EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

10.16.13

Linux Backdoors Revisited (New Revelations and Old Revelations)

Posted in GNU/Linux, Kernel, Security at 10:43 am by Dr. Roy Schestowitz

Claude Elwood Shannon, the man who introduced entropy

Claude Elwood Shannon

Summary: An anonymous backdooring attempt against Linux goes a decade back, but a randomisation problem in today’s Linux also seems possible (subverting encryption)

Jonathan Allen wrote this article about an incident mentioned also by Freedom to Tinker. Slashdot’s summary goes like this, documenting news from one decade ago:

“Ed Felton writes about an incident, in 2003, in which someone tried to backdoor the Linux kernel. Back in 2003 Linux used BitKeeper to store the master copy of the Linux source code. If a developer wanted to propose a modification to the Linux code, they would submit their proposed change, and it would go through an organized approval process to decide whether the change would be accepted into the master code. But some people didn’t like BitKeeper, so a second copy of the source code was kept in CVS. On November 5, 2003, Larry McAvoy noticed that there was a code change in the CVS copy that did not have a pointer to a record of approval. Investigation showed that the change had never been approved and, stranger yet, that this change did not appear in the primary BitKeeper repository at all. Further investigation determined that someone had apparently broken in electronically to the CVS server and inserted a small change to wait4: ‘if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) …’ A casual reading makes it look like innocuous error-checking code, but a careful reader would notice that, near the end of the first line, it said ‘= 0′ rather than ‘== 0′ so the effect of this code is to give root privileges to any piece of software that called wait4 in a particular way that is supposed to be invalid. In other words it’s a classic backdoor. We don’t know who it was that made the attempt—and we probably never will. But the attempt didn’t work, because the Linux team was careful enough to notice that that this code was in the CVS repository without having gone through the normal approval process. ‘Could this have been an NSA attack? Maybe. But there were many others who had the skill and motivation to carry out this attack,’ writes Felton. ‘Unless somebody confesses, or a smoking-gun document turns up, we’ll never know.’”

Backdoors in Linux are a subject for jokes in Torvalds' mind, but given the above we should take this subject very seriously. In any system, for example, having no mechanism for randomness (like in some embedded devices) typically means that strong encryption (with high entropy) is not possible. Given new alleged “insecurities in the Linux /dev/random,” as Bruce Schneier put it, Linux backdoors seem possible again. David Benfell said:

I’m guessing Schneier knows what the fuck he’s talking about. If it is the same vulnerability, then Torvalds’ defense is that the vulnerable source of entropy is only one of many. But if I read Schneier correctly, the result was still too predictable.

“On the other hand,” says Benfell, “here’s Theodore T’so from the comments:”

So I’m the maintainer for Linux’s /dev/random driver. I’ve only had a chance to look at the paper very quickly, and I will at it more closely when I have more time, but what the authors of this paper seem to be worried about is not even close to the top of my list in terms of things I’m worried about.

First of all, the paper is incorrect in some minor details; the most significant error is its (untrue) claim that we stop gathering entropy when the entropy estimate for a given entropy pool is “full”. Before July 2012, we went into a trickle mode where we only took in 1 in 096 values. Since then, the main way that we gather entropy, which is via add_interrupt_randomness(), has no such limit. This means that we will continue to collect entropy even if the input pool is apparently “full”.

This is critical, because *secondly* their hypothetical attacks presume certain input distributions which have an incorrect entropy estimate —| that is, either zero actual entropy but a high entropy estimate, or a high entropy, but a low entropy estimate. There has been no attempt by the paper’s authors to determine whether the entropy gathered by Linux meets either of their hypothetical models, and in fact in the “Linux Pseudorandom Number Generator Revisited”[1], the analysis showed that our entropy estimator was actually pretty good, given the real-life inputs that we are able to obtain from an actual running Linux system.

[1]http://eprint.iacr.org/2012/251.pdf

The main thing which I am much more worried about is that on various embedded systems, which do not have a fine-grained clock, and which is reading from flash which has a much more deterministic timing for their operations, is that when userspace tries to generate long-term public keys immediately after the machine is taken out of the box and plugged in, that there isn’t a sufficient amount of entropy, and since most userspace applications use /dev/urandom since they don’t want to block, that they end up with keys that aren’t very random. We had some really serious problems with this, which was written up in the “Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices” [2]paper, and the changes made in July 2012 were specifically designed to address these worries.

[2]https://www.factorable.net/paper.html

However, it may be that on certain systems, in particular ARM and MIPS based systems, where a long-term public key is generated very shortly after the first power-on, that there’s enough randomness that the techniques used in [2]would not find any problems, but that might be not enough randomness to prevent our friends in Fort Meade from being able to brute force guess the possible public-private key pairs.

Speaking more generally, I’m a bit dubious about academic analysis which are primarily worried about recovering from the exposure of the state of the random pool. In practice, if the bad guy can grab the state of random pool, they probably have enough privileged access that they can do many more entertaining things, such as grabbing the user’s passphrase or their long-term private key. Trying to preserve the amount of entropy in the pool, and making sure that we can extract as much uncertainty from the system as possible, are much higher priority things to worry about.

That’s not to say that I might not make changes to /dev/random in reaction to academic analysis; I’ve made changes in reaction to [2], and I have changes queued for the next major kernel release up to make some changes to address concerns raised in [1]. However, protection against artificially constructed attacks is not the only thing which I am worried about. Things like making sure we have adequate entropy collection on all platforms, especially embedded ones, and adding some conservatism just in case SHA isn’t a perfect random function are some of the other things which I am trying to balance as we make changes to /dev/random.

T’so, who is the former CTO of the Linux Foundation, at least acknowledges the possibility that there is a real issue here.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. The World is Changing and Patent Law Can Change Either for Better or for Worse

    Recent secret dealings (which are being exposed to the public owing to whistle-blowers) show the degree of coordination and collusion against public interests; it's up to us, the majority, to fight back and tackle this injustice



  2. The Latest on Patent 'Reform' in the US: GOP Media Deception, Healthwashing Patents, and SIIA Lobbying

    Techrights looks at the more prominent actors driving patent policy in the US, with budget to absorb and agenda to lobby for



  3. Newegg Uses Its Fight Against Patent Trolls for Marketing

    Comments on Newegg's fight against patent trolls in court, setting an example for other companies



  4. Microsoft Lies, Propaganda, Embedded 'Journalism' and Other Dirty Tricks to Promote Vista 10

    The Vista 10 entrapment is being sold to the public using bogus/unverified figures, Microsoft propagandists pretending to be journalists, and some gullible people who actually believe them



  5. Microsoft -- Like Bill Gates -- Bribes PBS for Propaganda to be Presented as 'TV Programme'

    Microsoft pays the supposedly 'public' network to act as courier of Microsoft marketing, shrewdly disguised as 'information'



  6. Links 2/8/2015: KDE Applications 15.08 Beta, Zorin OS 10

    Links for the day



  7. Links 1/8/2015: Steam Sale, blackPanther OS 14.1

    Links for the day



  8. Vista 10 Inherently Criminal: Vandalising the Competition (Dual Boot, Rival Web Browsers, Online Services)

    Vista 10, the latest incarnation of Windows, takes its anticompetitive aspects to a whole new level, betraying even so-called 'partners' in the process



  9. As Microsoft AstroTurfing/PR Budget Runs Dry, Vista 10 Truths Come Out

    The media manipulation by Microsoft (to the tune of hundreds of millions of dollars spent on 'marketing') grows thin as a growing number of growingly angry early adopters of Vista 10 publicly rant



  10. Links 31/7/2015: Lennart Poettering as 'Linux Hero' and systemd Conference Coming

    Links for the day



  11. Links 30/7/2015: Apache Spark on Z System, Elive 2.6.8 Beta

    Links for the day



  12. Microsoft's Mouthpiece Mary Branscombe Tries to Shoot Down Free Software, But Fails Miserably

    At the CBS-owned ZDNet, which is Free/Open Source software-hostile, new FUD surfaces, but the FUD is so flawed that a full rebuttal is easy and almost imperative



  13. People of New Zealand Must Rise Up to Defend Sovereignty and Stop Software Patents

    The TPPA serves to override (launder) the law of New Zealand, allegedly legalising patents on software in the process



  14. Microsoft Illegally Evades Billions of Dollars in Tax, Says IRS

    The criminal enterprise known as Microsoft finds itself embarrassingly exposed in the courtroom, for the IRS belatedly (decades too late) targets the company in an effort to tackle massive tax evasions



  15. Vista 10 Very Buggy Upon Release, Just as We Have Repeatedly Warned for Weeks

    Vista 10 is prematurely pushed out the door (to meet a deadline) way ahead of it being stable, even remotely polished, and supported by hardware companies (there is a serious drivers issue)



  16. Surveillance Machine With a Keylogger: Vista 10 Will Spy on the User (Over the Internet) Even While Playing Games

    Microsoft is making it clear that even playing a simple game like Solitaire on Vista 10 will make one subjected to spying (for targeted ads); other serious violations of privacy revealed upon release



  17. Links 29/7/2015: Akademy 2015 Ends, NetBSD 7.0 RC

    Links for the day



  18. MPEG-LA is Preparing New Patent Obstruction (Called DASH) Against Free Software, OIN Grows

    A new conspiracy against free multimedia software, set up by the MPEG cartel, is called DASH



  19. New Zealand's Media Gets History Wrong on Software Patents

    Setting the record straight on the fight against software patents in New Zealand



  20. Not Only Vista 10 Crashes a Lot, Any .NET Application Does Too (Updated)

    Microsoft software is quickly becoming synonymous with crashes as any piece of software developed with Microsoft's tools, not just the underlying platform, crashes chronically



  21. The Government of Bulgaria Sells Out to Microsoft, Again

    Despite some promises and reassurances that Bulgaria will consider Free/libre software, the Bulgarian government hands out a lot more of taxpayers' money to the Mafia



  22. Corporate Media Finally Finds Out That Vista 10 Crashes a Lot

    Stability issues of Vista 10 are belatedly reported to be a major catastrophe, leaving it unusable for many early adopters



  23. Links 28/7/2015: Linux 4.2 RC4, New Logos and Bug 'Branding' for FUD

    Links for the day



  24. Patents Roundup: Technicolor, Alice, Voip-Pal, Fitbit, Marijuana Patents, and JDate

    A look at some of last week's patent news, with imperative responses that criticise corporate exploitation of patents for protectionism (excluding and/or driving away the competition using legal threats)



  25. Corporate Lobbyists Including Koch-Connected Front Groups Attack Real and Perceived Patent Reform in the United States

    Looking at some of the latest propaganda for and against a bill which is already too watered-down to actually fix the US patent system



  26. Patents in the Android World Further Complicate Freedom in This Linux-Powered Platform

    A survey of last week's news with special focus on Google and Android, which are trying to coexist and thrive in a world full of patent maximalists



  27. The 'Unitary' Patent Trojan Horse Rammed Down the Throat of Europe

    Under the guise of 'unification' or 'unity', existing patent systems are being abandoned and more power gets passed to corrupt EPO officials



  28. HEVC Cartel is Not News, Only the Names of Backers and the Costs Are New

    A few remarks on and a roundup of recent articles about HEVC, which we first wrote about in spring



  29. IRC Proceedings: July 12th, 2015 – July 25th, 2015

    Many IRC logs



  30. Links 26/7/2015: Purism Librem and Freedom, Akademy Updates

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts