Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD.

I'd like to know if there are any other references to this issue. This would help in my Thesis addressing this or similar issues.

Could you recommend reliable resources, preferably academic papers?

(BibTex compatible is preferable)

share|improve this question
    
Please someone with higher rep. and experiense on Security.SE , retag my question. It's not typical for this site, so I feel lost when trying to tag it properly. –  Grzegorz Wierzowiecki Feb 7 '12 at 11:38
1  
I feel like they don't really use tags on this site. Everyone browses the general page since there is so much less activity. –  phpmeh Feb 7 '12 at 15:56
1  
@Grzegorz - Your question is vague. You do not even link to said articles, they could be written by random people, with no actual knowlege of what is contained in the OpenBSD source code. Unless you can prove that the FBI and/or CIA has modified the OpenBSD your Thesis is going to based on what could be pure fiction. What exactly is your question? I see no other possible tags. –  Ramhound Feb 7 '12 at 16:34
2  
I cannot explain the reason people are giving this a postive vote. The question vague, the author wants us to do his research, and link him to academic papers. Part of the process of writting a Thesis is doing your own research. Furthermore there isn't an actual question, he is asking "can you recommend reliable resource" the only logical answer is of course "I can" I just refuse to do so. –  Ramhound Feb 7 '12 at 16:41
    
Hi @Grzegorz - this question doesn't really fit this site. Have a quick look at the faq for some more guidance. –  Rory Alsop Feb 7 '12 at 19:57
show 2 more comments

closed as not constructive by Rory Alsop Feb 7 '12 at 19:55

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 3 down vote accepted

You should understand the OpenBSD allegations better before, no such thing as a backdoor was found. And it's mostly HOAX and FUD spread thanks to blogs and other funky websites that spread the rumor about an actual backdoor existing in the recent OpenBSD code. You might want to know exactly how it turned out before writing your Thesis.

Actually this was thoroughly discussed on the openbsd-misc/openbsd-tech mailing lists, you can access the archives easily.

The OpenBSD leader was contacted by an ex FBI agent or something who made allegations regarding some backdoor code implanted in the past by the FBI.

This led to a complete review of the source code by skilled developers, even not participating in OpenBSD's development. Not a single piece of what can look like a backdoor was found. Some bug fixing and improvements were possible thanks to this review, so in the end, these allegations made OpenBSD more reliable I guess.

You will find many many more details on the mailing list, use google and check for this thread: http://marc.info/?l=openbsd-tech&m=129236621626462&w=2

Very good subject, good luck with your Thesis.

EDIT: BTW, some people say bullshit on the ML, just dig through all the mails and don't make up your mind after reading one mail. Otto, Theo, Marc and Stuart are reliable, take their word for granted, they know what they are talking about.

EDIT2: One more interesting point is the bounty some people put up to encourage others to look for the backdoor.

EDIT3: Apparently I couldn't clearly express myself in my comment:

"I am not aware of other issues actually, as they say on the ML, the code changes fast and bugs happen all the time. However, what you can check is which where the remotely exploitable bugs on OpenBSD default install, they boast having only a few in a heck of a long time. It might be interesting to see how they happened"

I am not aware of any other issues concerning allegations of backdoors in OpenBSD. The code changes fast, even if the allegations are true and there had indeed been a backdoor introduced, it's most likely been fixed as a side effects of continuous development and auditing through time. OpenBSD claims on its webpage: "Only two remote holes in the default install, in a heck of a long time!". So it's worth looking these two remote holes, how they were introduced and why. This could add some relevance to the Thesis, one could analyze how related or unrelated to a third party (governments, ...) these two critical issues were.

share|improve this answer
    
I am not aware of other issues actually, as they say on the ML, the code changes fast and bugs happen all the time. However, what you can check is which where the remotely exploitable bugs on OpenBSD default install, they boast having only a few in a heck of a long time. It might be interesting to see how they happened. –  Aki Feb 7 '12 at 18:40
    
What? Your comment makes no sense. Please explain it within your answer. The article linked to is over 2 years ago, there wasn't any sort of additional information in the article itself, just what basically amounts to rumors. As you point out there was no evidence there was ever a reason for concern to begin with. –  Ramhound Feb 7 '12 at 19:38
    
Wiil do. The mails linked are 1 day earlier than the article linked in the question. You have dozens of mails (just click next in thread) from developers explaining the situation and investigating the allegation. Proof of their work can be found on the openbsd-cvs mailing list, just look for commits after December 14th 2010. They don't like to waste time and make public announcements, so the information is right there, in the tech mailing list and the CVS logs. Other blogs and paper just extrapolate information from these sources. –  Aki Feb 7 '12 at 19:50
    
Thanks @Aki, that was was I've been looking for. I wanted to clarify my understanding of whole issue with OpenBSD, FBI and IPSEC stack. –  Grzegorz Wierzowiecki Feb 7 '12 at 21:04
    
You can dig through the full-disclosure mailing list archives as well, I recall seeing a funny issue about a well visible backdoor in an opensource software. The code was even commented saying that nobody even bothered looking at the code except bad guys. Underlining the failure of opensource in providing more code review/security 99% of the time. –  Aki Feb 7 '12 at 21:23
add comment

The closest thing I've seen to what you're asking (and it has nothing to do with state-sponsorship) is this speech by Ken Thompson during his Turing Award Lecture. It basically asks the question, if the gcc compiler was at one point poisoned to produce compilers which produced backdoor-ed code, and then the was used to compile gcc for a number of major distros and subsequently the code was destroyed, would we ever know?>

This is more a thought experiment on what could potentially happen if someone were to attack systems high enough up the stack. Interesting concept, there are ways to automate the output of a compiler to ensure that it's sane (assuming your tools were compiled with a good compiler...) but as far as I know they are not implemented on any of the major open-source projects.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.