Artifact
0eb2ae3468814231811234ff98ff709c35940529:
Wiki page
[nsa-backdoor] by
bernd
2015-03-29 18:05:19.
0000: 44 20 32 30 31 35 2d 30 33 2d 32 39 54 31 38 3a D 2015-03-29T18:
0010: 30 35 3a 31 39 2e 39 38 32 0a 4c 20 6e 73 61 2d 05:19.982.L nsa-
0020: 62 61 63 6b 64 6f 6f 72 0a 50 20 33 33 63 38 61 backdoor.P 33c8a
0030: 36 37 38 39 33 30 65 62 65 61 32 34 30 39 34 63 678930ebea24094c
0040: 34 61 35 34 32 64 32 33 33 63 30 33 61 32 30 64 4a542d233c03a20d
0050: 33 33 61 0a 55 20 62 65 72 6e 64 0a 57 20 33 32 33a.U bernd.W 32
0060: 37 39 0a 3c 68 31 3e 4e 53 41 20 42 61 63 6b 64 79.<h1>NSA Backd
0070: 6f 6f 72 20 46 6e 6f 72 64 3c 2f 68 31 3e 0a 0a oor Fnord</h1>..
0080: 3c 70 3e 41 73 20 79 6f 75 20 61 6c 6c 20 6b 6e <p>As you all kn
0090: 6f 77 2c 20 69 74 20 69 73 20 6e 6f 74 20 61 6c ow, it is not al
00a0: 6c 6f 77 65 64 20 74 6f 20 73 70 65 61 6b 20 61 lowed to speak a
00b0: 62 6f 75 74 20 4e 53 41 2d 64 65 6d 61 6e 64 65 bout NSA-demande
00c0: 64 20 62 61 63 6b 64 6f 6f 72 73 2c 0a 61 6e 64 d backdoors,.and
00d0: 20 65 73 70 65 63 69 61 6c 6c 79 20 69 74 20 69 especially it i
00e0: 73 20 73 74 72 69 63 74 6c 79 20 70 72 6f 68 69 s strictly prohi
00f0: 62 69 74 65 64 20 74 6f 20 67 69 76 65 20 61 6e bited to give an
0100: 79 20 64 65 74 61 69 6c 73 2e 20 26 6e 62 73 70 y details.  
0110: 3b 48 6f 77 65 76 65 72 2c 20 69 74 0a 69 73 20 ;However, it.is
0120: 61 6c 6c 6f 77 65 64 20 74 6f 20 62 6f 6c 64 6c allowed to boldl
0130: 79 20 6c 69 65 20 61 62 6f 75 74 20 4e 53 41 2d y lie about NSA-
0140: 64 65 6d 61 6e 64 65 64 20 62 61 63 6b 64 6f 6f demanded backdoo
0150: 72 73 20 69 66 20 79 6f 75 20 64 69 64 6e 27 74 rs if you didn't
0160: 20 72 65 63 65 69 76 65 0a 73 75 63 68 20 61 20 receive.such a
0170: 72 65 71 75 65 73 74 2c 20 62 65 63 61 75 73 65 request, because
0180: 20 79 6f 75 20 61 72 65 20 6e 6f 74 20 75 6e 64 you are not und
0190: 65 72 20 61 20 67 61 67 20 6f 72 64 65 72 2c 20 er a gag order,
01a0: 61 6e 64 20 69 6e 20 67 65 6e 65 72 61 6c 2c 20 and in general,
01b0: 6c 79 69 6e 67 0a 61 62 6f 75 74 20 74 68 65 20 lying.about the
01c0: 71 75 61 6c 69 74 79 20 6f 66 20 79 6f 75 72 20 quality of your
01d0: 70 72 6f 64 75 63 74 20 69 73 20 6e 6f 74 20 6f product is not o
01e0: 6e 6c 79 20 6c 65 67 61 6c 2c 20 62 75 74 20 22 nly legal, but "
01f0: 62 65 73 74 20 70 72 61 63 74 69 63 65 22 2e 0a best practice"..
0200: 26 6e 62 73 70 3b 54 68 65 20 70 75 72 70 6f 73 The purpos
0210: 65 20 6f 66 20 74 68 69 73 20 4e 53 41 20 62 61 e of this NSA ba
0220: 63 6b 64 6f 6f 72 20 66 6e 6f 72 64 20 69 73 20 ckdoor fnord is
0230: 74 6f 20 6d 61 6b 65 20 79 6f 75 20 77 6f 72 72 to make you worr
0240: 79 20 61 62 6f 75 74 20 74 68 65 0a 71 75 61 6c y about the.qual
0250: 69 74 79 20 6f 66 20 6e 65 74 32 6f 2c 20 61 6e ity of net2o, an
0260: 64 20 74 68 65 72 65 66 6f 72 65 20 79 6f 75 20 d therefore you
0270: 73 74 61 72 74 20 6c 6f 6f 6b 69 6e 67 20 61 74 start looking at
0280: 20 74 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 the source code
0290: 3b 20 74 68 65 0a 74 6f 70 69 63 73 20 6d 65 6e ; the.topics men
02a0: 74 69 6f 6e 65 64 20 68 65 72 65 20 61 72 65 20 tioned here are
02b0: 61 6c 6c 20 73 65 63 75 72 69 74 79 20 74 68 69 all security thi
02c0: 6e 67 73 20 74 6f 20 63 6f 6e 73 69 64 65 72 2e ngs to consider.
02d0: 3c 2f 70 3e 0a 0a 3c 70 3e 54 68 65 72 65 66 6f </p>..<p>Therefo
02e0: 72 65 2c 20 68 65 72 65 20 69 73 20 74 68 65 20 re, here is the
02f0: 6f 66 66 69 63 69 61 6c 20 73 74 61 74 65 6d 65 official stateme
0300: 6e 74 20 61 62 6f 75 74 20 4e 53 41 2d 64 65 6d nt about NSA-dem
0310: 61 6e 64 65 64 20 62 61 63 6b 64 6f 6f 72 73 3a anded backdoors:
0320: 20 49 0a 68 61 76 65 20 61 6e 20 6f 66 66 69 63 I.have an offic
0330: 69 61 6c 20 66 72 6f 6e 74 20 64 6f 6f 72 20 69 ial front door i
0340: 6e 20 6e 65 74 32 6f 20 66 6f 72 20 74 68 65 20 n net2o for the
0350: 4e 53 41 2e 20 26 6e 62 73 70 3b 3c 62 3e 55 70 NSA. <b>Up
0360: 64 61 74 65 3a 3c 2f 62 3e 26 6e 62 73 70 3b 54 date:</b> T
0370: 68 65 0a 61 75 73 74 72 61 6c 69 61 6e 20 73 65 he.australian se
0380: 63 72 65 74 20 73 65 72 76 69 63 65 20 41 53 44 cret service ASD
0390: 20 77 61 73 20 68 65 72 65 2c 20 61 6e 64 20 73 was here, and s
03a0: 61 69 64 20 74 68 61 74 26 6e 62 73 70 3b 3c 61 aid that <a
03b0: 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 6f href="http://bo
03c0: 69 6e 67 62 6f 69 6e 67 2e 6e 65 74 2f 32 30 31 ingboing.net/201
03d0: 35 2f 30 33 2f 32 36 2f 61 75 73 74 72 61 6c 69 5/03/26/australi
03e0: 61 2d 6f 75 74 6c 61 77 73 2d 77 61 72 72 61 6e a-outlaws-warran
03f0: 74 2d 63 61 6e 61 2e 68 74 6d 6c 22 3e 77 61 72 t-cana.html">war
0400: 72 61 6e 74 0a 63 61 6e 61 6e 61 72 69 65 73 20 rant.cananaries
0410: 61 72 65 20 6f 75 74 6c 61 77 65 64 3c 2f 61 3e are outlawed</a>
0420: 2e 3c 2f 70 3e 0a 0a 3c 70 3e 41 73 20 6e 65 74 .</p>..<p>As net
0430: 32 6f 20 69 73 20 6f 70 65 6e 20 73 6f 75 72 63 2o is open sourc
0440: 65 2c 20 79 6f 75 20 63 61 6e 20 76 65 72 69 66 e, you can verif
0450: 79 20 74 68 65 20 74 72 75 74 68 20 76 61 6c 75 y the truth valu
0460: 65 20 6f 66 20 74 68 65 20 73 74 61 74 65 6d 65 e of the stateme
0470: 6e 74 0a 61 62 6f 76 65 2e 20 26 6e 62 73 70 3b nt.above.
0480: 41 6e 64 20 6b 65 65 70 20 61 6e 20 65 79 65 20 And keep an eye
0490: 6f 6e 20 74 68 69 73 20 70 61 67 65 2e 3c 2f 70 on this page.</p
04a0: 3e 0a 0a 3c 68 32 3e 57 68 61 74 20 69 73 20 74 >..<h2>What is t
04b0: 68 69 73 20 70 61 67 65 20 66 6f 72 3f 3c 2f 68 his page for?</h
04c0: 32 3e 0a 0a 3c 70 3e 53 6f 66 74 77 61 72 65 20 2>..<p>Software
04d0: 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 62 75 is inherently bu
04e0: 67 67 79 20 2d 20 77 65 20 61 6c 6c 20 6d 61 6b ggy - we all mak
04f0: 65 20 6d 69 73 74 61 6b 65 73 2e 20 53 65 63 75 e mistakes. Secu
0500: 72 65 20 6e 65 74 77 6f 72 6b 69 6e 67 0a 73 6f re networking.so
0510: 66 74 77 61 72 65 20 69 73 20 65 76 65 6e 20 77 ftware is even w
0520: 6f 72 73 65 2c 20 62 65 63 61 75 73 65 20 73 6d orse, because sm
0530: 61 6c 6c 20 62 75 67 73 20 68 61 76 65 20 62 69 all bugs have bi
0540: 67 20 63 6f 6e 73 65 71 75 65 6e 63 65 73 2e 20 g consequences.
0550: 41 6e 64 20 77 69 74 68 20 74 68 65 0a 4e 53 41 And with the.NSA
0560: 20 42 75 6c 6c 72 75 6e 20 70 72 6f 67 72 61 6d Bullrun program
0570: 2c 20 77 65 20 6e 6f 74 20 6f 6e 6c 79 20 68 61 , we not only ha
0580: 76 65 20 74 6f 20 64 65 61 6c 20 77 69 74 68 20 ve to deal with
0590: 74 68 65 20 6e 6f 72 6d 61 6c 2c 20 22 6c 61 7a the normal, "laz
05a0: 79 22 20 62 75 67 73 2c 0a 77 68 69 63 68 20 64 y" bugs,.which d
05b0: 6f 6e 27 74 20 63 61 75 73 65 20 61 6e 79 20 68 on't cause any h
05c0: 61 72 6d 20 75 6e 74 69 6c 20 66 6f 75 6e 64 20 arm until found
05d0: 28 65 69 74 68 65 72 20 62 79 20 68 6f 6e 65 73 (either by hones
05e0: 74 20 73 65 63 75 72 69 74 79 20 72 65 73 65 61 t security resea
05f0: 72 63 68 65 72 20 6f 72 0a 65 76 69 6c 20 63 72 rcher or.evil cr
0600: 69 6d 69 6e 61 6c 73 29 2c 20 62 75 74 20 77 69 iminals), but wi
0610: 74 68 20 62 75 67 73 20 69 6e 74 65 6e 74 69 6f th bugs intentio
0620: 6e 61 6c 6c 79 20 70 6c 61 63 65 64 2c 20 61 6e nally placed, an
0630: 64 20 75 73 65 64 20 62 79 20 74 68 65 20 73 65 d used by the se
0640: 63 72 65 74 0a 73 65 72 76 69 63 65 73 20 66 72 cret.services fr
0650: 6f 6d 20 64 61 79 20 30 2e 3c 2f 70 3e 0a 0a 3c om day 0.</p>..<
0660: 70 3e 44 65 76 65 6c 6f 70 69 6e 67 20 69 6e 20 p>Developing in
0670: 46 6f 72 74 68 20 69 73 20 61 20 22 63 72 61 73 Forth is a "cras
0680: 68 20 65 61 72 6c 79 2c 20 63 72 61 73 68 20 6f h early, crash o
0690: 66 74 65 6e 22 20 65 78 65 72 63 69 73 65 2c 20 ften" exercise,
06a0: 62 75 74 20 73 65 63 75 72 69 74 79 0a 72 65 6c but security.rel
06b0: 61 74 65 64 20 62 75 67 73 20 64 6f 6e 27 74 20 ated bugs don't
06c0: 63 72 61 73 68 20 74 68 65 20 70 72 6f 67 72 61 crash the progra
06d0: 6d 2e 3c 2f 70 3e 0a 0a 3c 70 3e 6e 65 74 32 6f m.</p>..<p>net2o
06e0: 20 69 73 20 6e 6f 74 20 72 65 61 64 79 20 66 6f is not ready fo
06f0: 72 20 75 73 65 2c 20 73 6f 20 62 75 67 73 20 64 r use, so bugs d
0700: 6f 20 68 61 70 70 65 6e 2c 20 61 6e 64 20 67 65 o happen, and ge
0710: 74 20 66 69 78 65 64 2c 20 62 75 74 20 74 68 65 t fixed, but the
0720: 20 62 75 67 73 0a 64 65 73 63 72 69 62 65 64 20 bugs.described
0730: 68 65 72 65 20 75 73 75 61 6c 6c 79 20 61 72 65 here usually are
0740: 20 72 65 61 6c 20 62 75 67 73 20 49 20 66 6f 75 real bugs I fou
0750: 6e 64 20 61 6e 64 20 66 69 78 65 64 20 64 75 72 nd and fixed dur
0760: 69 6e 67 20 64 65 76 65 6c 6f 70 6d 65 6e 74 2e ing development.
0770: 20 41 6c 6c 0a 6f 66 20 74 68 65 6d 20 6c 6f 6f All.of them loo
0780: 6b 20 6c 69 6b 65 20 70 72 6f 66 65 73 73 69 6f k like professio
0790: 6e 61 6c 6c 79 20 69 6d 70 6c 61 6e 74 65 64 20 nally implanted
07a0: 62 75 67 73 20 62 79 20 74 68 65 20 4e 53 41 2c bugs by the NSA,
07b0: 20 62 65 63 61 75 73 65 20 74 68 61 74 27 73 20 because that's
07c0: 74 68 65 0a 73 74 61 74 65 20 6f 66 20 74 68 65 the.state of the
07d0: 20 61 72 74 20 68 6f 77 20 74 6f 20 69 6d 70 6c art how to impl
07e0: 61 6e 74 20 62 61 63 6b 64 6f 6f 72 73 3a 20 49 ant backdoors: I
07f0: 74 20 6d 75 73 74 20 70 72 6f 76 69 64 65 20 69 t must provide i
0800: 74 73 20 61 75 74 68 6f 72 20 77 69 74 68 0a 22 ts author with."
0810: 72 65 61 73 6f 6e 61 62 6c 65 20 64 65 6e 69 61 reasonable denia
0820: 6c 22 2c 20 63 6c 61 69 6d 69 6e 67 20 69 6e 63 l", claiming inc
0830: 6f 6d 70 65 74 65 6e 63 65 2e 3c 2f 70 3e 0a 0a ompetence.</p>..
0840: 3c 70 3e 48 6f 77 65 76 65 72 2c 20 69 6e 20 6f <p>However, in o
0850: 72 64 65 72 20 74 6f 20 67 65 74 20 74 68 69 6e rder to get thin
0860: 67 73 20 72 69 67 68 74 2c 20 77 65 20 6e 65 65 gs right, we nee
0870: 64 20 61 20 63 75 6c 74 75 72 65 20 6f 66 20 61 d a culture of a
0880: 63 63 65 70 74 69 6e 67 20 6f 75 72 0a 6d 69 73 ccepting our.mis
0890: 74 61 6b 65 73 2c 20 61 6e 64 20 66 69 78 69 6e takes, and fixin
08a0: 67 20 74 68 65 6d 2e 20 26 6e 62 73 70 3b 4d 61 g them. Ma
08b0: 6e 79 20 70 72 6f 67 72 61 6d 6d 65 72 73 20 64 ny programmers d
08c0: 65 6e 79 20 62 75 67 73 2c 20 61 6e 64 20 72 65 eny bugs, and re
08d0: 71 75 65 73 74 20 61 74 0a 6c 65 61 73 74 20 61 quest at.least a
08e0: 20 70 72 6f 6f 66 20 6f 66 20 63 6f 6e 63 65 70 proof of concep
08f0: 74 20 61 74 74 61 63 6b 2c 20 62 65 66 6f 72 65 t attack, before
0900: 20 74 68 65 79 20 61 63 74 75 61 6c 6c 79 20 73 they actually s
0910: 74 61 72 74 20 64 6f 69 6e 67 20 73 6f 6d 65 74 tart doing somet
0920: 68 69 6e 67 2e 0a 26 6e 62 73 70 3b 54 68 69 73 hing.. This
0930: 20 73 6f 72 74 20 6f 66 20 63 75 6c 74 75 72 65 sort of culture
0940: 20 69 73 20 73 6f 20 77 72 6f 6e 67 3a 20 41 73 is so wrong: As
0950: 20 61 75 74 68 6f 72 20 6f 66 20 73 65 63 75 72 author of secur
0960: 69 74 79 20 63 72 69 74 69 63 61 6c 20 73 79 73 ity critical sys
0970: 74 65 6d 73 2c 0a 79 6f 75 20 6d 75 73 74 20 62 tems,.you must b
0980: 65 20 63 6f 6e 73 74 61 6e 74 6c 79 20 73 63 61 e constantly sca
0990: 72 65 64 20 62 79 20 70 65 6f 70 6c 65 20 75 73 red by people us
09a0: 69 6e 67 20 65 76 65 72 79 20 77 61 79 20 74 6f ing every way to
09b0: 20 62 72 65 61 6b 20 69 6e 74 6f 20 79 6f 75 72 break into your
09c0: 0a 73 6f 66 74 77 61 72 65 2c 20 61 6e 64 20 79 .software, and y
09d0: 6f 75 20 6d 75 73 74 20 62 65 20 72 65 61 64 79 ou must be ready
09e0: 20 74 6f 20 66 69 78 20 65 76 65 72 79 20 62 75 to fix every bu
09f0: 67 2c 20 65 76 65 6e 20 6a 75 73 74 20 70 6f 74 g, even just pot
0a00: 65 6e 74 69 61 6c 20 72 69 73 6b 73 2c 0a 62 65 ential risks,.be
0a10: 66 6f 72 65 20 73 6f 6d 65 6f 6e 65 20 73 68 6f fore someone sho
0a20: 77 73 20 79 6f 75 20 61 6e 20 61 63 74 75 61 6c ws you an actual
0a30: 20 65 78 70 6c 6f 69 74 2e 3c 2f 70 3e 0a 0a 3c exploit.</p>..<
0a40: 68 32 3e 57 61 72 72 61 6e 74 20 43 61 6e 61 72 h2>Warrant Canar
0a50: 79 3c 2f 68 32 3e 0a 0a 3c 70 3e 54 68 69 73 20 y</h2>..<p>This
0a60: 73 6f 72 74 20 6f 66 20 74 68 69 6e 67 20 49 27 sort of thing I'
0a70: 6d 20 64 6f 69 6e 67 20 68 65 72 65 20 69 73 20 m doing here is
0a80: 63 61 6c 6c 65 64 20 22 77 61 72 72 61 6e 74 20 called "warrant
0a90: 63 61 6e 61 72 79 22 2c 20 6e 61 6d 65 64 20 61 canary", named a
0aa0: 66 74 65 72 0a 74 68 65 20 63 61 6e 61 72 69 65 fter.the canarie
0ab0: 73 20 75 73 65 64 20 62 79 20 6d 69 6e 65 72 73 s used by miners
0ac0: 20 77 68 69 63 68 20 61 72 65 20 6d 6f 72 65 20 which are more
0ad0: 73 65 6e 73 69 74 69 76 65 20 74 6f 20 70 6f 69 sensitive to poi
0ae0: 73 6f 6e 6f 75 73 20 67 61 73 20 6c 65 61 6b 73 sonous gas leaks
0af0: 0a 74 68 61 6e 20 68 75 6d 61 6e 73 2e 20 26 6e .than humans. &n
0b00: 62 73 70 3b 54 68 65 20 74 68 69 6e 67 20 77 6f bsp;The thing wo
0b10: 75 6c 64 20 62 65 20 69 6d 70 6f 73 73 69 62 6c uld be impossibl
0b20: 65 20 69 66 20 74 68 65 20 6f 74 68 65 72 20 73 e if the other s
0b30: 69 64 65 20 77 6f 75 6c 64 20 73 61 79 0a 22 63 ide would say."c
0b40: 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 62 75 73 ontinue with bus
0b50: 69 6e 65 73 73 20 61 73 20 75 73 75 61 6c 2c 20 iness as usual,
0b60: 73 6f 20 74 68 61 74 20 6e 6f 62 6f 64 79 20 6b so that nobody k
0b70: 6e 6f 77 73 20 77 65 20 77 65 72 65 20 68 65 72 nows we were her
0b80: 65 22 2e 0a 26 6e 62 73 70 3b 54 61 6b 65 64 6f e".. Takedo
0b90: 77 6e 73 20 6c 69 6b 65 20 74 68 65 20 6f 6e 65 wns like the one
0ba0: 20 6f 66 20 4c 61 76 61 62 69 74 20 28 77 68 69 of Lavabit (whi
0bb0: 63 68 20 77 61 73 20 74 72 69 67 67 65 72 65 64 ch was triggered
0bc0: 20 62 79 20 61 6e 20 4e 53 4c 29 20 6f 72 20 6d by an NSL) or m
0bd0: 6f 72 65 0a 72 65 63 65 6e 74 6c 79 20 62 79 20 ore.recently by
0be0: 54 72 75 65 43 72 79 70 74 20 28 77 68 69 63 68 TrueCrypt (which
0bf0: 20 77 65 20 64 6f 6e 27 74 20 6b 6e 6f 77 20 77 we don't know w
0c00: 68 79 20 74 68 65 79 20 64 69 64 20 69 74 29 20 hy they did it)
0c10: 61 72 65 6e 27 74 20 73 75 63 68 0a 63 6f 6e 74 aren't such.cont
0c20: 69 6e 75 61 74 69 6f 6e 73 2c 20 70 65 6f 70 6c inuations, peopl
0c30: 65 20 63 61 6e 20 67 75 65 73 73 20 74 68 61 74 e can guess that
0c40: 20 74 68 65 20 4e 53 41 20 77 61 73 20 74 68 65 the NSA was the
0c50: 72 65 2e 3c 2f 70 3e 0a 0a 3c 70 3e 54 68 65 20 re.</p>..<p>The
0c60: 62 65 73 74 20 63 6f 75 6e 74 65 72 6d 65 61 73 best countermeas
0c70: 75 72 65 20 61 67 61 69 6e 73 74 20 61 20 68 6f ure against a ho
0c80: 73 74 69 6c 65 20 74 61 6b 65 6f 76 65 72 20 62 stile takeover b
0c90: 79 20 73 75 63 68 20 61 6e 20 61 67 65 6e 63 79 y such an agency
0ca0: 20 69 73 20 74 6f 0a 77 6f 72 6b 20 6f 75 74 20 is to.work out
0cb0: 69 6e 20 74 68 65 20 6f 70 65 6e 2c 20 61 6e 64 in the open, and
0cc0: 20 68 61 76 65 20 61 20 6d 75 6c 74 69 2d 6e 61 have a multi-na
0cd0: 74 69 6f 6e 61 6c 20 74 65 61 6d 20 74 68 61 74 tional team that
0ce0: 20 63 61 6e 27 74 20 62 65 20 73 75 62 6a 65 63 can't be subjec
0cf0: 74 20 74 6f 0a 74 68 65 20 73 61 6d 65 20 62 75 t to.the same bu
0d00: 6c 6c 79 69 6e 67 3b 20 74 68 65 20 6c 61 74 74 llying; the latt
0d10: 65 72 20 69 73 20 73 6f 6d 65 74 68 69 6e 67 20 er is something
0d20: 49 20 64 6f 6e 27 74 20 68 61 76 65 2e 3c 2f 70 I don't have.</p
0d30: 3e 0a 0a 5a 20 36 30 63 32 34 36 35 31 64 30 33 >..Z 60c24651d03
0d40: 66 37 36 37 35 36 37 61 64 64 61 65 39 66 32 30 f767567addae9f20
0d50: 62 64 30 63 32 0a bd0c2.