NSA Releases Security-Enhanced Android 81
An anonymous reader writes with the recent news that, in line with its goal to provide secure phones to government employees in various domains, "The NSA has released a set of security enhancements to Android. These appear to be based on SELinux, which was also originally created by the NSA."
Enhancement, from the NSA? (Score:1, Troll)
Another platform, more backdoors?
Re:Enhancement, from the NSA? (Score:5, Funny)
One source said it has twice as many backdoors as SELinux. Another source said ten times as many.
I think they're both correct.
Re: (Score:2)
Re: (Score:2)
*sigh*. Think about it for a moment. For which values of x is it true that 2x == 10x?
Re: (Score:2)
Re: (Score:1)
One source said it has twice as many backdoors as SELinux. Another source said ten times as many.
I think they're both correct.
Wait, if it has both twice as many backdoors as SELinux and ten times as many, wouldn't that imply both have zero backdoors?
Re: (Score:1)
Obviously you don't understand binary or English.
Re: (Score:2)
Nobody said "ten", decimal "2" is represented in binary as "10".
Nobody said "ten", but the OP wrote "ten", if you really insist on being pernickety.
Re:Enhancement, from the NSA? (Score:5, Insightful)
SELinux Android is OSS, same as SELinux. Look at the code yourself if you are convinced there are backdoors. That is part of the point of OSS after all.
Re:Enhancement, from the NSA? (Score:5, Insightful)
You're joking, right? Do you honestly think that, if someone were injecting a flaw, they would inject a flaw that was readily discoverable? No. Of course not. They'd introduce some miniscule mistake in some random number generator that makes the result no longer be quite uniformly distributed in such a way that the error is only detectable by performing thousands of calls and doing heavy math on them, thus enabling a side channel attack on the randomly generated symmetric keys used for SSL or some such.
Re:Enhancement, from the NSA? (Score:5, Funny)
While I don't necessarily disagree with your premise; could I interest you in one of my new security enhanced tinfoil hats?
Re: (Score:3)
The politically correct term is: "Magnetically Shielded Helm" or "Induction Resistant Headwear", never "tinfoil hats"...
Re: (Score:1)
While I don't necessarily disagree with your premise; could I interest you in one of my new security enhanced tinfoil hats?
Don't be silly. We all know you can't trust a tinfoil hat unless you folded it yourself from source.
Re: (Score:2)
If this app has its own RNG algorithm in it I'd say that's a pretty big red flag already.
Re: (Score:1)
The algorithms for RNGs are quite simple and hardly easy to program in a flaw that would survive a review at that level. Entropy gathering, that's more complex but entropy is usually assumed to be non-uniform so we have some nice simple methods for converting it to be uniform. Also non-uniform RNGs would be detected in scientific work rather quickly and it's quite easy to test for statistical flaws by making a few hundred thousand random numbers.
Now, some package maintainer commenting out the line in OpenSS
Re: (Score:2)
You'd think this would be detected rather quickly. Unfortunately, history [wikinews.org] disagrees with you. It took almost two years. And this one wasn't even deliberately obfuscated by anyone.
Re: (Score:1)
That was the incident I was referring to. In that case valgrind points it out rightfully as uninitialized memory, a patch to initialize it was reviewed by the OpenSSL team in 2003 and rejected with the stated reason that the PRNG used the uninitialized data as part of the entropy (they even have an FAQ entry for it). The Debian maintainer for OpenSSL proceed to patch the code in their build script later in 2006 by actually removing the call to the function! So in this case the bad patch wasn't reviewed by a
Re: (Score:2)
Having done a little tinkering in this area myself, trust me. The Internet is not working very hard on this.
Re: (Score:2)
Re: (Score:2)
The issue is not skilled eyes or appropriate eyes, but eyes at all, no-one is looking because it works..
The code does get security audited, by professional companies, often the same ones that audit closed source systems, it does get regression tested, but mostly by the people who wrote it ...
The flaw is that no-one is really looking for bugs in code that works, but that is also true of closed source systems ..
Re: (Score:1)
Re:Enhancement, from the NSA? (Score:5, Informative)
I recommend you look at some of the examples of winning entries. It's amazing what these people have come up with. No number of eyes will find it. Simply put, even if it's a popular open-source project, thousands of eyes are likely to miss a well-placed backdoor like these. And if anyone is capable of doing it, the NSA certainly is.
Still don't believe me? How about the OpenSSH PRNG flaw [cyberciti.biz] that went unnoticed for two years, despite being used in servers all over the world. It was due to someone removing what appeared to be a useless line of code, but that code was actually adding some necessary extra entropy to the random number generator. It might've been an accident, or malicious. But the point is it happened, and on a high-profile project.
Re:Enhancement, from the NSA? (Score:4, Interesting)
Of course they can hide a backdoor in it. But why bother when they already have nearly unlimited powers due to the PATRIOT act, have many corporations that will bend over backwards for the police state, and laws like CALEA.
Re:Enhancement, from the NSA? (Score:5, Insightful)
Capable? Yes. The NSA hires geniuses. But so do foreign nations, various companies, and universities. If we're going to indulge in an encomium of the extraordinary competence of the NSA, though, the most honest praise would be for an NSA imagined as most likely trying to provide genuine security with this effort, not backdoors, which open up the possibility of breaches or discovery.
Consider the NSA's purpose in making a secure version of Android: it's a system built by geniuses to be operated, in the end, by idiots, who are targeted for attack by other geniuses. From the NSA's perspective, there are two opponents: the brilliant Enemy and the Friendly moron. Leaving a backdoor, however well-obfuscated, provides the brilliant Enemy with an avenue for taking advantage of the Friendly moron who violates security procedures for his ill-conceived convenience. Backdoors allow breaches, and the NSA has to be smart enough to know that there are enough geniuses out there working for the other side(s) to find one and exploit it.
Consider also the fallout if a backdoor were to be discovered in the NSA's source code. Geniuses will be reading this code, if for no other reason than because it demonstrates the NSA's thinking. If someone found a backdoor and, instead of exploiting it or selling it to exploiters, decided to publicize it as an example of a purposeful NSA backdoor, the NSA would lose immense credibility. What kind of turf and funding wars would they face then, if the rest of the government agencies lost trust in them? Would the much-vaunted geniuses of the NSA consider that risk acceptable?
It's in the NSA's interest not to introduce even well-obfuscated backdoors in this product. It is in their interest to have such facilities available in consumer-grade products and exports, and God only knows what's baked into the phone companies' customized builds that they've compiled and installed onto a consumer-grade phone. It is not, however, useful to them to have such access in source code that is publicly available to be read by people looking for problems or compiled by people smart enough to know what they're doing.
If the NSA really is as smart as we'd all like to believe, they'll make this an honest, open, secure product without backdoors or traps. They'll make a product that will solidify their place in the government funding arena as the authority in hardened security.
Re:Enhancement, from the NSA? (Score:4, Interesting)
while mainly correct, your proposition ignores the fact that in programming you have a lot of plausible deniability in form of the programming mistake. A wrongly placed comparison or wrongly compiled regexp can have huge side effects while looking like little mistypes even a good albeit tired dev would make. Now think that by implanting such a small discrepancy into a big project you could do very many things without being ever detected. Also the side effects of such a behavior are very difficult to follow in a big project making the possibilities of it being forcibly discovered ridiculous since you would have to follow every reroute into oblivion before being sure there are not deliberate side effects.
Re: (Score:1)
your proposition ignores the fact that in programming you have a lot of plausible deniability in form of the programming mistake
You do. I do. The NSA don't. Seriously -- if you heard there was a "bug" in NSA-provided code that effectively allowed back door access to people's phones, would you consider for more than a couple of seconds the possibility that it was accidental?
Re: (Score:3)
You kind of have to at least acknowledge the fact that somebody could just have screwed up, it still is just "sacks of mostly water" that write those programs. That, of course, if you aren't pathologically paranoid.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
BTW the UCC hasn't been updated in two years? the last contest post is from early 2010 and there is no winners anouncement.
Re: (Score:2)
Re: (Score:2)
No such thing... You probably meant OpenSSL, but I doubt a typo made you omit the fact that this was ONLY in the Debian packages of it, and worse, they were warned the patch was a terrible idea and ignored the advice.
Is it secure from the NSA et al? (Score:3, Interesting)
The question is what backdoors have they placed on it. Is it secure from themselves (NSA) and other three letter agencies?
Re:Is it secure from the NSA et al? (Score:5, Insightful)
Considering Android was pretty much swiss cheese to begin with, you'd have to wonder why they'd bother.
And the risk involved in doing something like that and releasing it all as source code makes even less sense.
No, I think the simple truth is the NSA realizes that being secure is hard work. Even people whos lives depend on it get it wrong. The average schmoe hardening up their smartphone is still going to fall prey to an easily shoulder-surfed password. Or the XKCD $5 wrench. Or all of the data that goes thru the boot-licking telecom companies. Or... or...
No, this is probably the real deal. The NSA guys hate Blackberries as much as the rest of us and are looking for approved replacements.
Re: (Score:3)
And the risk involved in doing something like that and releasing it all as source code makes even less sense.
If you believe in security through obscurity, then yes that would make no sense to you.
Re:Is it secure from the NSA et al? (Score:4, Interesting)
Unless the "security through obscurity" is to make the OS more widespread, and so make actual NSA phones less obvious targets. One thousand "sensitive" phones amongst an install base numbering one hundred thousand slashdotters and tinfoil hatters is a good starting point.
Re:Is it secure from the NSA et al? (Score:5, Informative)
NSA is made up of two sections; one does cryptanalysis (i.e. signals intelligence), the other provides crytographic help for the government (and the public), often being at the cutting edge of cryptographic research.
SHA1 and SHA2 were NSA designed; do you trust those?
In any case it's open source (info page is here: http://selinuxproject.org/page/SEAndroid . currently down; use google cache)
The NSA has a good track record too (Score:5, Informative)
Take a look at DES. There was a big to do about the NSA "messing" with the S-boxes in DES. People conspiracy theoried that they had weakened it so they could crack it. Nobody at the NSA or IBM (who made DES) would say anything about it. The, in 1990, differential cryptanalysis was discovered by public researchers and it turned out the DES S-boxes were way more resilient to it than had then been random. Turns out IBM and the NSA knew about it back in the 70s, but the NSA asked IBM to keep a lid on it. The NSA's changes made DES more resilient.
Time has borne it out too. DES is decades old now and there has been no magic break in it discovered, no "backdoor" that would let people in, it is just too short a key to be useful anymore.
Along those lines, the NSA has signed off on AES (which was originally developed in Finland) as an approved standard to be used for classified data and said that AES is good security for the commercial world (which was the point of the AES standard). Again, time seems to bear them out on that, it is the most analyzed cryptosystem out there, and nobody has found any "backdoor" in it.
While there's no doubt the NSA takes their signals intelligence mission seriously, they seem to take their security mission seriously too. Their track record so far is excellent. Everything they've released has stood the test of time.
Now I suppose it is possible in theory that they are so far advanced of everyone else, and so arrogantly confident in their superiority, that they have hidden "backdoors" they figure nobody will ever notice... However if they really were that much better, would they need to?
Re: (Score:1)
AES Finland? (Score:3, Informative)
No Sir, you must be joking. AES ie. Rijndael comes from Belgium.
AES [wikipedia.org]
Re: (Score:1)
Re:Is it secure from the NSA et al? (Score:5, Funny)
or just direct a satellite to read the reflections on your glasses.
Sorry, we're talking about the NSA, not CSI.
This is probably appropriate too. [youtube.com]
Re: (Score:1)
or just direct a satellite to read the reflections on your glasses.
Sorry, we're talking about the NSA, not CSI.
That's not CSI, that's 007.
Re: (Score:2)
That clip was amusing. What I found even more amusing was clicking one of the YouTube thumbnail videos off to the right side of that page, which lead me to the CSI gem below.
Never seen the show myself but it seems to be a clip where one of the agents is quoted as saying:
Somebody got paid how much to write that? I can only believe some screen-writer slipped that in as an Easter egg for those with a clue. But
Re: (Score:2)
CSI has lots of product placement advertising for MS products. I'd really like to believe it was a hidden joke for techies, but... :-(
Re: (Score:1)
Re: (Score:2)
The funny thing is, all of that IS actually possible IF the camera records the data. Zooming in on photos can reveal details you did not notice when the picture was shown at normal detail levels... however
I am not aware of any consumer or professional grade cameras that are capable of recording that much information in a single frame.
Re: (Score:2)
Re: (Score:2)
Check the source code and let us know. Kinda hard to place a back door in OSS isn't it.
Re: (Score:1)
Seriously, the biggest problem with Android is it's complete lack of filesystem encryption.
And how do you propose to securely decrypt the filesystem at boot? Have a touch screen keyboard as part of the boot-loader?! I'm sure U-Boot will accept your patches....
Re: (Score:3)
Probably not the decryptor function!
Re: (Score:2)
What's wrong with that (apart from the standard PITA factor of on-screen keyboards that most people seem to accept)? They'd have to randomize the keypad layout though to prevent password recovery via fingerprint-lifting.
Re: (Score:2)
The Asus Transformer running v2.3 Honeycomb had full disc encryption. When it started to boot, it would show a virtual keyboard and I'd have to enter my password.
It is a little easier on a tablet, with the bigger screen, but it certainly was possible and not cumbersome.
And yet, ..... (Score:1)
Its funny (Score:4, Insightful)
Yet, for a number of you, you will trust the physical hardware is OK coming in from China. Why on god's green earth, would you trust china, a nation that has more spies running around the world, esp. in the west, then does America, while screaming that America has planted a backdoor in open code?
fembots (Score:2)
many times I read the title and think of something very different, this time it was 'enhanced android', must be a fembot! from Austin Powers.
BACKDOOR (Score:1)
Another noose for the dev manufactorers. (Score:2)
Anything that removes potential security flaws from android is a double edged sword. Its many of those flaws that allow us to get root and install custom roms.