Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given the ongoing leaks concerning mass surveillance and the fact that the NSA is the original developer of SELinux, I'm wondering whether that means that backdoors should be expected in there?

As every other obfuscated C contest, not at last the Underhanded C Contest, shows, well-written backdoors can elude the reviewer. And just because software is FLOSS doesn't imply people always make use of the opportunity to read the code (not to mention the vast majority that wouldn't be able to comprehend it).

In case of SELinux it's not so much about crypto as the recent NIST RNG debacle, but backdoors in there would certainly provide an inroad into seemingly secure hosts.

Need we be worried? And if not, why not?

share|improve this question

closed as primarily opinion-based by Scott Pack, tylerl, Noordung, Xander, NULLZ Sep 14 '13 at 0:16

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
i disagree with Scott Pack, tylerl, TildalWave, Xander, NULLZ –  frank Apr 2 at 15:47

2 Answers 2

Expecting backdoors is a bit strong...

There are several strong arguments against the plausibility of such backdoors:

  • Linux is used by a lot of people, including US corporations. A big part of the mandate of modern security agencies is to protect the interests of their country. In particular, the NSA shall, as much as possible, protect US corporations against spying from foreign competitors. Putting a backdoor in Linux implies the risk of allowing "bad people" (from the NSA point of view) to spy on US corporations through this backdoor.

  • Linux is open-source and the kernel is believed to be under rather thorough scrutiny from competent programmers. This is the "many eyes" theory. SELinux is right in the middle of all this inspection. Whether the "many eyes" theory actually holds is debatable (and debated). However, there are people who do PhD theses on SELinux, so it is not preposterous to assume that this particular piece of code was thoroughly investigated.

  • Any patch committed into the Linux kernel is followed through revision control. SELinux comes from the NSA and is tagged as such. If a backdoor was inserted and then subsequently discovered, it would be easy to track it back to the apparent author. A very basic protection measure is to not do such things in your own name ! If I were the NSA, I would first build up a virtual persona who is not associated with the NSA, so that even if he gets caught pushing backdoors, this will not incriminate my organization. Spy agencies know a lot about spy network segmentation. It would be singularly dumb of them to inject backdoors in their own name.

There is also a strong argument for the existence of such backdoors:

  • Spying on a lot of people and organizations is the core business of the NSA.

Honestly, until you find the corpse (i.e. the backdoor itself), your question is unanswerable. It is a matter of many parameters which can only be know through subjective estimates...

(Personally, I still find that backdoors in PRNG, especially hardware PRNG, are much more plausible than backdoors "hidden in plain sight".)

share|improve this answer
    
Good points. And given your arguments I think you may be right about it being unanswerable. Thanks +1 –  0xC0000022L Sep 13 '13 at 19:51
    
Detailed answer, but I have a question. What if you're working for the NSA and avoided some facts and stated the ones that suggest that there is no backdoor. I'm not saying that you're, but if I were the NSA and had a backdoor, I'd make my employees write good things about SELinux.LOL! –  Ufoguy Dec 23 '13 at 15:49
1  
You can trust me, I am a stranger on the Internet ! –  Tom Leek Dec 23 '13 at 22:22
    
I don't think the NSA's official mission is a good reason to believe it wouldn't add backdoors. The agency considers American citizens to be adversaries, not beneficiaries of its operations. –  augurar Oct 21 at 4:23

From the beginning open source solutions have this advantage that when in doubt, you can verify it yourself by checking the code. This assumption that open source can have backdoors without anyone's noticing in my point of view is rather weak. The reason is that if that is indeed the case, then what is the assumption that Linux Kernel don't have such a pull request that is merged within the main source tree long time ago and it is providing uninterrupted access to NSA or any other intelligence agency? Why should I trust the people on stack exchange and their advice? They might all be agents of the NSA!

The reason why these arguments don't hold the ground is because stack exchange is not a one man forum. NSA is not the only place on earth where good C/C++ programmers work. No one can backdoor an open source package for so long just because of this reason that there won't be anyone who would bother looking at the code. Kernel or OS is not the only place where you need to hide the backdoor. There are networks on which your backdoor need to communicate. There are log and network traffic monitors which analyse every action performed at the system or network level. All these devices and systems are developed by people of different countries and backgrounds. If one component is compromised, there are other components that can detect it and report it to the user. Therefore, I believe this argument is fundamentally flawed that popular open source packages can have backdoors for so long because there is no capable programmer in the whole world who can spot the anomaly.

"Every time some [developer] says, ‘Nobody will go to the trouble of doing that,’ there’s some kid in Finland who will go to the trouble.”

The above is true not only for software development but for any type of development (including backdoors).

share|improve this answer
    
I'm sorry, but belief is the last thing I want involved in an answer to my question. Thanks for answering, but it tries to invalidate the proposal in my question, thereby carefully dodges the actual question. If we have learned one thing from the leaks, it's that paranoia can't be classified as paranoia if the subject of the alleged paranoia turns out to be a fact. Extending on your argument, it should be equally impossible to hide backdoors in closed source, because it is always theoretically possible to reverse engineer and vet it. The origin of SELinux is suspicious enough to raise concern. –  0xC0000022L Sep 13 '13 at 19:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.