EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

10.16.13

Linux Backdoors Revisited (New Revelations and Old Revelations)

Posted in GNU/Linux, Kernel, Security at 10:43 am by Dr. Roy Schestowitz

Claude Elwood Shannon, the man who introduced entropy

Claude Elwood Shannon

Summary: An anonymous backdooring attempt against Linux goes a decade back, but a randomisation problem in today’s Linux also seems possible (subverting encryption)

Jonathan Allen wrote this article about an incident mentioned also by Freedom to Tinker. Slashdot’s summary goes like this, documenting news from one decade ago:

“Ed Felton writes about an incident, in 2003, in which someone tried to backdoor the Linux kernel. Back in 2003 Linux used BitKeeper to store the master copy of the Linux source code. If a developer wanted to propose a modification to the Linux code, they would submit their proposed change, and it would go through an organized approval process to decide whether the change would be accepted into the master code. But some people didn’t like BitKeeper, so a second copy of the source code was kept in CVS. On November 5, 2003, Larry McAvoy noticed that there was a code change in the CVS copy that did not have a pointer to a record of approval. Investigation showed that the change had never been approved and, stranger yet, that this change did not appear in the primary BitKeeper repository at all. Further investigation determined that someone had apparently broken in electronically to the CVS server and inserted a small change to wait4: ‘if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) …’ A casual reading makes it look like innocuous error-checking code, but a careful reader would notice that, near the end of the first line, it said ‘= 0′ rather than ‘== 0′ so the effect of this code is to give root privileges to any piece of software that called wait4 in a particular way that is supposed to be invalid. In other words it’s a classic backdoor. We don’t know who it was that made the attempt—and we probably never will. But the attempt didn’t work, because the Linux team was careful enough to notice that that this code was in the CVS repository without having gone through the normal approval process. ‘Could this have been an NSA attack? Maybe. But there were many others who had the skill and motivation to carry out this attack,’ writes Felton. ‘Unless somebody confesses, or a smoking-gun document turns up, we’ll never know.’”

Backdoors in Linux are a subject for jokes in Torvalds' mind, but given the above we should take this subject very seriously. In any system, for example, having no mechanism for randomness (like in some embedded devices) typically means that strong encryption (with high entropy) is not possible. Given new alleged “insecurities in the Linux /dev/random,” as Bruce Schneier put it, Linux backdoors seem possible again. David Benfell said:

I’m guessing Schneier knows what the fuck he’s talking about. If it is the same vulnerability, then Torvalds’ defense is that the vulnerable source of entropy is only one of many. But if I read Schneier correctly, the result was still too predictable.

“On the other hand,” says Benfell, “here’s Theodore T’so from the comments:”

So I’m the maintainer for Linux’s /dev/random driver. I’ve only had a chance to look at the paper very quickly, and I will at it more closely when I have more time, but what the authors of this paper seem to be worried about is not even close to the top of my list in terms of things I’m worried about.

First of all, the paper is incorrect in some minor details; the most significant error is its (untrue) claim that we stop gathering entropy when the entropy estimate for a given entropy pool is “full”. Before July 2012, we went into a trickle mode where we only took in 1 in 096 values. Since then, the main way that we gather entropy, which is via add_interrupt_randomness(), has no such limit. This means that we will continue to collect entropy even if the input pool is apparently “full”.

This is critical, because *secondly* their hypothetical attacks presume certain input distributions which have an incorrect entropy estimate —| that is, either zero actual entropy but a high entropy estimate, or a high entropy, but a low entropy estimate. There has been no attempt by the paper’s authors to determine whether the entropy gathered by Linux meets either of their hypothetical models, and in fact in the “Linux Pseudorandom Number Generator Revisited”[1], the analysis showed that our entropy estimator was actually pretty good, given the real-life inputs that we are able to obtain from an actual running Linux system.

[1]http://eprint.iacr.org/2012/251.pdf

The main thing which I am much more worried about is that on various embedded systems, which do not have a fine-grained clock, and which is reading from flash which has a much more deterministic timing for their operations, is that when userspace tries to generate long-term public keys immediately after the machine is taken out of the box and plugged in, that there isn’t a sufficient amount of entropy, and since most userspace applications use /dev/urandom since they don’t want to block, that they end up with keys that aren’t very random. We had some really serious problems with this, which was written up in the “Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices” [2]paper, and the changes made in July 2012 were specifically designed to address these worries.

[2]https://www.factorable.net/paper.html

However, it may be that on certain systems, in particular ARM and MIPS based systems, where a long-term public key is generated very shortly after the first power-on, that there’s enough randomness that the techniques used in [2]would not find any problems, but that might be not enough randomness to prevent our friends in Fort Meade from being able to brute force guess the possible public-private key pairs.

Speaking more generally, I’m a bit dubious about academic analysis which are primarily worried about recovering from the exposure of the state of the random pool. In practice, if the bad guy can grab the state of random pool, they probably have enough privileged access that they can do many more entertaining things, such as grabbing the user’s passphrase or their long-term private key. Trying to preserve the amount of entropy in the pool, and making sure that we can extract as much uncertainty from the system as possible, are much higher priority things to worry about.

That’s not to say that I might not make changes to /dev/random in reaction to academic analysis; I’ve made changes in reaction to [2], and I have changes queued for the next major kernel release up to make some changes to address concerns raised in [1]. However, protection against artificially constructed attacks is not the only thing which I am worried about. Things like making sure we have adequate entropy collection on all platforms, especially embedded ones, and adding some conservatism just in case SHA isn’t a perfect random function are some of the other things which I am trying to balance as we make changes to /dev/random.

T’so, who is the former CTO of the Linux Foundation, at least acknowledges the possibility that there is a real issue here.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 28/8/2014: Many New Games, CTO of Red Hat Steps Down

    Links for the day



  2. We Are Gradually Winning the Battle Against Software Patents

    The once-elusive war on software patents is finally leading to some breakthrough and even the Federal Circuit reinforces the trend of software patents' demise



  3. Free/Open Source Software (FOSS) Companies Versus FOSS Moles (VMware, Sonatype, Xamarin)

    A look at three entities which pretend to be pro-FOSS but are actually FOSS-hostile and very much determined to replace FOSS with proprietary software



  4. Links 27/8/2014: GNU/Linux in Space, China, LinuxCon

    Links for the day



  5. FUD Against Google and FOSS Security Amid Microsoft Windows Security Blunders

    In the age of widespread fraud due to Microsoft Windows with its back doors there is an attempt to shift focus to already-fixed flaws/deficiencies in competitors of Microsoft



  6. Microsoft Spin Watch: IDG Turns to More Microsoft Propaganda, Hires Microsoft Boosters

    Media in Microsoft's pocket is telling Microsoft's lies and deceives the public for Microsoft's bottom line



  7. Microsoft's Massive Tax Evasion Becomes Better Known

    A new report about Microsoft's admission that it plays dirty tricks with tax (sometimes using moles in government) is increasing awareness of Microsoft's criminal aspects



  8. Links 25/8/2014: China's Linux Revolution Imminent

    Links for the day



  9. Links 24/8/2014: GNU/Linux Specialisation and Benchmarks

    Links for the day



  10. Links 23/8/2014: GNU/Linux Growth

    Links for the day



  11. Microsoft-Funded Attacks on Android Security and Patent/Copyright

    A look back at examples of people who smear Android and are receiving (or received) money from Microsoft



  12. Blowback in Chile and Munich After Microsoft Intervention

    Microsoft's attacks on the digital sovereignty of countries involves lobbying, corruption, an attack on standards (e.g. ODF), an attack on FOSS policies, and even an attack on accurate reporting (truth itself)



  13. The End of Microsoft is Nigh

    A look back at a tough year for Microsoft and a not-so-promising future



  14. Links 22/8/2014: Linux Foundation LFCS, LFCE

    Links for the day



  15. UPS Burned by Microsoft Windows, Gives Away Massive Number of Credit Card Details

    UPS is the latest victim of Microsoft's shoddy back door with software on top of it (Windows); attempts to blame FOSS for data compromise actually divert attention from the real culprit, which is proprietary software



  16. Microsoft's Funding of ALEC and Other Systemic Corruption

    Microsoft role in writing of laws by proxy, via groups such as ALEC



  17. Microsoft is Still Preying on British Taxpayers, Playing Politics

    Some news from the UK showing how Microsoft uses politics to extract money out of taxpayers, irrespective of their preferences



  18. Microsoft's Patent Troll Intellectual Ventures is Collapsing as 20% of Staff Laid Off

    More good news regarding the demise of patents as Microsoft's leading patent proxy is collapsing more rapidly than anyone ever imagined and software patents too are collectively doubted



  19. Links 21/8/2014: Conferences of Linux Foundation, Elephone Emerges

    Links for the day



  20. Links 20/8/2014: Linux Event, GNOME Milestone

    Links for the day



  21. Corruption Watch: Microsoft Lobbying Designed to Kill Chile's Free Software Policy and Promote Microsoft With Subsidies, More Dirty Tricks Emerge in Munich

    icrosoft is systematically attacking migrations to GNU, Linux and Free software, using dirty tricks, as always



  22. Vista 8 Such a Disaster That Even Microsoft Cannot Cope With It, Vapourware Tactics Start Early

    Microsoft's Windows-powered services are failing and Windows gets bricked by Microsoft patches, whereupon we are seeing yet more of Microsoft's vapourware tactics (focusing in imaginary, non-existent versions of Windows)



  23. On BlackBerry and Other Patent Trolls

    A roundup regarding patent trolls, starting with the bigger and latest joiner, BlackBerry's new patents apparatus



  24. Links 19/8/2014: Humble Jumbo Bundle 2 Betrayal, Mercedes-Benz Runs GNU/Linux

    Links for the day



  25. BlackBerry -- Like Microsoft Nokia -- Could be the Next Patent Proxy Troll

    BlackBerry is restructuring for patent assertion (i.e. trolling) in the wake of some alliances with Microsoft



  26. After Microsoft's Soft Bribe Some Non-Technical Deputy Does Not Like Free Software, Microsoft-Linked Media Responds to This Non-News by Making Bogus Claims of Munich Leaving GNU/Linux (Updated)

    The subversive forces that have secretly been attacking Munich over its migration to GNU/Linux (Microsoft press, Gartner, and even HP) are back to doing it while China and Russia follow Munich's lead



  27. Gates Foundation CFO Quits and Debate About Revolving Doors Recalled Amid Systematic and Shrewd Bribery of Public Officials

    More officials step out of the Gates Foundation and their destination is not known yet; Gates continues to corrupt the public sector with his money so as to increase personal gain at taxpayers' expense



  28. Links 19/8/2014: GNU/Linux Raves and Alternative to Proprietary Voice Chat

    Links for the day



  29. Links 18/8/2014: Linux 3.17 RC1, Escalation in Ferguson

    Links for the day



  30. Gartner Group Advocates Using Defective Software With Back Doors

    Despite strong evidence that Microsoft has been complicit in illegal surveillance, Gartner continues to recommend the use of Windows and other espionage-ready Microsoft software


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts