EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

10.16.13

Linux Backdoors Revisited (New Revelations and Old Revelations)

Posted in GNU/Linux, Kernel, Security at 10:43 am by Dr. Roy Schestowitz

Claude Elwood Shannon, the man who introduced entropy

Claude Elwood Shannon

Summary: An anonymous backdooring attempt against Linux goes a decade back, but a randomisation problem in today’s Linux also seems possible (subverting encryption)

Jonathan Allen wrote this article about an incident mentioned also by Freedom to Tinker. Slashdot’s summary goes like this, documenting news from one decade ago:

“Ed Felton writes about an incident, in 2003, in which someone tried to backdoor the Linux kernel. Back in 2003 Linux used BitKeeper to store the master copy of the Linux source code. If a developer wanted to propose a modification to the Linux code, they would submit their proposed change, and it would go through an organized approval process to decide whether the change would be accepted into the master code. But some people didn’t like BitKeeper, so a second copy of the source code was kept in CVS. On November 5, 2003, Larry McAvoy noticed that there was a code change in the CVS copy that did not have a pointer to a record of approval. Investigation showed that the change had never been approved and, stranger yet, that this change did not appear in the primary BitKeeper repository at all. Further investigation determined that someone had apparently broken in electronically to the CVS server and inserted a small change to wait4: ‘if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) …’ A casual reading makes it look like innocuous error-checking code, but a careful reader would notice that, near the end of the first line, it said ‘= 0′ rather than ‘== 0′ so the effect of this code is to give root privileges to any piece of software that called wait4 in a particular way that is supposed to be invalid. In other words it’s a classic backdoor. We don’t know who it was that made the attempt—and we probably never will. But the attempt didn’t work, because the Linux team was careful enough to notice that that this code was in the CVS repository without having gone through the normal approval process. ‘Could this have been an NSA attack? Maybe. But there were many others who had the skill and motivation to carry out this attack,’ writes Felton. ‘Unless somebody confesses, or a smoking-gun document turns up, we’ll never know.’”

Backdoors in Linux are a subject for jokes in Torvalds' mind, but given the above we should take this subject very seriously. In any system, for example, having no mechanism for randomness (like in some embedded devices) typically means that strong encryption (with high entropy) is not possible. Given new alleged “insecurities in the Linux /dev/random,” as Bruce Schneier put it, Linux backdoors seem possible again. David Benfell said:

I’m guessing Schneier knows what the fuck he’s talking about. If it is the same vulnerability, then Torvalds’ defense is that the vulnerable source of entropy is only one of many. But if I read Schneier correctly, the result was still too predictable.

“On the other hand,” says Benfell, “here’s Theodore T’so from the comments:”

So I’m the maintainer for Linux’s /dev/random driver. I’ve only had a chance to look at the paper very quickly, and I will at it more closely when I have more time, but what the authors of this paper seem to be worried about is not even close to the top of my list in terms of things I’m worried about.

First of all, the paper is incorrect in some minor details; the most significant error is its (untrue) claim that we stop gathering entropy when the entropy estimate for a given entropy pool is “full”. Before July 2012, we went into a trickle mode where we only took in 1 in 096 values. Since then, the main way that we gather entropy, which is via add_interrupt_randomness(), has no such limit. This means that we will continue to collect entropy even if the input pool is apparently “full”.

This is critical, because *secondly* their hypothetical attacks presume certain input distributions which have an incorrect entropy estimate —| that is, either zero actual entropy but a high entropy estimate, or a high entropy, but a low entropy estimate. There has been no attempt by the paper’s authors to determine whether the entropy gathered by Linux meets either of their hypothetical models, and in fact in the “Linux Pseudorandom Number Generator Revisited”[1], the analysis showed that our entropy estimator was actually pretty good, given the real-life inputs that we are able to obtain from an actual running Linux system.

[1]http://eprint.iacr.org/2012/251.pdf

The main thing which I am much more worried about is that on various embedded systems, which do not have a fine-grained clock, and which is reading from flash which has a much more deterministic timing for their operations, is that when userspace tries to generate long-term public keys immediately after the machine is taken out of the box and plugged in, that there isn’t a sufficient amount of entropy, and since most userspace applications use /dev/urandom since they don’t want to block, that they end up with keys that aren’t very random. We had some really serious problems with this, which was written up in the “Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices” [2]paper, and the changes made in July 2012 were specifically designed to address these worries.

[2]https://www.factorable.net/paper.html

However, it may be that on certain systems, in particular ARM and MIPS based systems, where a long-term public key is generated very shortly after the first power-on, that there’s enough randomness that the techniques used in [2]would not find any problems, but that might be not enough randomness to prevent our friends in Fort Meade from being able to brute force guess the possible public-private key pairs.

Speaking more generally, I’m a bit dubious about academic analysis which are primarily worried about recovering from the exposure of the state of the random pool. In practice, if the bad guy can grab the state of random pool, they probably have enough privileged access that they can do many more entertaining things, such as grabbing the user’s passphrase or their long-term private key. Trying to preserve the amount of entropy in the pool, and making sure that we can extract as much uncertainty from the system as possible, are much higher priority things to worry about.

That’s not to say that I might not make changes to /dev/random in reaction to academic analysis; I’ve made changes in reaction to [2], and I have changes queued for the next major kernel release up to make some changes to address concerns raised in [1]. However, protection against artificially constructed attacks is not the only thing which I am worried about. Things like making sure we have adequate entropy collection on all platforms, especially embedded ones, and adding some conservatism just in case SHA isn’t a perfect random function are some of the other things which I am trying to balance as we make changes to /dev/random.

T’so, who is the former CTO of the Linux Foundation, at least acknowledges the possibility that there is a real issue here.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 6/5/2016: Neptune 4.5.1, Parts of Basho DB Liberated

    Links for the day



  2. IBM Comes Under Growing Scrutiny for Increasingly Acting Just Like a Patent Troll Amid Layoffs

    Deservedly if not belatedly too, more and more pundits come to recognise the rogue element which is IBM, having promoted software patents all around the world, utilised software patents aggressively (to attack/marginalise/tax rivals), lobbied the government to antagonise the Supreme Court's decision on Alice (using former IBM staff which it had somehow snuck into the USPTO), created bogus solutions to the side effects (such as patent trolls) and so on



  3. Enemies of Europe: A Month After Promoting UPC in London, Benoît Battistelli and the EPO Do This in Helsinki

    The US-leaning corporate occupation by Battistelli and his big corporate clients (or bosses) comes up north, approaching even Russia's border



  4. You Need to Become Proprietary Software Customer (Microsoft Recommended) to Interact with the European Patent Office

    The European Patent Office (EPO) continues to show technical and bureaucratic anomalies that have essentially turned it into agent of monopolisation, benefiting firms from across the Atlantic



  5. US Congress Should Investigate EPO and Battistelli, Not Just WIPO and Francis Gurry

    The US takes more and more actions against WIPO for abuses against workers, but why not the European Patent Office (EPO) as well?



  6. Amid French Political Actions Against EPO Management French Consulate the Target of Next Week's EPO Staff Protest

    Next Wednesday at lunchtime staff of the European Patent Office will march to the French consulate in Munich in pursuit of labour rights, human rights etc. (not just of EPO staff but also, by extension, all staff in such unaccountable international institutions)



  7. Links 5/5/2016: gNewSense 4.0 released, IPFire 2.19

    Links for the day



  8. Links 4/5/2016: Wine Staging 1.9.9, ImageMagick Bug Fixes

    Links for the day



  9. Links 3/5/2016: Mozilla Firefox 46.0.1, More Jolla Funding

    Links for the day



  10. New Paper About the UPC Explains Why It is Bad for Small- and Medium-sized European Businesses

    A detailed academic analysis of the Unitary (or Unified) Patent Court reveals/concludes/asserts that it is being marketed or promoted using a misleading premise and promise



  11. [ES] Gobiernos en Europa Todavía Activos en Contra de la Gerencia de la EPO

    Todavía hay trabajo político que está siendo hecho — aunque discretamente — contra Battistelli y sus chácales en la alta gerencia de la Oficina Europea de Patentes



  12. Links 3/5/2016: International Day Against DRM, 25th Anniversary of Linux (Kernel) Near

    Links for the day



  13. Interesting Supreme Court Cases About Patents in the United States

    A quick review of some of the latest developments regarding SCOTUS (the US Supreme Court) as far as patents go



  14. Governments in Europe Still Active Against EPO Management

    There is still political work being done -- albeit rather discreetly -- against Battistelli and his goons at the European Patent Office's top-level management



  15. The European Spam Office (EPO)

    EPO budget at 'work', days after doing copy-paste jobs and also working overtime in the weekend for an extravagant and needless/purposeless event (except for Battistelli's own pride)



  16. Not Just Benoît Battistelli and Willy Minnoye (EPO): Željko Topić Too Thinks He is Above the Law, Avoids the Judges and Courts

    The latest developments regarding some of the criminal complaints and civil lawsuits against Topić, who is now a Vice-President at the European Patent Office (EPO)



  17. Nefarious Forces for Patent Abuse and Software Patents in the United States, Australia, India, Korea, and Europe

    A roundup of news from the weekend and today, with emphasis on the elements inside the system (or the media) which push for regressive policies that benefit them financially at the expense of everybody else



  18. [ES] El Sistema de Patentes de los EE.UU: Donde Uno Desperdicia Años en Corte y Gasta $8,000,000 en Honorarios de Abogados Peleándo una Patente Falsa

    un sumario de noticias acerca de las patentes de software en los EE.UU. Y ha lo que han llevado, debido en gran manera al decline en calidad de las patentes por parte de la USPTO (dejando que otros se las arreglen limpiando el desórden)



  19. [ES] La Oficina Europea de Patentes Todavía Sigilósamente Abusiva, Pagará $15,000 en Compensasió a Trabajadora Tras un Tardío Fallo de la ILO

    La Organización Internacional del Trabajo (ILO) emite un fallo en un caso de abuso de la EPO y nota “la excesiva duración de los procedimienteos internos de apelación.”



  20. Links 2/5/2016: Linux 4.6 RC6, DragonBox Pyra

    Links for the day



  21. Links 1/5/2016: Wine 1.9.9, Devuan Jessie 1.0 Beta

    Links for the day



  22. The US Patent System: Where One Wastes Years in Court and Spends $8,000,000 in Lawyers' Fees Fighting a Bogus Patent

    A roundup of news about software patents in the US and what they have led to, owing in part to the USPTO's declining patent quality (leaving others to clean up its mess)



  23. The European Patent Office Still Silently Abusive, Will Pay $15,000 in Compensation to Female Worker After Belated ILO Judgment

    The International Labour Organisation (ILO) issues a judgment on a case of abuse by the EPO and notes "excessive length of the internal appeal proceedings."



  24. [ES] Alice Continúa Quebrando Patentes de Software Asi Que los Abogados de Patentes, Cabilderos de los Monopolistas, Etc. Ahora Atacan a la Corte Suprema por Hacer Esto

    los cabilderos Corpórativos y abogados de patentes están tratándo de poner a Alicia en la tumba, por su impacto en las patentes de software que es muy profundo y así hasta ahora casi indetenible



  25. [ES] ¿Cómo Salvar la Reputación de la EPO?: Crear Más Jurados de Apelaciónes en Europa y Abolir la Malgíada/Malintencionada Fantasía de la UPC

    Una crítica evaluación de lo que ocurre en la Oficina Europea de Patentes (EPO), la que rápidamente se está yendo para abajo (y degradando sobre todo) a el nivel de los sistemas Chinos, en conjuntamente con corrupción, los abusos, y la bajísima calidad de las patentes



  26. [ES] La Corte de Apelaciónes del Circuito Federal (CAFC) Acaba de Ponerse a Favor de los Trolles de Patentes

    la tristémente célebre CAFC, que manifestó las patentes de software en los EE.UU, acaba de dar un regalo a los trolles de patentes quienes típicamente usan las patentes de software para extorsión enc complicidad con los jueces del Este de Texas



  27. [ES] Análisis de los Últimos Datos de Lex Machina Acerca de la Litigación de Patentes Muestra Como está Declinándo

    el Professor Mark Lemley de Lex Machina resalta las tendencias en litigation al colectar y analizar datos relacionados con patente y concerniéntes a monopolios intelectuales en general; actualmente muestra una sequía de litigaciones (muestran que ha disminuído)



  28. [ES] La India Está Teniendo Otra Prueba de los Peligros de las Patentes Occidentales, Debe Aprender a Rechazar Completamente las Patentes de Software en Medio de Gran Presión

    El gigante de software que es la India continua enfrentándos ea la cruel y agresivo cabildeo de Occidente, haciéndo que este controle a la India por patentes que no deberían de existir en primer lugar



  29. [ES] Microsoft Dice que Continuará Extorsiónando a Compañías Que Distribuyan Linux, Usando Patentes de Software Usuallmente

    La guerra de Microsoft contra Linux, una guerra que es peleada usando patentes de software patents (por ganancias y/o por chantáje con arreglos empaquetados), todavía continúa a pesar de todas las tácticas de relaciónes públicas de Microsoft y sus sócios



  30. Alice Continues to Smash Software Patents So Patent Lawyers, Monopolists' Lobbyists Etc. Now Attack the Supreme Court for Doing This

    Corporate lobbyists and patent lawyers are trying to put Alice in the grave, for its impact on software patents is very profound and thus far almost unstoppable


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts