Windows 7 was my idea.
John Hodgman: "Hi, I'm a PC." ... I guess you know who to choose."
*silence*
John Hodgman: "Oh, and Mac couldn't be here today because Windows 7 fiddled with his brakes. So
Parent
A better "I'm a Mac" ad... (Score:5, Funny)
"Hi, I'm a PC"
and then the NSA guy with the latex glove enters the scene...
Parent
Strategic Defense Initiative (Score:5, Insightful)
Who needs a back door? (Score:5, Funny)
Despite many years’ warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with [today.com], millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying “COME AND GET IT.”
Microsoft cannot believe people have not applied the patch for the problems, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. “Don’t they trust us?” asked marketing marketer Steve Ballmer.
Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. “There’s a reason the Unix system on Mac OS X is called Darwin,” said appallingly smug Mac user Arty Phagge.
“It can’t be stupid if everyone else runs it,” said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. “Macs cost more than Windows PCs.”
“Yes,” said Phagge. “Yes, they do.”
Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can’t say we care.
Re:Who needs a back door? (Score:5, Funny)
What about all three of the BSD users?
Parent
Probably easier to back door Linux. (Score:5, Interesting)
You know, its funny, but if the NSA ever got its hooks into a repository, it could do all sorts of fun stuff that way in Linux. We only "trust" Linux because Linux is a huge trust circle. WE trust it because its open, and assume that someone else must have looked at it. But I have about as much idea of what's going on inside of my Ubuntu as I did my Windows, from a backdoor perspective.
A test? (Score:5, Interesting)
This should keep the developers on their toes and give us some confidence that the code IS being audited properly.
Parent
Under the PATRIOT act... (Score:5, Insightful)
If Microsoft had assisted the NSA and deliberately buggered their security model for the government's purposes, it would be a federal crime for them to admit it.
-jcr
Never believe something until... (Score:5, Insightful)
Never believe something until it is officially denied. :o)
There's more than one way (Score:5, Interesting)
Like any other intelligence agency, spying on people who use Windows would be a prime goal, but there's plenty of malware out there to do that, with Microsoft and the security industry formed to fix the holes left by Microsoft's technical incompetence can only fix so much. There's no reason why the NSA couldn't develop their own malware with VB and run it like any other criminals, without any collusion with Microsoft at all.
Given the fact that Windows is as secure as a paper tank at the best of times, and the governments of the world seem to want to insist that people use Windows, it's mot hard to imagine Microsoft suits using the "hey if you force your people to use our software, you can spy on what they do with them much easier" as a reason NOT to support calls for a FOSS / Linux switch.
Given how many crimes Microsoft get away with in more jurisdictions it's also not hard to imagine a meeting where Microsoft agree to turn a blind eye to malware from certain sources in return for cases being dropped, or friendly judges put on the case who will promptly find in favour of Microsoft, and dismiss any logical evidence that they've done anything wrong.
As far as "it's in our interests to make Windows secure as we use it", how much of the US defense network still use Windows? I've noticed some have switched to Linux, while Microsoft had to create a special "secure XP" for them because the regular one wasn't up to the task. How easy would it be for the entire network to switch to Linux to protect itself while endorsing Windows for everyone else as it gives them and easy target to hit if they need to? They could even get Linux to pretend it's Windows when queried so nobody outside would know.
Remember most govt departments are VERY partisan, they don't like to co-operate as much as they should. They don't like sharing stuff that would help everyone because if only they do it and look good, they look even better in comparison to other departments who didn't do it. The contrast is even wider.
NOBODY is mentioning FIPS? (Score:5, Interesting)
My limited understanding of FIPS compliance is such that I thing the likelihood is much higher that the involvement of the NSA is to work with Microsoft (as they have others) to make sure the right libraries are used and so on for FIPS compliance. If you want to sell software to the US Government, it must be FIPS compliant.
The following is my understanding (which is likely flawed in some ways, but I think is fairly close to accurate) of how FIPS works (Taken from a response I wrote to someone else about this).
In all likelihood, this is all about their encryption being FIPS compliant and has nothing to do with backdoors.
The way I understand FIPS (because I got a mini-lesson on it during an SDR as they were doing it for [another software product I work with alot]) you have to use very specific encryption protocols that not only meet the standard for the encryption routine (e.g. RSA, or whatever) and the bit-size, but you have to use one of a specific set of approved implementation libraries.
That means you can use the exact same encrypting schema and key size as FIPS specifies, but if you don't do the encryption with an approved library, you're not compliant.
The rules get weirder from there. If you are required to be FIPS compliant at work, and must send something encrypted, you have to send it to someone who is also FIPS compliant. -- follow this logic now -- if you have to send it to someone who is NOT compliant, even though they use compatible encryption/decryption code and have exchanged keys with you, you CANNOT send them the encrypted file because their libraries are not FIPS compliant. You can, however, send them the file IN THE CLEAR if you decide it's safe to do so.
In other words, FIPS says it is better to send something in the clear if you cannot be sure the other end is FIPS compliant, even if they can decrypt what you're sending.
That's your government at work.
BTW: The routines which ARE certified have been fully vetted by many government and non-government people, and do not contain any special code in them that would lead to making decryption by the NSA any easier than it would otherwise be. Since the routines are by nature just implementation of well know encryption standards, the only way to do that would be to interrupt the key pair creation process and use "less random" seeds. I don't believe FIPS specifies the random number generation routine used.
Hope this helps.
Re:Well (Score:5, Funny)
This is true. However, I plan to register microsoftrapedandkilledandembeddedinwindows7ayounggirlin2009.com because they haven't denied that they have not.
Parent