Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it. -Edward Snowden

Would it be safe to assume that every popular linux distro out there has a backdoor in it that got there by people connected to US intelligence?

I think probably most of them yes, purely logically speaking that is, though I also immediately logically assume that these are kept secret from even private intelligence contractors like Stratfor and that only highest levels in US intelligence have access to them and only as last resort for only important matters as it risks the backdoor being discovered.

In other words I assume rich people can't buy access to such backdoors or their data.

Following that logic... what OS's or linux distro's are safe, not from high level US intelligence, but from leaking to the rest of the world from lower clearance US Int. and Hackers?

A good example being free of vulnerabilities whose data collection has low clearance within US intelligence, which is accessed and leaked potentially too easily trough their incompetent contractors as pointed out by Edward Snowden among his reasons to reveal prism.

The purpose is for receiving, sending and storing mail on a mini laptop that will only be used for that purpose and perhaps also used to boot Lightweight Portable Security (LPS) to access only paypal.com and my bank's website.

share|improve this question

closed as primarily opinion-based by CodesInChaos, Xander, makerofthings7, Terry Chia, Gilles Sep 28 '13 at 16:11

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
If you downvote please state the reason for the downvote, there are many interesting Operating Systems out there that may display qualities allowing us to rank them. Like Argante –  Mr.Happy Sep 28 '13 at 15:02
    
I didn't downvote, but this is a broad question since each there are different security requirements for general purpose computing vs specialized needs (bank kiosks) the risk profiles are different, threats are different. This question is impossible to answer as long as computer software is written by humans. –  makerofthings7 Sep 28 '13 at 15:27
    
I've added the purpose to the post. Also probably yes but that doesn't mean one can't say which one comes closest in probability. –  Mr.Happy Sep 28 '13 at 15:36

1 Answer 1

up vote 1 down vote accepted

The point of a backdoor is that it would be difficult to detect. Sadly, there's no way to be certain about any operating system unless you built it from machine code on up. There are even ways to make it so that compilers will introduce backdoors in clean code that they compile or for a hardware back door to be put in that could usurp the OS's kernel mode access entirely. The only way to tell for certain if an OS is secure is to do everything (including hardware design and implementation) yourself and that simply isn't possible.

share|improve this answer
    
A hardware backdoor eh? How difficult would that be to detect? After how many years would it be probably detected if the hardware is popular? I'm curious because the Chinese-made mini laptop I want to buy costs about 60$ and many of the worlds hackers are savvy Chinese after all, would be handy for a small manufacturer to slip in a backdoor in coop with a hacker. I mean I could see it work commercially, we're not talking mayor brands here, these manufacturers appear and disappear. Gets me worried when I want to use a bitcoin wallet on such a machine. –  Mr.Happy Sep 28 '13 at 20:05
    
@Mr.Happy - it would be effectively impossible to detect. It could be triggered off of any random operation sequence that would result in the CPU executing privileged instructions without the OS knowing about it. It would be most effective to compromise the CPU itself though. Other methods would be more difficult, so if the CPU is trustworthy you have at least some protection since the CPU won't cooperate with the hijacking then (but some data might still be accessible, such as dumping RAM values via DMA). –  AJ Henderson Sep 28 '13 at 20:57
    
A proprietary OS such as Windows, Mac, or even Red Hat Linux are more likely to have backdoors installed by the vendor with encouragement from the NSA. In contrast, a truly open source Linux distro is IMO much less likely to have such a backdoor. As such, it is not fair to imply that the risk is equal for any random OS. The point is not to do it all yourself, but to put your faith in what the collective can examine. –  A-B-B Dec 3 '13 at 8:30
    
@A-B-B - Unless you are running your own compilations, I'd call BS on that. The official distro could have just as much pressure put on them to build something nefarious in when government entities are in play. Unless you compile it yourself you are trusting whoever built it for you because you don't know what source they used. Even if you do compile it, the compiler itself could introduce a back door too because you don't know the source of the compiler for sure, unless you are also building your own compiler. And even if you do that, you don't know that the hardware itself is secure. –  AJ Henderson Dec 3 '13 at 14:02
1  
@A-B-B unless you self compile though you have no idea what actually was built. Just because I have source ABC posted online doesn't mean I don't have a patch file to put in all the back doors that I apply before building the "official" build from source ABCD. –  AJ Henderson Dec 3 '13 at 16:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.