Artifact
bfc01b45dd96dbd48b3fd5c2cd0a2639f5c4b1cf:
Wiki page
[nsa-backdoor] by
bernd
2014-05-28 19:34:27.
0000: 44 20 32 30 31 34 2d 30 35 2d 32 38 54 31 39 3a D 2014-05-28T19:
0010: 33 34 3a 32 37 2e 36 37 33 0a 4c 20 6e 73 61 2d 34:27.673.L nsa-
0020: 62 61 63 6b 64 6f 6f 72 0a 50 20 63 38 38 66 35 backdoor.P c88f5
0030: 39 64 38 38 35 32 31 63 66 37 32 32 61 33 35 39 9d88521cf722a359
0040: 64 33 61 61 34 33 35 37 63 61 32 39 62 61 30 64 d3aa4357ca29ba0d
0050: 35 34 36 0a 55 20 62 65 72 6e 64 0a 57 20 32 34 546.U bernd.W 24
0060: 31 36 0a 3c 68 31 3e 4e 53 41 20 42 61 63 6b 64 16.<h1>NSA Backd
0070: 6f 6f 72 20 46 6e 6f 72 64 3c 2f 68 31 3e 0a 0a oor Fnord</h1>..
0080: 3c 70 3e 41 73 20 79 6f 75 20 61 6c 6c 20 6b 6e <p>As you all kn
0090: 6f 77 2c 20 69 74 20 69 73 20 6e 6f 74 20 61 6c ow, it is not al
00a0: 6c 6f 77 65 64 20 74 6f 20 73 70 65 61 6b 20 61 lowed to speak a
00b0: 62 6f 75 74 20 4e 53 41 2d 64 65 6d 61 6e 64 65 bout NSA-demande
00c0: 64 20 62 61 63 6b 64 6f 6f 72 73 2c 0a 61 6e 64 d backdoors,.and
00d0: 20 65 73 70 65 63 69 61 6c 6c 79 20 69 74 20 69 especially it i
00e0: 73 20 73 74 72 69 63 74 6c 79 20 70 72 6f 68 69 s strictly prohi
00f0: 62 69 74 65 64 20 74 6f 20 67 69 76 65 20 61 6e bited to give an
0100: 79 20 64 65 74 61 69 6c 73 2e 20 26 6e 62 73 70 y details.  
0110: 3b 48 6f 77 65 76 65 72 2c 20 69 74 0a 69 73 20 ;However, it.is
0120: 61 6c 6c 6f 77 65 64 20 74 6f 20 62 6f 6c 64 6c allowed to boldl
0130: 79 20 6c 69 65 20 61 62 6f 75 74 20 4e 53 41 2d y lie about NSA-
0140: 64 65 6d 61 6e 64 65 64 20 62 61 63 6b 64 6f 6f demanded backdoo
0150: 72 73 20 69 66 20 79 6f 75 20 64 69 64 6e 27 74 rs if you didn't
0160: 20 72 65 63 65 69 76 65 0a 73 75 63 68 20 61 20 receive.such a
0170: 72 65 71 75 65 73 74 2c 20 62 65 63 61 75 73 65 request, because
0180: 20 79 6f 75 20 61 72 65 20 6e 6f 74 20 75 6e 64 you are not und
0190: 65 72 20 61 20 67 61 67 20 6f 72 64 65 72 2c 20 er a gag order,
01a0: 61 6e 64 20 69 6e 20 67 65 6e 65 72 61 6c 2c 20 and in general,
01b0: 6c 79 69 6e 67 0a 61 62 6f 75 74 20 74 68 65 20 lying.about the
01c0: 71 75 61 6c 69 74 79 20 6f 66 20 79 6f 75 72 20 quality of your
01d0: 70 72 6f 64 75 63 74 20 69 73 20 6e 6f 74 20 6f product is not o
01e0: 6e 6c 79 20 6c 65 67 61 6c 2c 20 62 75 74 20 22 nly legal, but "
01f0: 62 65 73 74 20 70 72 61 63 74 69 63 65 22 2e 0a best practice"..
0200: 26 6e 62 73 70 3b 54 68 65 20 70 75 72 70 6f 73 The purpos
0210: 65 20 6f 66 20 74 68 69 73 20 4e 53 41 20 62 61 e of this NSA ba
0220: 63 6b 64 6f 6f 72 20 66 6e 6f 72 64 20 69 73 20 ckdoor fnord is
0230: 74 6f 20 6d 61 6b 65 20 79 6f 75 20 77 6f 72 72 to make you worr
0240: 79 20 61 62 6f 75 74 20 74 68 65 0a 71 75 61 6c y about the.qual
0250: 69 74 79 20 6f 66 20 6e 65 74 32 6f 2c 20 61 6e ity of net2o, an
0260: 64 20 74 68 65 72 65 66 6f 72 65 20 79 6f 75 20 d therefore you
0270: 73 74 61 72 74 20 6c 6f 6f 6b 69 6e 67 20 61 74 start looking at
0280: 20 74 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 the source code
0290: 3b 20 74 68 65 0a 74 6f 70 69 63 73 20 6d 65 6e ; the.topics men
02a0: 74 69 6f 6e 65 64 20 68 65 72 65 20 61 72 65 20 tioned here are
02b0: 61 6c 6c 20 73 65 63 75 72 69 74 79 20 74 68 69 all security thi
02c0: 6e 67 73 20 74 6f 20 63 6f 6e 73 69 64 65 72 2e ngs to consider.
02d0: 3c 2f 70 3e 0a 0a 3c 70 3e 54 68 65 72 65 66 6f </p>..<p>Therefo
02e0: 72 65 2c 20 68 65 72 65 20 69 73 20 74 68 65 20 re, here is the
02f0: 6f 66 66 69 63 69 61 6c 20 73 74 61 74 65 6d 65 official stateme
0300: 6e 74 20 61 62 6f 75 74 20 4e 53 41 2d 64 65 6d nt about NSA-dem
0310: 61 6e 64 65 64 20 62 61 63 6b 64 6f 6f 72 73 3a anded backdoors:
0320: 0a 54 68 65 72 65 20 69 73 20 61 20 4e 53 41 2d .There is a NSA-
0330: 72 65 71 75 65 73 74 65 64 20 62 61 63 6b 64 6f requested backdo
0340: 6f 72 20 69 6e 20 6e 65 74 32 6f 2e 20 26 6e 62 or in net2o. &nb
0350: 73 70 3b 3c 62 3e 55 70 64 61 74 65 3a 3c 2f 62 sp;<b>Update:</b
0360: 3e 20 54 68 65 20 4e 53 41 20 77 61 73 0a 68 65 > The NSA was.he
0370: 72 65 20 61 67 61 69 6e 2c 20 61 6e 64 20 74 61 re again, and ta
0380: 6c 6b 65 64 20 61 62 6f 75 74 20 73 6f 6d 65 20 lked about some
0390: 73 6f 72 74 20 6f 66 20 61 64 64 69 6e 67 20 61 sort of adding a
03a0: 20 22 62 65 61 63 6f 6e 22 20 6f 72 20 77 68 61 "beacon" or wha
03b0: 74 65 76 65 72 2e 3c 2f 70 3e 0a 0a 3c 70 3e 41 tever.</p>..<p>A
03c0: 73 20 6e 65 74 32 6f 20 69 73 20 6f 70 65 6e 20 s net2o is open
03d0: 73 6f 75 72 63 65 2c 20 79 6f 75 20 63 61 6e 20 source, you can
03e0: 76 65 72 69 66 79 20 74 68 65 20 74 72 75 74 68 verify the truth
03f0: 20 76 61 6c 75 65 20 6f 66 20 74 68 65 20 73 74 value of the st
0400: 61 74 65 6d 65 6e 74 0a 61 62 6f 76 65 2e 20 26 atement.above. &
0410: 6e 62 73 70 3b 41 6e 64 20 6b 65 65 70 20 61 6e nbsp;And keep an
0420: 20 65 79 65 20 6f 6e 20 74 68 69 73 20 70 61 67 eye on this pag
0430: 65 2e 3c 2f 70 3e 0a 0a 3c 68 32 3e 57 68 61 74 e.</p>..<h2>What
0440: 20 69 73 20 74 68 69 73 20 70 61 67 65 20 66 6f is this page fo
0450: 72 3f 3c 2f 68 32 3e 0a 0a 3c 70 3e 53 6f 66 74 r?</h2>..<p>Soft
0460: 77 61 72 65 20 69 73 20 69 6e 68 65 72 65 6e 74 ware is inherent
0470: 6c 79 20 62 75 67 67 79 20 2d 20 77 65 20 61 6c ly buggy - we al
0480: 6c 20 6d 61 6b 65 20 6d 69 73 74 61 6b 65 73 2e l make mistakes.
0490: 20 53 65 63 75 72 65 20 6e 65 74 77 6f 72 6b 69 Secure networki
04a0: 6e 67 0a 73 6f 66 74 77 61 72 65 20 69 73 20 65 ng.software is e
04b0: 76 65 6e 20 77 6f 72 73 65 2c 20 62 65 63 61 75 ven worse, becau
04c0: 73 65 20 73 6d 61 6c 6c 20 62 75 67 73 20 68 61 se small bugs ha
04d0: 76 65 20 62 69 67 20 63 6f 6e 73 65 71 75 65 6e ve big consequen
04e0: 63 65 73 2e 20 41 6e 64 20 77 69 74 68 20 74 68 ces. And with th
04f0: 65 0a 4e 53 41 20 42 75 6c 6c 72 75 6e 20 70 72 e.NSA Bullrun pr
0500: 6f 67 72 61 6d 2c 20 77 65 20 6e 6f 74 20 6f 6e ogram, we not on
0510: 6c 79 20 68 61 76 65 20 74 6f 20 64 65 61 6c 20 ly have to deal
0520: 77 69 74 68 20 74 68 65 20 6e 6f 72 6d 61 6c 2c with the normal,
0530: 20 22 6c 61 7a 79 22 20 62 75 67 73 2c 0a 77 68 "lazy" bugs,.wh
0540: 69 63 68 20 64 6f 6e 27 74 20 63 61 75 73 65 20 ich don't cause
0550: 61 6e 79 20 68 61 72 6d 20 75 6e 74 69 6c 20 66 any harm until f
0560: 6f 75 6e 64 20 28 65 69 74 68 65 72 20 62 79 20 ound (either by
0570: 68 6f 6e 65 73 74 20 73 65 63 75 72 69 74 79 20 honest security
0580: 72 65 73 65 61 72 63 68 65 72 20 6f 72 0a 65 76 researcher or.ev
0590: 69 6c 20 63 72 69 6d 69 6e 61 6c 73 29 2c 20 62 il criminals), b
05a0: 75 74 20 77 69 74 68 20 62 75 67 73 20 69 6e 74 ut with bugs int
05b0: 65 6e 74 69 6f 6e 61 6c 6c 79 20 70 6c 61 63 65 entionally place
05c0: 64 2c 20 61 6e 64 20 75 73 65 64 20 62 79 20 74 d, and used by t
05d0: 68 65 20 73 65 63 72 65 74 0a 73 65 72 76 69 63 he secret.servic
05e0: 65 73 20 66 72 6f 6d 20 64 61 79 20 30 2e 3c 2f es from day 0.</
05f0: 70 3e 0a 0a 3c 70 3e 44 65 76 65 6c 6f 70 69 6e p>..<p>Developin
0600: 67 20 69 6e 20 46 6f 72 74 68 20 69 73 20 61 20 g in Forth is a
0610: 22 63 72 61 73 68 20 65 61 72 6c 79 2c 20 63 72 "crash early, cr
0620: 61 73 68 20 6f 66 74 65 6e 22 20 65 78 65 72 63 ash often" exerc
0630: 69 73 65 2c 20 62 75 74 20 73 65 63 75 72 69 74 ise, but securit
0640: 79 0a 72 65 6c 61 74 65 64 20 62 75 67 73 20 64 y.related bugs d
0650: 6f 6e 27 74 20 63 72 61 73 68 20 74 68 65 20 70 on't crash the p
0660: 72 6f 67 72 61 6d 2e 3c 2f 70 3e 0a 0a 3c 70 3e rogram.</p>..<p>
0670: 6e 65 74 32 6f 20 69 73 20 6e 6f 74 20 72 65 61 net2o is not rea
0680: 64 79 20 66 6f 72 20 75 73 65 2c 20 73 6f 20 62 dy for use, so b
0690: 75 67 73 20 64 6f 20 68 61 70 70 65 6e 2c 20 61 ugs do happen, a
06a0: 6e 64 20 67 65 74 20 66 69 78 65 64 2c 20 62 75 nd get fixed, bu
06b0: 74 20 74 68 65 20 62 75 67 73 0a 64 65 73 63 72 t the bugs.descr
06c0: 69 62 65 64 20 68 65 72 65 20 75 73 75 61 6c 6c ibed here usuall
06d0: 79 20 61 72 65 20 72 65 61 6c 20 62 75 67 73 20 y are real bugs
06e0: 49 20 66 6f 75 6e 64 20 61 6e 64 20 66 69 78 65 I found and fixe
06f0: 64 20 64 75 72 69 6e 67 20 64 65 76 65 6c 6f 70 d during develop
0700: 6d 65 6e 74 2e 20 41 6c 6c 0a 6f 66 20 74 68 65 ment. All.of the
0710: 6d 20 6c 6f 6f 6b 20 6c 69 6b 65 20 70 72 6f 66 m look like prof
0720: 65 73 73 69 6f 6e 61 6c 6c 79 20 69 6d 70 6c 61 essionally impla
0730: 6e 74 65 64 20 62 75 67 73 20 62 79 20 74 68 65 nted bugs by the
0740: 20 4e 53 41 2c 20 62 65 63 61 75 73 65 20 74 68 NSA, because th
0750: 61 74 27 73 20 74 68 65 0a 73 74 61 74 65 20 6f at's the.state o
0760: 66 20 74 68 65 20 61 72 74 20 68 6f 77 20 74 6f f the art how to
0770: 20 69 6d 70 6c 61 6e 74 20 62 61 63 6b 64 6f 6f implant backdoo
0780: 72 73 3a 20 49 74 20 6d 75 73 74 20 70 72 6f 76 rs: It must prov
0790: 69 64 65 20 69 74 73 20 61 75 74 68 6f 72 20 77 ide its author w
07a0: 69 74 68 0a 22 72 65 61 73 6f 6e 61 62 6c 65 20 ith."reasonable
07b0: 64 65 6e 69 61 6c 22 2c 20 63 6c 61 69 6d 69 6e denial", claimin
07c0: 67 20 69 6e 63 6f 6d 70 65 74 65 6e 63 65 2e 3c g incompetence.<
07d0: 2f 70 3e 0a 0a 3c 70 3e 48 6f 77 65 76 65 72 2c /p>..<p>However,
07e0: 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 67 65 74 in order to get
07f0: 20 74 68 69 6e 67 73 20 72 69 67 68 74 2c 20 77 things right, w
0800: 65 20 6e 65 65 64 20 61 20 63 75 6c 74 75 72 65 e need a culture
0810: 20 6f 66 20 61 63 63 65 70 74 69 6e 67 20 6f 75 of accepting ou
0820: 72 0a 6d 69 73 74 61 6b 65 73 2c 20 61 6e 64 20 r.mistakes, and
0830: 66 69 78 69 6e 67 20 74 68 65 6d 2e 20 26 6e 62 fixing them. &nb
0840: 73 70 3b 4d 61 6e 79 20 70 72 6f 67 72 61 6d 6d sp;Many programm
0850: 65 72 73 20 64 65 6e 79 20 62 75 67 73 2c 20 61 ers deny bugs, a
0860: 6e 64 20 72 65 71 75 65 73 74 20 61 74 0a 6c 65 nd request at.le
0870: 61 73 74 20 61 20 70 72 6f 6f 66 20 6f 66 20 63 ast a proof of c
0880: 6f 6e 63 65 70 74 20 61 74 74 61 63 6b 2c 20 62 oncept attack, b
0890: 65 66 6f 72 65 20 74 68 65 79 20 61 63 74 75 61 efore they actua
08a0: 6c 6c 79 20 73 74 61 72 74 20 64 6f 69 6e 67 20 lly start doing
08b0: 73 6f 6d 65 74 68 69 6e 67 2e 0a 26 6e 62 73 70 something.. 
08c0: 3b 54 68 69 73 20 73 6f 72 74 20 6f 66 20 63 75 ;This sort of cu
08d0: 6c 74 75 72 65 20 69 73 20 73 6f 20 77 72 6f 6e lture is so wron
08e0: 67 3a 20 41 73 20 61 75 74 68 6f 72 20 6f 66 20 g: As author of
08f0: 73 65 63 75 72 69 74 79 20 63 72 69 74 69 63 61 security critica
0900: 6c 20 73 79 73 74 65 6d 73 2c 0a 79 6f 75 20 6d l systems,.you m
0910: 75 73 74 20 62 65 20 63 6f 6e 73 74 61 6e 74 6c ust be constantl
0920: 79 20 73 63 61 72 65 64 20 62 79 20 70 65 6f 70 y scared by peop
0930: 6c 65 20 75 73 69 6e 67 20 65 76 65 72 79 20 77 le using every w
0940: 61 79 20 74 6f 20 62 72 65 61 6b 20 69 6e 74 6f ay to break into
0950: 20 79 6f 75 72 0a 73 6f 66 74 77 61 72 65 2c 20 your.software,
0960: 61 6e 64 20 79 6f 75 20 6d 75 73 74 20 62 65 20 and you must be
0970: 72 65 61 64 79 20 74 6f 20 66 69 78 20 65 76 65 ready to fix eve
0980: 72 79 20 62 75 67 2c 20 65 76 65 6e 20 6a 75 73 ry bug, even jus
0990: 74 20 70 6f 74 65 6e 74 69 61 6c 20 72 69 73 6b t potential risk
09a0: 73 2c 0a 62 65 66 6f 72 65 20 73 6f 6d 65 6f 6e s,.before someon
09b0: 65 20 73 68 6f 77 73 20 79 6f 75 20 61 6e 20 61 e shows you an a
09c0: 63 74 75 61 6c 20 65 78 70 6c 6f 69 74 2e 3c 2f ctual exploit.</
09d0: 70 3e 0a 0a 5a 20 65 34 33 37 32 61 62 36 31 30 p>..Z e4372ab610
09e0: 35 39 35 65 35 36 65 37 65 65 31 62 34 32 35 65 595e56e7ee1b425e
09f0: 66 62 33 34 36 35 0a fb3465.