Is Linux SSL/TLS Flaw an NSA Backdoor?

A code audit conducted by Red Hat in February uncovered a critical bug in the SSL/TLS security implementation in Linux (Secure Socket Layer/Transport Layer Security). This followed a similar bug found in Apple products last month.

The flaw allows an attacker to gain access the SSL/TLS stack which encrypts data being transferred between two points on a network (like the Internet) through a fraudulent security certificate. SSL is used for everything from securing your banking transactions to protecting your email and chats.

The bug effects not only Red Hat but most every Linux distribution and has been in place for a decade or more. The amount of software which uses this protocol and may have to be updated could be staggering.

TLS is an updated form of SSL and uses a protocol developed by the IETF (Internet Engineering Task Force), which was developed in 1999 and updated in 2008 and 2011. (Interestingly, a Snowden leaked documents from 2012 show the NSA had recently added Apple users to it's list of compromised systems.)

Chrome and Firefox users are safe from this bug as they use OpenSSL, which is not affected by this vulnerability.

How could such a gaping hole go so long without being discovered in Open Source software? Don't 'many eyes make all bugs shallow?'

According this article in PCWorld, to David Walser, a security manager for Mageia Linux, explained,

“The code is extremely complicated. Even though the code is freely available for review, only a select group of people would be qualified to accurately analyze and understand the whole system well enough to catch such a subtle bug. It’s also not the type of vulnerability that can be found by automated analysis tools, requiring manual scrutiny instead."

In September of 2013, Linus Torvalds caused a stir in the Linux community when he indicated, through a nod of the head, that the NSA had requested a back door into Linux systems.

Following news of the hint, Linus is reported to have said he was joking. Was this retraction due to the Linux community not getting the joke or was it due to legal advice? Linus is not known for his sense of humor. Rather, he is known for being honestly blunt, sometimes a bit too blunt.

The question has hung in the air ever since: Is there a backdoor in Linux?  And is this SSL/TLS vulnerablity an NSA backdoor?

The FBI has been obsessed with breaking encryption for more than a decade. Leaked documents by Edward Snowden have shown the NSA went to great lengths to access encrypted data. From pressuring companies to install government accessible back doors or provide encryption keys or stealing keys from those who did not cooperate. According to the NY Times:

"The N.S.A. hacked into target computers to snare messages before they were encrypted. In some cases, companies say they were coerced by the government into handing over their master encryption keys or building in a back door. And the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world."

There was also a purported back-door in the OpenBSD operating system, which was disclosed on a mailing list in December of 2010. The writer stated that his non-disclosure agreement had recently expired and he wanted everyone to know that security holes had been intentionally placed in the system:

"My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI."

No known back door was found in FreeBSD when this was reported. But the time frame and data targeted fits with the decade old flaw recently disclosed in Linux systems.

We don't know if this huge security flaw was intentionally placed in Linux systems or it was a coding error. No one can say how it got there. But no one can dispute that it has existed unnoticed for a very long time.

A patch for the bug has been rolled out and is available for most Linux distributions. Update your system now.

Thank you to Red Hat for finding and disclosing this bug. This shows without a doubt that open code does not guarantee security. And automated tools for finding flaws is no substitute for trained eyes.

The days of "Many eyes make all bugs shallow" may be true for actual bugs, but what of intentional vulnerabilities which have been carefully obfuscated or a small but profound mistake in millions of lines of code? Perhaps the adage needs to be changed to reflect the level of complexity in today's code: "Qualified eyes make all bugs shallow."

freedigitalphotos.net/twobee

Can Linux Be Trusted? Linus Confirms NSA Backdoor Request

NSA Headquarters (from Wikipedia)

At the keynote speech at LinuxCon, Linus Torvalds, creator and lead developer of the Linux kernel, was asked if the National Security Agency (NSA) had asked him to insert a backdoor into the popular open source operating system. Linus responded by nodding yes while saying the word, "no," implying that he had been asked to do so, but was not able to discuss it.

This has caused quite a stir in the Linux community, who has always considered the 'open' nature of the source, that is, anyone can view the code, would make it impossible to hide such a deliberate security hole. But how many actually have looked at the kernel code and how many could identify such a backdoor in the millions of lines, especially if care were taken to obfuscate the process?

This commenter spoke for millions of Linux users when replying to this article on the subject from e-week:

"What they should have asked is: Did you, in fact put a backdoor in the Linux Kernel?"

And there was this:

"All further development on the kernel, modules, etc... should be halted until a thorough audit has taken place by those skilled enough to do so. Linux is no longer trustworthy"

Sound paranoid? Perhaps not so much. Lets look at some facts we know to be true.

NSA Thwarts Encryption Through Influencing Standards, Hacking, Inserting Backdoors:

Recently leaked documents from Edward Snowden show a concerted effort by federal agencies to access encrypted data, either through pressuring companies to install backdoors and provide encryption keys, stealing keys from company servers or hacking the computers of end users. According to this article from the NY Times:

"The N.S.A. hacked into target computers to snare messages before they were encrypted. In some cases, companies say they were coerced by the government into handing over their master encryption keys or building in a back door. And the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world."

A leaked NSA memo from 2006 showed that the NSA managed to not only influence encryption standards, but was able to become the creator and sole editor and pressure international standards groups to ratify it. A year later, a 'fatal' security hole was discovered in the new encryption standard. It appears the security hole was actually a purposeful creation of the NSA.

NSA Scoops Up Google, Facebook, Apple, User Data 

The Guardian reports the NSA has gained direct access to servers used by Internet tech giants to collect user data. The companies either dispute this is true or maintain they have no knowledge of such access. Google responded with this statement:

"Google cares deeply about the security of our users' data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government 'back door' into our systems, but Google does not have a back door for the government to access private user data."

Their cooperation with of thousands of FISA Court subpoenas has been widely reported and several companies, eager to reassure nervous customers, have filed a law suit requesting permission to disclose to users what data they have disclosed to the Fed. (See Google, Microsoft, Facebook Sue for More NSA Transparancy, 08/31/2013)

Windows 8 'Trusted Computing' Not So Trustworthy:

Ziet.de is reporting that German government IT officials contend the new 'trusted computing' built into Windows 8, which is supposed to protect against trojans and viruses can be used as a snooping device for the NSA. German government officials suggest staying with Windows 7 for the time being. According to this Business Insider article:

"Experts at the BSI, the Ministry of Economic Affairs, and the Federal Administration warned unequivocally against using computers with Windows 8 and TPM 2.0. One of the documents from early 2012 lamented, “Due to the loss of full sovereignty over the information technology, the security objectives of ‘confidentiality’ and ‘integrity’ can no longer be guaranteed.”

Microsoft Opens Outlook, Hotmail, Skype and SkyDrive to NSA Snooping: 
According to this article in The Guardian, Microsoft has worked closely with NSA and made changes to popular e-mail and video phone programs to make it easier for NSA to obtain full access to user emails and voice communications. According to the article:

• The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;
• The company worked with the FBI this year to allow the NSA easier access via Prism to its cloud storage service SkyDrive, which now has more than 250 million users worldwide;
• Microsoft also worked with the FBI's Data Intercept Unit to "understand" potential issues with a feature in Outlook.com that allows users to create email aliases;
• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;
• Material collected through Prism is routinely shared with the FBI and CIA, with one NSA document describing the program as a "team sport".

NSA Collects Millions of Internet and Cell Phone Records
In this report from The Guardian shows Verizon is collecting millions of customer phone record 'metadata' by order of a secret FISA court.  Normally, the national security court requests information on specific customers but this order is significant due to its sweeping nature. According to The Guardian's report:

The order, a copy of which has been obtained by the Guardian, requires Verizon on an "ongoing, daily basis" to give the NSA information on all telephone calls in its systems, both within the US and between the US and other countries.

Lest customers of other cell phone and Internet companies feel safe, you can probably assume your company is also under some type of similar order. It was only a few years ago when it was disclosed that AT&T had a secret switching room devoted to collecting all internet and phone traffic coming through it's hub in San Francisco then sending the data on to the NSA. According to the Electronic Frontier Foundation (EFF):

"The undisputed documents show that AT&T installed a fiberoptic splitter at its facility at 611 Folsom Street in San Francisco that makes copies of all emails web browsing and other Internet traffic to and from AT&T customers and provides those copies to the NSA. This copying includes both domestic and international Internet activities of AT&T customers. As one expert observed, “this isn’t a wiretap, it’s a country-tap.” Secret government documents,  published by the media in 2013, confirm the NSA obtains full copies of everything that is carried along major domestic fiber optic cable networks."

FBI Consultant Claims Backdoors in Open BSD Operating System

In December 2010, man who had worked on funding the Crypto Framework in the Open BSD Operating System claimed the FBI had inserted several backdoors into the Open BSD code a decade before. He said he could not disclose the information before that time because he had to comply with a ten year Non-Disclosure Agreement (NDA). 

In an email to Theo, de Raadt, Gregory Perry, who says he was an FBI consultant working on cryptography for NETSEC, writes:

"My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI."

To my knowledge, no backdoor was found in Open BSD when this was disclosed ten years later. Whether it existed at one time and was quietly removed or if Mr. Perry is being untruthful is left to the reader to decide. In light of the governments obsession with breaking or bypassing encryption (see above) it certainly seems plausible.

What about Linux? 
At this point, we don't know. Linus isn't allowed to tell and hopefully he won't get into trouble with the Feds for the 'heads-up' he gave the community already. I am sure there will suddenly be many more people taking an interest in the Linux kernel or other components in the operating system which may be vulnerable to snooping.

There is an adage in the Open Source Community that "many eyes make all bugs shallow" (Ironically, this is known as 'Linus's Law') Lets hope that applies to backdoors too and if such a thing exists in Linux, it is discovered and (dis)closed very soon.