Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I guess you have heard of Edward Snowden. Papers around the world published that the NSA invests much time, money and effort for a »full take« of the communication around the world.

Given this, it seems -- without too much knowledge of computers -- plausible, that people who invest large amounts of money in such actions could tend to force US based companies to implement a backdoor or some kind of trojan in their own software, in particular force Microsoft to implement a backdoor / trojan into Windows or SBS 2011.

You see, I'm a lawyer in Europe and I'm obliged by law to keep the secrets of my clients. I can breach the law simply by doing nothing, if action would be obviously necessary. Because my small law firm uses computers, I've got two questions:

  1. Would such a backdoor / trojan make my computer accessible with administrator rights from outside, if the PC or server is connected to the internet, usually via router?

  2. Would IT security professionals sooner or later become aware of such a backdoor / trojan and therefore its existence is really, really improbable?

Please take my apologies for asking such questions here. But I guess my question is being pondered by many people these days, who don't have your qualifications.


Edit:

This question has been put on hold, because the regulars here, well, guessed, that answers would not been given on knowledge, but on opinion.

But the first answer (http://security.stackexchange.com/a/41515/30160) was good enough to give me a clue. And besides that, the Washington Post published a long article which confirmed the answer given by AJ_Henderson : A backdoor in Windows made by manufacturer etc. is improbable, because it would be noticed.

So the question now is:

Is there a way to find out, whether the encryption modules in Windows 7 and the Small Business Server 2011 deliver encrypted files or messages, which can be read by Microsoft, by using a kind of implemented key?

For Windows 8 there has been a hot discussion in Germany, see here: http://investmentwatchblog.com/leaked-german-government-warns-key-entities-not-to-use-windows-8-links-the-nsa/

And to ease the fear for stackexchange, that I'd spread the rumour there were a backdoor in the encryption of MS product: clearly I do not assume that; I just would like to know, whether there are hints in one or the other direction.

share|improve this question
    
Any vendor who sells security products and intentionally puts a back door in is ruining that trust and will likely never get it back. If Microsoft added a backdoor, they would be out of business very quickly –  makerofthings7 Sep 2 '13 at 13:42
    
I just read the original German article and if you compare Windows 8 to an iOS tablet (not a Windows PC) it seems similar to what Apple does: a closed software ecosystem. Easier and simpler. IT people want control, so they don't want this automatic management. Everything else is speculation, conspiracy theory and doesn't make sense for a capitalistic business to do. –  makerofthings7 Sep 2 '13 at 13:53
    
With your last edit, you're substantially changing the nature of your question, so please rather ask a new one, not to invalidate any previous answers (one of which you say it was helpful). Thanks! –  TildalWave Sep 2 '13 at 15:00
add comment

closed as primarily opinion-based by Adnan, Xander, NULLZ, TildalWave, Terry Chia Aug 30 '13 at 1:52

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 1 down vote accepted

Is it possible that one could avoid detection, possibly, but if it was used with any regularity, it would be detected quickly. There would need to be a mechanism to hook into it and the amount of scrutiny that the code receives makes it pretty unlikely. Additionally, if there was any such back door, then the software wouldn't be used on government machines and we can compare the executables the government uses to the ones that are otherwise provided to users.

Since there aren't differences like this and nothing has ever been spotted, we can be reasonably sure that there aren't backdoors as they would be both hard to find and a security issue for the government itself. Again, there is no way to definitively prove a negative, but it isn't particularly likely that Windows has a backdoor in it. Even if it did, using a firewall that isolates the system from the Internet would prevent it from being able to be accessed remotely unless the networking gear also had back doors.

Unless you are using encryption, Windows doesn't provide any security against local control of your hardware, so the only real question then becomes is there a backdoor in the encryption Windows provides. This gets a little bit trickier since this kind of encryption is used less or not at all by government, so there might be something there and it would be far harder to tell since cryptography systems are far harder to look for holes.

Once again, the possible outcry from something being found probably makes it unlikely. It would be on a whole different level if the encryption was intentionally compromised than the fact that they have been sharing access to records that they maintain. Businesses use the encryption to protect billions of dollars worth of data and if Microsoft intentionally put a backdoor in, they would be liable if that backdoor was used to compromise business data. You don't normally make that kind of gamble with your entire business.

share|improve this answer
    
So windows machines are perfectly secure then; I guess I was wrong about everything, and all those security patches are just for show. Meanwhile, back in reality, windows OS security is swiss cheese. Microsoft has never been held liable for uncounted losses due to security breaches. No one knows what all those patches do or what doors have been deliberately or only inadvertantly left open. –  ddyer Aug 30 '13 at 5:57
    
@ddyer - OS X is also perfectly secure and changing your system's time does not give you root access to the machine. –  Ramhound Aug 30 '13 at 12:08
    
@ddyer - you raise a valid point that a security vulnerability could be left in and written off as an accident, but that still wouldn't explain why the government uses it if there are known holes. Also, those holes are routinely discovered and patched and many still require local code execution to be exploited, which as I mentioned, if you have local control, any OS is screwed unless it is using encryption. –  AJ Henderson Aug 30 '13 at 14:37
    
Another thought; microsoft (and many other vendors) do not even need a back door. We've been trained to give them the keys to the front door. Anytime one of the vendors who routinely load updates on my machines wants to do something either for me or to me, I am powerless to resist - unless I'm willing to risk that certified malware won't get me if I do. –  ddyer Aug 30 '13 at 16:21
add comment

No. A back door is like a magic spell - if properly done, there's no external evidence that a deliberately installed back door exists. Furthermore, snooping around trying to discover if a door exists is indistinguishable from snooping around, looking for ways to break into the machine.

Overwhelmingly, back doors are either unintentional, or are discovered because someone in the know spills the beans.

share|improve this answer
    
People a great smarter then the collective that is Microsoft has looked at Windows, people who help design the very foundation of Windows NT, have written books that are still valid today. People have been looking at Windows for 20 years. After all these years not a single person has released a single shred of evidence that Windows has a backdoor. –  Ramhound Aug 30 '13 at 12:10
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.