EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

02.24.14

The Increasing Danger of Back Doors in Standards and Binary Blobs

Posted in Apple, GNU/Linux, Microsoft, Security at 9:06 am by Dr. Roy Schestowitz

Summary: The risk of back doors in GNU/Linux comes not from source code but from blobs, back room deals, the build process, and bogus standards with weaknesses cleverly shoehorned into them

IT HAS BEEN a while since we last wrote about Mr. Srinivasan from Microsoft-Novell. Suffice to say, Novell did a lot for Microsoft and some former staff of Novell continues to work for Microsoft (either directly or indirectly). One gift from Novell to Microsoft was OOXML inside FOSS/OOo. Another was Mono and let’s not forget intrusion into Linux itself. Robert Pogson goes as far as saying that Microsoft “Hacked Linux!”

“My configuration,” Pogson argues, “has CONFIG_HYPERV not set. The code in question is Copyright 2010, Novell (mshyperv.c), and Copyright 2009, M$ (vmbus_drv.c). K. Y. Srinivasan is listed as one of the authours on both. I’m not about to run that other OS on Beast, but thank you, Thomas Gleixner, for fixing things.” (see this link)

Performance issues overlook the much bigger problem — a problem which we addressed several times before. We already know that the NSA is pursuing back doors in Linux [1, 2, 3, 4] and as we pointed out before, the NSA might already have some.

incidentally, as we have shown before, Yahoo was fighting against NSA surveillance in court. When Microsoft took over Yahoo it became apparent that Yahoo stopped fighting and soon became part of PRISM. While some new reports suggest that Yahoo might be ready to escape Microsoft “Yahoo is still in NSA’s pocket though even if they break free of Microsoft,” explains iophk.

Likewise, even if Linux does not engage with Microsoft, the code from Microsoft remains stuck inside Linux and even if there are no back doors in the code itself, this connects to a system, Hyper-V, which is developed by a back doors specialist (Microsoft). There are binary-level back doors from which to access GNU/Linux systems because if the host machine runs Windows, then we already know that the NSA has access. A nearby company that I once visited, UKFast (the UK’s largest ‘cloud’ provider), runs GNU/Linux servers under HyperV, based on what they told me. How insane is that?! GCHO must love it!

Adding to some concerns about back doors, NSA ally and PRISM partner Apple turns out to have hidden a back door. As Think Progress puts it, “Apple quietly released a major update Friday to fix a security glitch in its iOS 7 systems. But independent security experts say the seemingly routine update covers up what arguably could be Apple’s biggest security lapse, exposing iPhone, iPad and iPod Touch users to hackers.”

Whether it’s a back door or just direct access does not matter, but it enables Apple to dance around important questions. It works across several Apple platforms, even desktop platforms [1].

As iophk put it, in relation to this other new article [2] “Potential problems with an official back door in HTTP 2.0, though only in a proposed draft so far. But because of the ways certificates are currently (mis-)managed, this kind of interception of HTTPS is already easy.”

“See one example with four steps,” he added, pointing to [3] from the OpenBSD mailing lists.

It’s not as though GNU/Linux is immune to back doors (Debian has some new security advisories [4,5]), but at least with access to source code the back doors remain very shallow and too risky/difficult for malicious/covert entities to hide. It’s when proprietary software gets added that we lose the ability to ascertain security and privacy.

Related/contextual items from the news:

  1. Apple SSL Vulnerability Affects OSX Too
  2. No, I Don’t Trust You! — One of the Most Alarming Internet Proposals I’ve Ever Seen

    If you care about Internet security, especially what we call “end-to-end” security free from easy snooping by ISPs, carriers, or other intermediaries, heads up! You’ll want to pay attention to this.

    You’d think that with so many concerns these days about whether the likes of AT&T, Verizon, and other telecom companies can be trusted not to turn our data over to third parties whom we haven’t authorized, that a plan to formalize a mechanism for ISP and other “man-in-the-middle” snooping would be laughed off the Net.

    But apparently the authors of IETF (Internet Engineering Task Force) Internet-Draft “Explicit Trusted Proxy in HTTP/2.0″ (14 Feb 2014) haven’t gotten the message.

    What they propose for the new HTTP/2.0 protocol is nothing short of officially sanctioned snooping.

  3. relayd SSL interception

    This mail includes a quite detailed explanation of the attached diff that adds support for SSL Interception (“SSL-MITM”) to relayd. If you don’t want to read the story, just skip to the configuration example and diff below.

  4. Debian: 2862-1: chromium-browser: Multiple vulnerabilities
  5. Debian: 2861-1: file: denial of service
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. The EPO is Collapsing. Attacks on Journalists, Interns as Staff, Patents on Plants, and Bureaucratic Red Tape...

    A look at some of the latest issues surrounding the European Patent Office, whose insistence on denying the problems and instead attacking those who bring up legitimate concerns, will spell its doom



  2. Ignore the Bristows UPC Echo Chamber, the UPC is Not Happening

    Response to some of the latest UPC promotion, courtesy of some of the usual suspects, who stand to benefit financially if the UPC ever becomes a reality



  3. British Media Slams Battistelli for Attempting to Cover Up 2 Years of Juridical Abuses With Help From the Administrative Council of the EPO

    A growing voice of concern about the integrity of the European Patent Organisation, whose management appears to be in cahoots (overseers/regulators included) so as to cover up its own serious abuses



  4. Boards of Appeal Still Under Attack From Team Battistelli While the EPO Proceeds to Granting Patents on Carlsberg BEER!

    The lunacy of the EPO with its patent maximalism will likely go unchecked (and uncorrected) if Battistelli gets his way and turns the EPO into another SIPO (Croatian in the human rights sense and Chinese in the quality sense)



  5. Memo “Deliberately Leaked to Cover up the UPC” With Its Many Associated Issues Amid Brexit

    Some eye-opening updates about the awkward move from Lucy Neville-Rolfe, who made promises (expression of intent) she can neither fulfill nor justify to the British public



  6. Links 8/12/2016: Korora GNU/Linux 25, SparkyLinux 4.5.1

    Links for the day



  7. Links 7/12/2016: ROSA Desktop Fresh R8 Plasma 5, Ubuntu Touch OTA-14

    Links for the day



  8. The UPC Scam Part VII: A Fine Mess in the Making, as Nothing Can be Made of It Amid/After Brexit

    The final part in this multi-part series about UPC, which cannot be implemented in the UK as long as Brexit is on the agenda



  9. The UPC Scam Part VI: The Real Story Which People Missed Due to Puff Pieces Seeded by Battistelli-Bribed Media is That UPC Technically Cannot Come to the UK

    Another long installment in a multi-part series about UPC at times of post-truth Battistelli-led EPO, which pays the media to repeat the lies and pretend that the UPC is inevitable so as to compel politicians to welcome it regardless of desirability and practicability



  10. EPO Spiraling Down the Drain as Experienced Examiners and Judges Are Seemingly Being Replaced by Interns

    Implementing yet more of his terrible ideas and so-called 'reforms', Battistelli seems to be racing to the bottom of everything (patent quality, staff experience, labour rights, working conditions, access to justice etc.)



  11. A Lot of News From the Supreme Court (SCOTUS) Today, With Some Important Decisions on Patents Coming Soon

    A roundup of today's outcomes from the US Supreme Court, which intends to review and decide on important patent cases



  12. In Historic Blow to Design Patents, Apple Loses to Samsung at the Supreme Court

    A $399 million judgment against Android devices from Samsung, with potential implications for other Android OEMs, is rejected by SCOTUS



  13. Good Riddance. Ray Niro is Dead.

    The infamous father of patent trolling is dead, so we need to remember his real legacy rather than rewrite his history to appease his rich relatives (enriched by destroying real companies)



  14. EPO Suicides Greater in Number Than is Widely Reported, Unjust System a Contributor to These

    The horrible regime of Benoît Battistelli has an enormous human toll (fatalities), far greater than the Office is willing to publicly acknowledge



  15. Lobbying Disguised as 'Reporting' by the Patent Microcosm, Which Wants More Patents and More Lawsuits (Lawyers Needed)

    A rebuttal to some new articles about patents, especially those that strive to increase patent-related activities (usually for personal gain)



  16. USPTO Echo Chamber That Lacks Actual Software Professionals Deciding on Patentability of Software

    A look at yesterday's "Roundtable on Patent Subject Matter Eligibility," which lacked involvement from those actually affected by patents rather than those who sell, trade, and exploit these



  17. More Examples of Microsoft and Its Patent Trolls Taxing Linux, Even After Microsoft 'Joined' (Paid) the Linux Foundation

    A quick look at the past week's news and clues about Microsoft's (and its broad army of patent trolls) strategy for taxing Linux, or imposing bundling at zero cost (to Microsoft)



  18. Heiko Maas, the SPD “Cash for Access” Affair, and Suspicions of Unwarranted Censorship at IP Kat (Again)

    Unsayable views or just a glitch? Readers of IP Kat express concern about a culture of censorship at IP Kat



  19. Endgame for Battistelli at the European Patent Office (EPO)

    Battistelli turns bad into worse by spitting on the very notion of accepting justice (from the highest court in The Hague or even the UN in this case)



  20. Les Échos Chamber: Having Corrupted the Media (With EPO Money), Battistelli Now Uses It for More UPC Propaganda

    The lies about the Unitary Patent are now being broadcast (Battistelli given the platform) by the publication that Battistelli pays



  21. Rumour: EPO in Berlin the Next Casualty of Battistelli's 'Reform' (Organisational Suicide Plan)

    Months after we learned that a former staff representative in Berlin had been dismissed we come across an anonymous claim that Berlin's 'branch' of the EPO will be folded onto Munich's



  22. Caricature: the Maas App

    The failure of Maas to even bother with regulation of Battistelli (among others) earns him this cartoon



  23. Links 5/12/2016: Linux 4.9 RC 8, DeepMind as FOSS

    Links for the day



  24. Leaked: Battistelli Acknowledges Bunk 'Justice' in About 100 Cases at the Internal Appeals Committee of the EPO

    A look at Battistelli's response to the latest from the International Labour Organisation (ILO), exceptionally delivering two decisions at the very end of last month



  25. The UPC Scam Part V: Unitary Patent Regime a Fantasy of Patent Trolls

    "Good for trolls" is a good way to sum up the Unitary Patent, which would give litigators plenty of business (defendants and plaintiffs, plus commissions on high claims of damages) if it ever became a reality



  26. EPO at a Tipping Point: Battistelli Quarrelling With French Politicians, Administrative Council Urged to Act, Staff Unrest Peaking

    The latest messages about Battistelli's regime at the EPO, which faces growing opposition from more directions than ever before



  27. Quality of Patents at the EPO Dependent on the Appeal Boards When Battistelli Assesses Performance Using the Wrong 'Production' Yardstick

    A look at some recent articles regarding patent quality in the US and in Europe, in particular because of growing trouble at today's EPO, which marginalises the appeal boards



  28. Microsoft's Push for Software Patents Another Reminder That There is No 'New' Microsoft

    Microsoft's continued fascination with and participation in the effort to undermine Alice so as to make software patents, which the company uses to blackmail GNU/Linux vendors, widely acceptable and applicable again



  29. Links 5/12/2016: SparkyLinux 4.5 Released, Kondik Exits Cyanogen (Destroyed After Microsoft Deal)

    Links for the day



  30. Software Patents Continue Their Invalidation Process, But Patent Law Firms Try to Deny This in Order to Attract Misinformed (or Poorly-Informed) Clients

    A roundup of news about software patents and demonstration of the sheer bias in the media, which is mostly controlled or steered by the patent microcosm rather than actual inventors


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts