NSA Backdoor in Windoze OSs

[akinrog]

Dear Friends,

The following link indicates NSA and many US-based software companies incorporate secret backdoors in the OSs and many products.

http://www.heise.de/tp/r4/artikel/5/5263/1.html

Regards,

[Jacks Complete]

It's dated 1999, so it might well have been changed by now. Then again, the rate that MS patches critical security holes is pretty slow. (Funny how they arms-race against cracks in thier DRM inside of hours...)

I guess those unusual cash transactions going through your bank account can be blamed on the NSA now.

[akinrog]

It's dated 1999, so it might well have been changed by now. Then again, the rate that MS patches critical security holes is pretty slow. (Funny how they arms-race against cracks in thier DRM inside of hours...)


Actually I have found this link amongst many links with regard to Vista, but for some reason I don't know, I chose this one and I'll be damned if I could ever find the other ones again.

A few years ago, when XP first emerged, there was an article in a famous computer magazine stating that there are secret users which can be used as back doors and indicating that how they are disabled? :eek:

[ShadowMyGeekSpace]

Windows has enough holes in it anyways... who care's? It's not a secure operating system, and was never designed to be in the first place. Now it's just Micro$oft trying to add security years later, and they're failing miserably.

[akinrog]

Windows has enough holes in it anyways... who care's?

The problem is not security, in the article (and the other articles, I have read like this (http://watchingamerica.com/diewelt000013.shtml)) the authors say, the MS incorporated secret codes (programs) and keys into ADVAPI and crypto api libraries which means the cryptographic keys you are producing with them are either insecure or have a backdoor incorporated therein, thereby compromising your trusted encrypted messages, encrypted disk volumes and anything involving encryption.

This is the serious threat. Assume that, you downloaded many controversial files (like federoff) etc. into an encrypted volume/disk you have on your computer which you trust to be secure and government snoops use their magic key and determines the contents of that encrypted volume/disk.

Or by means of backdoors they enter into your computer without alerting AV/firewall software and recording your keystrokes (via keyloggers) or takes pictures of your desktop (for defeating virtual keyboards). You (i.e. we) are simply f*cked. :eek:
That's what I'm talking about. Regards.

[Cindor]

If you people are so worried about your privacy then you should try using any Linux based OS.

[Jacks Complete]

The odds of a Linux distro being any more secure against an attack like this is low. I can assure you that few enough people know how to write a good strong crypto system that the NSA will have simply gone all out to break each of the new ones as they come to market. Then, everyone who uses, say, Blowfish, they send them to the Blowfish decoder, PGP goes to the PGP decoder, etc.

Don't forget they have a budget far beyond measure, and about half the world's good crypto guys. If crypto is your only security, you would be crazy. It is only ever an adjunct.

[Alexires]

Use a stand alone PC to store your stuff on. If you can't afford it and you think you may need to hide your stuff, steal one.

Combined with a booby trapped Box/HD as well as an external power on switch that runs through a keypad/biometric and your laughing.

[akinrog]

... each of the new ones as they come to market. Then, everyone who uses, say, Blowfish, they send them to the Blowfish decoder, PGP goes to the PGP decoder, etc.

Don't forget they have a budget far beyond measure, and about half the world's good crypto guys. If crypto is your only security, you would be crazy. It is only ever an adjunct.

I don't think they could forcibly decrpyt ciphertext and recover the key using supercomputers each time they get an encrypted message, provided that you use geniunely cryptographically strong keys and algorithms (like asymmetric algorithms) and further provided that they did not find some esoteric numerical solutions for breaking them.

However, if your keys (created by using Windoze's built-in crypto api) are not as cryptographically strong as they supposed to be, then it takes a few hours of a simple desktop PC to crack your encrypted message not a few years (months?) of a supercomputer.

[ShadowMyGeekSpace]

The problem is not security, in the article (and the other articles, I have read like this (http://watchingamerica.com/diewelt000013.shtml)) the authors say, the MS incorporated secret codes (programs) and keys into ADVAPI and crypto api libraries which means the cryptographic keys you are producing with them are either insecure or have a backdoor incorporated therein, thereby compromising your trusted encrypted messages, encrypted disk volumes and anything involving encryption.This only affects the microsoft crypto libraries... aka useless, unused libraries now-a-day's within software. This doesn't affect OpenSSL libraries, for example. Noone builds against Microsoft's SSL implimentation but Microsoft, because it's outdated and has enough holes of it's own, as stated previously.

This is the serious threat. Assume that, you downloaded many controversial files (like federoff) etc. into an encrypted volume/disk you have on your computer which you trust to be secure and government snoops use their magic key and determines the contents of that encrypted volume/disk.This isn't a serious threat. EFS never has been secure because of the way it works. All they need is your Windows password to access the NTFS-EFS encrypted files, and they can get that by bruteforcing your %systemroot%\system32\config\SAM file using commonly available programs such as LC5 or mdcrack. There's also applications that will directly brute force the files themselves. (http://www.google.com/search?hl=en&q=efs+brute+force&btnG=Google+Search) If you want a true cryptographic filing system, then there's Truecrypt. (http://www.truecrypt.org/) Nobody who has a clue uses NTFS-EFS.

Or by means of backdoors they enter into your computer without alerting AV/firewall software and recording your keystrokes (via keyloggers) or takes pictures of your desktop (for defeating virtual keyboards). You (i.e. we) are simply f*cked. :eek:Guess what, they can do this with any exploit within windows. See http://milw0rm.com/platforms/windows for some of the latest.

As I've said, this is no real threat. Don't like the shit microsoft can be doing behind the scenes with internet explorer? Great, get a different browser like firefox (http://www.mozilla.com/en-US/firefox/) or Opera. (http://www.opera.com) Don't like the flawed EFS design? Truecrypt.

This also gos to mention that a software firewall(such as the one provided by Microsoft, or ZoneAlarm, or BlackIce, or any other solution) is flawed by design within windows also, because any program can hook into the ipstack rather easily and bypass the firewall using the same API calls the firewall itself is using, or the software can be sabotaged by whatever rootkit/trojan/worm/virus you find yourself downloading and running. It's a much better idea to setup(or purchase) a NAT router(usually just called a "router" or "hardware firewall"), because anything that isn't explictly forwarded gets ignored, and never hits your computer.

And since we're on the topic of flawed by design, let's bring ourselves to virus scanners(which scan for alot more than viruses). Virus scanners detect old viruses/trojans/worms/what have you, not new ones. Even heuristic analysys doesn't do anything(but waste huge ammounts of system resources) because the malicious software is deliberatly designed to avoid detection during it's 0day period. Viruses, trojans, and worms are a user problem. Assuming you've taken measures to stop the malware from getting into your machine from the outside(I've covered a few of these measures), you have to download them and run them for them to actually do anything. It comes down to a user problem.

I'm willing to bet that I download more games, software, and movies than anyone here. I'm involved with the filesharing scene, and I've been involved with the computer security scene since I was 8. The one time I have gotten a trojan was because my friend will asked me to test his latest toy. It's a user problem. I don't even have an antivirus installed on my machine, and haven't since 1999. When I get a questionable file, there's always http://virusscan.jotti.org/



So, I guess the purpose of this whole long post is to say: People, get informed already and stop [i]trying to hide behind your last line of defense measures that are most always people's first line of defense.



PS: Internet explorer was insecure for 284 days in 2006 (http://blog.washingtonpost.com/securityfix/2007/01/internet_explorer_unsafe_for_2.html), and that's just the exploits that are public.

[Jacks Complete]

Shadow, I can't possibly agree. The one thing about computer security is defense in depth. You need a hardware firewall and a software firewall, and you need a good idea of how they work. You also need to be aware that there are threats out there that can do strange things, regadless of how smart you might be.

A new email threat could blow a hole in your hardware firewall in moments, if it isn't a good firewall, as it will allow *any* properly routed traffic from your PC out onto the net, and let the answers back in. So if your Outlook Express is silently sending 5000 spam a day, because someone found a way to activate it, you will be sat there wondering why Thunderbird seems a little slow today. And until you look at your firewall or port traffic, you will have no idea at all!

I run a mix of things. Nothing catches everything, but having ten eyes is better than 1.

[anonymous411]

I'm a former FFRDC research analyst who's done projects funded by JTF-CNO. If you don't know what that is, here's a link:

http://www.iwar.org.uk/iwar/resources/jtf-cno/factsheet.htm

All I can say is the entire computer "security" industry is corrupt to the core. Not to mention the fact that the backbone of the internet is compromised from the ground up. Two words: AIR GAP. If you don't want it known, don't keep it on a machine connected to the internet.

"Defense in Depth" is great for most situations, but if you think you can keep anything secret online from a determined and well-funded attacker, you're completely mistaken. Nine times out of ten, it's safe to assume nobody really gives a shit about your pissant goings-on, but still. It's that tenth time that matters.

Remember: complacency is the kiss of death. No matter how good you think you are, there's always the possibility somebody out there is better. Never forget the old CI operative saying...nobody is more of an easy target than the guy who thinks he's unfoolable.

[ShadowMyGeekSpace]

You need a hardware firewall and a software firewall, and you need a good idea of how they work.No to the first part, yes to the second.

You also need to be aware that there are threats out there that can do strange things, regadless of how smart you might be.Yes.

A new email threat could blow a hole in your hardware firewall in moments if it isn't a good firewall, as it will allow *any* properly routed traffic from your PC out onto the net, and let the answers back in. So if your Outlook Express is silently sending 5000 spam a day, because someone found a way to activate it, you will be sat there wondering why Thunderbird seems a little slow today.I wouldn't be caught dead using OE. The client issue is there regardless of software firewall presense or not, it does nothing more to stop the attack vector than a hardware firewall. The result of the attack is irrelevant. A few problems with your example:

1) A firewall does not detect machine infection or software-specific exploits.
2) A software firewall cannot be trusted at all once an attack has occured.
3) Because of #2, you can't rely on a software firewall to alert you to a proccess opening a new connection, especially since your example attack vector (a 0day email client exploit) is most likely going to result in the code being executed as an already trusted proccess.
4) The mail client software will be vulnerable regardless of the software firewalls existance.
5) A firewall is not an IDS, and an anti virus suit would not detect a 0day exploit attack such as this. An AV relys on known attack vectors.

In the end, do as you wish - throw your CPU cycles away, I don't care. I'm too baked to rant about how keeping up with software updates is a users responsibility, and how an administrator should be monitoring newsgroups such as bugtraq and nanog, as well as CVE repositories and shit.

[Bugger]

I read somewhere that the "backdoor" that the NSA has in Windows, to enable online snooping into your PC, is a section headed (when decrypted) "NSA key" in the file advapi32.dll, in windows/system. This "NSA key" is in all versions of Windows since Windows 98 and NT4. Only the version in Windows 95 is without it, and later versions of the file are much larger as the result. Try replacing the version of advapi32.dll in later versions installed on a PC with the Windows 95 version, which I happen to have, and see what happens. If anyone wants the Windows 95 version of this file, let me know. (Unfortunately, I cannot see any way to attach files to posts here, so it will have to be emailed).

[Killian]

Someone's been reading Dan Brown's "Digital Fortress".

*nix systems: They're much more reliable security wise. The greatest part is many of them are open source. Allowing anyone to scan through it for possible 'secret code'. Of course most people don't know what to look for, but many do and would be more than willing to report it.

[Defendu]

Unfortunately, I cannot see any way to attach files to posts here,

Click the "Go Advanced" button below the message box at the bottom of each thread, or "New Reply".

As for attachments:

http://i5.tinypic.com/2vw66bs.jpg

Click "Manage Attachments".

[Bugger]

Thanks for the info. Here, attached, is the Windows 95 version of advapi32.dll , which unlike later versions does not contain the backdoor "NSA key" which allows the NSA to snoop on your computer when online. Try replacing the version of the file (much larger, due entirely to the NSA key, I am sure) supplied with later Windows versions, i.e. NT4, 98, 98SE, Me, 2000, 2003 Server, XP, and Vista, in the Windows\System folder. You may have to reboot your PC into DOS, possibly with an emergency boot disk, to do this.

[nbk2000]

As if the NSA requires a special key in the windows O/S to compromise the most buggy O/S on the planet. :p

[Chaosmark]

True, but why waste time when they can just have the company bend you over by proxy?

[Killian]

True, but why waste time when they can just have the company bend you over by proxy?

They certainly wouldn't have a problem with it. They've been bending people over for years!

[sparkchaser]

When "baselining" computers for government use, to include computers using classified info no less, we have to run a baseline applicator tool to help minimize the risks from the Windows OS itself. The program is completely automated and still takes 30 or more minutes to run. It closes down most of the open ports but not all, and still the computer can only be run through layered servers using redhat.

Yes, Windows sucks ass. Any OS that has a port for .jpg files that can be used to take complete control of a computer is just wrong.

[Pollsmoor]

The odds of a Linux distro being any more secure against an attack like this is low.

You're joking... right?

I can assure you that few enough people know how to write a good strong crypto system that the NSA will have simply gone all out to break each of the new ones as they come to market. Then, everyone who uses, say, Blowfish, they send them to the Blowfish decoder, PGP goes to the PGP decoder, etc.


The nice thing about systems like, for example, Blowfish, is that their mathematical properties are _precicely_ known. Anyone with sufficient knowledge can write a "Blowfish decoder", and the time it would take to crack a specific message is well known.

The problem, if you can call it that, is that the time is on the order of gazillions of years, assuming that you chose your keys wisely [1].

Blowfish, Twofish, AES, Serpent -- all of these are exactly as secure as the (peer reviewed) papers state -- that is after all the purpose of peer review (something which Microsoft doesn't have, to bring us back to the original concern).

And *that* is why a backdoor is required -- the machines to crack the code don't exist.

Of course, the machines might exist in a few years time, and just about everything is archived these days, so your past might just come back to haunt you if you're young enough now and Moore's law holds out. The tip here is use the longest key possible and don't incriminate yourself just because you're encrypting the message.

Coming back to firewalls. Use a *nix box (I prefer Linux, but most people in the know think that BSD is a better choice) and configure that as a NAT firewall. That's the only way you'll find me connecting a 'doze box to the 'net [2]. Linux is reasonably secure, because a lot of really bright guys scratch around inside it all the time, anything you try to hide in there will be uncovered pretty damn quickly.

I doubt whether Ken Thompson's legendary hack (http://catb.org/jargon/html/B/back-door.html) can be repeated today, simply because it's known -- he got away with it because it was new. That's why everything is MD5 checksummed these days.

Trust in the source, Luke :-)

[1] It's easier to hack the passphrase. Which basically boils down to social engineering.

[2] And I'm on DSL, with the provider blocking everything so that I can't accidentally run a web server or something -- that would cut into their profits. Two firewalls for the price of one.